kenaz 0.0.0-stage → 0.3.2

package/core/.formation/tools/post-complete.js

@@ -0,0 +1,3660 @@
+#!/usr/bin/env node
+/**
+ * Formation Post-Complete
+ * 任務完成後的自動化處理：Archive 清理 + Git 分支管理
+ *
+ * 支援多專案：projectPath 指定子專案時，所有 git/archive/task 操作
+ * 都在子專案的 repo 中執行（而非 KenazAI core）。
+ *
+ * 流程：
+ *   1. Archive 檢查：done 任務超過 N 個時，將最舊的移到 archived/
+ *   2. Git 分支：建立 task branch → commit → merge 到用戶分支
+ *
+ * Usage:
+ *   node .formation/tools/post-complete.js --task=TASK_XXX
+ *   node .formation/tools/post-complete.js --task=TASK_XXX --project-path=/path/to/sub
+ *   node .formation/tools/post-complete.js --task=TASK_XXX --keep=10
+ *   node .formation/tools/post-complete.js --task=TASK_XXX --skip-git
+ *   node .formation/tools/post-complete.js --task=TASK_XXX --skip-archive
+ *   node .formation/tools/post-complete.js --task=TASK_XXX --dry-run
+ *   node .formation/tools/post-complete.js --task=TASK_XXX \
+ *     --test-cmd "cd dashboard && npm test" \
+ *     --test-cmd "cd dashboard/pty-server && cargo test"
+ */
+
+/* =============================================================================
+ * STRUCTURAL AUDIT — post-complete pipeline (TASK_1137, 2026-04-11)
+ * ============================================================================
+ *
+ * Context: ~5939-line orchestrator accumulated 13 incremental bug fixes
+ * (B1-B3, B5-B13) across B1-B14 fix chain sessions.  Health score stuck at
+ * D (52.1-52.4) despite fixes.  High fix velocity + stagnant health = symptom-
+ * patching without addressing root causes.  This audit maps the full flow,
+ * catalogs each fix, analyzes concurrency correctness, and proposes a
+ * prioritized refactor plan.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * SECTION A — EXECUTION FLOW MAP
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * A.1  postComplete() — top-level orchestrator (L4865)
+ *
+ * | Step  | Description                              | Branch Condition                          | Error Handler              | Failure Mode                        |
+ * |-------|------------------------------------------|-------------------------------------------|----------------------------|-------------------------------------|
+ * | GC    | gcStaleWorktrees()                       | always                                    | try/catch (non-fatal)      | orphan worktrees accumulate          |
+ * | Guard | Duplicate-suppress guard                 | recent worktree pass for same taskId (<2m) | try/catch (non-fatal)     | double execution                    |
+ * | 0     | Hippocampus episode start                | taskId && !dryRun                         | try/catch (non-fatal)      | episodes not started                |
+ * | 1     | archiveCheck()                           | !skipArchive                              | inline logging             | none — optional                     |
+ * | 2     | gitBranchAndMerge() or _gitMergeFromWorktree() | !skipGit && taskId              | throws (caught at CLI)     | task stuck in active                |
+ * | 2.5a  | Yggdrasil commit-sync (fire-and-forget)  | gitResult.committed && !dryRun            | catch (silent)             | sync missed silently                |
+ * | 2.6a  | Passive rune extraction                  | gitResult.committed && !dryRun            | catch (silent)             | runes not extracted                 |
+ * | 2.7   | Outcome recording + surprise detection   | !dryRun                                   | catch (silent)             | no outcome metrics recorded         |
+ * | 2.8   | Skill matrix update                      | !dryRun                                   | catch (log warning)        | metrics not updated                 |
+ * | 2.9   | Cognitive attribution                    | !dryRun && mergeSucceeded                 | catch (silent)             | attribution missed                  |
+ * | 2.5b  | Complete/block task via task-api         | merge success or failure                  | spawnSync; safety net move | task stuck in active                |
+ * | 2.5c  | Record AC failures (ACCEPTANCE_FAILED)   | acFailures.length > 0                     | catch (log)                | AC failures invisible               |
+ * | 2.5d  | Safety net: force-move to done           | merge succeeded but complete() failed     | spawnSync                  | task stays in active                |
+ * | 2.5e  | Passive rune extraction (completed)      | result.taskCompleted && !dryRun           | catch (silent)             | completion runes not tagged         |
+ * | 2.6b  | Ansuz inbox signal                       | result.taskCompleted && !dryRun           | catch (silent)             | Ansuz not notified                  |
+ * | 2.6c  | Relay task_completed event (TASK_1409)   | result.taskCompleted && !dryRun && relay  | catch (silent)             | PM inbox not notified cross-node    |
+ * | 3     | Memory agent onTaskCompleted/onError     | memoryAgent && taskId                     | catch (log warning)        | memory event not queued             |
+ * | 3b    | Provenance runes (synapse_inscribe)      | !dryRun && git.merged                     | catch (silent)             | provenance not tagged               |
+ * | 4     | Guardian health check + KEEP/REVERT      | taskId (always)                           | catch (log)                | no feedback signal for loop         |
+ * | 6     | Hippocampus episode close                | hippocampusEpisodeId set                  | catch (log warning)        | episode not closed properly         |
+ *
+ * A.2  gitBranchAndMerge() — serial mode (L2344)
+ *
+ * | Step    | Description                                | Branch Condition                             | Error Handler               | Failure Mode                       |
+ * |---------|--------------------------------------------|----------------------------------------------|-----------------------------|------------------------------------|
+ * | Worktree| Delegates to _gitMergeFromWorktree()       | worktreePath truthy                          | delegated                   | —                                  |
+ * | 0       | Initial commit for empty repo              | !hasInitialCommit()                          | catch (returns)             | hard fail                          |
+ * | 0.1     | Check for changes (scope-aware, TASK_2029) | !hasChangesInScope() / !hasChanges()         | isMemoryOnlyTask() check    | returns noChanges                  |
+ * | 0.2     | Scope paths safety guard                   | scope_paths not found on disk                | warn + return               | returns scopePathsMissing          |
+ * | 0.2.1   | Preflight unmerged index check             | getUnmergedPaths().length > 0                | return blockedReason        | returns unmerged_index             |
+ * | 0.2.2   | Acquire git lock                           | lock file exists (EEXIST)                    | PID liveness; timeout force | deadlock risk at timeout boundary  |
+ * | 0.3     | Snapshot task files                        | always                                       | inline (try/finally)        | state corruption on branch change  |
+ * | 0.4     | Pre-commit task YAML files                 | existingTaskDirs non-empty                   | throws=false                | task files not tracked before stash|
+ * | 0.4b    | Remove SQLite journal files                | trackedJournals non-empty                    | throws=false                | modify/delete conflicts at merge   |
+ * | 0.45    | Revert runtime/binary files                | RUNTIME_REVERT_PATHS exist                   | throws=false                | merge conflicts on runtime files   |
+ * | 0.5     | Stash dirty files (stash push -u)          | always                                       | throws=false                | stash never created (silent)       |
+ * | 1       | Create task branch (checkout -b)           | branchExists? salvage/delete first (B1)      | catch branchOpError         | stuck on wrong branch              |
+ * | 1.5     | Restore stash (stash pop)                  | didStash                                     | 3-step recovery             | changes lost if recovery fails     |
+ * | 1.6     | Remove DB runtime files from index         | dbFilesOnBranch non-empty                    | throws=false                | modify/delete at merge             |
+ * | 2       | Regression tests (PPL-113)                 | !skipTests                                   | createRegressionFixTask()   | creates FIX task, continues        |
+ * | 2.1     | Stage + commit (gitAddSafe scope-aware)    | always (scope or blanket)                    | catch; reset + return       | returns uncommitted                |
+ * | 2.2     | Scope verification (canary module)         | taskScopePaths.length > 0                    | log violations              | violations visible but not blocking|
+ * | 2.2b    | Staged scope coverage verify               | taskScopePaths non-empty                     | reset + checkout + return   | blocks commit if missing scope file|
+ * | 2.5     | Acceptance criteria verify (LLM)           | !skipTests                                   | createFixTasks(); indeterminate→report only | FIX tasks (fix-tagged: note marker only); timeout/parse=INDETERMINATE not pass |
+ * | 2.6     | Integration gap detection                  | !skipTests                                   | catch (log)                 | wiring gaps not detected           |
+ * | 3       | Checkout user branch                       | branchExists? create from baseBranch         | throws                      | stuck on task branch               |
+ * | 4       | Merge task branch → user branch            | always                                       | merge --abort + salvage     | returns mergeConflict              |
+ * | 4b      | verify_merge_landed()                      | merged === true                              | ensureSalvageBranch()       | false success without verification |
+ * | 5       | Stay on user branch                        | always                                       | —                           | —                                  |
+ * | finally | Branch recovery (3 attempts) + git lock    | cur !== originalBranch                       | 3-attempt recovery          | permanent branch drift on fail     |
+ *
+ * A.3  _gitMergeFromWorktree() — parallel mode (L2908)
+ *
+ * | Step  | Description                                    | Branch Condition                         | Error Handler               | Failure Mode                      |
+ * |-------|------------------------------------------------|------------------------------------------|-----------------------------|-----------------------------------|
+ * | 0     | Verify taskBranch exists in main repo          | !branchExists(taskBranch)                | recovery commit in worktree | returns missingTaskBranch         |
+ * | 0.1   | Runtime-only smoke task check                  | runtimeOnlySmoke && clean worktree       | cleanupWorktree()           | returns memoryOnly                |
+ * | 0.2   | Snapshot task files                            | always                                   | inline (try/finally)        | state corruption                  |
+ * | 0.3   | Rescue misplaced files (main repo → worktree)  | mainStatus has M/? candidates in scope   | catch (log)                 | agent work lost on worktree cleanup|
+ * | 0.4   | Scrub Codex 'claude' empty artifact            | claude file exists && 0 bytes            | catch (log)                 | artifact enters git index          |
+ * | 0.5   | git add -A in worktree (unconditional)         | always                                   | —                           | —                                  |
+ * | B10   | Unstage daemon-managed files                   | getDaemonPathsToUnstage() non-empty       | throws=false                | daemon noise enters commit        |
+ * | 0.6   | Commit if staged diff non-empty                | stagedAfter non-empty                    | catch "nothing to commit"   | throws on real commit error       |
+ * | Rebase| rebase --autostash onto userBranch             | branchExists(userBranch)                 | abort; check conflict count | returns rebaseConflict or fallthrough|
+ * | Rev   | Last-chance recovery commit                    | 0 unique commits but worktree has changes| catch (log)                 | recovery may fail silently        |
+ * | Lock  | acquireMergeLock()                             | always                                   | timeout force-acquire       | deadlock risk at timeout boundary |
+ * | MrgPre| Revert daemon-managed files in main repo       | listDaemonManagedPaths() non-empty       | throws=false                | merge blocked by daemon drift     |
+ * | MrgChk| Check unmerged index in main repo              | getUnmergedPaths().length > 0            | releaseMergeLock(); return  | returns unmerged_index            |
+ * | Stash | Stash main repo dirty files                    | always                                   | throws=false                | stash not created (silent)        |
+ * | Chk   | Checkout userBranch in main repo               | branchExists? create                     | throws                      | stuck on wrong branch             |
+ * | DmPre | Revert DAEMON_STATE_FILES + WORKTREE_STATIC    | iterate both lists                       | throws=false                | merge blocked by daemon drift     |
+ * | Merge | Merge taskBranch → userBranch (--no-ff)        | always                                   | merge --abort + salvage     | returns mergeConflict             |
+ * | 4b    | verify_merge_landed()                          | merged === true                          | ensureSalvageBranch()       | false success                     |
+ * | GC    | cleanupWorktree() on success                   | verify_merge_landed === true             | (inline)                    | worktree leaked on partial success|
+ * | finally| restoreTaskFiles + releaseMergeLock + stashPop | always                                  | catch (log)                 | dirty main repo on failure        |
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * SECTION B — B1-B14 FIX CATALOG
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * Note: B4 does not exist (numbering gap in original commit).
+ *
+ * | Fix   | Code Location (file:line)                        | Classification    | Rationale                                                                      |
+ * |-------|--------------------------------------------------|-------------------|--------------------------------------------------------------------------------|
+ * | B1    | post-complete.js:2530-2550                       | root-cause-fix    | Prevents force-delete of salvageable agent commits; renames to _salvage_<ts>   |
+ * | B2    | post-complete.js:656-694 (getPostCompleteChangedFiles) | symptom-patch | HEAD~1 for HEAD^1 Windows fix; correct but doesn't fix race that misattributes files |
+ * | B3    | post-complete.js:3928                            | root-cause-fix    | Dropped /m flag in outcome regex; prevents YAML corruption — real fix          |
+ * | B4    | N/A (skipped in numbering)                       | N/A               | Does not exist                                                                 |
+ * | B5    | post-complete.js:2505-2517 (RUNTIME_REVERT_PATHS)| symptom-patch     | Added turn_context_state.json for serial mode; doesn't generalize to new daemons|
+ * | B6    | post-complete.js:2527-2595                       | symptom-patch     | try/catch around branch ops to prevent stash leak; doesn't fix the race        |
+ * | B7    | post-complete.js:3295-3299 (worktreeCheckoutRevertPaths) | symptom-patch | turn_context_state.json for worktree mode; same issue as B5, different path   |
+ * | B8    | post-complete.js:1260-1325 (DAEMON_STATE_FILES)  | symptom-patch     | Expanded hardcoded list from 1→22 daemon paths; list is still finite/incomplete|
+ * | B9    | post-complete.js:660-710                         | symptom-patch     | taskBranch diff range when merge fails; masks race not fix it                  |
+ * | B10   | post-complete.js:3135-3157                       | symptom-patch     | Unstage daemon files after git add -A; downstream of hardcoded list root cause |
+ * | B11   | post-complete.js:4634-4696 (gcStaleWorktrees)    | symptom-patch     | GC orphan worktrees; cleans aftermath, doesn't prevent creation                |
+ * | B12   | task-api.js (YAML null-safe + filename id fallback) | symptom-patch  | Defensive coding; no structural change to loading logic                        |
+ * | B13   | post-complete.js:1415-1493 (detectAllTestCommands) | root-cause-fix  | Scope-aware Rust test skip; solves the false cargo failure root cause           |
+ * | B14+  | post-complete.js:3182-3400 (TASK_1111/1112/1113/1130/1132) | mixed | rebase --autostash replaces manual stash+rebase; autostash is correct approach but rebase still runs outside merge lock |
+ * | B15   | post-complete.js (TASK_1416 D.5 pre-merge gate)  | root-cause-fix    | [REMOVED in TASK_2341: health no longer gates or reverts] git reset HEAD~1 cascade bug (rune_867d6afe). Replaced by D.5 pre-merge health gate in git-merge.js. Post-merge REVERT feature-flagged behind HEIMDALL_POSTMERGE_REVERT=true; if re-enabled uses git revert -m 1 (non-destructive). ansuz_session_handoff.json added to daemon-manifest.yaml (TASK_1413 conflict source). |
+ *
+ * Classification summary: 4 root-cause-fixes (B1, B3, B13, B15), 10 symptom-patches (B2, B5-B12, B14+).
+ * Health D-grade plateau explained: symptom patches outnumber root-cause fixes 10:3.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * SECTION C — CONCURRENCY ANALYSIS
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * C.1  Git lock race at timeout boundary (CRITICAL)
+ *   File:line  acquireGitLock():L959-965
+ *   Pattern:   Timeout forces lock acquisition via unlink+writeFileSync.
+ *   Race:      Two concurrent post-completes both time out (e.g., under system
+ *              load), both call unlink, then both call writeFileSync in rapid
+ *              succession — neither wins atomically. writeFileSync is NOT atomic
+ *              on Windows; the second write overwrites the first.
+ *   Result:    Both processes believe they hold the lock simultaneously → index
+ *              corruption possible if both write task branches and try to checkout.
+ *   Evidence:  acquireGitLock():L959 "Timed out — force acquire".
+ *
+ * C.2  Rebase outside merge lock — stale rebase window (HIGH)
+ *   File:line  _gitMergeFromWorktree():L3199-3256 (rebase), L3292-3294 (lock acquire)
+ *   Pattern:   rebase --autostash runs BEFORE acquireMergeLock().
+ *   Race:      Peer task merges new commits into userBranch between rebase start
+ *              and merge lock acquisition. When current task finally merges, its
+ *              rebase is onto an older userBranch HEAD → merge may see "new file
+ *              in peer's commit not present in our rebased tree" → false conflict.
+ *   Result:    Merge failures that look like genuine conflicts but are actually
+ *              sequencing artifacts. Estimated ~20-30% residual parallel failures.
+ *   Evidence:  L3182-3198 (rebase rationale), L3292 (lock acquire).
+ *
+ * C.3  DAEMON_STATE_FILES hardcoded list — incomplete coverage (HIGH)
+ *   File:line  L1260-1294 (DAEMON_STATE_FILES), L1296-1325 (WORKTREE_STATIC_DAEMON_PATHS)
+ *   Pattern:   Explicit file enumeration for daemon noise filtering.
+ *   Race:      New daemon-managed files added in future sessions (e.g., new
+ *              specialist/ subsystems) are NOT in either list. They pass through
+ *              unstage check (getDaemonPathsToUnstage) undetected until another
+ *              B8-style fix is added.
+ *   Result:    New daemon file causes recurring merge conflicts until explicitly
+ *              listed. Permanent low-level structural debt.
+ *   Evidence:  L1274 (TASK_1112 follow-up), L1280 (TASK_1130), L1284 (TASK_1130 audit).
+ *
+ * C.4  ansuz_inbox.json non-atomic write (MEDIUM)
+ *   File:line  postComplete():L5321-5332
+ *   Pattern:   readFileSync → push → writeFileSync (no tmp+rename).
+ *   Race:      Two concurrent post-completes both read the same inbox, both push
+ *              their entry, both write — last writer wins, first entry lost.
+ *   Result:    Ansuz misses task_completed notifications under parallel dispatch.
+ *   Compare:   ambient_signals.json at L3890-3892 correctly uses tmp+rename.
+ *
+ * C.5  post-complete-guard.json non-atomic read-modify-write (LOW)
+ *   File:line  postComplete():L4892-4908
+ *   Pattern:   readFileSync → mutate → writeFileSync (no tmp+rename).
+ *   Race:      Same as C.4 but for deduplication guard state. Low impact because
+ *              the guard only fires within 120s window and failures are silent.
+ *   Evidence:  L4906 direct writeFileSync.
+ *
+ * C.6  Merge lock held too briefly — daemon writes between stash and merge (MEDIUM)
+ *   File:line  _gitMergeFromWorktree():L3314-3342
+ *   Pattern:   Stash main repo → checkout userBranch → iterate DAEMON_STATE_FILES →
+ *              git merge. Between the stash (L3314) and daemon revert (L3340), daemon
+ *              process can write new content to tracked daemon files. The DAEMON_STATE_FILES
+ *              revert at L3340 covers this window IF the file is in the list (C.3 dependency).
+ *   Result:    If daemon writes to an unlisted file in this window, "would be overwritten
+ *              by merge" error → merge abort.
+ *   Evidence:  L3331-3342 (TASK_1112 comment).
+ *
+ * C.7  No ordering guarantee between parallel _gitMergeFromWorktree calls (MEDIUM)
+ *   File:line  acquireMergeLock():L988-1031
+ *   Pattern:   FIFO order is NOT guaranteed — first process to retry after
+ *              MERGE_LOCK_POLL_MS (500ms) wins. Under load, later tasks may
+ *              merge before earlier tasks even though the earlier task has more
+ *              complete work.
+ *   Result:    Non-deterministic merge ordering. Low practical impact but
+ *              complicates debugging.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * SECTION D — PRIORITIZED REFACTOR PLAN
+ * ─────────────────────────────────────────────────────────────────────────────
+ *
+ * D.1  Rebase-under-lock with stale detection  [P1 / High complexity]
+ *   Addresses: C.2 (stale rebase window)
+ *   Scope path: .formation/tools/post-complete.js (_gitMergeFromWorktree L3199-3294)
+ *   Change:
+ *     1. Call acquireMergeLock() BEFORE rebase (currently called AFTER).
+ *     2. After successful rebase, verify userBranch HEAD is unchanged:
+ *        capturedHead = git rev-parse userBranch; after rebase: if HEAD changed,
+ *        release lock, wait briefly, re-acquire, re-rebase.
+ *     3. Max 2 re-rebase attempts before marking as blocked.
+ *   Complexity: High — must not increase merge lock hold time excessively
+ *     (rebase can take 1-10s; holds others from merging during that time).
+ *   Dependency: None (standalone within _gitMergeFromWorktree).
+ *   Expected health delta: +2 to +4 pts (reduces parallel merge conflict rate).
+ *
+ * D.2  Daemon-state manifest replacing hardcoded lists  [P1 / Medium complexity]
+ *   Addresses: C.3 (hardcoded DAEMON_STATE_FILES)
+ *   Scope path: .formation/tools/post-complete.js (L1252-1403),
+ *               .kenaz/specialist/daemon-manifest.yaml (new file)
+ *   Change:
+ *     1. Create .kenaz/specialist/daemon-manifest.yaml with current DAEMON_STATE_FILES
+ *        + WORKTREE_STATIC_DAEMON_PATHS content.
+ *     2. listDaemonManagedPaths() reads manifest + dynamic discovery (current .synapse scan).
+ *     3. isDaemonManagedPath() and getDaemonPathsToUnstage() delegate to manifest.
+ *     4. New daemon files need only a manifest YAML update, not a code change.
+ *   Complexity: Medium — YAML loading is straightforward; must handle missing manifest.
+ *   Dependency: None.
+ *   Expected health delta: +1 to +2 pts (prevents future B8-style patches).
+ *
+ * D.3  Atomic writes for shared state files  [P2 / Low complexity]
+ *   Addresses: C.4 (ansuz_inbox.json), C.5 (post-complete-guard.json)
+ *   Scope path: .formation/tools/post-complete.js (L5321-5332, L4892-4908)
+ *   Change:
+ *     1. Extract atomic write helper: writeJsonAtomic(filePath, data) →
+ *        writeFileSync(tmpPath, JSON.stringify), renameSync(tmpPath, filePath).
+ *     2. Replace direct writeFileSync calls at L5332 and L4906.
+ *   Complexity: Low — pattern already established at L3891-3892 (ambient_signals.json).
+ *   Dependency: None.
+ *   Expected health delta: +1 pt (code quality, reduces race window).
+ *
+ * D.4  Extract post-complete.js into focused modules  [P2 / High complexity]
+ *   Addresses: Code size root cause of low health score (5939 lines, cyclomatic complexity)
+ *   Scope path: .formation/tools/post-complete.js,
+ *               .formation/tools/git-ops.js (new),
+ *               .formation/tools/daemon-filter.js (new),
+ *               .formation/tools/outcome-recording.js (new)
+ *   Proposed split:
+ *     - post-complete.js     : orchestration only (~800 lines)
+ *     - git-ops.js           : gitBranchAndMerge + _gitMergeFromWorktree + locks (~1800 lines)
+ *     - daemon-filter.js     : DAEMON_STATE_FILES + isDaemonManagedPath + getDaemonPaths (~200 lines)
+ *     - outcome-recording.js : recordOutcome + compareOutcomePrediction + ambient signals (~400 lines)
+ *   Complexity: High — many cross-function dependencies; requires careful export surface design.
+ *   Dependency: D.2 (daemon manifest) and D.3 (atomic writes) should be completed first
+ *     so the extracted modules start clean.
+ *   Expected health delta: +8 to +12 pts (D-grade → C-grade from complexity reduction alone).
+ *
+ * D.5  Pre-merge health gate replacing post-merge REVERT  [P3 / Medium complexity]
+ *   Addresses: post-merge REVERT requires git reset after landing — risky, disruptive
+ *   Scope path: .formation/tools/post-complete.js (_gitMergeFromWorktree, Step 4 guardian)
+ *   Change:
+ *     1. After rebase (D.1), before merge, run measureHealthScoreSync() in worktree context.
+ *     2. Compare predicted delta: if preSn.score - worktreeHealth.score > threshold, open
+ *        a BLOCK note on the task and abort merge instead of committing.
+ *     3. Remove post-merge REVERT path (loop.js git reset) when this gate is active.
+ *   Complexity: Medium — adds latency to merge path (~3-5s for health snapshot).
+ *   Dependency: D.1 (rebase-under-lock must be stable before adding health gate on top).
+ *   Expected health delta: indirect — prevents regressions from landing in first place.
+ *
+ * Dependency ordering: D.3 → D.2 → D.1 → D.4 → D.5
+ * Total estimated health recovery: D (52.4) → C (64-68) with D.1+D.2+D.4.
+ * ============================================================================
+ */
+
+const { execSync, spawnSync } = require('child_process');
+const path = require('path');
+const fs = require('fs');
+const {
+  ROOT, COLLABORATION_API, LOG_DIR, getLogDir, preserveUntrackedStashCommand,
+  removeWorktree,
+} = require('./utils');
+const { verify: verifyAcceptance } = require('./verify-acceptance');
+// TASK_1825: the TASK_1482 runtime HTTP acceptance verifier
+// (post-complete/verify-acceptance.js, Step 1.5) was REMOVED. Measurement:
+// 7/6713 criteria (0.10%) were tool-call-shaped, its verdict field on the
+// post-complete result object had zero readers, and its writeVerdictToTask
+// never landed a single acceptance_verdict note. Net effect on the system: zero.
+// LLM-based acceptance verification (./verify-acceptance.js) remains and is the
+// one whose result (result.git.acceptance) is actually read.
+
+// Memory Agent（記憶系統整合）
+let memoryAgent = null;
+try {
+  memoryAgent = require('../../.memory/tools/memory-agent');
+} catch { /* memory-agent not available — graceful degradation */ }
+
+// Design Reasoning Attribution (TASK_1074)
+let designReasoning = null;
+try {
+  designReasoning = require('../../.specialist/tools/design-reasoning');
+} catch { /* design-reasoning not available — graceful degradation */ }
+
+// TASK_2078: read-only fallback deriving duration_ms/tool_uses/first_edit_s
+// from the subagent's own Claude Code transcript when agent_result_<TASK>.json
+// is missing or incomplete.
+let deriveSubagentStats = null;
+try {
+  ({ deriveSubagentStats } = require('./post-complete/subagent-transcript-stats'));
+} catch { /* subagent-transcript-stats not available — graceful degradation */ }
+
+// ─────────────────────────────────────────
+// 配置
+// ─────────────────────────────────────────
+
+const CONFIG = {
+  DEFAULT_KEEP: 10,
+  GUARDIAN_INTERVAL: 10, // Run synapse_health snapshot every N completed tasks
+};
+
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: UTILITIES
+// ?????????????????????????????????????????????????????????????????????????????
+/**
+ * 解析專案根目錄（git 操作、檔案掃描的 cwd）
+ * @param {string|null} projectPath - 專案路徑
+ * @returns {string|null} - git repo root, or null if not a git repo (skip git ops)
+ */
+function resolveProjectRoot(projectPath) {
+  let resolved = projectPath || ROOT;
+
+  // Production fallback: ROOT may be AppData\kenaz-core (not a git repo).
+  // Try reading .kenaz/project.yaml → project_path to find the real repo.
+  if (!fs.existsSync(path.join(resolved, '.git'))) {
+    const yamlPath = path.join(resolved, '.kenaz', 'project.yaml');
+    if (fs.existsSync(yamlPath)) {
+      try {
+        const content = fs.readFileSync(yamlPath, 'utf8');
+        const match = content.match(/^project_path:\s*"?([^"\n]+)"?/m);
+        if (match) {
+          const candidate = path.resolve(match[1].trim());
+          if (fs.existsSync(path.join(candidate, '.git'))) {
+            resolved = candidate;
+          }
+        }
+      } catch {}
+    }
+  }
+
+  if (!fs.existsSync(path.join(resolved, '.git'))) {
+    // Not a git repo — return null so callers can skip git operations gracefully
+    return null;
+  }
+  return resolved;
+}
+
+/**
+ * 解析任務檔案基底目錄
+ * 所有專案（含 KenazAI 本體）：有 .kenaz/tasks/ 就用它
+ */
+function resolveTasksBase(projectPath) {
+  const root = projectPath || ROOT;
+  const kenazTasks = path.join(root, '.kenaz', 'tasks');
+  if (fs.existsSync(kenazTasks)) return kenazTasks;
+  return path.join(root, '.collaboration', 'tasks');
+}
+
+/**
+ * 解析任務目錄的相對路徑前綴（用於 git 指令）
+ */
+function resolveTasksRelative(projectPath) {
+  const root = projectPath || ROOT;
+  const kenazTasks = path.join(root, '.kenaz', 'tasks');
+  if (fs.existsSync(kenazTasks)) return '.kenaz/tasks';
+  return '.collaboration/tasks';
+}
+
+// ─────────────────────────────────────────
+// Phase 9 outcome log (TASK_1732)
+// ─────────────────────────────────────────
+
+/**
+ * Append one structured JSONL line to .kenaz/specialist/phase9_dispatch_outcomes.jsonl.
+ * Called at Step 2.7b in postComplete() after merge verdict is definitively known.
+ * Respects project pinning: writes under the effective project root (projectPath || ROOT).
+ *
+ * Format: { task_id, verify_merge_landed: bool, ts, [duration_ms], [tool_uses], [turns], [first_edit_s], [corrections], [correction_heads], [informational], [informational_heads] }
+ *
+ * (formerly read by the removed efe-drift-monitor) primary source for phase9_verify_fail_rate
+ * (subagent-path dispatches write no dispatch_*.log — this is the replacement source).
+ *
+ * TASK_1998 R1c: the four bracketed fields are OPTIONAL turn-count telemetry.
+ * Ansuz writes `.kenaz/specialist/agent_result_<TASK_ID>.json` from the Agent
+ * tool's notification payload (wall duration, tool-use count, turn count,
+ * time-to-first-edit) before calling post-complete; when that file exists we
+ * fold whichever of these numeric fields it carries straight into this same
+ * JSONL line, so dev/scripts/dispatch-stats.js can read turns/duration/tool_uses
+ * without a separate join against dispatch_prompt_stats.jsonl. Missing file,
+ * unparseable JSON, or a non-numeric field are all silently ignored — this
+ * telemetry must never block post-complete.
+ * Shape (agent_result_<TASK_ID>.json, any subset of these keys):
+ *   { "duration_ms": number, "tool_uses": number, "turns": number, "first_edit_s": number }
+ *
+ * TASK_2078: agent_result_<TASK_ID>.json still wins field-by-field when it
+ * carries a field. For whichever of duration_ms/tool_uses/first_edit_s it
+ * LACKS, fall back to deriveSubagentStats (reads the subagent's own Claude
+ * Code transcript — see subagent-transcript-stats.js). `turns` has no
+ * transcript-derived counterpart and stays agent_result-only. Records
+ * `timing_source` ('agent_result' | 'transcript' | 'mixed') and `spawns`
+ * (re-dispatch count) whenever transcript data contributed anything.
+ *
+ * TASK_2097: `corrections` (count of distinct Ansuz correction/review
+ * messages delivered mid-dispatch) and `correction_heads` (their first-120-
+ * char heads, capped at 10) have NO agent_result counterpart at all — they
+ * only ever come from deriveSubagentStats — so the transcript is read
+ * whenever it is available, even when agent_result already covers every
+ * timing field (the `stillMissing` timing check below only gates the
+ * timing fields, never the corrections read).
+ *
+ * Best-effort throughout — must never throw or block post-complete.
+ */
+function appendPhase9OutcomeLog(taskId, verifyMergeLanded, projectPath) {
+  const root = projectPath || ROOT;
+  const dir  = path.join(root, '.kenaz', 'specialist');
+  const file = path.join(dir, 'phase9_dispatch_outcomes.jsonl');
+  if (!fs.existsSync(dir)) {
+    try { fs.mkdirSync(dir, { recursive: true }); } catch { return; }
+  }
+  const record = { task_id: taskId, verify_merge_landed: !!verifyMergeLanded, ts: new Date().toISOString() };
+  const fromAgentResult = new Set();
+  try {
+    const agentResultFile = path.join(dir, `agent_result_${taskId}.json`);
+    if (fs.existsSync(agentResultFile)) {
+      const raw = JSON.parse(fs.readFileSync(agentResultFile, 'utf8'));
+      for (const field of ['duration_ms', 'tool_uses', 'turns', 'first_edit_s']) {
+        if (typeof raw[field] === 'number' && Number.isFinite(raw[field])) {
+          record[field] = raw[field];
+          fromAgentResult.add(field);
+        }
+      }
+    }
+  } catch { /* best-effort — malformed/missing agent_result file is fine */ }
+
+  const fromTranscript = new Set();
+  try {
+    const transcriptFields = ['duration_ms', 'tool_uses', 'first_edit_s'];
+    const stillMissing = transcriptFields.some((f) => !fromAgentResult.has(f));
+    if (typeof deriveSubagentStats === 'function') {
+      const derived = deriveSubagentStats(taskId, root);
+      if (derived) {
+        if (stillMissing) {
+          for (const field of transcriptFields) {
+            if (fromAgentResult.has(field)) continue;
+            if (typeof derived[field] === 'number' && Number.isFinite(derived[field])) {
+              record[field] = derived[field];
+              fromTranscript.add(field);
+            }
+          }
+          if (fromTranscript.size > 0 && typeof derived.spawns === 'number') {
+            record.spawns = derived.spawns;
+          }
+        }
+        if (typeof derived.corrections === 'number' && Number.isFinite(derived.corrections)) {
+          record.corrections = derived.corrections;
+          record.correction_heads = Array.isArray(derived.correction_heads)
+            ? derived.correction_heads.slice(0, 10)
+            : [];
+          if (!(typeof record.spawns === 'number') && typeof derived.spawns === 'number') {
+            record.spawns = derived.spawns;
+          }
+        }
+        // TASK_2109: informational coordinator messages (FYI/context, no
+        // rework demanded) are tracked separately and never folded into
+        // `corrections` — see subagent-transcript-stats.js classifyCoordinatorMessage.
+        if (typeof derived.informational === 'number' && Number.isFinite(derived.informational)) {
+          record.informational = derived.informational;
+          record.informational_heads = Array.isArray(derived.informational_heads)
+            ? derived.informational_heads.slice(0, 10)
+            : [];
+        }
+      }
+    }
+  } catch { /* best-effort — transcript fallback must never block post-complete */ }
+
+  if (fromAgentResult.size > 0 || fromTranscript.size > 0) {
+    record.timing_source = (fromAgentResult.size > 0 && fromTranscript.size > 0) ? 'mixed'
+      : (fromAgentResult.size > 0) ? 'agent_result' : 'transcript';
+  }
+
+  const line = JSON.stringify(record);
+  try { fs.appendFileSync(file, line + '\n', 'utf8'); } catch { /* best-effort */ }
+}
+
+// ─────────────────────────────────────────
+// Git Lock（序列化 post-complete git 操作）
+// ─────────────────────────────────────────
+
+const GIT_LOCK_TIMEOUT_MS = 120000; // 2 minutes
+const GIT_LOCK_POLL_MS = 1000;
+
+function getGitLockPath(projectRoot) {
+  const dotGit = path.join(projectRoot, '.git');
+  let stat;
+  try { stat = fs.statSync(dotGit); } catch (e) { stat = null; }
+  if (stat && stat.isFile()) {
+    // git worktree: .git is a file containing "gitdir: <path>"
+    const contents = fs.readFileSync(dotGit, 'utf8');
+    const match = contents.match(/^gitdir:\s*(.+)/m);
+    if (match) {
+      const realGitDir = path.resolve(projectRoot, match[1].trim());
+      return path.join(realGitDir, 'post-complete.lock');
+    }
+  }
+  return path.join(projectRoot, '.git', 'post-complete.lock');
+}
+
+function normalizeRepoPath(relPath) {
+  const normalized = String(relPath || '')
+    .replace(/\\/g, '/')
+    .replace(/^\.\//, '')
+    .replace(/\/+/g, '/');
+  return normalized.endsWith('/') ? normalized : normalized.replace(/\/$/, '');
+}
+
+function isDaemonManagedPath(relPath) {
+  const normalized = normalizeRepoPath(relPath);
+  if (!normalized) return false;
+  if (getDaemonStateFiles().includes(normalized) || getDaemonStaticPaths().includes(normalized)) return true;
+  // TASK_2255: a static_paths entry ending in '/' is a directory prefix — its children match.
+  // (normalizeRepoPath already unified separators; TS twin: DIR_PREFIXES loop.)
+  for (const entry of getDaemonStaticPaths()) {
+    if (typeof entry === 'string' && entry.endsWith('/') && normalized.startsWith(normalizeRepoPath(entry))) return true;
+  }
+  if (normalized.startsWith('.tmp/')) return true;
+  if (normalized.startsWith('.formation/state/')) return true;
+  if (normalized.startsWith('.formation/analytics/')) return true;
+  if (normalized.startsWith('.formation/signals/')) return true;
+  if (normalized.startsWith('.synapse/') && /(?:^|\/)(?:.+_cache\.json|memory-shared\.json)$/i.test(normalized)) return true;
+  if (normalized === '.memory/registry.json') return true;
+  if (normalized === '.prefrontal/generalize_counter.json') return true;
+  // TASK_1622: one-off probe/episode-writer scripts in .formation/ root
+  // These are created by Ansuz during live sessions and must never
+  // be swept into task commits by the blanket git add -A in worktree staging.
+  if (/^[.]formation[/]tmp_[^/]+[.](js|json)$/.test(normalized)) return true;
+  if (/^[.]formation[/](?:muninn_snapshot_[0-9]+|muninn_rune_check|episode_writer(?:_v[0-9]+)?)[.]js$/.test(normalized)) return true;
+  return false;
+}
+
+function listDaemonManagedPaths(projectRoot) {
+  const discovered = new Set([
+    ...getDaemonStateFiles(),
+    ...getDaemonStaticPaths(),
+  ]);
+
+  const scanDir = (relDir) => {
+    const absDir = path.join(projectRoot, relDir);
+    if (!fs.existsSync(absDir)) return;
+    const stat = fs.statSync(absDir);
+    if (!stat.isDirectory()) {
+      if (isDaemonManagedPath(relDir)) discovered.add(normalizeRepoPath(relDir));
+      return;
+    }
+    const stack = [{ abs: absDir, rel: normalizeRepoPath(relDir).replace(/\/$/, '') }];
+    while (stack.length > 0) {
+      const current = stack.pop();
+      for (const entry of fs.readdirSync(current.abs, { withFileTypes: true })) {
+        const relPath = normalizeRepoPath(path.posix.join(current.rel, entry.name));
+        if (entry.isDirectory()) {
+          stack.push({ abs: path.join(current.abs, entry.name), rel: relPath });
+          continue;
+        }
+        if (isDaemonManagedPath(relPath)) discovered.add(relPath);
+      }
+    }
+  };
+
+  scanDir('.synapse');
+  scanDir('.prefrontal');
+  scanDir('.memory');
+  if (fs.existsSync(path.join(projectRoot, '.tmp'))) discovered.add('.tmp/');
+
+  return Array.from(discovered);
+}
+
+function pathExistsInHead(repoRoot, relPath) {
+  const normalized = normalizeRepoPath(relPath).replace(/\/$/, '');
+  if (!normalized) return false;
+  const out = git(`ls-tree -r --name-only HEAD -- "${normalized}"`, { cwd: repoRoot, throws: false }) || '';
+  return out.split(/\r?\n/).some(line => normalizeRepoPath(line) === normalized);
+}
+
+function getDaemonPathsToUnstage(worktreePath) {
+  const staged = (git('diff --cached --name-only', { cwd: worktreePath, throws: false }) || '')
+    .split(/\r?\n/)
+    .map(line => normalizeRepoPath(line))
+    .filter(Boolean);
+  const discovered = staged.filter(relPath => isDaemonManagedPath(relPath) && pathExistsInHead(worktreePath, relPath));
+  return Array.from(new Set([
+    ...getDaemonStateFiles(),
+    ...getDaemonStaticPaths(),
+    ...discovered,
+  ]));
+}
+
+/** Strip ANSI escape codes from string */
+
+function stripAnsi(str) {
+  // eslint-disable-next-line no-control-regex
+  return str.replace(/\u001b\[[0-9;]*[a-zA-Z]/g, '');
+}
+
+/**
+ * Strip CJK (Chinese/Japanese/Korean) characters from a string.
+ * MEM-LANG-001: SQLite FTS5 unicode61 tokenizer cannot tokenize CJK properly,
+ * causing synapse_recall to return 0 results for runes containing CJK text.
+ *
+ * @param {string} text - input text possibly containing CJK characters
+ * @returns {string} text with CJK chars removed, extra whitespace collapsed
+ */
+function stripCJK(text) {
+  if (!text) return '';
+  // Remove CJK Unified Ideographs (U+4E00–9FFF) and common CJK extension blocks
+  return text
+    .replace(/[\u4E00-\u9FFF\u3400-\u4DBF\uF900-\uFAFF\u3000-\u303F\uFF00-\uFFEF]/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+/**
+ * Load scope_paths from task YAML for scope verification.
+ * @param {string} taskId - TASK_XXX
+ * @param {string} [projectPath] - Sub-project path
+ * @returns {string[]} scope_paths array (empty if not found)
+ */
+function loadTaskScopePaths(taskId, projectPath) {
+  if (!taskId) return [];
+  const tasksBase = resolveTasksBase(projectPath);
+
+  const dirs = ['done', 'active', 'backlog', 'blocked'];
+  for (const dir of dirs) {
+    const dirPath = path.join(tasksBase, dir);
+    if (!fs.existsSync(dirPath)) continue;
+    const files = fs.readdirSync(dirPath).filter(f => f.startsWith(taskId) && f.endsWith('.yaml'));
+    if (files.length === 0) continue;
+
+    try {
+      const content = fs.readFileSync(path.join(dirPath, files[0]), 'utf8');
+      const match = content.match(/^scope_paths:\s*\n((?:\s+-\s+.+\n?)*)/m);
+      if (match) {
+        return match[1].split('\n')
+          .map(line => line.match(/^\s+-\s+"?([^"]+)"?\s*$/))
+          .filter(Boolean)
+          .map(m => m[1].trim());
+      }
+    } catch { /* skip */ }
+  }
+  return [];
+}
+
+/**
+ * Detect if a task is memory-only (no git-trackable changes expected).
+ * A task is memory-only if:
+ *   - tags contain 'synapse' or 'memory', OR
+ *   - all scope_paths are under .synapse/
+ * @param {string} taskId - TASK_XXX
+ * @param {string} [projectPath] - Sub-project path
+ * @returns {boolean}
+ */
+function isMemoryOnlyTask(taskId, projectPath) {
+  if (!taskId) return false;
+  const tasksBase = resolveTasksBase(projectPath);
+
+  const dirs = ['active', 'done', 'backlog', 'blocked'];
+  for (const dir of dirs) {
+    const dirPath = path.join(tasksBase, dir);
+    if (!fs.existsSync(dirPath)) continue;
+    const files = fs.readdirSync(dirPath).filter(f => f.startsWith(taskId) && f.endsWith('.yaml'));
+    if (files.length === 0) continue;
+
+    try {
+      const content = fs.readFileSync(path.join(dirPath, files[0]), 'utf8');
+
+      // Check tags for 'synapse' or 'memory'
+      const tagsMatch = content.match(/^tags:\s*\n((?:\s+-\s+.+\n?)*)/m);
+      if (tagsMatch) {
+        const tags = tagsMatch[1].split('\n')
+          .map(line => line.match(/^\s+-\s+"?([^"]+)"?\s*$/))
+          .filter(Boolean)
+          .map(m => m[1].trim().toLowerCase());
+        if (tags.includes('synapse') || tags.includes('memory')) return true;
+      }
+
+      // Check scope_paths — all must be under .synapse/
+      const scopeMatch = content.match(/^scope_paths:\s*\n((?:\s+-\s+.+\n?)*)/m);
+      if (scopeMatch) {
+        const paths = scopeMatch[1].split('\n')
+          .map(line => line.match(/^\s+-\s+"?([^"]+)"?\s*$/))
+          .filter(Boolean)
+          .map(m => m[1].trim());
+        if (paths.length > 0 && paths.every(p => p.startsWith('.synapse/'))) return true;
+      }
+    } catch { /* skip */ }
+    break; // found the file, stop searching
+  }
+  return false;
+}
+
+/**
+ * Detect runtime-only smoke tasks that intentionally forbid source edits and
+ * therefore should not rescue unrelated dirty root files into a worktree.
+ * @param {string} taskId
+ * @param {string} [projectPath]
+ * @returns {boolean}
+ */
+function isRuntimeOnlySmokeTask(taskId, projectPath) {
+  if (!taskId) return false;
+  const tasksBase = resolveTasksBase(projectPath);
+  const dirs = ['active', 'done', 'backlog', 'blocked'];
+
+  for (const dir of dirs) {
+    const dirPath = path.join(tasksBase, dir);
+    if (!fs.existsSync(dirPath)) continue;
+    const files = fs.readdirSync(dirPath).filter(f => f.startsWith(taskId) && f.endsWith('.yaml'));
+    if (files.length === 0) continue;
+
+    try {
+      const content = fs.readFileSync(path.join(dirPath, files[0]), 'utf8');
+      const tagsMatch = content.match(/^tags:\s*\n((?:\s+-\s+.+\n?)*)/m);
+      const requirementMatch = content.match(/^requirements:\s*\n((?:\s+-\s+.+\n?)*)/m);
+
+      const tags = tagsMatch
+        ? tagsMatch[1].split('\n')
+          .map(line => line.match(/^\s+-\s+"?([^"]+)"?\s*$/))
+          .filter(Boolean)
+          .map(m => m[1].trim().toLowerCase())
+        : [];
+
+      const requirements = requirementMatch
+        ? requirementMatch[1].split('\n')
+          .map(line => line.match(/^\s+-\s+"?([^"]+)"?\s*$/))
+          .filter(Boolean)
+          .map(m => m[1].trim().toLowerCase())
+        : [];
+
+      return tags.includes('smoke')
+        && tags.includes('runtime')
+        && requirements.some(req =>
+          req.includes('do not modify source files') || req.includes('no source files are modified')
+        );
+    } catch {
+      return false;
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Rank changed files by scope-match first, then git diff --stat order.
+ * Returns up to `limit` file paths.
+ * @param {string} taskId
+ * @param {string} projectRoot
+ * @param {string[]} scopePaths
+ * @param {number} limit
+ * @returns {string[]}
+ */
+function rankTouchedFiles(projectRoot, scopePaths, limit) {
+  // Get changed files via diff --stat (most-changed first)
+  let changedFiles = [];
+  try {
+    // HEAD~1 (not HEAD^1): on Windows cmd.exe, ^ is the escape character and ^1 becomes 1.
+    const statOut = execSync('git diff --stat HEAD~1 HEAD', {
+      cwd: projectRoot, encoding: 'utf8', timeout: 8000, windowsHide: true,
+    });
+    // Parse lines like " path/to/file | 42 ++++++-----"
+    const lines = statOut.split('\n').filter(l => l.includes('|'));
+    const parsed = lines.map(l => {
+      const m = l.match(/^\s*(.+?)\s*\|\s*(\d+)/);
+      if (!m) return null;
+      return { file: m[1].trim(), changes: parseInt(m[2], 10) };
+    }).filter(Boolean);
+    parsed.sort((a, b) => b.changes - a.changes);
+    changedFiles = parsed.map(p => p.file);
+  } catch {
+    // Fallback to plain --name-only
+    changedFiles = getPostCompleteChangedFiles(projectRoot, null);
+    if (changedFiles.length === 0) return [];
+  }
+
+  // Rank: scope-matching first, then diff-stat order
+  const normScope = (scopePaths || []).map(p => p.replace(/\\/g, '/'));
+  const inScope = [];
+  const outOfScope = [];
+  for (const f of changedFiles) {
+    const norm = f.replace(/\\/g, '/');
+    if (normScope.some(s => norm === s || norm.startsWith(s + '/') || s.endsWith('/') && norm.startsWith(s))) {
+      inScope.push(f);
+    } else {
+      outOfScope.push(f);
+    }
+  }
+  return [...inScope, ...outOfScope].slice(0, limit);
+}
+
+function writeJsonAtomic(filePath, data) {
+  const tmpFile = filePath + '.tmp.' + process.pid;
+  fs.writeFileSync(tmpFile, JSON.stringify(data, null, 2), 'utf8');
+  fs.renameSync(tmpFile, filePath);
+}
+
+/**
+ * TASK_1828: resolve the freshest handoff snapshot for a project root.
+ *
+ * The M3 migration (TASK_1760, ansuz-handoff-snapshot.js) moved handoff writes
+ * to per-session slots under .kenaz/specialist/handoffs/<sessionId>.json; the
+ * legacy single slot .kenaz/specialist/ansuz_session_handoff.json is read-only
+ * back-compat (nothing writes it anymore). Selection rule: newest valid
+ * generated_at wins. Two filename families coexist in handoffs/ by design
+ * (<conversation-uuid>.json and ansuz-prompt-<timestamp>.json — different
+ * callers derive sessionId differently), so filename ordering is meaningless;
+ * generated_at is the only reliable ordering.
+ *
+ * TASK_2254 contract: ansuz-boot-fast.js RENAMES every handoffs/ slot (and the
+ * legacy slot) into .kenaz/specialist/handoff_archive/ on boot, so after a boot
+ * the live dir is empty. Fallback order: handoffs/ -> newest (generated_at)
+ * valid handoff_archive/ slot -> legacy slot. Archived files keep their
+ * original content, so generated_at ordering works identically.
+ *
+ * @param {string} root project root
+ * @returns {object|null} parsed handoff object, or null. Never throws.
+ */
+function readLatestHandoff(root) {
+  let best = null;
+  let bestTs = -Infinity;
+  try {
+    const handoffsDir = path.join(root, '.kenaz', 'specialist', 'handoffs');
+    for (const f of fs.readdirSync(handoffsDir)) {
+      if (!f.endsWith('.json')) continue;
+      try {
+        const data = JSON.parse(fs.readFileSync(path.join(handoffsDir, f), 'utf8'));
+        const ts = Date.parse(data && data.generated_at);
+        if (Number.isFinite(ts) && ts > bestTs) { bestTs = ts; best = data; }
+      } catch { /* skip corrupt slot */ }
+    }
+  } catch { /* handoffs/ missing — fall through to archive */ }
+  if (best) return best;
+  try {
+    const archiveDir = path.join(root, '.kenaz', 'specialist', 'handoff_archive');
+    for (const f of fs.readdirSync(archiveDir)) {
+      if (!f.endsWith('.json')) continue;
+      try {
+        const data = JSON.parse(fs.readFileSync(path.join(archiveDir, f), 'utf8'));
+        const ts = Date.parse(data && data.generated_at);
+        if (Number.isFinite(ts) && ts > bestTs) { bestTs = ts; best = data; }
+      } catch { /* skip corrupt archived slot */ }
+    }
+  } catch { /* handoff_archive/ missing — fall through to legacy */ }
+  if (best) return best;
+  try {
+    const legacy = path.join(root, '.kenaz', 'specialist', 'ansuz_session_handoff.json');
+    if (fs.existsSync(legacy)) return JSON.parse(fs.readFileSync(legacy, 'utf8'));
+  } catch { /* corrupt legacy — nothing usable */ }
+  return null;
+}
+
+/**
+ * Reads, evaluates, and updates the post-complete dedup guard file.
+ * Returns a skip-result object if this invocation is a duplicate; null if it should proceed.
+ * Extracted for unit-testability.
+ *
+ * TASK_1593: Guard entries now store `lastOutcome: 'success'|'failure'` (written by
+ * updatePostCompleteGuardOutcome after the pass completes). The worktree->null
+ * suppression window only fires when the PREVIOUS worktree pass SUCCEEDED — a failed
+ * worktree pass must allow a retry through, otherwise the legitimate retry after a
+ * failed/ENOENT worktree pass is silently eaten (observed live TASK_1590/1591).
+ */
+function checkAndUpdatePostCompleteGuard(guardFile, taskId, worktreePath) {
+  try {
+    const dir = path.dirname(guardFile);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    let guard = {};
+    if (fs.existsSync(guardFile)) {
+      try { guard = JSON.parse(fs.readFileSync(guardFile, 'utf8')); } catch { guard = {}; }
+    }
+    const now = Date.now();
+    const previous = taskId ? guard[taskId] : null;
+
+    // Guard 1: worktree->null transition within 120s.
+    // TASK_1593: Only suppress when the previous worktree pass SUCCEEDED.
+    // If the previous pass failed (e.g. worktree_missing ENOENT), the null-path
+    // retry is legitimate and must NOT be suppressed.
+    if (taskId && previous && previous.worktreePath && !worktreePath && (now - previous.ts) < 120000) {
+      if (previous.lastOutcome !== 'failure') {
+        console.log(`   Duplicate post-complete suppressed for ${taskId} (recent worktree pass already handled it)`);
+        return { taskId, skipped: true, duplicateSuppressed: true, previousWorktreePath: previous.worktreePath };
+      } else {
+        console.log(`   Allowing retry for ${taskId}: previous worktree pass outcome=failure (not suppressing)`);
+      }
+    }
+
+    // Guard 2: null->null retry within 30s — the prod crash pattern (TASK_1430)
+    // Also only suppress when the previous pass succeeded.
+    if (taskId && previous && !previous.worktreePath && !worktreePath && (now - previous.ts) < 30000) {
+      if (previous.lastOutcome !== 'failure') {
+        console.log(`   Duplicate post-complete suppressed (null-null retry) for ${taskId}`);
+        return { taskId, skipped: true, duplicateSuppressed: true, nullNullRetry: true };
+      } else {
+        console.log(`   Allowing retry for ${taskId}: previous null pass outcome=failure (not suppressing)`);
+      }
+    }
+
+    if (taskId) {
+      // lastOutcome is null until updatePostCompleteGuardOutcome() records the result
+      guard[taskId] = { ts: now, worktreePath: worktreePath || null, lastOutcome: null };
+      writeJsonAtomic(guardFile, guard);
+    }
+    return null; // caller should proceed normally
+  } catch (e) {
+    console.log(`   post-complete guard skipped: ${e.message}`);
+    return null;
+  }
+}
+
+/**
+ * Records the outcome of a post-complete pass into the guard file.
+ * Call this after the pass completes (success or failure) so the next
+ * Guard 1/2 evaluation can distinguish success from failure.
+ *
+ * TASK_1593: Closes the dedup loop — guard only suppresses retries when
+ * the prior pass actually succeeded (lastOutcome='success').
+ *
+ * @param {string} guardFile
+ * @param {string} taskId
+ * @param {'success'|'failure'} outcome
+ */
+function updatePostCompleteGuardOutcome(guardFile, taskId, outcome) {
+  if (!taskId) return;
+  try {
+    let guard = {};
+    if (fs.existsSync(guardFile)) {
+      try { guard = JSON.parse(fs.readFileSync(guardFile, 'utf8')); } catch { guard = {}; }
+    }
+    if (guard[taskId]) {
+      guard[taskId].lastOutcome = outcome;
+      writeJsonAtomic(guardFile, guard);
+    }
+  } catch { /* best-effort — guard update failure is non-fatal */ }
+}
+
+/**
+ * Writes a task_completed entry to ansuz_inbox.json with idempotency.
+ * Skips if an unprocessed entry with the same (type, task_id) already exists.
+ * Returns { written: true } or { skipped: true, reason: 'already-present' }.
+ * Extracted for unit-testability.
+ */
+function writeInboxEntryIdempotent(inboxFile, specialistDir, entry) {
+  let inbox = { messages: [] };
+  try {
+    if (fs.existsSync(inboxFile)) {
+      inbox = JSON.parse(fs.readFileSync(inboxFile, 'utf8'));
+      if (!Array.isArray(inbox.messages)) inbox.messages = [];
+    }
+  } catch { inbox = { messages: [] }; }
+
+  const processedIds = inbox.processed_ids || [];
+  const alreadyPresent = inbox.messages.some(
+    m => m.type === entry.type && m.task_id === entry.task_id && !processedIds.includes(m.id)
+  );
+  if (alreadyPresent) {
+    console.log(`   📬 Ansuz inbox: task_completed for ${entry.task_id} already present — skipped (idempotent)`);
+    return { skipped: true, reason: 'already-present' };
+  }
+
+  inbox.messages.push(entry);
+  fs.mkdirSync(specialistDir, { recursive: true });
+  writeJsonAtomic(inboxFile, inbox);
+  console.log(`   📬 Ansuz inbox: task_completed signal written for ${entry.task_id}`);
+  return { written: true };
+}
+
+function getPostCompleteChangedFiles(projectRoot, gitResult) {
+  // Use HEAD~1 not HEAD^1: on Windows cmd.exe, ^ is the escape character and ^1 strips to 1,
+  // producing "fatal: ambiguous argument 'HEAD1'". HEAD~1 is shell-safe everywhere.
+  //
+  // B9 (2026-04-09): when worktree merge fails, the agent's actual commit lives on
+  // taskBranch~1..taskBranch — NOT on the main repo HEAD~1..HEAD which captures
+  // whatever unrelated commits happened in the main branch during the dispatch
+  // (e.g. concurrent post-complete bug fixes). Prefer taskBranch range whenever
+  // we know the branch and it still exists in the shared git object database.
+  const candidateCmds = [];
+  const taskBranch = gitResult && gitResult.taskBranch;
+
+  // Check if taskBranch still exists (might be deleted after a successful merge cleanup)
+  const taskBranchExists = taskBranch
+    ? (() => {
+        try {
+          execSync(`git rev-parse --verify --quiet ${taskBranch}`, {
+            cwd: projectRoot, encoding: 'utf8', timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true,
+          });
+          return true;
+        } catch { return false; }
+      })()
+    : false;
+
+  if (isVerifiedMergeSuccess(gitResult)) {
+    // Merge succeeded — the merge commit is at HEAD, its first parent is HEAD~1.
+    // taskBranch~1..taskBranch would also work but is identical to HEAD~1..HEAD here.
+    candidateCmds.push('git diff --name-only HEAD~1 HEAD');
+  } else if (taskBranchExists) {
+    // Merge failed or not attempted but agent committed on a task branch — use the
+    // branch's own range so unrelated main-repo activity does not pollute outcome.
+    candidateCmds.push(`git diff --name-only ${taskBranch}~1 ${taskBranch}`);
+  }
+
+  if (gitResult && gitResult.committed) {
+    candidateCmds.push('git diff --name-only HEAD~1 HEAD');
+  }
+  // Last-resort fallback (memory-only tasks, no taskBranch, etc.)
+  candidateCmds.push('git diff --name-only HEAD~1 HEAD');
+
+  for (const cmd of candidateCmds) {
+    try {
+      const raw = execSync(cmd, {
+        cwd: projectRoot,
+        encoding: 'utf8',
+        timeout: 8000,
+        windowsHide: true,
+      }).trim();
+      if (raw) return raw.split('\n').filter(Boolean);
+    } catch {
+      // try next candidate
+    }
+  }
+
+  return [];
+}
+
+/**
+ * Find the most recent formation log file for a given task ID.
+ * Scans LOG_DIR (or project-specific log dir) for files containing the task ID.
+ * @param {string} taskId
+ * @param {string} [projectPath]
+ * @returns {string|null} log file path, or null if not found
+ */
+function findLogForTask(taskId, projectPath) {
+  const logRoot = projectPath ? getLogDir(projectPath) : LOG_DIR;
+  if (!fs.existsSync(logRoot)) return null;
+
+  // Scan formation subdirs (unit/, solo/, squad/, etc.)
+  let candidates = [];
+  try {
+    const subdirs = fs.readdirSync(logRoot, { withFileTypes: true });
+    for (const d of subdirs) {
+      if (!d.isDirectory()) continue;
+      const formDir = path.join(logRoot, d.name);
+      const files = fs.readdirSync(formDir).filter(f => f.endsWith('.log'));
+      for (const f of files) {
+        const fullPath = path.join(formDir, f);
+        // Check if log content references this task
+        try {
+          const head = fs.readFileSync(fullPath, 'utf-8').slice(0, 500);
+          if (head.includes(taskId)) {
+            const stat = fs.statSync(fullPath);
+            candidates.push({ path: fullPath, mtime: stat.mtimeMs });
+          }
+        } catch { /* unreadable file */ }
+      }
+    }
+  } catch { /* log dir scan failed */ }
+
+  if (candidates.length === 0) return null;
+  // Return the most recent match
+  candidates.sort((a, b) => b.mtime - a.mtime);
+  return candidates[0].path;
+}
+
+// ─────────────────────────────────────────
+// Cognitive Checkpoint Detection
+// ─────────────────────────────────────────
+
+/**
+ * B11: Conservative stale worktree GC. Scans .formation/worktrees/ for orphan
+ * dirs whose owning task is already in done/cancel/archived state. Safe by
+ * design — never touches a worktree whose task is still active/backlog/blocked,
+ * never touches the worktree currently being processed, never recurses outside
+ * .formation/worktrees/. Runs at the start of every postComplete invocation so
+ * the system self-heals from any historical merge-failure leftovers without
+ * waiting for manual cleanup.
+ *
+ * Triggered by historical observation: 11 stale worktrees / 2.9 GB accumulated
+ * across multiple sessions of the post-complete bug chain (B1-B10).
+ *
+ * TASK_2028: a worktree interrupted mid-`git worktree add` (Windows process-
+ * tree kill on timeout, session end) is LOCKED by git itself with reason
+ * "initializing", and `git worktree prune` never prunes a locked entry even
+ * after its directory is gone (see utils.js createWorktree/
+ * cleanupFailedWorktreeAttempt for the same pattern on the creation side).
+ * A raw `fs.rmSync` on the directory therefore only removes the working
+ * copy — the `.git/worktrees/<name>/locked` registration in the MAIN repo
+ * survives, permanently marking the task branch "checked out" and blocking
+ * any future retry with "already checked out" / "branch already exists".
+ * reclaimWorktreeDir() below unlocks first, then prefers `git worktree
+ * remove --force` (utils.removeWorktree, which also prunes as a fallback)
+ * over a bare directory delete, so GC actually clears the git-level lock
+ * instead of leaving a ghost registration behind.
+ */
+function reclaimWorktreeDir(repoRoot, worktreesRoot, name) {
+  const fullPath = path.join(worktreesRoot, name);
+  try {
+    execSync(`git worktree unlock "${fullPath}"`, {
+      cwd: repoRoot, encoding: 'utf8', timeout: 10000, windowsHide: true,
+      stdio: ['pipe', 'pipe', 'pipe'],
+    });
+  } catch { /* not locked / not registered — fine */ }
+  const removed = removeWorktree(repoRoot, fullPath);
+  if (!removed && fs.existsSync(fullPath)) {
+    // Last resort: directory delete + explicit prune so the admin metadata
+    // (and its lock) doesn't outlive the working copy.
+    fs.rmSync(fullPath, { recursive: true, force: true });
+    try {
+      execSync('git worktree prune', {
+        cwd: repoRoot, encoding: 'utf8', timeout: 10000, windowsHide: true,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch { /* prune failure is non-fatal */ }
+  }
+}
+
+function gcStaleWorktrees(currentTaskId, projectPath) {
+  try {
+    const worktreesRoot = path.join(ROOT, '.formation', 'worktrees');
+    if (!fs.existsSync(worktreesRoot)) return;
+    const entries = fs.readdirSync(worktreesRoot, { withFileTypes: true });
+    let removedCount = 0;
+    let preservedCount = 0;
+    for (const ent of entries) {
+      if (!ent.isDirectory()) continue;
+      // Pattern: task_task_<taskidsuffix> — extract the TASK_ID
+      const m = ent.name.match(/^task_task_(.+)$/);
+      if (!m) continue;
+      const taskIdSuffix = m[1];
+      const fullTaskId = taskIdSuffix.startsWith('TASK_') ? taskIdSuffix : `TASK_${taskIdSuffix}`;
+      // Never remove the worktree for the task currently being processed
+      if (currentTaskId && (fullTaskId === currentTaskId || taskIdSuffix === currentTaskId)) {
+        preservedCount++;
+        continue;
+      }
+      // Probe task status via task-api — only act on done/cancel/archived
+      try {
+        const apiArgs = projectPath ? ['--project-path', projectPath] : [];
+        apiArgs.push('get', fullTaskId);
+        const result = spawnSync('node', [COLLABORATION_API, ...apiArgs], {
+          encoding: 'utf8', timeout: 5000, cwd: ROOT, windowsHide: true,
+        });
+        if (result.status !== 0) {
+          // Task does not exist (deleted, never created) → safe to remove orphan worktree
+          reclaimWorktreeDir(ROOT, worktreesRoot, ent.name);
+          removedCount++;
+          continue;
+        }
+        const parsed = JSON.parse(result.stdout || '{}');
+        const status = parsed._status_dir || parsed.status_dir || (parsed.task && parsed.task._status_dir) || null;
+        if (status && ['done', 'cancel', 'archived'].includes(status)) {
+          reclaimWorktreeDir(ROOT, worktreesRoot, ent.name);
+          removedCount++;
+        } else {
+          preservedCount++;
+        }
+      } catch {
+        // Task probe failed — leave the worktree alone (conservative)
+        preservedCount++;
+      }
+    }
+    if (removedCount > 0) {
+      console.log(`   🧹 Stale worktree GC: removed ${removedCount} dir(s) from completed tasks${preservedCount > 0 ? ` (${preservedCount} preserved for active work)` : ''}`);
+    }
+  } catch (e) {
+    console.log(`   ⚠️  Stale worktree GC failed (non-fatal): ${e.message}`);
+  }
+}
+
+// ============================================================================
+// Cognitive tool usage tracking (TASK_1105)
+// Records which cognitive tools (synapse_recall, kenaz_lsp_*, ddx, etc.) were
+// invoked during the task, aggregates into .kenaz/specialist/ansuz_self_model.json
+// under cognitive_competence, and flags negative-trend tools as mirror blind spots.
+// ============================================================================
+
+const COGNITIVE_TOOLS = [
+  'synapse_recall',
+  'kenaz_lsp_callers',
+  'kenaz_lsp_references',
+  'synapse_inscribe',
+  'synapse_forge',
+  'ddx',
+  'hippocampus_episode_start',
+  'cortex_recall',
+];
+
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Returns true if cargo stderr indicates a transient file lock contention. */
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: GIT_PRIMITIVES
+// ?????????????????????????????????????????????????????????????????????????????
+function git(cmd, opts = {}) {
+  if (!opts.cwd) {
+    throw new Error(`git(): cwd is required — refusing to default to ROOT to prevent cross-project contamination. Command: git ${cmd}`);
+  }
+
+  // 子專案 git 隔離：GIT_CEILING_DIRECTORIES 阻止 git 向上遍歷
+  // 即使 cwd 設錯，git 也不會找到上層的 .git/
+  const env = { ...process.env };
+  if (opts.cwd && opts.cwd !== ROOT) {
+    env.GIT_CEILING_DIRECTORIES = path.dirname(opts.cwd);
+  }
+
+  try {
+    const out = execSync(`git ${cmd}`, {
+      encoding: 'utf8',
+      timeout: 30000,
+      stdio: ['pipe', 'pipe', 'pipe'],  // suppress stderr noise to parent
+      env,
+      ...opts, windowsHide: true
+    });
+    // opts.raw: caller needs byte-exact stdout (e.g. porcelain parsing where
+    // the first line's leading space encodes index-status — trim() would
+    // strip it and corrupt slice-based field extraction).
+    return opts.raw ? out.replace(/\r?\n$/, '') : out.trim();
+  } catch (e) {
+    if (opts.throws !== false) throw e;
+    return null;
+  }
+}
+
+function gitPreservingUntracked(cmd, opts = {}) {
+  const safeCmd = preserveUntrackedStashCommand(cmd);
+  if (safeCmd !== cmd && !opts.silentPreserveUntrackedLog) {
+    console.log('   preserve untracked: stash command downgraded to tracked-only for workspace safety');
+  }
+  return git(safeCmd, opts);
+}
+
+function getCurrentBranch(projectRoot) {
+  return git('rev-parse --abbrev-ref HEAD', { cwd: projectRoot, throws: false });
+}
+
+/**
+ * 取得 dispatch 時保存的原始分支名。
+ * 並行 dispatch 時 getCurrentBranch() 可能回傳其他 task 的分支，
+ * 這個函數確保 post-complete 總是能回到正確的用戶分支。
+ */
+function getDispatchBranch(projectRoot) {
+  const dispatchBranchFile = path.join(projectRoot, '.formation', '.dispatch-branch');
+  try {
+    if (fs.existsSync(dispatchBranchFile)) {
+      const branch = fs.readFileSync(dispatchBranchFile, 'utf-8').trim();
+      if (branch && !branch.startsWith('task/')) return branch;
+    }
+  } catch { /* ignore */ }
+  return null;
+}
+
+/**
+ * 檢查 repo 是否有至少一個 commit（HEAD 是否存在）
+ */
+function hasInitialCommit(projectRoot) {
+  return git('rev-parse HEAD', { cwd: projectRoot, throws: false }) !== null;
+}
+
+function branchExists(branch, projectRoot) {
+  return git(`rev-parse --verify ${branch}`, { cwd: projectRoot, throws: false }) !== null;
+}
+
+function getGitUserBranch(projectRoot) {
+  // NAME IS A LIE — kept for call-site stability. This returns the main
+  // worktree's branch (the user's originating branch), NOT git config user.name.
+  // The old heuristic (git config user.name) assumed the user named their branch
+  // after their git username and produced phantom branches like "xyz9516" when
+  // the real branch was "xyz951610", causing post-complete checkout failures.
+  // `git worktree list --porcelain` first stanza is always the main worktree.
+  const raw = git('worktree list --porcelain', { cwd: projectRoot, throws: false, raw: true });
+  if (!raw) return null;
+  for (const line of raw.split(/\r?\n/)) {
+    const m = line.match(/^branch refs\/heads\/(.+)$/);
+    if (m && !m[1].startsWith('task/')) return m[1];
+  }
+  return null;
+}
+
+function getBaseBranch(projectRoot) {
+  if (branchExists('main', projectRoot)) return 'main';
+  if (branchExists('master', projectRoot)) return 'master';
+  return getCurrentBranch(projectRoot) || 'HEAD';
+}
+
+function resolveUserBranch(projectRoot) {
+  const currentBranch = getCurrentBranch(projectRoot);
+  const gitUserBranch = getGitUserBranch(projectRoot);
+  const dispatchBranch = getDispatchBranch(projectRoot);
+  // dispatchBranch is ground truth: recorded at dispatch time from the main
+  // repo's HEAD. currentBranch can be task/* when post-complete runs from
+  // the worktree. gitUserBranch (git config user.name) is a weak heuristic
+  // that assumes the branch is named after the user — fails for branches
+  // like "xyz951610" when user.name is "xyz9516" (phantom-branch checkout).
+  if (dispatchBranch) return dispatchBranch;
+  if (currentBranch && !currentBranch.startsWith('task/')) return currentBranch;
+  if (gitUserBranch) return gitUserBranch;
+  return getBaseBranch(projectRoot);
+}
+
+function hasChanges(projectRoot) {
+  const status = git('status --porcelain', { cwd: projectRoot });
+  return status && status.length > 0;
+}
+
+function getUnmergedPaths(projectRoot) {
+  const out = git('diff --name-only --diff-filter=U', { cwd: projectRoot, throws: false });
+  if (!out || !out.trim()) return [];
+  return out.trim().split('\n').map(s => s.trim()).filter(Boolean);
+}
+
+function acquireGitLock(taskId, projectRoot) {
+  const lockPath = getGitLockPath(projectRoot);
+  const deadline = Date.now() + GIT_LOCK_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      // wx = exclusive create — atomic, fails if file already exists
+      fs.writeFileSync(lockPath, JSON.stringify({
+        pid: process.pid,
+        taskId,
+        acquiredAt: new Date().toISOString(),
+      }), { flag: 'wx' });
+      console.log(`   🔒 Git lock acquired for ${taskId}`);
+      return true;
+    } catch (e) {
+      if (e.code === 'EEXIST') {
+        // Check if lock holder process is still alive
+        try {
+          const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+          process.kill(lock.pid, 0); // throws if process is dead
+          // Process alive — wait and retry
+          console.log(`   ⏳ Waiting for git lock (held by ${lock.taskId}, pid ${lock.pid})...`);
+        } catch {
+          // Lock holder is dead — steal the lock
+          try { fs.unlinkSync(lockPath); } catch {}
+          continue;
+        }
+        const wait = Date.now() + GIT_LOCK_POLL_MS;
+        while (Date.now() < wait) { /* busy wait */ }
+      } else {
+        throw e;
+      }
+    }
+  }
+  // Timed out — force acquire to avoid permanent deadlock
+  console.log('   ⚠️  Timed out waiting for git lock, forcing acquire');
+  try { fs.unlinkSync(lockPath); } catch {}
+  fs.writeFileSync(lockPath, JSON.stringify({
+    pid: process.pid, taskId, acquiredAt: new Date().toISOString(),
+  }));
+  return true;
+}
+
+function releaseGitLock(projectRoot) {
+  try {
+    fs.unlinkSync(getGitLockPath(projectRoot));
+    console.log('   🔓 Git lock released');
+  } catch {}
+}
+
+// ─────────────────────────────────────────
+// Merge Lock（輕量鎖，只序列化 merge 步驟）
+// Used in worktree mode — replaces broad git lock for parallel dispatch.
+// Short-lived (seconds, not minutes). Only held during `git merge`.
+// ─────────────────────────────────────────
+
+const MERGE_LOCK_TIMEOUT_MS = 60000; // 1 minute max wait
+const MERGE_LOCK_POLL_MS = 500;
+
+function getMergeLockPath(projectRoot) {
+  return path.join(projectRoot, '.formation', '.merge-lock');
+}
+
+function acquireMergeLock(taskId, projectRoot) {
+  const lockPath = getMergeLockPath(projectRoot);
+  const formDir = path.join(projectRoot, '.formation');
+  if (!fs.existsSync(formDir)) fs.mkdirSync(formDir, { recursive: true });
+  const deadline = Date.now() + MERGE_LOCK_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    try {
+      fs.writeFileSync(lockPath, JSON.stringify({
+        pid: process.pid, taskId, acquiredAt: new Date().toISOString(),
+      }), { flag: 'wx' });
+      console.log(`   🔒 Merge lock acquired for ${taskId}`);
+      return true;
+    } catch (e) {
+      if (e.code === 'EEXIST') {
+        try {
+          const lock = JSON.parse(fs.readFileSync(lockPath, 'utf8'));
+          try {
+            process.kill(lock.pid, 0); // throws if process is dead
+            console.log(`   ⏳ Waiting for merge lock (held by ${lock.taskId}, pid ${lock.pid})...`);
+          } catch {
+            // Lock holder is dead — steal the lock
+            try { fs.unlinkSync(lockPath); } catch {}
+            continue;
+          }
+        } catch {
+          // Corrupt lock file — steal it
+          try { fs.unlinkSync(lockPath); } catch {}
+          continue;
+        }
+        const wait = Date.now() + MERGE_LOCK_POLL_MS;
+        while (Date.now() < wait) { /* busy wait */ }
+      } else {
+        throw e;
+      }
+    }
+  }
+  // Timed out — force acquire to avoid deadlock
+  console.log('   ⚠️  Timed out waiting for merge lock, forcing acquire');
+  try { fs.unlinkSync(lockPath); } catch {}
+  fs.writeFileSync(lockPath, JSON.stringify({
+    pid: process.pid, taskId, acquiredAt: new Date().toISOString(),
+  }));
+  return true;
+}
+
+function releaseMergeLock(projectRoot) {
+  // TASK_1391: retry on EBUSY (Windows: AV / file watcher may briefly hold a handle).
+  // Silent on ENOENT (already released). Warn (not silent) on persistent failure so
+  // operators can spot the leak without breaking dispatch flow.
+  const lockPath = getMergeLockPath(projectRoot);
+  for (let i = 0; i < 3; i++) {
+    try {
+      fs.unlinkSync(lockPath);
+      console.log('   🔓 Merge lock released');
+      return true;
+    } catch (e) {
+      if (e.code === 'ENOENT') return true;
+      if (e.code === 'EBUSY' && i < 2) {
+        const wait = Date.now() + 100;
+        while (Date.now() < wait) {}
+        continue;
+      }
+      console.warn(`   ⚠️  releaseMergeLock failed (${e.code || e.message}) — lock may persist`);
+      return false;
+    }
+  }
+  return false;
+}
+
+/**
+ * Atomically decrement the parallel dispatch semaphore.
+ * Mirrors _decrementParallelCount in headless.js.
+ * Called after successful worktree merge + removal.
+ */
+function decrementParallelSemaphore() {
+  const countFile = path.join(ROOT, '.formation', '.parallel-count');
+  const countLock = path.join(ROOT, '.formation', '.parallel-count-lock');
+  const deadline = Date.now() + 10000;
+  while (Date.now() < deadline) {
+    let lockFd = null;
+    try {
+      lockFd = fs.openSync(countLock, 'wx');
+      try {
+        const count = fs.existsSync(countFile) ? (parseInt(fs.readFileSync(countFile, 'utf-8').trim()) || 0) : 0;
+        fs.writeFileSync(countFile, String(Math.max(0, count - 1)));
+      } finally {
+        fs.closeSync(lockFd);
+        try { fs.unlinkSync(countLock); } catch {}
+      }
+      console.log('   📉 Parallel semaphore decremented');
+      return;
+    } catch {
+      if (lockFd !== null) { try { fs.closeSync(lockFd); } catch {} }
+      const wait = Date.now() + 200;
+      while (Date.now() < wait) { /* busy wait */ }
+    }
+  }
+  console.log('   ⚠️  Semaphore decrement timed out — slot may be leaked');
+}
+
+/**
+ * Remove worktree and decrement parallel semaphore.
+ * Called after successful merge in worktree mode.
+ * On conflict (merge failed), worktree is preserved — do NOT call this.
+ * @param {string} worktreePath - absolute path to worktree directory
+ * @param {string} projectRoot - main repo root
+ */
+function cleanupWorktree(worktreePath, projectRoot) {
+  if (!worktreePath) return;
+  try {
+    const utils = require('./utils');
+    const removed = utils.removeWorktree(projectRoot, worktreePath);
+    console.log(removed
+      ? `   🧹 Worktree removed: ${path.relative(projectRoot, worktreePath)}`
+      : `   ⚠️  Worktree removal failed or already gone: ${path.basename(worktreePath)}`
+    );
+  } catch (e) {
+    console.log(`   ⚠️  Worktree cleanup error: ${e.message}`);
+  }
+  decrementParallelSemaphore();
+}
+
+function isVerifiedMergeSuccess(gitResult) {
+  return Boolean(gitResult && gitResult.merged === true && gitResult.verify_merge_landed === true);
+}
+
+function ensureSalvageBranch(projectRoot, taskBranch) {
+  if (!projectRoot || !taskBranch || !branchExists(taskBranch, projectRoot)) return null;
+
+  const salvageBranch = `${taskBranch}_salvage_${Date.now()}`;
+  const created = git(`branch ${salvageBranch} ${taskBranch}`, { cwd: projectRoot, throws: false });
+  if (created === null) return null;
+
+  console.log(`   💾 Salvage branch created: ${salvageBranch}`);
+  return salvageBranch;
+}
+
+/**
+ * Convert a leaked stash entry into a discoverable salvage branch + drop the stash.
+ * Used when stash pop fails (typically dirty WD overlapping with merged content)
+ * — without this, the stash silently accumulates (29-stash-leak bug, 2026-05-05).
+ *
+ * Implementation: a stash IS a commit (stash@{N} resolves to a SHA representing
+ * the WIP tree). We point a branch ref at that SHA, then `stash drop` to clear
+ * the entry. Recovery is then `git stash apply <salvage_branch>` or
+ * `git checkout <salvage_branch>` to view the WIP state.
+ *
+ * @returns branch name on success, null on failure (stash kept intact)
+ */
+function salvageStashAsBranch(projectRoot, taskId, stashRef) {
+  if (!projectRoot) return null;
+  const ref = stashRef || 'stash@{0}';
+  const sha = git(`rev-parse ${ref}`, { cwd: projectRoot, throws: false });
+  if (!sha || !sha.trim()) return null;
+
+  const stashSha = sha.trim();
+  const salvage = `stash-salvage/${taskId || 'unknown'}-${Date.now()}`;
+  const created = git(`branch ${salvage} ${stashSha}`, { cwd: projectRoot, throws: false });
+  if (created === null) return null;
+
+  // Drop the stash only after the branch ref is in place — protects against
+  // the unconditional-drop bug at the recovery path (changes lost when restore failed).
+  git(`stash drop ${ref}`, { cwd: projectRoot, throws: false });
+
+  console.log(`   💾 Stash salvaged → branch ${salvage}`);
+  console.log(`   💡 Recovery: git stash apply ${salvage}  (or checkout to inspect)`);
+  return salvage;
+}
+
+function verify_merge_landed(projectRoot, taskBranch, targetBranch, taskBranchCommit) {
+  // TASK_1525: Distinguish 'unknown' (attempted, failed) from null (not attempted).
+  // taskBranchCommit may already be 'unknown' from the caller's capture step.
+  let commitHash = '';
+  if (taskBranchCommit && taskBranchCommit !== 'unknown') {
+    commitHash = taskBranchCommit.trim();
+  } else if (!taskBranchCommit) {
+    // Not yet captured by caller — attempt here as fallback
+    const raw = git(`rev-parse ${taskBranch}`, { cwd: projectRoot, throws: false });
+    commitHash = (raw || '').trim();
+    if (raw === null) {
+      console.log(`   ⚠️  [TASK_1525] verify_merge_landed: rev-parse ${taskBranch} failed — commitHash unknown`);
+    }
+  }
+  // else taskBranchCommit === 'unknown' — commitHash stays ''
+
+  let targetHead = 'unknown';
+  const rawTarget = git(`rev-parse ${targetBranch}`, { cwd: projectRoot, throws: false });
+  if (rawTarget !== null) {
+    targetHead = rawTarget.trim() || 'unknown';
+  } else {
+    console.log(`   ⚠️  [TASK_1525] verify_merge_landed: rev-parse ${targetBranch} failed — targetHead unknown`);
+  }
+
+  if (!commitHash) {
+    return {
+      ok: false,
+      reason: taskBranchCommit === 'unknown' ? 'task_branch_commit_capture_failed' : 'missing_task_branch_commit',
+      taskBranchCommit: taskBranchCommit === 'unknown' ? 'unknown' : null,
+      targetHead,
+    };
+  }
+
+  const probe = spawnSync('git', ['merge-base', '--is-ancestor', commitHash, targetBranch], {
+    cwd: projectRoot,
+    encoding: 'utf8',
+    timeout: 8000,
+    windowsHide: true,
+  });
+
+  if (probe.status !== 0) {
+    return {
+      ok: false,
+      reason: (probe.stderr || probe.stdout || 'merge commit not reachable from target HEAD').trim(),
+      taskBranchCommit: commitHash,
+      targetHead,
+    };
+  }
+
+  // TASK_1593: Content check — verify task branch files actually arrived in targetBranch.
+  // Ancestor check above only proves the merge commit exists; it does NOT prove the
+  // files changed by the task branch are present in targetBranch HEAD. In the regression
+  // scenario (TASK_1590/1591) a false-positive merged=true was reported while real task
+  // content was missing and only transcript/daemon noise had been committed.
+  //
+  // Strategy: list files changed by taskBranch vs its merge-base with targetBranch,
+  // exclude daemon/transcript noise, then diff commitHash..targetHead -- <agentFiles>.
+  // An empty diff means content landed; non-empty means merge_content_missing.
+  // Non-fatal on errors: if we cannot compute, fall through to ancestor_verified.
+  try {
+    const mbOut = spawnSync('git', ['merge-base', commitHash, targetBranch], {
+      cwd: projectRoot, encoding: 'utf8', timeout: 8000, windowsHide: true,
+    });
+    const mergeBase = mbOut.status === 0 ? mbOut.stdout.trim() : '';
+    if (mergeBase) {
+      const changedOut = spawnSync('git', ['diff', '--name-only', mergeBase, commitHash, '--'], {
+        cwd: projectRoot, encoding: 'utf8', timeout: 8000, windowsHide: true,
+      });
+      const taskFiles = changedOut.status === 0
+        ? changedOut.stdout.trim().split('\n').filter(Boolean)
+        : [];
+      // Exclude daemon/transcript noise paths from the content check
+      const CONTENT_NOISE_PREFIXES = [
+        '.kenaz/transcripts/', '.kenaz/specialist/', '.kenaz/efe_snapshots/',
+        '.kenaz/logs/', '.formation/signals/', '.synapse/', '.formation/muninn_snapshot',
+      ];
+      const CONTENT_NOISE_EXACT = [
+        'dashboard/package.json', 'dashboard/src-tauri/Cargo.lock', 'package-lock.json',
+        '.formation/.active-dispatches.json',
+      ];
+      const agentFiles = taskFiles.filter(f => {
+        if (!f) return false;
+        if (CONTENT_NOISE_EXACT.includes(f)) return false;
+        return !CONTENT_NOISE_PREFIXES.some(p => f.startsWith(p));
+      });
+      if (agentFiles.length > 0) {
+        const diffArgs = ['diff', '--name-only', commitHash, targetHead, '--'].concat(agentFiles);
+        const contentDiff = spawnSync('git', diffArgs, {
+          cwd: projectRoot, encoding: 'utf8', timeout: 10000, windowsHide: true,
+        });
+        const missingFiles = contentDiff.status === 0
+          ? contentDiff.stdout.trim().split('\n').filter(Boolean)
+          : [];
+        if (missingFiles.length > 0) {
+          console.log('   [TASK_1593] content_check FAILED: ' + missingFiles.length + ' agent file(s) missing from ' + targetBranch);
+          for (const mf of missingFiles.slice(0, 5)) {
+            console.log('      missing: ' + mf);
+          }
+          return {
+            ok: false,
+            reason: 'merge_content_missing',
+            taskBranchCommit: commitHash,
+            targetHead,
+            missingFiles,
+          };
+        }
+        console.log('   [TASK_1593] content_check OK: ' + agentFiles.length + ' agent file(s) verified in ' + targetBranch);
+      }
+    }
+  } catch (ccErr) {
+    // Non-fatal: ancestor check already passed; don't block on content-check failure
+    console.log('   [TASK_1593] content_check error (non-fatal): ' + (ccErr.message || '').split('\n')[0]);
+  }
+
+  return {
+    ok: true,
+    reason: 'ancestor_verified',
+    taskBranchCommit: commitHash,
+    targetHead,
+  };
+}
+
+// B10: Daemon-managed cognitive state files. Touched as a side effect of any
+// Ansuz session running (counters, observations, inbox polls), never as
+// intentional task work. Used by:
+//   - worktreeCheckoutRevertPaths (revert in main repo before worktree merge)
+//   - worktree commit step (reset out of index after `git add -A` so the
+//     agent's intended work is captured but daemon noise is not)
+// Listed explicitly (not wildcarded) so a task that legitimately scopes one
+// of these files still has its change committed via the scoped-add path.
+// D.2 (TASK_1210): Daemon-managed paths loaded from YAML manifest.
+// Add new daemon files to .kenaz/specialist/daemon-manifest.yaml — no code change needed.
+let _daemonManifestCache = null;
+function loadDaemonManifest() {
+  if (_daemonManifestCache) return _daemonManifestCache;
+  const manifestPath = path.join(ROOT, '.kenaz', 'specialist', 'daemon-manifest.yaml');
+  try {
+    let yaml;
+    try { yaml = require('js-yaml'); } catch {
+      const candidates = [
+        path.resolve(__dirname, '../../.vendor/js-yaml.cjs'),
+        path.resolve(__dirname, '.vendor/js-yaml.cjs'),
+      ];
+      for (const c of candidates) { try { yaml = require(c); break; } catch {} }
+    }
+    if (!yaml) throw new Error('js-yaml not found');
+    const raw = yaml.load(fs.readFileSync(manifestPath, 'utf8'));
+    _daemonManifestCache = {
+      stateFiles: Array.isArray(raw?.state_files) ? raw.state_files : [],
+      staticPaths: Array.isArray(raw?.static_paths) ? raw.static_paths : [],
+    };
+  } catch (e) {
+    console.log(`   ⚠️  daemon-manifest.yaml load failed (${e.message}), using inline fallback`);
+    _daemonManifestCache = {
+      stateFiles: [
+        '.kenaz/specialist/turn_context_state.json', '.kenaz/specialist/ansuz_rules.yaml',
+        '.kenaz/specialist/ansuz_session.json', '.kenaz/specialist/ansuz_state.json',
+        '.kenaz/specialist/ansuz_inbox.json', '.kenaz/specialist/ambient_signals.json',
+        '.kenaz/huginn-attention.json', '.kenaz/specialist/ritual_state.json',
+      ],
+      staticPaths: [
+        '.formation/.parallel-count', '.formation/.active-dispatches.json',
+        '.synapse/db/index_state.json', '.tmp/', 'claude', '.formation/signals/',
+      ],
+    };
+  }
+  return _daemonManifestCache;
+}
+function getDaemonStateFiles() { return loadDaemonManifest().stateFiles; }
+function getDaemonStaticPaths() { return loadDaemonManifest().staticPaths; }
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: TASK_UTILITIES
+// ?????????????????????????????????????????????????????????????????????????????
+/**
+ * Write merge conflict info to task YAML notes field.
+ * Preserves worktree path for manual resolution.
+ */
+function writeConflictNotesToTask(taskId, taskBranch, userBranch, errMsg, worktreePath, projectPath) {
+  try {
+    const worktreeNote = worktreePath ? ` Worktree at: ${worktreePath}` : '';
+    // TASK_1957: verbatim git stderr (not just the first line) so a working-tree
+    // collision ("local changes to X would be overwritten") is diagnosable from
+    // the task notes alone, without re-running the merge by hand.
+    const fullErr = String(errMsg || '').trim();
+    const note = `Merge failed: ${taskBranch} -> ${userBranch}. ${fullErr}.${worktreeNote} Resolve manually then run post-complete.`;
+    const updateArgs = projectPath ? ['--project-path', projectPath] : [];
+    updateArgs.push('update', taskId, '--notes', note);
+    spawnSync('node', [COLLABORATION_API, ...updateArgs], {
+      encoding: 'utf8', timeout: 10000, cwd: ROOT, windowsHide: true,
+    });
+  } catch { /* best-effort */ }
+}
+
+/**
+ * TASK_2233: failure_reason for a git step that did not land. 'merge_conflict' only when
+ * git reported a conflict (mergeConflict bucket / conflictFiles) — never as the catch-all.
+ */
+function classifyMergeFailureReason(g) {
+  if (g?.failure_reason) return g.failure_reason;
+  if (g?.rebaseConflict) return 'rebase_conflict';
+  if (g?.checkoutBlocked) return 'checkout_blocked';
+  if (g?.missingTaskBranch) return 'task_branch_missing';
+  if (/author identity unknown|please tell me who you are|empty ident name/i.test(`${g?.mergeErrorText || ''} ${g?.gitException || ''}`)) return 'git_identity_missing';
+  if (g?.mergeConflict || (g?.conflictFiles && g.conflictFiles.length)) return 'merge_conflict';
+  return 'git_step_failed';
+}
+
+function blockTaskForMergeFailure(taskId, projectPath, gitResult) {
+  if (!taskId) return false;
+
+  const isRebaseConflict = gitResult?.rebaseConflict === true;
+  const isLastChanceOrphan = gitResult?.lastChanceRecoveryOrphan === true;
+  const vitals = {
+    // TASK_1588: checkoutBlocked = step-3 checkout threw; no merge was attempted
+    // TASK_1591: also check missingTaskBranch (ansuz-wt-* branch naming) and gitResult.failure_reason (set by git-merge.js)
+    failure_reason: classifyMergeFailureReason(gitResult),
+    merge_failure_mode: gitResult?.blockedReason || (isRebaseConflict ? 'rebase_conflict' : (gitResult?.verify_merge_landed === false ? (gitResult?.verify_merge_landed_reason || 'verify_merge_landed') : 'git_merge_failed')),
+    conflict_files: gitResult?.conflictFiles || null,
+    verify_merge_landed: gitResult?.verify_merge_landed === true,
+    // TASK_1456: propagate verify_merge_landed_reason into vitals so task YAML records it
+    ...(gitResult?.verify_merge_landed_reason ? { verify_merge_landed_reason: gitResult.verify_merge_landed_reason } : {}),
+    task_branch: gitResult?.taskBranch || null,
+    // TASK_1525: preserve 'unknown' sentinel (attempted but failed) vs null (not attempted)
+    task_branch_commit: gitResult?.taskBranchCommit ?? null,
+    target_branch: gitResult?.verify_merge_target || gitResult?.userBranch || null,
+    // TASK_1525: preserve 'unknown' sentinel from verify_merge_landed
+    target_head: gitResult?.targetHead ?? null,
+    salvage_branch: gitResult?.salvageBranch || null,
+    stash_salvage_branch: gitResult?.stashSalvageBranch || null,
+    conflict_worktree_path: gitResult?.conflictWorktreePath || null,
+    // TASK_1957: verbatim git error text (working-tree collisions and other
+    // non-conflict merge failures were previously indistinguishable from a
+    // real content conflict once reduced to failure_reason='merge_conflict').
+    ...(gitResult?.mergeErrorText ? { git_error_text: gitResult.mergeErrorText } : {}),
+    // TASK_1456: include last-chance recovery orphan details for investigation
+    ...(isLastChanceOrphan ? {
+      last_chance_recovery_orphan: true,
+      last_chance_recovery_hash: gitResult?.lastChanceRecoveryHash || null,
+    } : {}),
+    // TASK_1525: propagate git ref capture failure notes so debugging is possible
+    ...(gitResult?.notes ? { notes: gitResult.notes } : {}),
+  };
+
+  const note = [
+    'post-complete merge failure: task moved to blocked',
+    vitals.target_branch ? `target=${vitals.target_branch}` : null,
+    vitals.task_branch_commit ? `task_commit=${vitals.task_branch_commit}` : null,
+    gitResult?.conflictSummary ? `summary=${gitResult.conflictSummary}` : null,
+    // TASK_1957: full verbatim git error text (do not truncate to conflictSummary's
+    // first line) — this is what turns "failure_reason=merge_conflict" into an
+    // actionable diagnosis instead of a re-run-it-yourself label.
+    gitResult?.mergeErrorText ? `git_error=${gitResult.mergeErrorText.replace(/\n/g, ' \\n ')}` : null,
+    gitResult?.verify_merge_landed === false ? `verify_merge_landed=${gitResult.verify_merge_landed_reason || 'false'}` : null,
+    gitResult?.salvageBranch ? `salvage_branch=${gitResult.salvageBranch}` : null,
+    gitResult?.conflictWorktreePath ? `worktree=${gitResult.conflictWorktreePath}` : null,
+  ].filter(Boolean).join(' | ');
+
+  const payload = { taskId, projectPath, vitals, note };
+
+  const script = `
+    const { TaskAPI } = require(${JSON.stringify(path.join(ROOT, '.collaboration', 'core', 'task-api.js'))});
+    (async () => {
+      const payload = JSON.parse(process.argv[1]);
+      const api = new TaskAPI(payload.projectPath ? { projectPath: payload.projectPath } : {});
+      const task = await api.getTask(payload.taskId);
+      if (!task) throw new Error('task not found');
+      const updatedTask = {
+        ...task,
+        status: 'blocked',
+        notes: [task.notes, payload.note].filter(Boolean).join('\\n'),
+        vitals: { ...(task.vitals || {}), ...(payload.vitals || {}) },
+      };
+      await api.moveTask(payload.taskId, 'blocked', updatedTask, { skipValidation: true });
+    })().catch((err) => {
+      console.error(err.message || String(err));
+      process.exit(1);
+    });
+  `;
+  const updateResult = spawnSync('node', ['-e', script, JSON.stringify(payload)], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: 15000,
+    windowsHide: true,
+  });
+
+  if (updateResult.status !== 0) {
+    const errMsg = (updateResult.stderr || updateResult.stdout || '').trim();
+    console.log(`   ⚠️  Failed to move ${taskId} to blocked/: ${errMsg.split('\n')[0] || 'unknown error'}`);
+    return false;
+  }
+
+  console.log(`   🚫 Task ${taskId} moved to blocked/ (failure_reason=${vitals.failure_reason})`);
+  return true;
+}
+
+// Write merge_landed=true/false to task YAML after completion so consumers can filter accurately.
+// Best-effort — never blocks post-complete.
+function annotateMergeLanded(taskId, projectPath, landed) {
+  if (!taskId) return;
+  try {
+    const updateArgs = projectPath ? ['--project-path', projectPath] : [];
+    updateArgs.push('update', taskId, `--merge-landed=${landed ? 'true' : 'false'}`);
+    spawnSync('node', [COLLABORATION_API, ...updateArgs], {
+      encoding: 'utf8', timeout: 10000, cwd: ROOT, windowsHide: true,
+    });
+  } catch { /* best-effort */ }
+}
+
+// Regression Guard constants moved to ./post-complete/testing.js
+
+/** Synchronous sleep using Atomics.wait (safe in Node.js main thread). */
+
+/**
+ * 快照 tasks/ 所有 YAML 狀態
+ * git checkout 到舊 branch 會還原已提交的 task 檔案位置，
+ * 快照讓我們在 git 操作後恢復正確狀態。
+ */
+function snapshotTaskFiles(tasksBase) {
+  const snapshot = {};
+  for (const dir of TASK_STATUS_DIRS) {
+    const full = path.join(tasksBase, dir);
+    if (!fs.existsSync(full)) continue;
+    snapshot[dir] = {};
+    for (const f of fs.readdirSync(full).filter(x => x.endsWith('.yaml'))) {
+      snapshot[dir][f] = fs.readFileSync(path.join(full, f), 'utf8');
+    }
+  }
+  return snapshot;
+}
+
+/**
+ * 從快照恢復 task 檔案狀態，修正 git checkout 造成的位移
+ */
+function restoreTaskFiles(snapshot, tasksBase) {
+  // Build lookup: fileName → correct dir
+  const correctLocation = {};
+  for (const [dir, files] of Object.entries(snapshot)) {
+    for (const f of Object.keys(files)) {
+      correctLocation[f] = dir;
+    }
+  }
+
+  for (const dir of TASK_STATUS_DIRS) {
+    const full = path.join(tasksBase, dir);
+    if (!fs.existsSync(full)) {
+      if (snapshot[dir] && Object.keys(snapshot[dir]).length > 0) {
+        fs.mkdirSync(full, { recursive: true });
+      } else {
+        continue;
+      }
+    }
+
+    // Remove files that git checkout restored into the wrong dir
+    for (const f of fs.readdirSync(full).filter(x => x.endsWith('.yaml'))) {
+      if (correctLocation[f] === dir) continue; // correct location
+      if (correctLocation[f]) {
+        // File belongs in a different dir — remove from here
+        try { fs.unlinkSync(path.join(full, f)); } catch {}
+      }
+      // Files not in snapshot (newly created by another agent) — leave them
+    }
+
+    // Restore files that should be in this dir
+    if (snapshot[dir]) {
+      for (const [f, content] of Object.entries(snapshot[dir])) {
+        const filePath = path.join(full, f);
+        if (!fs.existsSync(filePath)) {
+          fs.writeFileSync(filePath, content, 'utf8');
+        }
+      }
+    }
+  }
+
+  // Dedup pass: if a TASK_ID appears in multiple dirs (e.g., git merge restored
+  // a file that was created by a parallel agent AFTER the snapshot), keep only
+  // the copy in the most-progressed status dir.
+  const STATUS_PRIORITY = { cancel: 0, blocked: 1, backlog: 2, active: 3, done: 4, archived: 5 };
+  const taskLocations = {}; // taskId → [{ dir, fileName, priority }]
+  for (const dir of TASK_STATUS_DIRS) {
+    const full = path.join(tasksBase, dir);
+    if (!fs.existsSync(full)) continue;
+    for (const f of fs.readdirSync(full).filter(x => x.endsWith('.yaml'))) {
+      const match = f.match(/^(TASK_\d+)/);
+      if (!match) continue;
+      const taskId = match[1];
+      if (!taskLocations[taskId]) taskLocations[taskId] = [];
+      taskLocations[taskId].push({ dir, fileName: f, priority: STATUS_PRIORITY[dir] ?? -1 });
+    }
+  }
+  for (const [, locations] of Object.entries(taskLocations)) {
+    if (locations.length <= 1) continue;
+    // Keep the highest-priority (most progressed) copy
+    locations.sort((a, b) => b.priority - a.priority);
+    const keep = locations[0];
+    for (let i = 1; i < locations.length; i++) {
+      const dup = locations[i];
+      try {
+        fs.unlinkSync(path.join(tasksBase, dup.dir, dup.fileName));
+        console.log(`   🧹 Dedup: removed ${dup.dir}/${dup.fileName} (kept in ${keep.dir}/)`);
+      } catch {}
+    }
+  }
+}
+
+// ─────────────────────────────────────────
+// Git：建立分支、commit、merge 到用戶分支
+// ─────────────────────────────────────────
+
+/**
+ * 收集所有 pending 任務（backlog/ active/ blocked/）的依賴 ID
+ * 回傳一個 Set，包含仍被其他任務依賴的 task ID
+ * @param {string} tasksBase - 任務根目錄（如 .collaboration/tasks/ 或 .kenaz/tasks/）
+ * @returns {Set<string>} 被依賴的 task ID 集合
+ */
+function getDependedIds(tasksBase) {
+  const depended = new Set();
+  const pendingDirs = ['backlog', 'active', 'blocked', 'todo'];
+  for (const dir of pendingDirs) {
+    const dirPath = path.join(tasksBase, dir);
+    if (!fs.existsSync(dirPath)) continue;
+    const files = fs.readdirSync(dirPath).filter(f => f.endsWith('.yaml') || f.endsWith('.yml'));
+    for (const file of files) {
+      try {
+        const content = fs.readFileSync(path.join(dirPath, file), 'utf8');
+        // 簡易 YAML 解析 dependencies 陣列，避免引入 yaml lib 依賴
+        const match = content.match(/^dependencies:\s*\n((?:\s+-\s+.+\n?)*)/m);
+        if (match) {
+          const deps = match[1].split('\n')
+            .map(line => line.match(/^\s+-\s+"?(TASK_\d+)"?\s*$/))
+            .filter(Boolean)
+            .map(m => m[1]);
+          for (const dep of deps) depended.add(dep);
+        }
+      } catch { /* skip unreadable files */ }
+    }
+  }
+  return depended;
+}
+// SECTION: TESTING (extracted to ./post-complete/testing.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  initTesting,
+  detectAllTestCommands,
+  runRegressionTests,
+  hasOpenRegressionFixTask,
+  createRegressionFixTask,
+} = require('./post-complete/testing');
+initTesting({ stripAnsi, sleepSync });
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: STAGING_AND_COVERAGE (extracted to ./post-complete/staging.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  initStaging,
+  setConfig: setStagingConfig,
+  gitAddSafe,
+  verifyStagedScopeCoverage,
+  archiveDir,
+  archiveCheck,
+} = require('./post-complete/staging');
+initStaging({ git, resolveTasksBase, getDependedIds });
+setStagingConfig(CONFIG);
+// ?????????????????????????????????????????????????????????????????????????????
+
+// ─────────────────────────────────────────
+// Task File Protection（防止 git 操作破壞 task 狀態）
+// ─────────────────────────────────────────
+
+const TASK_STATUS_DIRS = ['backlog', 'todo', 'active', 'done', 'blocked'];
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: HEALTH_AND_GUARDIAN (extracted to ./post-complete/health.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  resolveMcpProjectPath,
+  readLoopConfig,
+  measureHealthScoreSync,
+  readPreTaskHealthSnapshot,
+  saveTaskHealthSnapshot,
+  computeHealthVerdict,
+  writeVerdictToTask,
+  readGuardianCounter,
+  writeGuardianCounter,
+  triggerGuardianHealthCheck,
+  HEALTH_SNAPSHOTS_DIR_NAME,
+} = require('./post-complete/health');
+
+// TASK_1885: deliberately NOT the same knob as loopCfg.revert_threshold (DEFAULT_REVERT_THRESHOLD
+// in health.js). This is a fixed calibration point for the Design Reasoning Attribution valence
+// classifier (feeds skill matrix / EFE learning signals) -- it answers "was this outcome bad
+// enough to learn from as a negative example", not "should Guardian auto-revert this commit".
+// revert_threshold is a user-tunable Dashboard Loop Control setting; wiring the attribution
+// classifier to it would mean a user loosening the auto-revert threshold (e.g. to -5, "only
+// revert on big regressions") would silently also start labeling -3/-4 outcomes as "neutral"
+// in the long-term learning data, corrupting historical comparability of skill/EFE signals for
+// a reason unrelated to learning. The two concerns share a numeric coincidence (-2) today, not
+// a shared meaning -- kept as a separate named constant so the coincidence doesn't calcify into
+// an accidental coupling next time DEFAULT_REVERT_THRESHOLD changes.
+const ATTRIBUTION_NEGATIVE_VALENCE_THRESHOLD = -2;
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: COGNITIVE (extracted to ./post-complete/cognitive.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  initCognitive,
+  parseCognitiveCheckpoint,
+  detectCognitiveCheckpoint,
+  collectThinkingTags,
+  triggerPassiveRuneExtraction,
+  callHippocampusMcpSync,
+} = require('./post-complete/cognitive');
+initCognitive({ findLogForTask, getPostCompleteChangedFiles, rankTouchedFiles, stripCJK });
+
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: OUTCOME_AND_SKILL_MATRIX (extracted to ./post-complete/outcome.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  initOutcome,
+  recordOutcome,
+  compareOutcomePrediction,
+  updateCompetenceMap,
+  classifySkillKey,
+  inferSkillKey,
+  updateSkillMatrix,
+  accumulateValence,
+} = require('./post-complete/outcome');
+initOutcome({ resolveProjectRoot, resolveTasksBase, loadTaskScopePaths, getPostCompleteChangedFiles, callHippocampusMcpSync });
+
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: INTEGRATION_GAPS (extracted to ./post-complete/integration-gaps.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const { detectIntegrationGaps } = require('./post-complete/integration-gaps');
+
+// ─────────────────────────────────────────
+// Outcome Recording + Surprise Detection (TASK_931)
+// ─────────────────────────────────────────
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: GIT_MERGE
+// ?????????????????????????????????????????????????????????????????????????????
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: GIT_MERGE (extracted to ./post-complete/git-merge.js)
+// ?????????????????????????????????????????????????????????????????????????????
+const {
+  initGitMerge,
+  setTaskStatusDirs: setGitMergeTaskStatusDirs,
+  gitBranchAndMerge,
+  _gitMergeFromWorktree,
+} = require('./post-complete/git-merge');
+initGitMerge({
+  resolveProjectRoot, resolveTasksBase, resolveTasksRelative,
+  getCurrentBranch, getDispatchBranch, resolveUserBranch,
+  hasInitialCommit, hasChanges, getUnmergedPaths, branchExists, getBaseBranch,
+  git: gitPreservingUntracked, gitAddSafe, verifyStagedScopeCoverage,
+  loadTaskScopePaths, isMemoryOnlyTask, isRuntimeOnlySmokeTask,
+  writeConflictNotesToTask, blockTaskForMergeFailure,
+  snapshotTaskFiles, restoreTaskFiles,
+  verify_merge_landed, ensureSalvageBranch,
+  getDaemonPathsToUnstage, sleepSync,
+  acquireGitLock, releaseGitLock, acquireMergeLock, releaseMergeLock,
+  decrementParallelSemaphore, cleanupWorktree,
+  runRegressionTests, createRegressionFixTask, hasOpenRegressionFixTask,
+  isVerifiedMergeSuccess, listDaemonManagedPaths, detectIntegrationGaps,
+  // Stash leak → salvage branch (post-complete-stash-accumulation-bug, 2026-05-05)
+  salvageStashAsBranch,
+});
+setGitMergeTaskStatusDirs(TASK_STATUS_DIRS);
+// ?????????????????????????????????????????????????????????????????????????????
+
+
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: ORCHESTRATOR
+// ?????????????????????????????????????????????????????????????????????????????
+function postComplete(opts = {}) {
+  const {
+    taskId,
+    keep = CONFIG.DEFAULT_KEEP,
+    skipArchive = false,
+    skipGit = false,
+    skipTests = false,
+    dryRun = false,
+    message,
+    projectPath,
+    testCommands = [],
+    logPath,
+    formation,
+    skill,
+    worktreePath = process.env.FORMATION_WORKTREE_PATH || null,
+  } = opts;
+
+  // B11: opportunistic GC of orphan worktrees from prior failed dispatches
+  gcStaleWorktrees(taskId, projectPath);
+
+  // TASK_1593: guardFile hoisted so updatePostCompleteGuardOutcome can record
+  // outcome on the same entry before postComplete returns.
+  const guardRoot = projectPath || ROOT;
+  const guardFile = path.join(guardRoot, '.kenaz', 'logs', 'post-complete-guard.json');
+  {
+    const skipResult = checkAndUpdatePostCompleteGuard(guardFile, taskId, worktreePath);
+    if (skipResult) return skipResult;
+  }
+
+  console.log(`\n⚔️  Post-Complete: ${taskId || '(no task)'}`);
+  console.log(`   Keep: ${keep} | Archive: ${!skipArchive} | Git: ${!skipGit} | Tests: ${!skipTests} | DryRun: ${dryRun}`);
+  if (projectPath) console.log(`   Project: ${projectPath}`);
+  console.log(`   WorktreePath: ${worktreePath || '(null — serial mode)'}`);
+  // Debug: write to persistent log
+  try {
+    const debugLog = path.join(projectPath || ROOT, '.kenaz', 'logs', 'post-complete-debug.log');
+    fs.appendFileSync(debugLog, `[${new Date().toISOString()}] postComplete: taskId=${taskId} worktreePath=${worktreePath || 'null'} projectPath=${projectPath || 'null'}\n`);
+  } catch {}
+  console.log('');
+
+  const result = { archive: null, git: null };
+
+  // Step 0: Hippocampus Episode Start (episodic memory — TASK_716)
+  // TASK_963: Resolve touched file_paths so Rust can create TOUCHES edges to Symbols
+  let hippocampusEpisodeId = null;
+  if (taskId && !dryRun) {
+    try {
+      // Collect file_paths from worktree git diff or task scope_paths
+      let filePaths = [];
+      const diffRoot = worktreePath || resolveProjectRoot(projectPath);
+      if (diffRoot) {
+        try {
+          const diffCmd = worktreePath
+            ? 'git diff --name-only main...HEAD'
+            : 'git diff --name-only HEAD~1 HEAD';
+          const diffOut = spawnSync('git', diffCmd.split(' ').slice(1), {
+            cwd: diffRoot, encoding: 'utf8', timeout: 8000, windowsHide: true,
+          });
+          if (diffOut.status === 0 && diffOut.stdout) {
+            filePaths = diffOut.stdout.trim().split('\n').filter(Boolean);
+          }
+        } catch { /* git diff failed — fall through to scope_paths */ }
+      }
+      if (filePaths.length === 0) {
+        filePaths = loadTaskScopePaths(taskId, projectPath);
+      }
+
+      const epArgs = {
+        task_id: taskId,
+        scope: `post-complete:${taskId}`,
+        agent_role: formation || 'unit',
+        agent_skill: skill || 'do',
+        ...(filePaths.length > 0 ? { file_paths: filePaths } : {}),
+        // TASK_2025: hippocampus_episode_start is now a write tool that requires
+        // an explicit projectPath (mcp.rs resolve_project_for_write) -- it no
+        // longer silently falls back to the Dashboard's currently-selected
+        // project. projectPath is only set here when --project-path was passed
+        // (sub-project dispatch); core-project dispatches never pass it, so
+        // fall back to ROOT (this script's own core project root) rather than
+        // omitting the param and hard-failing every core-project run.
+        projectPath: projectPath || ROOT,
+      };
+      const epResult = callHippocampusMcpSync('hippocampus_episode_start', epArgs);
+      if (epResult && epResult.episode_id) {
+        hippocampusEpisodeId = epResult.episode_id;
+        console.log(`   🧠 Hippocampus: episode ${hippocampusEpisodeId} started (${filePaths.length} file_paths)`);
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Hippocampus episode start skipped: ${e.message}`);
+    }
+  }
+
+  // Step 1: Archive
+  if (!skipArchive) {
+    console.log('── Archive Check ──');
+    const archiveResult = archiveCheck({ keep, dryRun, projectPath });
+    result.archive = archiveResult;
+
+    // 新系統（或子專案的 .kenaz/tasks/）
+    const c = archiveResult.collab;
+    if (c.archived.length > 0) {
+      console.log(`   📦 Archived ${c.archived.length} tasks (${c.total} → ${c.kept.length}):`);
+      for (const f of c.archived) console.log(`      → ${f}`);
+    } else {
+      console.log(`   ✅ done: ${c.total}/${keep} — no archive needed`);
+    }
+    if (c.skippedDeps && c.skippedDeps.length > 0) {
+      console.log(`   🔗 Skipped ${c.skippedDeps.length} depended task(s):`);
+      for (const f of c.skippedDeps) console.log(`      ⏭ ${f}`);
+    }
+
+    // 舊系統（只在 core）
+    if (!projectPath) {
+      const l = archiveResult.legacy;
+      if (l.archived.length > 0) {
+        console.log(`   📦 [legacy] Archived ${l.archived.length} tasks (${l.total} → ${l.kept.length}):`);
+        for (const f of l.archived) console.log(`      → ${f}`);
+      } else {
+        console.log(`   ✅ [legacy] completed: ${l.total}/${keep} — no archive needed`);
+      }
+      if (l.skippedDeps && l.skippedDeps.length > 0) {
+        console.log(`   🔗 [legacy] Skipped ${l.skippedDeps.length} depended task(s)`);
+      }
+    }
+    console.log('');
+  }
+
+  // Step 1.5 (Runtime Acceptance Verification, TASK_1482) removed by TASK_1825
+  // — see comment at the top-of-file require block for the measurement.
+
+  // Step 1.9: Pre-capture git commit snapshot for the guard failure detector (TASK_1896)
+  // Step 4.6 below (git_commit_pattern detector) needs commits on `task/<taskId>`,
+  // but Step 2's merge just below is a read-after-mutation hazard for it: the
+  // worktree-mode merge rebases task/<taskId> onto main before merging, which
+  // makes `git log <branch> --not main` (what the live detector queries) come
+  // back EMPTY once Step 2 has run — the branch itself is NOT deleted; the
+  // rebase's `git branch -D` + immediate `checkout -b` at git-merge.js ~849/852
+  // is stale-branch cleanup from a PRIOR attempt, followed by recreating the
+  // branch fresh, and is unrelated to this. Confirmed by direct execution
+  // (TASK_1896 verification): after a successful worktree merge the branch
+  // still exists but has zero commits ahead of main, so Step 4.6 (which runs
+  // after Step 2, in the same postComplete() call) saw `no_commits_on_branch`
+  // for real completed tasks. This fix captures the commit data here, before
+  // Step 2 can rebase it away, so Step 4.6 evaluates the real pre-merge commits
+  // instead. (A separate, still-open question: most of guard_detector_shadow.jsonl's
+  // historical entries are `branch_not_found`, not `no_commits_on_branch` — that
+  // reason means the branch didn't exist at query time at all, which this fix
+  // does not explain or address. The likely cause is that those tasks never
+  // went through this git path in the first place, so task/<taskId> was never
+  // created — unverified; needs checking against those specific task IDs before
+  // claiming this fix resolves them.) This does NOT change branch -D's own
+  // behavior or timing — it only reads (rev-parse, log). Lifetime: this single
+  // postComplete() call only — held on `result`, never persisted to disk, never
+  // reused across invocations, so there is no cache-staleness surface to manage.
+  // Only runs on the path that can actually rebase the branch (!skipGit &&
+  // taskId); on --skip-git, Step 2 never runs and detectGitCommitPattern's own
+  // live-query fallback already sees the branch untouched, so no snapshot is
+  // needed there.
+  if (taskId && !skipGit && !dryRun) {
+    try {
+      const detectorMod = require(path.join(ROOT, '.specialist', 'tools', 'failure-detector.js'));
+      result.gitCommitSnapshot = { taskId, ...detectorMod.captureGitCommitSnapshot(taskId) };
+    } catch (e) {
+      console.log(`   [warn] Git commit snapshot capture skipped: ${e.message}`);
+    }
+  }
+
+  // Step 2: Git
+  if (!skipGit && taskId) {
+    console.log('── Git Branch & Merge ──');
+    if (worktreePath) console.log(`   Worktree mode: ${worktreePath}`);
+    // TASK_1536 Part A: wrap gitBranchAndMerge in try/catch so git exceptions
+    // (e.g. gitlink checkout failure, lock contention, unexpected git error) do NOT
+    // propagate out of post-complete entirely — which was bypassing the
+    // blockTaskForMergeFailure call and leaving a self-completed task in done/ with
+    // no code landed. Catching here ensures the reconciliation gate below always runs.
+    let gitResult;
+    try {
+      // TASK_1759 (Multi-Ansuz M2): opt-in integration queue (bors-lite).
+      // KENAZ_INTEGRATION_QUEUE=1 delegates the merge step to integration.js:
+      // in-lock rebase + re-verify + ff-only merge + task YAML active->done.
+      // No `git add -A` sweep and no autostash on this path (only the task
+      // branch commits + the YAML move enter main).
+      // Flag absent (default) => legacy gitBranchAndMerge path, byte-identical
+      // to previous behavior — rollback is trivial. Dry runs stay on legacy.
+      if (process.env.KENAZ_INTEGRATION_QUEUE === '1' && !dryRun) {
+        gitResult = require('./integration.js').integrateForPostComplete({ taskId, projectPath, message });
+      } else {
+        gitResult = gitBranchAndMerge({ taskId, message, dryRun, projectPath, skipTests, testCommands, worktreePath });
+      }
+    } catch (gitException) {
+      const exMsg = (gitException.message || String(gitException)).split('\n')[0];
+      console.log(`   ❌ gitBranchAndMerge threw: ${exMsg}`);
+      gitResult = {
+        taskBranch: taskId ? `task/${taskId.toLowerCase()}` : null,
+        userBranch: null,
+        originalBranch: null,
+        committed: true,
+        merged: false,
+        verify_merge_landed: false,
+        failure_reason: 'git_exception',
+        gitException: exMsg,
+      };
+    }
+    result.git = gitResult;
+    const mergeSucceeded = isVerifiedMergeSuccess(gitResult);
+    console.log('');
+
+    // Step 2.5: Yggdrasil commit-sync（fire-and-forget）
+    if (gitResult.committed && !dryRun) {
+      try {
+        const { syncLatestCommit } = require('./commit-sync');
+        syncLatestCommit({ taskId, projectPath }).catch(() => {});
+      } catch { /* commit-sync not available — graceful degradation */ }
+    }
+
+    // Step 2.6: Passive Rune Extraction（fire-and-forget）
+    if (gitResult.committed && !dryRun) {
+      try {
+        const commitMsg = message || `[${taskId}] task completed`;
+        const projectRoot = resolveProjectRoot(projectPath);
+        if (projectRoot) {
+          triggerPassiveRuneExtraction(commitMsg, projectRoot, projectPath);
+        }
+      } catch { /* rune extraction failed — never block post-complete */ }
+    }
+
+    // Step 2.7: Outcome Recording + Surprise Detection（fire-and-forget）
+    if (!dryRun) {
+      try {
+        recordOutcome(taskId, projectPath, gitResult);
+      } catch { /* outcome recording failed — never block post-complete */ }
+    }
+
+    // Step 2.7b: Phase 9 outcome log — record structured verdict
+    // (TASK_1732) Subagent-path dispatches write no dispatch_*.log, so phase9_verify_fail_rate
+    // lost its data source after 2026-06-09 routing change. This JSONL write is the replacement:
+    // { task_id, verify_merge_landed: bool, ts } appended to .kenaz/specialist/phase9_dispatch_outcomes.jsonl
+    if (!dryRun && taskId) {
+      try {
+        appendPhase9OutcomeLog(taskId, mergeSucceeded, projectPath);
+      } catch { /* never block post-complete */ }
+    }
+
+    // Step 2.8: Skill Matrix Update (TASK_986)
+    if (!dryRun) {
+      try {
+        const success = gitResult ? mergeSucceeded : true;
+        const fixCycles = gitResult?.acceptanceFixTasks?.length || 0;
+
+        // Pull file prediction accuracy from ansuz_accuracy.json if available
+        let filePredAcc = null;
+        try {
+          const root = projectPath || ROOT;
+          const accFile = path.join(root, '.kenaz', 'specialist', 'ansuz_accuracy.json');
+          if (fs.existsSync(accFile)) {
+            const accData = JSON.parse(fs.readFileSync(accFile, 'utf8'));
+            if (Array.isArray(accData.comparison_history)) {
+              const match = accData.comparison_history.find(h => h.task_id === taskId);
+              if (match) filePredAcc = match.file_jaccard;
+            }
+          }
+        } catch { /* accuracy data not available */ }
+
+        updateSkillMatrix({ taskId, projectPath, success, fixCycles, filePredictionAccuracy: filePredAcc });
+      } catch (e) { console.log(`   ⚠️  Skill matrix update failed: ${e.message}`); }
+    }
+
+    // Step 2.9 (cognitive attribution via /api/synapse/link-cognitive) removed in TASK_2341: route deleted with the graph.
+  }
+
+  // Step 2.5: Complete task if git merge succeeded (AC is signal, not gate)
+  // Previously, AC failure prevented task completion even when code was already
+  // committed and merged into the user branch. This caused tasks to pile up in
+  // active/ on the Mission Board. Now: git merge success = task complete.
+  // AC failures are recorded in task metadata for visibility.
+  if (taskId && !dryRun && result.git && isVerifiedMergeSuccess(result.git)) {
+    // Record AC failures in task metadata if any.
+    // TASK_1825: the note starts with the canonical token ACCEPTANCE_FAILED so
+    // "cards that failed acceptance but still went to done/" is one query away:
+    //   grep -rln "ACCEPTANCE_FAILED" .kenaz/tasks/
+    // For fix-tagged cards (verify-acceptance loop guard: no FIX card is created)
+    // this note is the failure's ONLY home besides the .formation/reports/verify/
+    // report — the fix disposition line makes that explicit.
+    // Written here (after merge) rather than inside verify-acceptance, because a
+    // task-api update mid-merge would dirty the working tree between commit and
+    // checkout (the exact failure TASK_1588 fixed for hooks). Notes only — never
+    // move card status here; TASK_1536 reconciliation owns status moves.
+    const acFailures = result.git?.acceptance?.results?.filter(r => !r.pass) || [];
+    if (acFailures.length > 0) {
+      try {
+        const failureNotes = acFailures.map(f => `❌ ${f.criterion}: ${f.reason || 'failed'}`).join('\n');
+        const ac = result.git.acceptance || {};
+        const fixDisposition = ac.fixSkipped
+          ? `fix_disposition: NO_FIX_CARD (${ac.fixSkipReason || 'fix-tag loop guard'})`
+          : (result.git.acceptanceFixTasks && result.git.acceptanceFixTasks.length > 0
+            ? `fix_disposition: FIX_CARDS ${result.git.acceptanceFixTasks.join(',')}`
+            : 'fix_disposition: NO_FIX_CARD (creation failed or no failed criteria)');
+        const updateArgs = projectPath ? ['--project-path', projectPath] : [];
+        updateArgs.push('update', taskId,
+          '--notes', `ACCEPTANCE_FAILED (signal — code merged, task completed)\n${fixDisposition}\n${failureNotes}`);
+        spawnSync('node', [COLLABORATION_API, ...updateArgs], {
+          encoding: 'utf8', timeout: 15000, cwd: ROOT, windowsHide: true
+        });
+        console.log(`   📝 Recorded ${acFailures.length} AC failure(s) in task metadata (ACCEPTANCE_FAILED marker)`);
+      } catch (e) {
+        console.log(`   ⚠️  Failed to record AC failures: ${e.message}`);
+      }
+    }
+
+    // Complete the task (move to done/)
+    // TASK_1622 ROOT CAUSE: --skip-post-complete is mandatory here. Without it the
+    // nested task-api complete re-enters the FULL postComplete pipeline, whose
+    // second gitBranchAndMerge gets killed mid-flight by this spawnSync's 15s
+    // timeout — leaving HEAD stranded on task/task_XXXX with an orphan transcript
+    // commit (observed on TASK_1620/1621/1622; reflog: checkout→commit→killed).
+    try {
+      const completeArgs = projectPath ? ['--project-path', projectPath] : [];
+      completeArgs.push('complete', taskId, '--skip-post-complete');
+      const completeResult = spawnSync('node', [COLLABORATION_API, ...completeArgs], {
+        encoding: 'utf8', timeout: 15000, cwd: ROOT, windowsHide: true
+      });
+      if (completeResult.status === 0) {
+        result.taskCompleted = true;
+        console.log(`   ✅ Task ${taskId} marked as done (code merged → complete)`);
+      } else {
+        const errMsg = (completeResult.stderr || completeResult.stdout || '').trim();
+        // Task may already be in done/ (idempotent)
+        if (errMsg.includes('already') || errMsg.includes('done')) {
+          result.taskCompleted = true;
+          console.log(`   ✅ Task ${taskId} already in done/`);
+        } else {
+          console.log(`   ⚠️  Failed to complete task: ${errMsg.split('\n')[0]}`);
+        }
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Task complete error: ${e.message}`);
+    }
+  } else if (taskId && !dryRun && result.git && result.git.noChanges) {
+    // No git changes to merge — either a memory-only task (git changes were
+    // never expected) or, since TASK_2029's scope-aware hasChanges gate, a
+    // task whose declared scope_paths had zero changes on disk. Either way
+    // there is nothing to merge and nothing to block on. Before this fix,
+    // the non-memory-only case fell through every branch here and the card
+    // stayed stuck in active/ forever (it neither completed nor blocked).
+    const noChangeReason = result.git.gitSkipped ? `Git step skipped (${result.git.gitSkipReason})` : (result.git.memoryOnly ? 'Memory-only task' : `No changes within ${taskId}'s declared scope`);
+    console.log(`   🧠 ${noChangeReason} — completing ${taskId} without git merge`);
+    try {
+      const completeArgs = projectPath ? ['--project-path', projectPath] : [];
+      // TASK_1622: prevent nested postComplete re-entry (see merge-success path above)
+      completeArgs.push('complete', taskId, '--skip-post-complete');
+      const completeResult = spawnSync('node', [COLLABORATION_API, ...completeArgs], {
+        encoding: 'utf8', timeout: 15000, cwd: ROOT, windowsHide: true
+      });
+      if (completeResult.status === 0) {
+        result.taskCompleted = true;
+        console.log(`   ✅ Task ${taskId} marked as done (no changes → complete)`);
+      } else {
+        const errMsg = (completeResult.stderr || completeResult.stdout || '').trim();
+        if (errMsg.includes('already') || errMsg.includes('done')) {
+          result.taskCompleted = true;
+          console.log(`   ✅ Task ${taskId} already in done/`);
+        } else {
+          console.log(`   ⚠️  Failed to complete task: ${errMsg.split('\n')[0]}`);
+        }
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Task complete error: ${e.message}`);
+    }
+  } else if (taskId && result.git && !isVerifiedMergeSuccess(result.git) && !result.git.noGitRepo && !result.git.noChanges) {
+    result.taskBlocked = blockTaskForMergeFailure(taskId, projectPath, result.git);
+    if (result.taskBlocked) {
+      console.log(`   ⚠️  Git merge failed — task ${taskId} moved to blocked/`);
+    }
+    if (!result.taskBlocked) {
+      console.log(`   ⚠️  Git merge failed — task ${taskId} could not be moved to blocked/`);
+    }
+  }
+
+  // TASK_1536 Part A: Reconciliation gate.
+  // A worktree-dispatched agent may have self-completed via `task-api complete`
+  // (moving the task to done/) BEFORE post-complete's merge runs. If the merge
+  // then did NOT land (merged=false / verify_merge_landed!=true / exception), the
+  // task is now falsely in done/ with no code on the user branch.
+  //
+  // This gate catches that scenario regardless of how the merge failure was reported:
+  //   (a) gitBranchAndMerge returned merged:false — blockTaskForMergeFailure above
+  //       moved active→blocked but the task was already in done/ so nothing happened
+  //   (b) gitBranchAndMerge threw — caught above as git_exception result
+  //
+  // Action: when the merge did not land AND the task is currently in done/ (agent
+  // self-completed), force-move it done→blocked with an explicit failure_reason and
+  // vitals so the false-positive is visible and actionable.
+  //
+  // We bypass the normal done→blocked state-machine guard via the inline task-api
+  // script (same pattern as blockTaskForMergeFailure) rather than the CLI path
+  // which honours transition guards and would refuse the done→blocked move.
+  if (!dryRun && taskId && result.git && !isVerifiedMergeSuccess(result.git) && !result.git.noGitRepo && !result.git.gitSkipped) {
+    try {
+      // Check whether the task is currently in done/ (agent self-completed)
+      const reconcileScript = `
+        const { TaskAPI } = require(${JSON.stringify(path.join(ROOT, '.collaboration', 'core', 'task-api.js'))});
+        (async () => {
+          const payload = JSON.parse(process.argv[1]);
+          const api = new TaskAPI(payload.projectPath ? { projectPath: payload.projectPath } : {});
+          const task = await api.getTask(payload.taskId);
+          if (!task) { process.exit(0); } // task not found — nothing to reconcile
+          if (task.status !== 'completed' && task._status_dir !== 'done') {
+            // task is not in done/ — already blocked or active, no reconciliation needed
+            process.exit(0);
+          }
+          // Task IS in done/ but merge did not land — move done→blocked
+          const vitals = payload.vitals;
+          const updatedTask = {
+            ...task,
+            status: 'blocked',
+            notes: [task.notes, payload.note].filter(Boolean).join('\\n'),
+            vitals: { ...(task.vitals || {}), ...vitals },
+          };
+          await api.moveTask(payload.taskId, 'blocked', updatedTask, { skipValidation: true });
+          console.log('[reconcile] moved done → blocked: ' + payload.taskId);
+        })().catch((err) => {
+          console.error(err.message || String(err));
+          process.exit(1);
+        });
+      `;
+      const gitResult = result.git;
+      const reconcileVitals = {
+        // TASK_1588: checkoutBlocked = step-3 checkout threw; no merge ran
+        // TASK_1591: missingTaskBranch (ansuz-wt-* naming) gets distinct label, not merge_conflict
+        failure_reason: gitResult.failure_reason || (gitResult.gitException ? 'git_exception' : (classifyMergeFailureReason(gitResult) === 'git_step_failed' ? 'merge_not_landed' : classifyMergeFailureReason(gitResult))),
+        verify_merge_landed: false,
+        merge_failure_mode: gitResult.blockedReason || gitResult.verify_merge_landed_reason || gitResult.failure_reason || 'unknown',
+        task_branch: gitResult.taskBranch || null,
+        task_branch_commit: gitResult.taskBranchCommit || null,
+        target_branch: gitResult.userBranch || null,
+        salvage_branch: gitResult.salvageBranch || gitResult.outOfScopeSalvageBranch || null,
+        out_of_scope_salvage_branch: gitResult.outOfScopeSalvageBranch || null,
+        git_exception: gitResult.gitException || null,
+      };
+      const reconcileNote = [
+        '[TASK_1536] post-complete reconciliation: agent self-completed but merge did not land',
+        `failure_reason=${reconcileVitals.failure_reason}`,
+        gitResult.taskBranch ? `task_branch=${gitResult.taskBranch}` : null,
+        gitResult.salvageBranch ? `salvage_branch=${gitResult.salvageBranch}` : null,
+        gitResult.gitException ? `git_exception=${gitResult.gitException}` : null,
+      ].filter(Boolean).join(' | ');
+      const reconcilePayload = { taskId, projectPath, vitals: reconcileVitals, note: reconcileNote };
+      const reconcileResult = spawnSync('node', ['-e', reconcileScript, JSON.stringify(reconcilePayload)], {
+        cwd: ROOT,
+        encoding: 'utf8',
+        timeout: 15000,
+        windowsHide: true,
+      });
+      if (reconcileResult.status === 0 && (reconcileResult.stdout || '').includes('[reconcile] moved done → blocked')) {
+        result.reconciliationApplied = true;
+        console.log(`   🚨 [TASK_1536] Reconciliation: task ${taskId} was in done/ but merge did not land — moved to blocked/ (failure_reason=${reconcileVitals.failure_reason})`);
+      } else if (reconcileResult.status === 0) {
+        // task was not in done/ — already blocked or active, nothing to reconcile
+        console.log(`   ✅ [TASK_1536] Reconciliation check: task ${taskId} not in done/ — no reconciliation needed`);
+      } else {
+        const errMsg = (reconcileResult.stderr || reconcileResult.stdout || '').trim();
+        console.log(`   ⚠️  [TASK_1536] Reconciliation failed: ${errMsg.split('\n')[0] || 'unknown error'}`);
+      }
+    } catch (reconcileErr) {
+      console.log(`   ⚠️  [TASK_1536] Reconciliation error (non-fatal): ${(reconcileErr.message || '').split('\n')[0]}`);
+    }
+  }
+
+  // Safety net: if merge succeeded but complete failed (e.g. state-machine rejection),
+  // fall back to move --force so the task never stalls in active/ after a successful merge.
+  //
+  // INVARIANT (TASK_1825 road sign — behavior intentionally unchanged): the only
+  // condition is isVerifiedMergeSuccess && !taskCompleted. It does NOT require that
+  // complete() was ever attempted. Therefore any future gate that tries to hold a
+  // card out of done/ by simply not setting result.taskCompleted (e.g. on acceptance
+  // failure) will be silently bypassed here — the card gets force-moved to done/
+  // anyway. If you ever need a gate that survives this safety net, it must set an
+  // explicit result flag that this condition checks, not just withhold taskCompleted.
+  if (taskId && !dryRun && result.git && isVerifiedMergeSuccess(result.git) && !result.taskCompleted) {
+    console.log(`   🔁 Safety net: forcefully completing ${taskId} (merge succeeded, complete failed)`);
+    try {
+      const moveArgs = projectPath ? ['--project-path', projectPath] : [];
+      moveArgs.push('move', taskId, 'done', '--force');
+      const moveResult = spawnSync('node', [COLLABORATION_API, ...moveArgs], {
+        encoding: 'utf8', timeout: 15000, cwd: ROOT, windowsHide: true
+      });
+      if (moveResult.status === 0) {
+        result.taskCompleted = true;
+        console.log(`   ✅ Task ${taskId} force-moved to done/ (safety net)`);
+      } else {
+        const errMsg = (moveResult.stderr || moveResult.stdout || '').trim();
+        if (errMsg.includes('already') || errMsg.includes('done')) {
+          result.taskCompleted = true;
+          console.log(`   ✅ Task ${taskId} already in done/`);
+        } else {
+          console.log(`   ⚠️  Safety net move failed: ${errMsg.split('\n')[0]}`);
+        }
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Safety net error: ${e.message}`);
+    }
+  }
+
+  // Annotate merge_landed=true so task-api list can filter accurately.
+  // Runs after all completion paths so result.taskCompleted is final.
+  if (result.taskCompleted && taskId && !dryRun) {
+    annotateMergeLanded(taskId, projectPath, true);
+  }
+
+  // Step 2.4: Forseti Level 0 — Structural integrity checks (auto, no spec needed)
+  // Catches: MCP wiring gaps, destructive diffs, build artifact pollution.
+  // Runs after merge+complete so it checks the actual merged state, not the worktree.
+  if (result.taskCompleted && taskId && !dryRun) {
+    try {
+      const { runLevel0 } = require('./forseti-verify');
+      const projectRoot = resolveProjectRoot(projectPath);
+      if (projectRoot) {
+        console.log('── Forseti Level 0 ──');
+        const l0 = runLevel0(taskId, projectRoot, projectPath);
+        result.forsetiL0 = l0;
+        if (l0.status === 'FAIL') {
+          console.log(`   ⚠️  Forseti L0: ${l0.failures.length} structural issue(s) detected`);
+          for (const f of l0.failures) {
+            console.log(`     ↳ ${f.check}: ${f.message}`);
+          }
+          const failSummary = `Forseti L0 FAIL for ${taskId}: ${l0.failures.map(f => f.message).join('; ')}`;
+
+          // Ambient signals → Phase 0 (cross-session persistence)
+          try {
+            const signalFile = path.join(projectRoot, '.kenaz', 'specialist', 'ambient_signals.json');
+            let signals = { signals: [] };
+            try { signals = JSON.parse(fs.readFileSync(signalFile, 'utf8')); } catch {}
+            signals.signals.push({
+              detected_at: new Date().toISOString(),
+              source: 'forseti_level0',
+              signal_type: 'structural_issue',
+              summary: failSummary,
+              symbols: l0.failures.map(f => f.check),
+              urgent: true,
+              routed_weight: 2.0,
+            });
+            signals.signals = signals.signals.slice(-10);
+            fs.writeFileSync(signalFile, JSON.stringify(signals, null, 2));
+          } catch {}
+        } else if (l0.status === 'PASS') {
+          console.log(`   ✅ Forseti L0: ${l0.checks.length} structural check(s) passed`);
+        }
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Forseti L0 error (non-blocking): ${e.message}`);
+    }
+  }
+
+  // Step 2.5: Passive Rune Extraction — task completion signal (TASK_747)
+  if (result.taskCompleted && taskId && !dryRun) {
+    try {
+      const runeScope = loadTaskScopePaths(taskId, projectPath);
+      if (runeScope.length > 0) {
+        // Read task title and requirements via task-api get
+        let runeContent = `Task ${taskId}: completed.`;
+        try {
+          const getArgs = projectPath ? ['--project-path', projectPath] : [];
+          getArgs.push('get', taskId);
+          const getResult = spawnSync('node', [COLLABORATION_API, ...getArgs], {
+            encoding: 'utf8', timeout: 10000, cwd: ROOT, windowsHide: true,
+          });
+          if (getResult.status === 0 && getResult.stdout) {
+            const taskData = JSON.parse(getResult.stdout.trim());
+            const rawTitle = taskData.title || '';
+            const reqs = Array.isArray(taskData.requirements) ? taskData.requirements : [];
+            // MEM-LANG-001: strip CJK so FTS5 unicode61 tokenizer can index the rune
+            const title = stripCJK(rawTitle);
+            const reqSummary = stripCJK(reqs.slice(0, 3).join('; '));
+            // Fallback: if English portion of title is too short, use task ID as title
+            const effectiveTitle = title.length >= 10 ? title : `${taskId} task`;
+            runeContent = `Task ${taskId}: ${effectiveTitle}. Requirements: ${reqSummary}`;
+            if (runeContent.length > 300) runeContent = runeContent.slice(0, 297) + '...';
+          }
+        } catch { /* skip — use fallback content */ }
+
+        // Fire-and-forget synapse_inscribe for each scope path
+        const http = require('http');
+        let fired = 0;
+        for (const scopePath of runeScope) {
+          try {
+            const inscribeArgs = {
+              symbol_id: scopePath,
+              type: 'summary',
+              content: runeContent,
+              confidence: 0.65,
+              linked_task: taskId,
+              // TASK_2025: write tool -- must not omit projectPath (see epArgs comment above).
+              projectPath: projectPath || ROOT,
+            };
+            const payload = JSON.stringify({
+              jsonrpc: '2.0',
+              id: `task-rune-${taskId}-${fired}`,
+              method: 'tools/call',
+              params: { name: 'synapse_inscribe', arguments: inscribeArgs },
+            });
+            const req = http.request({
+              hostname: '127.0.0.1', port: 18080, path: '/api/mcp',
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+              timeout: 10000,
+            }, (res) => {
+              res.on('data', () => {});
+              res.on('end', () => {});
+            });
+            req.on('error', (err) => { console.warn(`   ⚠️  synapse_inscribe HTTP error: ${err.message}`); });
+            req.on('timeout', () => { req.destroy(); });
+            req.write(payload);
+            req.end();
+            fired++;
+          } catch { /* skip this scope path */ }
+        }
+        console.log(`   🧠 Rune extraction: ${fired} scope symbols for ${taskId}`);
+      }
+    } catch { /* skip — never blocks post-complete */ }
+  }
+
+  // Step 2.55 (cognitive tool usage -> cognitive_competence) was removed in TASK_2348: its only
+  // data source, turn_feedback.jsonl, was written by the retired reflex hook.
+
+  // Step 2.6: Ansuz Inbox Signal — notify Ansuz that this task completed (TASK_947)
+  if (result.taskCompleted && taskId && !dryRun) {
+    try {
+      const root = projectPath || ROOT;
+      const specialistDir = path.join(root, '.kenaz', 'specialist');
+      const inboxFile = path.join(specialistDir, 'ansuz_inbox.json');
+
+      // Fetch task title (best-effort)
+      let taskTitle = taskId;
+      try {
+        const getArgs = projectPath ? ['--project-path', projectPath] : [];
+        getArgs.push('get', taskId);
+        const getResult = spawnSync('node', [COLLABORATION_API, ...getArgs], {
+          encoding: 'utf8', timeout: 10000, cwd: ROOT, windowsHide: true,
+        });
+        if (getResult.status === 0 && getResult.stdout) {
+          const taskData = JSON.parse(getResult.stdout.trim());
+          if (taskData.title) taskTitle = taskData.title;
+        }
+      } catch { /* use taskId as fallback */ }
+
+      // Determine branch
+      const branch = (result.git && (result.git.userBranch || result.git.originalBranch)) || null;
+
+      // Build inbox entry — deterministic ID: commit SHA (preferred) or 30s date bucket (fallback)
+      // so that concurrent or retry calls collide on the same ID rather than producing N unique entries.
+      const commitSha = (result.git && result.git.taskBranchCommit) || null;
+      const idSuffix = commitSha ? commitSha.slice(0, 12) : String(Math.floor(Date.now() / 30000) * 30000);
+      const entry = {
+        id: `task_completed_${taskId}_${idSuffix}`,
+        type: 'task_completed',
+        task_id: taskId,
+        task_title: taskTitle,
+        completed_at: new Date().toISOString(),
+        branch,
+      };
+
+      writeInboxEntryIdempotent(inboxFile, specialistDir, entry);
+    } catch { /* fire-and-forget — never blocks post-complete */ }
+  }
+
+  // Step 2.6c: Cross-node task_completed event → yggdrasil relay /task_events (TASK_1409)
+  // Payload schema v1: { event_type, task_id, from_node, to_node, payload: { schema_version,
+  //   commit_hash, branch, summary, status } }, idempotency_key = sha256(task_id:commit_hash:from_node).
+  // Consumer: TASK_1413 PM Inbox Events tab — GET /task_events?to_node=PM_node.
+  // Skip conditions: relay unconfigured, created_by missing (legacy task), self-dispatch,
+  //   internal infra task tag ([chore]/[FIX-INFRA]/no_relay_notify).
+  if (result.taskCompleted && taskId && !dryRun) {
+    try {
+      // 1. Load yggdrasil config (relay_url + node_name)
+      let yggConfig = null;
+      try {
+        const { loadYggdrasilConfig } = require('./supabase-client');
+        yggConfig = loadYggdrasilConfig(projectPath);
+      } catch { /* supabase-client unavailable */ }
+
+      // Per-project activation gate (TASK_1544/TASK_1546):
+      // Derive the task's effective project key and check it is in collaboration_projects.
+      // Mirrors TS computeEffectiveProjectKey (dashboard/src/lib/yggdrasil-project-key.ts:29-41)
+      // and Rust derive_project_key (dashboard/src-tauri/.../yggdrasil.rs:164-179).
+      // Priority: (1) explicit yggdrasil_project override, (2) git remote origin normalized,
+      // (3) folder name of project root.
+      // When collaboration_projects is absent or empty (legacy / not-yet-configured), the gate
+      // is a no-op so existing single-yaml deployments keep working.
+      let _yggProjectActivated = true; // assume activated unless gate says otherwise
+      // _effectiveKey hoisted here so it is available for both the gate check AND the
+      // relay emit body (Bug 2 fix — single derivation, no duplication).
+      // Mirrors TS computeEffectiveProjectKey and Rust derive_project_key.
+      // Priority: (1) explicit yggdrasil_project override, (2) git remote origin normalized,
+      // (3) folder name of project root.
+      let _effectiveKey = null;
+      if (yggConfig && yggConfig.relay_url) {
+        const _projectRoot = projectPath || ROOT;
+
+        // 1) explicit override
+        const _explicitOverride = yggConfig.yggdrasil_project
+          ? String(yggConfig.yggdrasil_project).trim() : '';
+        if (_explicitOverride) {
+          _effectiveKey = _explicitOverride;
+        }
+
+        // 2) git remote origin, normalized — mirrors TS deriveProjectKey (lines 14-22) and
+        //    Rust strip_git_protocol (yggdrasil.rs:786-811).
+        if (!_effectiveKey) {
+          try {
+            const _gitRemote = require('child_process').execSync(
+              'git remote get-url origin',
+              { cwd: _projectRoot, encoding: 'utf8', timeout: 3000, windowsHide: true }
+            ).trim();
+            if (_gitRemote) {
+              let _k = _gitRemote
+                .replace(/^https?:\/\//, '')       // strip https:// or http://
+                .replace(/^git@/, '')               // strip git@
+                .replace(/^ssh:\/\/[^@]*@/, '')    // strip ssh://user@
+                .replace(/^ssh:\/\//, '')           // strip ssh:// (no user)
+                .replace(/:(?!\/)/, '/')            // git@host:org → host/org
+                .replace(/\/+$/, '')                // trailing slashes
+                .replace(/\.git$/, '')              // .git suffix
+                .replace(/\/+$/, '');               // trailing slashes after .git strip
+              if (_k) _effectiveKey = _k;
+            }
+          } catch { /* no git remote — fall through */ }
+        }
+
+        // 3) folder name of project root
+        if (!_effectiveKey) {
+          _effectiveKey = path.basename(_projectRoot) || 'default';
+        }
+
+        const _collabProjectsRaw = (yggConfig.collaboration_projects != null)
+          ? String(yggConfig.collaboration_projects) : '';
+        const _collabProjects = _collabProjectsRaw
+          .split(',').map(s => s.trim()).filter(s => s.length > 0);
+
+        if (_collabProjects.length > 0) {
+          if (!_collabProjects.includes(_effectiveKey)) {
+            console.log(`   [yggdrasil] skip relay emit: project "${_effectiveKey}" not in collaboration_projects`);
+            _yggProjectActivated = false;
+          }
+        } else if (String(yggConfig.collaboration_mode) !== 'true') {
+          // No per-project set configured AND not a legacy collaboration_mode=true install.
+          // Per-project activation (TASK_1544) defaults OFF, so a relay-configured but
+          // not-yet-activated project must stay silent (single-machine / unactivated).
+          // Legacy collaboration_mode=true installs are exempt (backwards compat) until they
+          // re-save settings and seed collaboration_projects.
+          console.log(`   [yggdrasil] skip relay emit: no project activated (collaboration_projects empty)`);
+          _yggProjectActivated = false;
+        }
+      }
+
+      if (yggConfig && yggConfig.relay_url && _yggProjectActivated) {
+        // 2. Read publishable_key from ~/.kenaz/credentials.yaml (user-scoped, NOT project yaml)
+        const os = require('os');
+        let publishableKey = process.env.YGGDRASIL_PUBLISHABLE_KEY || null;
+        if (!publishableKey) {
+          try {
+            const credPath = path.join(os.homedir(), '.kenaz', 'credentials.yaml');
+            if (fs.existsSync(credPath)) {
+              const credRaw = fs.readFileSync(credPath, 'utf8');
+              const credMatch = credRaw.match(/^publishable_key:\s*"?([^"\n]+)"?/m);
+              if (credMatch) publishableKey = credMatch[1].trim();
+            }
+          } catch { /* credentials not available */ }
+        }
+
+        if (publishableKey) {
+          // 3. Read task YAML: extract created_by.git_user (to_node) + infra skip signals
+          let toNode = null;
+          let taskTitleForSkip = taskId;
+          let taskTagsForSkip = [];
+          try {
+            const taskGetArgs = projectPath ? ['--project-path', projectPath] : [];
+            taskGetArgs.push('get', taskId);
+            const taskGetResult = spawnSync('node', [COLLABORATION_API, ...taskGetArgs], {
+              encoding: 'utf8', timeout: 10000, cwd: ROOT, windowsHide: true,
+            });
+            if (taskGetResult.status === 0 && taskGetResult.stdout) {
+              const td = JSON.parse(taskGetResult.stdout.trim());
+              // ROUTING KEY (TASK_1546 + TASK_1547): to_node must equal the publisher's actual
+              // relay node_name. Priority order:
+              //   1. pool_publisher_node — carried from relay record at claim time (TASK_1547);
+              //      robust even when node_name is overridden via yggdrasil.yaml.
+              //   2. created_by.name — git user.name stamped at task creation; works when
+              //      node_name equals git user.name (the common case, non-pool/legacy tasks).
+              //   3. created_by.git_user — last-resort fallback (email-derived, lower fidelity).
+              toNode = (td && td.pool_publisher_node) || (td && td.created_by && (td.created_by.name || td.created_by.git_user)) || null;
+              taskTitleForSkip = (td && td.title) || taskId;
+              taskTagsForSkip = Array.isArray(td && td.tags) ? td.tags : [];
+            }
+          } catch { /* task fetch optional — skip emit on failure */ }
+
+          // Guard: created_by.name missing → legacy task (no cross-node routing key)
+          if (toNode) {
+            const fromNode = yggConfig.node_name;
+
+            // Guard: self-dispatch — PM dispatches to themselves; they see done/ directly
+            if (fromNode !== toNode) {
+              // Guard: internal infra tasks → reduce PM inbox noise
+              const INFRA_PREFIXES = ['[chore]', '[fix-infra]', '[infra]', '[hotfix]'];
+              const titleLower = taskTitleForSkip.toLowerCase();
+              const commitLower = (message || '').toLowerCase();
+              const isInfra = INFRA_PREFIXES.some(p => titleLower.startsWith(p) || commitLower.startsWith(p))
+                || taskTagsForSkip.includes('no_relay_notify');
+
+              if (!isInfra) {
+                const commitHash = (result.git && result.git.taskBranchCommit) || null;
+                const branch = (result.git && (result.git.taskBranch || result.git.userBranch)) || null;
+
+                // Summary: reuse handoff snapshot current_topic (TASK_1409: do NOT regenerate)
+                // TASK_1828: read via readLatestHandoff (handoffs/ per-session slots first,
+                // legacy single slot fallback) — the old singular-file read went dead after
+                // the M3 writer migration and every relay summary degraded to the fallback.
+                let summary = message || `[${taskId}] task completed`;
+                try {
+                  const handoffData = readLatestHandoff(projectPath || ROOT);
+                  const topic = handoffData && handoffData.isbar && handoffData.isbar.situation
+                    && handoffData.isbar.situation.current_topic;
+                  if (topic && String(topic).length > 5) summary = String(topic).substring(0, 120);
+                } catch { /* use fallback summary */ }
+
+                // Idempotency key: sha256(task_id:commit_hash:from_node) — relay deduplicates on retry
+                const crypto = require('crypto');
+                const idempotencyKey = crypto.createHash('sha256')
+                  .update(`${taskId}:${commitHash || ''}:${fromNode}`)
+                  .digest('hex');
+
+                // Read the completed task's raw yaml so the PM can write it to their local DONE
+                // on Accept (TASK_1551). Best-effort: never throw; omit done_yaml if not found.
+                let doneYaml = null;
+                try {
+                  const doneBase = path.join(projectPath || ROOT, '.kenaz', 'tasks', 'done');
+                  if (fs.existsSync(doneBase)) {
+                    const doneFiles = fs.readdirSync(doneBase);
+                    const match = doneFiles.find(f => f.startsWith(taskId));
+                    if (match) doneYaml = fs.readFileSync(path.join(doneBase, match), 'utf8');
+                  }
+                } catch { /* best-effort — never fail the relay emit */ }
+
+                const relayEventBody = JSON.stringify({
+                  event_type: 'task_completed',
+                  task_id: taskId,
+                  from_node: fromNode,
+                  to_node: toNode,
+                  project: _effectiveKey,
+                  payload: {
+                    schema_version: 1,
+                    commit_hash: commitHash,
+                    branch,
+                    summary,
+                    status: 'merged',
+                    ...(doneYaml ? { done_yaml: doneYaml } : {}),
+                  },
+                  idempotency_key: idempotencyKey,
+                });
+
+                // Convert ws(s) → http(s) for REST POST
+                const relayHttpBase = yggConfig.relay_url
+                  .replace(/^wss:\/\//, 'https://')
+                  .replace(/^ws:\/\//, 'http://');
+                let relayHostname = null, relayPort = 443, relayIsHttps = true;
+                try {
+                  const relayParsed = new URL(relayHttpBase);
+                  relayHostname = relayParsed.hostname;
+                  relayIsHttps = relayParsed.protocol === 'https:';
+                  relayPort = relayParsed.port
+                    ? Number(relayParsed.port)
+                    : (relayIsHttps ? 443 : 80);
+                } catch { /* malformed relay_url — skip emit */ }
+
+                if (relayHostname) {
+                  const relayModule = relayIsHttps ? require('https') : require('http');
+                  const relayReq = relayModule.request({
+                    hostname: relayHostname,
+                    port: relayPort,
+                    path: '/api/task_events',
+                    method: 'POST',
+                    headers: {
+                      'Content-Type': 'application/json',
+                      'Content-Length': Buffer.byteLength(relayEventBody),
+                      Authorization: `Bearer ${publishableKey}`,
+                    },
+                    timeout: 5000,
+                  });
+                  relayReq.on('error', (err) => {
+                    console.warn(`   ⚠️  relay /api/task_events unreachable (non-blocking): ${err.message}`);
+                  });
+                  relayReq.on('timeout', () => {
+                    relayReq.destroy();
+                    console.warn(`   ⚠️  relay /api/task_events timed out (non-blocking)`);
+                  });
+                  relayReq.on('response', (relayRes) => {
+                    relayRes.resume(); // drain body
+                    if (relayRes.statusCode >= 200 && relayRes.statusCode < 300) {
+                      console.log(`   📡 Relay: task_completed → ${toNode} (${taskId})`);
+                    } else {
+                      console.warn(`   ⚠️  relay /api/task_events returned HTTP ${relayRes.statusCode} (non-blocking)`);
+                    }
+                  });
+                  relayReq.write(relayEventBody);
+                  relayReq.end();
+                }
+              }
+            }
+          }
+        }
+      }
+    } catch { /* fire-and-forget — never blocks post-complete */ }
+  }
+
+  // Step 3: Memory Agent（記憶系統整合）
+  if (memoryAgent && taskId) {
+    try {
+      const testsFailed = result.git?.regression && !result.git.regression.passed && !result.git.regression.skipped;
+      if (testsFailed) {
+        // 回歸測試失敗 → onError（fire-and-forget）
+        memoryAgent.onError({
+          event: 'regression_test_failure',
+          taskId,
+          error: `Regression tests failed after ${taskId} completion`,
+          summary: result.git.regression.output?.slice(-500),
+        }).catch(() => {});
+        console.log('   🧠 Memory: error event queued (regression failure)');
+      } else {
+        // 任務成功完成 → onTaskCompleted（fire-and-forget）
+        memoryAgent.onTaskCompleted(taskId).catch(() => {});
+        console.log('   🧠 Memory: task completion event queued');
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Memory agent skipped: ${e.message}`);
+    }
+  }
+
+  // Step 3b: Provenance rune — record which task + role modified scope paths (Cognee-inspired)
+  if (taskId && !dryRun && result.git && result.git.merged) {
+    try {
+      const scopePaths = loadTaskScopePaths(taskId, projectPath);
+      const role = result.taskRole || 'unknown';
+      if (scopePaths.length > 0 && scopePaths.length <= 5) {
+        const http = require('http');
+        for (const scopePath of scopePaths) {
+          try {
+            const payload = JSON.stringify({
+              jsonrpc: '2.0', id: `provenance-${taskId}`,
+              method: 'tools/call',
+              params: { name: 'synapse_inscribe', arguments: {
+                symbol_id: scopePath,
+                type: 'summary',
+                content: `Modified by ${taskId} (${role}). Scope: ${scopePaths.join(', ')}`,
+                confidence: 0.6,
+                author: `agent:${role}`,
+                linked_task: taskId,
+                // TASK_2025: write tool -- must not omit projectPath (see epArgs comment above).
+                projectPath: projectPath || ROOT,
+              }},
+            });
+            const req = http.request({
+              hostname: '127.0.0.1', port: 18080, path: '/api/mcp',
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+              timeout: 5000,
+            }, (res) => { res.on('data', () => {}); res.on('end', () => {}); });
+            req.on('error', () => {});
+            req.on('timeout', () => { req.destroy(); });
+            req.write(payload);
+            req.end();
+          } catch { /* skip */ }
+        }
+        console.log(`   📝 Provenance runes: ${scopePaths.length} scope paths tagged with ${taskId}/${role}`);
+      }
+    } catch { /* never blocks */ }
+  }
+
+  // Step 4: Guardian Health Check + KEEP/REVERT delta (TASK_706)
+  if (taskId) {
+    const counter = readGuardianCounter();
+    counter.completed_since_last_health = (counter.completed_since_last_health || 0) + 1;
+
+    const loopCfg = readLoopConfig(projectPath);
+    const regressionSkipVerdictReason = result.git?.regression?.skipVerdictReason || '';
+    const shouldSkipHealthVerdict = !!result.git?.regression?.skipVerdict;
+
+    // TASK_2341: synapse_health now scores MEMORY (rune/episode/conflict backlog), not code,
+    // so it can never revert, block or penalise a task. Both modes only RECORD the trend.
+    if (loopCfg.mode === 'auto' && shouldSkipHealthVerdict) {
+      console.log('── Guardian Memory-Health Trend (loop auto mode) ──');
+      console.log(`   ⚠️  Guardian: health snapshot skipped — ${regressionSkipVerdictReason}`);
+      result.healthVerdictSkipped = { reason: regressionSkipVerdictReason };
+      counter.completed_since_last_health = 0;
+      counter.last_health_check = new Date().toISOString();
+      writeGuardianCounter(counter);
+    } else {
+      const preSn = readPreTaskHealthSnapshot(taskId, projectPath);
+      if (preSn && typeof preSn.score === 'number') {
+        console.log(`── Guardian Memory-Health Trend (${loopCfg.mode} mode — record only, never reverts) ──`);
+        const postHealth = measureHealthScoreSync(projectPath);
+        if (postHealth) {
+          const afterPayload = saveTaskHealthSnapshot(taskId, 'after', postHealth, projectPath);
+          const vr = computeHealthVerdict(preSn, postHealth, loopCfg.revert_threshold, {
+            trendDeltaFromPrevious: afterPayload ? afterPayload.delta_from_previous : null,
+          });
+          console.log(`   🛡️  Memory health: ${postHealth.score}/100 (${vr.reason})`);
+          if (typeof vr.trendDeltaFromPrevious === 'number') {
+            console.log(`   📈 Trend (delta_from_previous): ${vr.trendDeltaFromPrevious >= 0 ? '+' : ''}${vr.trendDeltaFromPrevious}`);
+          }
+          writeVerdictToTask(taskId, vr.verdict, vr.delta, vr.reason, projectPath);
+          result.healthVerdict = { verdict: vr.verdict, delta: vr.delta, reason: vr.reason };
+          // Auto-acted_on: mark runes recalled during this task as acted_on (closes the
+          // recall->acted_on->confidence_boost loop). Route still exists (synapse.rs).
+          if (loopCfg.mode === 'auto') {
+            try {
+              const actedOnPayload = JSON.stringify({ taskId });
+              const actReq = require('http').request({
+                hostname: '127.0.0.1',
+                port: 18080,
+                path: '/api/synapse/runes/mark-acted-on-by-task',
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(actedOnPayload) },
+                timeout: 3000,
+              }, (res) => {
+                let body = '';
+                res.on('data', c => body += c);
+                res.on('end', () => {
+                  try {
+                    const r = JSON.parse(body);
+                    if (r.marked > 0) console.log(`   🔗 Acted-on: ${r.marked} runes marked for ${taskId}`);
+                  } catch { /* parse error — silent */ }
+                });
+              });
+              actReq.on('error', () => { /* Dashboard offline — silent skip */ });
+              actReq.write(actedOnPayload);
+              actReq.end();
+            } catch { /* never blocks post-complete */ }
+          }
+          counter.completed_since_last_health = 0;
+          counter.last_health_check = new Date().toISOString();
+        } else {
+          console.log(`   🛡️  Guardian: Dashboard not running — after-snapshot skipped for ${taskId}`);
+        }
+      } else if (loopCfg.mode === 'auto') {
+        const postHealth = measureHealthScoreSync(projectPath);
+        if (postHealth) {
+          saveTaskHealthSnapshot(taskId, 'before', postHealth, projectPath);
+          console.log(`   🛡️  Guardian: memory health=${postHealth.score}/100 (${postHealth.grade}) — saved as baseline (no pre-task snapshot found)`);
+        } else {
+          console.log('   🛡️  Guardian: Dashboard not running — health snapshot skipped');
+        }
+        counter.completed_since_last_health = 0;
+        counter.last_health_check = new Date().toISOString();
+      } else if (counter.completed_since_last_health >= CONFIG.GUARDIAN_INTERVAL) {
+        console.log(`── Guardian Health Check (every ${CONFIG.GUARDIAN_INTERVAL} tasks) ──`);
+        triggerGuardianHealthCheck(projectPath);
+        counter.completed_since_last_health = 0;
+        counter.last_health_check = new Date().toISOString();
+      } else {
+        const remaining = CONFIG.GUARDIAN_INTERVAL - counter.completed_since_last_health;
+        console.log(`   🛡️  Guardian: ${remaining} tasks until next health snapshot (no pre-dispatch snapshot for ${taskId})`);
+      }
+    }
+
+    if (!shouldSkipHealthVerdict || loopCfg.mode !== 'auto') {
+      writeGuardianCounter(counter);
+    }
+  }
+
+  // Step 4.6: Guard Failure Detector (TASK_1653)
+  // Runs shadow-mode failure detectors for active lesson guards that carry failure_signature.
+  // Reads guard snapshots directly from lesson_guards.yaml (not the task chart) because
+  // lesson_guards_injected is recorded in the Ansuz session chart -- not in dispatched
+  // worker task charts (chart_TASK_XXXX.json). Reading from YAML is the reliable source.
+  // Shadow mode: detector_mode='shadow' guards log to guard_detector_shadow.jsonl only.
+  // Non-fatal: any failure is swallowed -- must never block post-complete.
+  if (taskId && !dryRun) {
+    try {
+      const detectorMod = require(path.join(ROOT, '.specialist', 'tools', 'failure-detector.js'));
+      const lgMod = require(path.join(ROOT, '.specialist', 'tools', 'lesson-guard.js'));
+      // thrift: build minimal snapshots from active guards with failure_signature only
+      const guardsData = lgMod.readGuards();
+      const guardSnapshots = Object.entries(guardsData.guards)
+        .filter(([, g]) => g.status === 'active' && g.failure_signature != null)
+        .map(([id, g]) => ({ id, failure_signature: g.failure_signature, phase: null }));
+      if (guardSnapshots.length > 0) {
+        detectorMod.runDetectorsForTask(taskId, guardSnapshots, result || null);
+      }
+    } catch (e) { console.log(`   [warn] Guard detector skipped: ${e.message}`); }
+  }
+
+  // Step 5: Cognitive Checkpoint Detection
+  if (taskId) {
+    const cogResult = detectCognitiveCheckpoint(taskId, logPath, projectPath);
+    result.cognitive = cogResult;
+    if (cogResult.checked) {
+      for (const w of cogResult.warnings) {
+        console.log(`   ${w}`);
+      }
+    } else if (cogResult.warnings.length > 0) {
+      console.log(`   🧠 Cognitive: ${cogResult.warnings[0]}`);
+    }
+  }
+
+  // Step 5.5: Design Reasoning Attribution (TASK_1074)
+  // Correlates Phase 3 design inputs (principles, guards, formation) with actual outcomes.
+  // Non-fatal: all errors swallowed; attribution must never block post-complete.
+  if (taskId && !dryRun && designReasoning) {
+    try {
+      const projectRoot = resolveProjectRoot(projectPath);
+      if (projectRoot) {
+        // Collect thinking tags from this task (already computed for cognitive attribution above)
+        const { tags: thinkingTags } = collectThinkingTags(taskId, projectRoot);
+
+        // Resolve outcome data
+        const outcomeSuccess = result.git ? (result.git.merged === true) : true;
+        // TASK_2341: the recorded health score is MEMORY-only (not a code-outcome signal), so it
+        // never feeds valence; valence comes from merge success alone.
+        const healthDelta = null;
+        const attrValence = outcomeSuccess ? 'positive' : 'negative';
+
+        // Read surprise score from ansuz_accuracy.json if available
+        let surpriseScore = null;
+        try {
+          const accFile = path.join(projectRoot, '.kenaz', 'specialist', 'ansuz_accuracy.json');
+          if (fs.existsSync(accFile)) {
+            const accData = JSON.parse(fs.readFileSync(accFile, 'utf8'));
+            if (Array.isArray(accData.comparison_history)) {
+              const match = accData.comparison_history.find(h => h.task_id === taskId);
+              if (match) surpriseScore = parseFloat((1.0 - (match.file_jaccard || 1)).toFixed(3));
+            }
+          }
+        } catch { /* surprise score optional */ }
+
+        const designInputs = typeof designReasoning.readDesignReasoning === 'function'
+          ? designReasoning.readDesignReasoning(taskId, projectPath)
+          : null;
+        const usingCompressionFallback = designInputs && designInputs.source === 'compression_fallback';
+
+        const report = designReasoning.generateAttributionReport({
+          taskId,
+          projectPath,
+          outcomeSuccess,
+          healthDelta,
+          surpriseScore,
+          valence: attrValence,
+          thinkingTags,
+        });
+
+        if (usingCompressionFallback) {
+          console.log(`   ℹ️ Attribution: compression-fallback prediction used for ${taskId} — full Phase 3 tracking was compressed`);
+        }
+
+        if (usingCompressionFallback) {
+          // Already logged the compression fallback attribution notice above.
+        } else if (report) {
+          const principleCount = report.principle_correlations.length;
+          const guardCount = report.guard_correlations.length;
+          console.log(`   🔗 Attribution: ${principleCount} principle(s), ${guardCount} guard(s) → valence=${attrValence}`);
+          if (report.heuristic_signal) {
+            console.log(`   📐 Signal: ${report.heuristic_signal.slice(0, 120)}`);
+          }
+        } else {
+          console.log(`   🔗 Attribution: no Phase 3 design inputs found for ${taskId} — skipped`);
+        }
+      }
+    } catch (e) {
+      console.log(`   ⚠️  Design attribution failed: ${e.message}`);
+    }
+  }
+
+  // Summary
+  console.log('── Summary ──');
+  if (result.archive) {
+    const ca = result.archive.collab;
+    console.log(`   Archive: ${ca.archived.length} archived, ${ca.kept.length} kept`);
+    if (!projectPath) {
+      const la = result.archive.legacy;
+      console.log(`   Archive [legacy]: ${la.archived.length} archived, ${la.kept.length} kept`);
+    }
+  }
+  if (result.git) {
+    if (result.git.regression) {
+      const r = result.git.regression;
+      if (r.skipVerdict) {
+        console.log(`   Tests: transient cargo lock contention — verdict skipped (${r.skipVerdictReason})`);
+      } else if (r.skipped) {
+        console.log('   Tests: skipped (none found)');
+      } else if (r.results && r.results.length > 0) {
+        const passed = r.results.filter(t => t.passed).length;
+        const failed = r.results.filter(t => !t.passed).length;
+        console.log(`   Tests: ${passed} passed, ${failed} failed ${r.passed ? '✅' : '❌'}`);
+        for (const t of r.results) {
+          console.log(`      ${t.passed ? '✅' : '❌'} ${t.label}`);
+        }
+      } else {
+        console.log(`   Tests: ${r.passed ? 'PASSED ✅' : 'FAILED ❌'}`);
+      }
+      if (result.git.regressionFixTask) {
+        console.log(`   Fix task: ${result.git.regressionFixTask}`);
+      }
+    }
+    // Acceptance criteria summary
+    if (result.git.acceptance) {
+      const ac = result.git.acceptance;
+      if (ac.skipped) {
+        console.log(`   Acceptance: skipped (${ac.message || 'n/a'})`);
+      } else if (ac.indeterminate) {
+        // TASK_1825: timeout/parse failure must reach the summary as non-pass
+        console.log(`   Acceptance: INDETERMINATE ⚠️ (${ac.error || 'unknown'}) — no verdict (NOT a pass); report in .formation/reports/verify/`);
+      } else if (ac.pass) {
+        const count = ac.results ? ac.results.length : 0;
+        console.log(`   Acceptance: ${count} criteria ALL PASS ✅`);
+      } else {
+        const passed = (ac.results || []).filter(r => r.pass).length;
+        const failed = (ac.results || []).filter(r => !r.pass).length;
+        console.log(`   Acceptance: ${passed} passed, ${failed} failed ❌`);
+        if (result.git.acceptanceFixTasks && result.git.acceptanceFixTasks.length > 0) {
+          console.log(`   Acceptance fix: ${result.git.acceptanceFixTasks.join(', ')}`);
+        }
+      }
+    }
+    if (result.git.integrationGaps && result.git.integrationGaps.orphans?.length > 0) {
+      console.log(`   Integration: ${result.git.integrationGaps.orphans.length} orphan export(s) detected`);
+      if (result.git.integrationFixTask) {
+        console.log(`   Wiring task: ${result.git.integrationFixTask}`);
+      }
+    }
+    console.log(`   Git: branch=${result.git.taskBranch} committed=${result.git.committed} merged=${result.git.merged} verify_merge_landed=${result.git.verify_merge_landed === true}`);
+    if (result.git.scopeViolations && result.git.scopeViolations.length > 0) {
+      console.log(`   ⚠️  Scope violations: ${result.git.scopeViolations.length} file(s) outside scope_paths`);
+    }
+    if (isVerifiedMergeSuccess(result.git)) {
+      console.log(`   👉 On branch: ${result.git.userBranch} — merge to main when ready`);
+    }
+  }
+  // Health verdict summary (TASK_706)
+  if (result.healthVerdict) {
+    const hv = result.healthVerdict;
+    console.log(`   Memory Health: ${hv.verdict} (trend=${typeof hv.delta === 'number' ? hv.delta.toFixed(1) : 'n/a'}) — ${hv.reason}`);
+  } else if (result.healthVerdictSkipped) {
+    console.log(`   Health Verdict: SKIPPED ⚠️ — ${result.healthVerdictSkipped.reason}`);
+  }
+
+  // Cognitive checkpoint summary
+  if (result.cognitive) {
+    const cog = result.cognitive;
+    if (cog.checked) {
+      const pre = cog.preCode || 'MISSING';
+      const post = cog.postCode || 'MISSING';
+      const icon = (cog.preCode && cog.postCode) ? '✅' : '⚠️';
+      console.log(`   Cognitive: Pre=${pre} Post=${post} ${icon}`);
+    } else {
+      console.log(`   Cognitive: not checked (no log)`);
+    }
+  }
+  console.log('');
+
+  // Step 8a: Hippocampus Episode Append — record task outcome (TASK_969)
+  if (hippocampusEpisodeId && !dryRun) {
+    try {
+      const contentParts = [`Task ${taskId} outcome:`];
+
+      // Changed files
+      const changedFileList = result.git?.diffStat || [];
+      if (changedFileList.length > 0) {
+        contentParts.push(`Changed files: ${changedFileList.join(', ')}`);
+      } else if (result.git?.committed) {
+        contentParts.push('Changes committed (file list unavailable).');
+      } else if (result.git?.noChanges) {
+        contentParts.push('No file changes detected.');
+      }
+
+      // Health delta (regression test results)
+      if (result.git?.regression?.skipVerdict) {
+        contentParts.push(`Health verdict skipped: ${result.git.regression.skipVerdictReason}.`);
+      } else if (result.git?.regression && !result.git.regression.skipped) {
+        contentParts.push(result.git.regression.passed
+          ? 'Health: tests passed.'
+          : `Health: tests FAILED.${result.git.regressionFixTask ? ` Fix task: ${result.git.regressionFixTask}` : ''}`);
+      }
+
+      // Fix loop status
+      if (result.git?.acceptanceFixTasks && result.git.acceptanceFixTasks.length > 0) {
+        contentParts.push(`Fix loop triggered: ${result.git.acceptanceFixTasks.join(', ')}`);
+      }
+
+      // Git merge status
+      if (isVerifiedMergeSuccess(result.git)) {
+        contentParts.push(`Merged to ${result.git.userBranch}.`);
+      }
+
+      const appendArgs = {
+        episode_id: hippocampusEpisodeId,
+        phase: 'outcome',
+        content: contentParts.join(' '),
+        confidence: 0.8,
+        outcome: isVerifiedMergeSuccess(result.git) ? 'success' : 'partial',
+        // TASK_2025: write tool -- must not omit projectPath (see epArgs comment above).
+        projectPath: projectPath || ROOT,
+      };
+      callHippocampusMcpSync('hippocampus_episode_append', appendArgs);
+      console.log(`   🧠 Hippocampus: episode ${hippocampusEpisodeId} appended outcome entry`);
+    } catch (e) {
+      console.log(`   ⚠️  Hippocampus episode append skipped: ${e.message}`);
+    }
+  }
+
+  // Step 8b: Hippocampus Episode Close (episodic memory — TASK_716)
+  if (hippocampusEpisodeId && !dryRun) {
+    try {
+      const outcome = isVerifiedMergeSuccess(result.git)
+        ? 'success'
+        : (result.git?.noChanges || result.git?.memoryOnly ? 'success' : 'partial');
+      const summaryParts = [`Task ${taskId} post-complete finished.`];
+      if (isVerifiedMergeSuccess(result.git)) summaryParts.push(`Git merged to ${result.git.userBranch}.`);
+      if (result.taskCompleted) summaryParts.push('Task marked done.');
+      if (result.git?.regression?.skipVerdict) {
+        summaryParts.push('Health verdict skipped due to cargo lock contention.');
+      } else if (result.git?.regression && !result.git.regression.skipped) {
+        summaryParts.push(result.git.regression.passed ? 'Tests passed.' : 'Tests failed — fix task created.');
+      }
+      const closeArgs = {
+        episode_id: hippocampusEpisodeId,
+        outcome,
+        summary: summaryParts.join(' '),
+        // TASK_2025: write tool -- must not omit projectPath (see epArgs comment above).
+        projectPath: projectPath || ROOT,
+      };
+      callHippocampusMcpSync('hippocampus_episode_close', closeArgs);
+      console.log(`   🧠 Hippocampus: episode ${hippocampusEpisodeId} closed (${outcome})`);
+    } catch (e) {
+      console.log(`   ⚠️  Hippocampus episode close skipped: ${e.message}`);
+    }
+  }
+
+  // TASK_1593: Record outcome in dedup guard so a failed pass does not
+  // suppress the next legitimate retry (Guard 1 worktree->null check).
+  if (taskId && !dryRun) {
+    const passSucceeded = isVerifiedMergeSuccess(result.git) ||
+      (result.git && (result.git.noChanges || result.git.memoryOnly));
+    updatePostCompleteGuardOutcome(guardFile, taskId, passSucceeded ? 'success' : 'failure');
+  }
+
+  return result;
+}
+
+// ─────────────────────────────────────────
+// CLI
+// ─────────────────────────────────────────
+if (require.main === module) {
+  const args = process.argv.slice(2);
+
+  if (args.includes('--help') || args.includes('-h')) {
+    console.log(`
+⚔️  Formation Post-Complete
+
+任務完成後自動化：Archive 清理 + Git 分支管理
+
+Usage:
+  node .formation/tools/post-complete.js --task=TASK_XXX [options]
+
+Options:
+  --task TASK_XXX        任務 ID（必填，除非 --skip-git）
+  --project-path PATH    子專案路徑（預設: core KenazAI）
+  --worktree-path PATH   Worktree 路徑（並行 dispatch 模式，env: FORMATION_WORKTREE_PATH）
+  --keep N               保留最新 N 個 done 任務（預設 10）
+  --skip-archive         跳過 archive 檢查
+  --skip-git             跳過 git 分支管理
+  --skip-tests           跳過回歸測試（PPL-113）
+  --test-cmd "CMD"       Agent 指定的測試指令（可多次指定，PPL-113）
+  --message "MSG"        自訂 commit message
+  --dry-run              模擬執行（不修改檔案/git）
+
+PPL-113 Regression Guard:
+  Agent 透過 --test-cmd 傳入測試指令，腳本依序執行。
+  未傳 --test-cmd 時 fallback 到自動偵測所有測試套件。
+  測試失敗 → 自動開 FIX 單（閉環），繼續 commit。
+
+Acceptance Criteria Verification:
+  Commit 後自動呼叫 verify-acceptance.js 驗證 task 的 acceptance_criteria。
+  用 Sonnet 讀取 git diff + source code，逐條判斷 PASS/FAIL。
+  驗證失敗 → 自動開 FIX 單（含失敗原因），繼續 merge。
+  原卡帶 fix tag → 不開 FIX 單（循環防護），改在原卡 notes 寫 ACCEPTANCE_FAILED 標記。
+  逾時 / 輸出無法解析 → INDETERMINATE（不是 pass），報告存 .formation/reports/verify/。
+  --skip-tests 同時跳過回歸測試和 acceptance 驗證。
+
+Git Flow:
+  1. 建立 task/task_xxx branch
+  2. Stage + commit 所有變更
+  2.5. Acceptance criteria verification（verify-acceptance）
+  3. Merge 到用戶分支（git user name, e.g. xyz9516）
+  4. 用戶手動 merge 到 main
+
+Archive Flow:
+  Core:    .collaboration/tasks/done/ → archived/ + dev/pipeline/completed/ → archived/
+  Sub:     .kenaz/tasks/done/ → archived/
+  超過 --keep 個 → 最舊的移到 archived/
+
+Examples:
+  node .formation/tools/post-complete.js --task=TASK_205
+  node .formation/tools/post-complete.js --task=TASK_9 --project-path=C:\\Users\\Wei\\Desktop\\Project\\assembly
+  node .formation/tools/post-complete.js --task=TASK_205 --keep=15
+  node .formation/tools/post-complete.js --task=TASK_205 --dry-run
+  node .formation/tools/post-complete.js --task=TASK_205 --test-cmd "cd dashboard && npm test" --test-cmd "cd dashboard/pty-server && cargo test"
+  node .formation/tools/post-complete.js --skip-git               # 只做 archive
+`);
+    process.exit(0);
+  }
+
+  const getArg = (flag) => {
+    for (let i = 0; i < args.length; i++) {
+      if (args[i].startsWith(`${flag}=`)) return args[i].split('=').slice(1).join('=');
+      if (args[i] === flag && args[i + 1]) return args[i + 1];
+    }
+    return null;
+  };
+
+  const taskId = getArg('--task');
+  const keep = getArg('--keep') ? parseInt(getArg('--keep'), 10) : CONFIG.DEFAULT_KEEP;
+  const skipArchive = args.includes('--skip-archive');
+  const skipGit = args.includes('--skip-git');
+  const skipTests = args.includes('--skip-tests');
+  const dryRun = args.includes('--dry-run');
+  const message = getArg('--message');
+  const projectPath = getArg('--project-path');
+  const worktreePath = getArg('--worktree-path') || process.env.FORMATION_WORKTREE_PATH || null;
+
+  // Collect all --test-cmd values (Agent-specified test commands)
+  const testCommands = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--test-cmd' && args[i + 1]) {
+      testCommands.push(args[++i]);
+    } else if (args[i].startsWith('--test-cmd=')) {
+      testCommands.push(args[i].split('=').slice(1).join('='));
+    }
+  }
+
+  if (!taskId && !skipGit) {
+    console.error('❌ --task is required (or use --skip-git for archive-only mode)');
+    process.exit(1);
+  }
+
+  try {
+    postComplete({ taskId, keep, skipArchive, skipGit, skipTests, dryRun, message, projectPath, testCommands, worktreePath });
+  } catch (e) {
+    console.error(`❌ Post-complete failed: ${e.message}`);
+    process.exit(1);
+  }
+}
+// ?????????????????????????????????????????????????????????????????????????????
+// SECTION: EXPORTS
+// ?????????????????????????????????????????????????????????????????????????????
+// ─────────────────────────────────────────
+// Sub-agent post-complete (lightweight equivalent for Agent tool dispatch)
+// ─────────────────────────────────────────
+
+/**
+ * Lightweight post-complete for tasks dispatched via Agent tool (isolation=worktree).
+ * The Agent tool handles worktree git isolation automatically, so git merge is skipped.
+ * Health scoring is deferred to the next Heimdall cycle (dashboard must be running
+ * for measureHealthScoreSync to work; safe to call from Ansuz interactive session).
+ *
+ * Call this after the Agent tool sub-agent returns to record the health delta.
+ *
+ * @param {string} taskId - Task ID (TASK_XXX)
+ * @param {string|null} projectPath - Sub-project path (null = core)
+ * @returns {Promise<{ healthDelta: number|null, grade: string|null }>}
+ */
+async function subagentPostComplete(taskId, projectPath) {
+  const result = { healthDelta: null, grade: null };
+
+  try {
+    // Record post-task health snapshot (for audit trail + Heimdall comparison)
+    const postHealth = measureHealthScoreSync(projectPath);
+    if (postHealth && taskId) {
+      saveTaskHealthSnapshot(taskId, 'after', postHealth, projectPath);
+      const preSn = readPreTaskHealthSnapshot(taskId, projectPath);
+      if (preSn?.score != null) {
+        // TASK_2341: null when the baseline is graph-era (different score_version)
+        result.healthDelta = computeHealthVerdict(preSn, postHealth).delta;
+        result.grade = postHealth.grade;
+        console.log(
+          `   🛡️  Sub-agent Guardian: health=${postHealth.score}/100 (${postHealth.grade})` +
+          ` trend=${typeof result.healthDelta === 'number' ? (result.healthDelta >= 0 ? '+' : '') + result.healthDelta : 'n/a'}`
+        );
+      } else {
+        // Save as baseline for future comparison
+        saveTaskHealthSnapshot(taskId, 'before', postHealth, projectPath);
+        result.grade = postHealth.grade;
+        console.log(`   🛡️  Sub-agent Guardian: health=${postHealth.score}/100 (${postHealth.grade}) — saved as baseline`);
+      }
+    }
+  } catch { /* never block Ansuz on health check failure */ }
+
+  return result;
+}
+
+module.exports = {
+  classifyMergeFailureReason,
+  postComplete,
+  archiveCheck,
+  gitBranchAndMerge,
+  measureHealthScoreSync,
+  saveTaskHealthSnapshot,
+  classifySkillKey,
+  isDaemonManagedPath,
+  listDaemonManagedPaths,
+  getDaemonPathsToUnstage,
+  verifyStagedScopeCoverage,
+  checkAndUpdatePostCompleteGuard,
+  updatePostCompleteGuardOutcome,
+  writeInboxEntryIdempotent,
+  subagentPostComplete,
+  readLatestHandoff, // TASK_1828: handoffs/-first resolver for relay summaries
+  reclaimWorktreeDir, // TASK_2028: unlock + git-level reclaim for stale/interrupted worktrees
+  appendPhase9OutcomeLog, // TASK_2078: exported for agent_result/transcript precedence unit testing
+};