mandrel 1.76.0 → 1.78.0

package/.agents/scripts/lib/orchestration/column-sync.js

@@ -35,6 +35,11 @@
  */
 
 import { AGENT_LABELS } from '../label-constants.js';
+import {
+  invalidateProjectMetaCache,
+  readProjectMetaCache,
+  writeProjectMetaCache,
+} from './project-meta-cache.js';
 import { resolveProjectMeta } from './project-meta-resolver.js';
 
 export const LABEL_TO_COLUMN = Object.freeze({
@@ -74,6 +79,7 @@ export class ColumnSync {
    *   projectNumber?: number | null,
    *   projectOwner?: string | null,
    *   logger?: { info: Function, warn: Function },
+   *   config?: object,
    *   ctx?: { provider?: object, config?: { github?: { projectNumber?: number|null } }, logger?: object },
    * }} opts
    */
@@ -89,7 +95,16 @@ export class ColumnSync {
       null;
     this.projectOwner = opts.projectOwner ?? provider.projectOwner ?? null;
     this.logger = opts.logger ?? ctx?.logger ?? console;
+    // Resolved config bag used to locate the on-disk meta cache's tempRoot.
+    // Optional — when omitted, the cache resolves the framework-default
+    // `temp` root (Story #4252).
+    this.config = opts.config ?? ctx?.config ?? undefined;
     this._meta = null; // lazy-cached { projectId, fieldId, options: Map<name, id> }
+    // Records whether the in-process `_meta` was hydrated from the on-disk
+    // cache, so a GraphQL error against possibly-stale cached metadata can
+    // invalidate the disk entry and force a fresh resolve on the next flip
+    // (Story #4252).
+    this._metaFromDiskCache = false;
   }
 
   /**
@@ -117,8 +132,9 @@ export class ColumnSync {
     const itemId = await this.#getProjectItemId(issueId, meta.projectId);
     if (!itemId) return { status: 'skipped', reason: 'not-on-project' };
 
-    await this.provider.graphql(
-      `
+    try {
+      await this.provider.graphql(
+        `
       mutation($projectId: ID!, $itemId: ID!, $fieldId: ID!, $optionId: String!) {
         updateProjectV2ItemFieldValue(
           input: {
@@ -129,18 +145,71 @@ export class ColumnSync {
           }
         ) { projectV2Item { id } }
       }`,
-      {
-        projectId: meta.projectId,
-        itemId,
-        fieldId: meta.fieldId,
-        optionId,
-      },
-    );
+        {
+          projectId: meta.projectId,
+          itemId,
+          fieldId: meta.fieldId,
+          optionId,
+        },
+      );
+    } catch (err) {
+      // A failed mutation against metadata that came from the disk cache
+      // most likely means the board was reconfigured since the entry was
+      // written (a stale projectId / fieldId / optionId). Invalidate the
+      // disk entry so the next flip re-resolves against the live board and
+      // self-heals (Story #4252). Re-throw so the caller's existing error
+      // handling (e.g. `syncProjectStatusColumn`'s warn) is preserved.
+      this.#invalidateMetaCache();
+      throw err;
+    }
     return { status: 'synced', column };
   }
 
+  /**
+   * The `(owner, projectNumber)` pair the disk cache is keyed by. Mirrors
+   * the owner that `#loadMeta` resolves the board against so a cache hit and
+   * a live resolve agree on the same board identity.
+   *
+   * @returns {{ owner: string|null, projectNumber: number|null }}
+   */
+  get #cacheBoard() {
+    return {
+      owner: this.projectOwner ?? this.provider.owner ?? null,
+      projectNumber: this.projectNumber,
+    };
+  }
+
+  /**
+   * Invalidate the on-disk metadata cache entry for this board and drop the
+   * in-process copy, so the next `#loadMeta` re-resolves from the live
+   * board. Only fires when the current `_meta` came from the disk cache —
+   * a freshly-resolved entry that fails the mutation is a transient/live
+   * problem, not a stale-cache problem.
+   */
+  #invalidateMetaCache() {
+    if (!this._metaFromDiskCache) return;
+    const { owner, projectNumber } = this.#cacheBoard;
+    invalidateProjectMetaCache({ owner, projectNumber, config: this.config });
+    this._meta = null;
+    this._metaFromDiskCache = false;
+  }
+
   async #loadMeta() {
     if (this._meta !== null) return this._meta || null;
+    // Disk cache hit short-circuits the ~2 metadata GraphQL round-trips
+    // (resolveProjectMeta) — repo-invariant board metadata persists across
+    // the cold CLI processes of a single-story delivery (Story #4252).
+    const cachedBoard = this.#cacheBoard;
+    const cached = readProjectMetaCache({
+      owner: cachedBoard.owner,
+      projectNumber: cachedBoard.projectNumber,
+      config: this.config,
+    });
+    if (cached) {
+      this._meta = cached;
+      this._metaFromDiskCache = true;
+      return this._meta;
+    }
     try {
       // Resolve the board by walking the owner-type ladder
       // (organization → user → viewer) via the shared resolver so the
@@ -176,6 +245,16 @@ export class ColumnSync {
         fieldId: field.id,
         options,
       };
+      // Persist the freshly-resolved, repo-invariant metadata so the next
+      // cold flip reads it from disk instead of re-paying the resolve
+      // (Story #4252). Best-effort: a write failure never blocks the sync.
+      writeProjectMetaCache({
+        owner: cachedBoard.owner,
+        projectNumber: cachedBoard.projectNumber,
+        meta: this._meta,
+        config: this.config,
+      });
+      this._metaFromDiskCache = false;
       return this._meta;
     } catch (err) {
       this.logger.warn?.(

package/.agents/scripts/lib/orchestration/lifecycle/emit-loop-tick.js

@@ -0,0 +1,183 @@
+/**
+ * emit-loop-tick.js — Story #4287 (Epic #4284).
+ *
+ * Programmatic helper that emits a single `loop.tick` lifecycle event
+ * THROUGH the lifecycle bus so a host-driven loop (e.g. a `/loop`-style
+ * recurring command or a long-running poll) lands a per-pass record in
+ * the on-disk ledger the `/deliver` idle watchdog already scans. The
+ * record is what keeps a host loop from running silently: each round
+ * appends an inspectable `emitted` line a reconciler can read for
+ * forward-progress evidence.
+ *
+ * Distinct from `story.heartbeat` (emit-story-heartbeat.js): the
+ * heartbeat carries Story-phase info for a single in-flight Story and is
+ * always Epic-scoped (its ledger path is `epicLedgerPath(epicId)`). A
+ * host loop is not bound to a Story tier, so `loop.tick` carries a
+ * free-form `loopName`, a monotonic `round` counter, the loop's
+ * configured `cadence` label, and a per-round `status` instead. Keeping
+ * the two events separate means a loop tick never masquerades as Story
+ * progress (and vice versa).
+ *
+ * Bus path (Story acceptance: "Emitting a loop.tick event THROUGH the
+ * lifecycle bus appends a record to the per-run ledger"): this helper
+ * constructs a `Bus`, registers a `LedgerWriter` against it, and calls
+ * `bus.emit('loop.tick', payload)`. The bus validates the payload against
+ * `loop.tick.schema.json` before any listener runs, and the
+ * LedgerWriter's privileged `onEmitted` hook lands the `emitted` record
+ * on disk — exactly the same persistence path every other lifecycle
+ * event flows through. The helper does NOT bypass the bus with a direct
+ * `appendFileSync`; routing through the bus is what gives the record its
+ * schema-validated, seqId-stamped guarantee.
+ *
+ * Schema contract (loop.tick.schema.json):
+ *   { event, loopName, round, cadence, status, timestamp }
+ *
+ * The schema declares `additionalProperties: false`, so this emitter's
+ * signature is deliberately narrow: only the schema-allowed fields are
+ * accepted. `status` is one of running|done|blocked.
+ *
+ * Ledger path resolution: a caller supplies EITHER an explicit
+ * `ledgerPath` (the host-loop case — the loop owns where its ledger
+ * lives) OR an `epicId`, in which case the canonical
+ * `epicLedgerPath(epicId)` is used so an Epic-scoped loop's ticks land
+ * in the same `temp/epic-<id>/lifecycle.ndjson` the rest of the run
+ * reads. Exactly one of the two MUST be supplied.
+ */
+
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import { epicLedgerPath } from '../../config/temp-paths.js';
+import { createBus } from './bus.js';
+import { createLedgerWriter } from './ledger-writer.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const SCHEMA_DIR = path.resolve(
+  __dirname,
+  '..',
+  '..',
+  '..',
+  '..',
+  'schemas',
+  'lifecycle',
+);
+
+const VALID_STATUSES = new Set(['running', 'done', 'blocked']);
+
+/**
+ * Parse `temp/epic-<id>/lifecycle.ndjson` (or any
+ * `<dir>/epic-<id>/lifecycle.ndjson`) back into `{ tempRoot, epicId }`
+ * so a LedgerWriter — which is constructed from `{ epicId, tempRoot }`
+ * rather than a raw path — can be bound to the supplied ledger path.
+ *
+ * The LedgerWriter intentionally re-derives the ledger path from its
+ * `tempRoot` + `epicId` (so it can recreate the directory if a listener
+ * moves it mid-run), so we decompose the path the caller gave us into
+ * those two parts here.
+ *
+ * @param {string} ledgerPath
+ * @returns {{ tempRoot: string, epicId: number }}
+ */
+function decomposeLedgerPath(ledgerPath) {
+  const epicDir = path.dirname(ledgerPath);
+  const tempRoot = path.dirname(epicDir);
+  const epicDirName = path.basename(epicDir);
+  const m = /^epic-(\d+)$/.exec(epicDirName);
+  if (!m) {
+    throw new Error(
+      `emitLoopTick: ledgerPath does not match <tempRoot>/epic-<id>/lifecycle.ndjson layout (got ${ledgerPath})`,
+    );
+  }
+  const epicId = Number.parseInt(m[1], 10);
+  return { tempRoot, epicId };
+}
+
+/**
+ * Emit exactly one `loop.tick` event through the lifecycle bus, landing
+ * an `emitted` (and `completed`) NDJSON record in the resolved ledger.
+ *
+ * @param {object} opts
+ * @param {string} opts.loopName     Free-form loop identifier (non-empty).
+ * @param {number} opts.round        Monotonic pass counter (integer >= 0).
+ * @param {string} opts.cadence      Configured interval label, e.g. '5m'.
+ * @param {string} [opts.status='running']
+ *                                   One of running|done|blocked.
+ * @param {string} [opts.timestamp]  ISO-8601 wall clock. Defaults to now().
+ * @param {number} [opts.epicId]     When supplied (and no `ledgerPath`),
+ *                                   the canonical `epicLedgerPath(epicId)`
+ *                                   is used for the ledger.
+ * @param {object} [opts.config]     Optional resolved config for tempRoot
+ *                                   (only consulted on the `epicId` path).
+ * @param {string} [opts.ledgerPath] Explicit ledger path (host-loop case).
+ *                                   Mutually exclusive with `epicId`.
+ * @returns {Promise<{ ledgerPath: string, payload: object, seqId: number }>}
+ */
+export async function emitLoopTick(opts) {
+  const {
+    loopName,
+    round,
+    cadence,
+    status = 'running',
+    timestamp = new Date().toISOString(),
+    epicId,
+    config,
+    ledgerPath: ledgerPathOverride,
+  } = opts ?? {};
+
+  if (typeof loopName !== 'string' || loopName.length === 0) {
+    throw new Error('emitLoopTick: loopName must be a non-empty string');
+  }
+  if (!Number.isInteger(round) || round < 0) {
+    throw new Error('emitLoopTick: round must be a non-negative integer');
+  }
+  if (typeof cadence !== 'string' || cadence.length === 0) {
+    throw new Error('emitLoopTick: cadence must be a non-empty string');
+  }
+  if (!VALID_STATUSES.has(status)) {
+    throw new Error(
+      `emitLoopTick: status "${status}" must be one of: ${[...VALID_STATUSES].join(', ')}`,
+    );
+  }
+
+  const hasEpicId = epicId !== undefined;
+  const hasLedgerPath = ledgerPathOverride !== undefined;
+  if (hasEpicId === hasLedgerPath) {
+    throw new Error('emitLoopTick: supply exactly one of epicId or ledgerPath');
+  }
+
+  let ledgerPath;
+  if (hasLedgerPath) {
+    if (
+      typeof ledgerPathOverride !== 'string' ||
+      ledgerPathOverride.length === 0
+    ) {
+      throw new Error('emitLoopTick: ledgerPath must be a non-empty string');
+    }
+    ledgerPath = ledgerPathOverride;
+  } else {
+    if (!Number.isInteger(epicId) || epicId < 1) {
+      throw new Error('emitLoopTick: epicId must be a positive integer');
+    }
+    ledgerPath = epicLedgerPath(epicId, config);
+  }
+
+  const payload = {
+    event: 'loop.tick',
+    loopName,
+    round,
+    cadence,
+    status,
+    timestamp,
+  };
+
+  // Route through the bus so the payload is schema-validated and the
+  // LedgerWriter's privileged onEmitted hook persists the record — the
+  // same path every lifecycle event flows through.
+  const { tempRoot, epicId: ledgerEpicId } = decomposeLedgerPath(ledgerPath);
+  const bus = createBus({ schemaDir: SCHEMA_DIR });
+  const writer = createLedgerWriter({ epicId: ledgerEpicId, tempRoot });
+  writer.register(bus);
+
+  const { seqId } = await bus.emit('loop.tick', payload);
+  return { ledgerPath: writer.ledgerPath, payload, seqId };
+}

package/.agents/scripts/lib/orchestration/lifecycle/listeners/automerge-armer.js

@@ -54,6 +54,8 @@
 
 import { spawnSync } from 'node:child_process';
 
+import { resolveAutoMergeArmCwd } from '../../auto-merge-cwd.js';
+
 /**
  * Default `gh pr view --json autoMergeRequest` probe. Pure-spawn helper
  * — exported so tests can stub the shell-out without touching the
@@ -77,12 +79,28 @@ export function ghPrViewAutoMerge({ prUrl, cwd, spawnFn = spawnSync }) {
  * helper. Exported so tests can stub. The arg list is captured in a
  * single helper so the merge-lockout lint allow-list narrows to one
  * literal site.
+ *
+ * Story #4282: `--delete-branch` makes `gh` shell out to local `git`
+ * (including a `git checkout <base>`). When this arm runs from a per-Story
+ * worktree cwd checked out on the head branch while the base branch is
+ * occupied by the primary worktree, that checkout collides
+ * (`fatal: '<base>' is already used by worktree`). We re-point the spawn
+ * cwd at the primary worktree root (which holds the base branch) via
+ * `resolveAutoMergeArmCwd`, so the local checkout is a no-op while
+ * `--delete-branch` (head-branch-removed-on-merge) is preserved. The
+ * resolver is non-fatal — it degrades to the original cwd.
  */
-export function ghPrMergeAuto({ prUrl, cwd, spawnFn = spawnSync }) {
+export function ghPrMergeAuto({
+  prUrl,
+  cwd,
+  spawnFn = spawnSync,
+  resolveArmCwd = resolveAutoMergeArmCwd,
+}) {
+  const armCwd = resolveArmCwd(cwd);
   const result = spawnFn(
     'gh',
     ['pr', 'merge', prUrl, '--auto', '--squash', '--delete-branch'],
-    { cwd, encoding: 'utf-8', shell: false },
+    { cwd: armCwd, encoding: 'utf-8', shell: false },
   );
   return {
     status: result.status ?? 1,

package/.agents/scripts/lib/orchestration/project-meta-cache.js

@@ -0,0 +1,238 @@
+/**
+ * project-meta-cache — on-disk cache for repo-invariant GitHub Projects v2
+ * board metadata (Story #4252).
+ *
+ * Every `agent::*` label flip routes through `transitionTicketState` →
+ * `ColumnSync.sync`, which must resolve the board's `{ projectId, fieldId,
+ * options }` before issuing the Status mutation. Single-story delivery
+ * performs each flip in a *separate cold CLI process* (init → executing,
+ * close → closing, confirm-merge → done, plus `resync-status-column`), so
+ * the in-process `_meta` cache is always empty and every flip re-pays
+ * `resolveProjectMeta` + an item-id lookup + the mutation (~3 GraphQL
+ * round-trips).
+ *
+ * The board metadata is **repo-invariant** — it changes only when the
+ * Status single-select field is reconfigured — so it is a prime candidate
+ * for an on-disk cache that survives across the cold processes. This module
+ * persists the resolved metadata to a small JSON file under the resolved
+ * `tempRoot`, keyed by `owner/projectNumber`, carrying a TTL. Correctness
+ * is bounded by "the mutation still validates against the live board": a
+ * stale entry at worst causes one failed mutation, which the caller treats
+ * as a signal to invalidate the entry and re-resolve — never a wrong write.
+ *
+ * Layout: `<tempRoot>/cache/project-meta.json`, a single JSON object keyed
+ * by `<owner>/<projectNumber>`:
+ *
+ *   {
+ *     "dsj1984/1": {
+ *       "cachedAt": 1718000000000,
+ *       "projectId": "PVT_…",
+ *       "fieldId": "PVTSSF_…",
+ *       "options": { "Todo": "abc", "In Progress": "def", "Done": "ghi" }
+ *     }
+ *   }
+ *
+ * The `options` map is serialised as a plain object and re-hydrated into a
+ * `Map<name, id>` on read so the ColumnSync call site is identical whether
+ * the metadata came from the disk cache or a live resolve.
+ *
+ * The cache file lives under `tempRoot`, which is gitignored
+ * (`temp/` in `.gitignore`), so it introduces no new tracked artifact.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { anchorTempRoot, tempRootFrom } from '../config/temp-paths.js';
+
+/**
+ * Default time-to-live for a cached board-metadata entry, in milliseconds.
+ * Board metadata is repo-invariant (it only changes on a manual Status
+ * field reconfiguration), so a generous TTL is safe — and a stale entry is
+ * self-healing via invalidate-on-error regardless. One hour comfortably
+ * spans a single `/single-story-deliver` run's four cold flips while still
+ * forcing a periodic re-resolve.
+ */
+const DEFAULT_META_TTL_MS = 60 * 60 * 1000;
+
+/**
+ * Resolve the path to the on-disk project-meta cache file under the
+ * (anchored) resolved `tempRoot`. A relative `tempRoot` is anchored to the
+ * main checkout root so a worktree child and the main-checkout host
+ * converge on the same file (Story #3900 semantics, reused here).
+ *
+ * @param {object} [config] Optional resolved config bag. Omitted → framework
+ *   default (`temp`).
+ * @returns {string}
+ */
+function projectMetaCachePath(config) {
+  return path.join(
+    anchorTempRoot(tempRootFrom(config)),
+    'cache',
+    'project-meta.json',
+  );
+}
+
+/**
+ * Build the per-board cache key from `(owner, projectNumber)`.
+ *
+ * @param {string|null|undefined} owner
+ * @param {number|string|null|undefined} projectNumber
+ * @returns {string|null} `<owner>/<projectNumber>`, or null when either part
+ *   is missing (an un-keyable board — caller skips the cache).
+ */
+function projectMetaCacheKey(owner, projectNumber) {
+  if (!owner || projectNumber === null || projectNumber === undefined) {
+    return null;
+  }
+  return `${owner}/${projectNumber}`;
+}
+
+/**
+ * Read the entire cache file as a plain object. Returns an empty object on
+ * any read/parse failure (missing file, malformed JSON) so the caller treats
+ * a corrupt cache as a cold miss rather than throwing.
+ *
+ * @param {string} filePath
+ * @returns {Record<string, object>}
+ */
+function readCacheFile(filePath) {
+  try {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Read a cached metadata entry for `(owner, projectNumber)`.
+ *
+ * Returns the re-hydrated `{ projectId, fieldId, options: Map }` descriptor
+ * when a fresh (within TTL) entry exists, or `null` on a miss / expired /
+ * malformed entry. Never throws — a read failure is a cache miss.
+ *
+ * @param {{
+ *   owner?: string|null,
+ *   projectNumber?: number|string|null,
+ *   config?: object,
+ *   ttlMs?: number,
+ *   now?: number,
+ * }} opts
+ * @returns {{ projectId: string, fieldId: string, options: Map<string,string> } | null}
+ */
+export function readProjectMetaCache(opts = {}) {
+  const key = projectMetaCacheKey(opts.owner, opts.projectNumber);
+  if (!key) return null;
+  const ttlMs = opts.ttlMs ?? DEFAULT_META_TTL_MS;
+  const now = opts.now ?? Date.now();
+
+  const filePath = projectMetaCachePath(opts.config);
+  const store = readCacheFile(filePath);
+  const entry = store[key];
+  if (!entry || typeof entry !== 'object') return null;
+
+  const { cachedAt, projectId, fieldId, options } = entry;
+  if (
+    typeof cachedAt !== 'number' ||
+    typeof projectId !== 'string' ||
+    typeof fieldId !== 'string' ||
+    !options ||
+    typeof options !== 'object'
+  ) {
+    return null;
+  }
+  // TTL check — an expired entry is a miss so the caller re-resolves.
+  if (now - cachedAt > ttlMs) return null;
+
+  return {
+    projectId,
+    fieldId,
+    options: new Map(Object.entries(options)),
+  };
+}
+
+/**
+ * Persist a resolved metadata descriptor for `(owner, projectNumber)`.
+ *
+ * The `options` value may be a `Map<name,id>` or a plain object; it is
+ * normalised to a plain object on disk. Best-effort: any write failure is
+ * swallowed (the cache is a pure optimisation — a failed write just means
+ * the next process re-resolves). Writes the rest of the store back intact so
+ * sibling board entries are preserved.
+ *
+ * @param {{
+ *   owner?: string|null,
+ *   projectNumber?: number|string|null,
+ *   meta: { projectId: string, fieldId: string, options: Map<string,string>|Record<string,string> },
+ *   config?: object,
+ *   now?: number,
+ * }} opts
+ * @returns {boolean} true when the entry was written, false on a skip/failure.
+ */
+export function writeProjectMetaCache(opts = {}) {
+  const key = projectMetaCacheKey(opts.owner, opts.projectNumber);
+  if (!key) return false;
+  const meta = opts.meta;
+  if (
+    !meta ||
+    typeof meta.projectId !== 'string' ||
+    typeof meta.fieldId !== 'string'
+  ) {
+    return false;
+  }
+  const now = opts.now ?? Date.now();
+
+  const options =
+    meta.options instanceof Map
+      ? Object.fromEntries(meta.options)
+      : { ...(meta.options ?? {}) };
+
+  const filePath = projectMetaCachePath(opts.config);
+  try {
+    const store = readCacheFile(filePath);
+    store[key] = {
+      cachedAt: now,
+      projectId: meta.projectId,
+      fieldId: meta.fieldId,
+      options,
+    };
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Invalidate (delete) the cached entry for `(owner, projectNumber)`.
+ *
+ * Called when a GraphQL error fires against a board whose metadata came from
+ * the cache, so a mid-run board reconfiguration self-heals on the next flip
+ * (which re-resolves and re-writes). Best-effort and idempotent: a missing
+ * entry or unreadable file is a no-op. Returns true when an entry was
+ * actually removed.
+ *
+ * @param {{
+ *   owner?: string|null,
+ *   projectNumber?: number|string|null,
+ *   config?: object,
+ * }} opts
+ * @returns {boolean}
+ */
+export function invalidateProjectMetaCache(opts = {}) {
+  const key = projectMetaCacheKey(opts.owner, opts.projectNumber);
+  if (!key) return false;
+  const filePath = projectMetaCachePath(opts.config);
+  try {
+    const store = readCacheFile(filePath);
+    if (!(key in store)) return false;
+    delete store[key];
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, `${JSON.stringify(store, null, 2)}\n`, 'utf8');
+    return true;
+  } catch {
+    return false;
+  }
+}

package/.agents/scripts/lib/orchestration/reassert-status-column.js

@@ -89,6 +89,7 @@ function defaultSleep(ms) {
  *   pollAttempts?: number,
  *   pollDelayMs?: number,
  *   sleepFn?: (ms: number) => Promise<void>,
+ *   config?: object,
  * }} args
  * @returns {Promise<{ status: string, column?: string, reason?: string, attempts?: number }>}
  */
@@ -100,6 +101,7 @@ export async function reassertStatusColumn(args) {
     pollAttempts = DEFAULT_POLL_ATTEMPTS,
     pollDelayMs = DEFAULT_POLL_DELAY_MS,
     sleepFn = defaultSleep,
+    config,
   } = args ?? {};
   if (!provider || typeof provider.getTicket !== 'function') {
     throw new TypeError(
@@ -128,7 +130,7 @@ export async function reassertStatusColumn(args) {
   if (!targetColumn) {
     return { status: 'skipped', reason: 'no-matching-label' };
   }
-  const sync = new ColumnSync({ provider, logger: logger ?? console });
+  const sync = new ColumnSync({ provider, logger: logger ?? console, config });
 
   // First attempt — always fires through ColumnSync.sync so the skip
   // paths (no-project / no-meta / no-option-<col> / not-on-project)

package/.agents/scripts/lib/orchestration/single-story-close/phases/auto-merge.js

@@ -12,9 +12,21 @@
  * inject a synchronous fake; the default runner delegates to
  * `gh.pr.merge`, which spawns through the classified, typed-error
  * surface instead of a raw `execFileSync('gh', …)` call.
+ *
+ * Story #4282 made arming robust when the base branch is checked out by a
+ * git worktree. The `--delete-branch` flag makes `gh` shell out to local
+ * `git` (including a `git checkout <base>`); from a per-Story worktree cwd
+ * that collides with the base branch already checked out by the primary
+ * worktree (`fatal: '<base>' is already used by worktree`). We now resolve
+ * the arm cwd to the **primary worktree root** (which holds the base
+ * branch) via `resolveAutoMergeArmCwd`, so `gh`'s local checkout is a
+ * no-op. `--delete-branch` is preserved verbatim, so the PR head branch is
+ * still deleted on merge without depending on the repo's auto-delete
+ * setting. Resolution is non-fatal — it degrades to the original cwd.
  */
 
 import { gh as defaultGh } from '../../../gh-exec.js';
+import { resolveAutoMergeArmCwd } from '../../auto-merge-cwd.js';
 
 /**
  * Enable GitHub native auto-merge on the PR. Non-fatal.
@@ -24,11 +36,22 @@ import { gh as defaultGh } from '../../../gh-exec.js';
  *   prNumber: number,
  *   gh?: ReturnType<typeof import('../../../gh-exec.js').createGh>,
  *   runner?: (args: string[], opts: object) => ({ status: number, stdout?: string, stderr?: string } | Promise<{ status: number, stdout?: string, stderr?: string }>),
+ *   resolveArmCwd?: (cwd: string) => string,
  * }} opts
  * @returns {Promise<{ enabled: boolean, reason?: string }>}
  */
-export async function enableAutoMergeWith({ cwd, prNumber, gh, runner }) {
+export async function enableAutoMergeWith({
+  cwd,
+  prNumber,
+  gh,
+  runner,
+  resolveArmCwd = resolveAutoMergeArmCwd,
+}) {
   const exec = runner ?? makeDefaultGhAutoMergeRunner(gh ?? defaultGh);
+  // Re-point the arm at the base-branch (primary) worktree so gh's
+  // `--delete-branch` local `git checkout <base>` cannot collide with the
+  // base branch already checked out by the primary worktree (Story #4282).
+  const armCwd = resolveArmCwd(cwd);
   try {
     const result = await exec(
       [
@@ -39,7 +62,7 @@ export async function enableAutoMergeWith({ cwd, prNumber, gh, runner }) {
         '--squash',
         '--delete-branch',
       ],
-      { cwd },
+      { cwd: armCwd },
     );
     if (result.status === 0) return { enabled: true };
     return {