mandrel 1.86.0 → 1.88.0

package/.agents/scripts/lib/feedback-loop/code-review-graduator.js

@@ -104,6 +104,13 @@ export function buildIdempotencyMarker(epicId, index) {
  * filter 🔴 (Critical Blocker — blocking) out; 🟠/🟡/🟢 are non-blocking
  * and graduate to follow-up issues.
  *
+ * Findings the Phase 5 focused-fix routing already fixed on-branch are
+ * rendered under a **"Fixed on-branch"** heading (Story #4399) with a ✅
+ * prefix so they no longer parse as open findings. As a belt-and-suspenders
+ * guard the parser also skips every line inside a Fixed-on-branch section
+ * outright, so a remediated 🟡 Medium never spawns a ghost follow-up issue
+ * even if its line retains its original severity emoji.
+ *
  * @param {string} body
  * @returns {Array<{ severity: 'high'|'medium'|'low', path: string, summary: string, index: number }>}
  */
@@ -112,9 +119,19 @@ export function parseFindings(body) {
   const findings = [];
   const lines = body.split(/\r?\n/);
   let idx = 0;
+  let inFixedSection = false;
   for (const line of lines) {
     const trimmed = line.trim();
     if (trimmed.length === 0) continue;
+    // Any markdown heading resets the Fixed-on-branch guard; a
+    // "Fixed on-branch" heading opens a section whose entries never
+    // graduate (Story #4399).
+    const headingMatch = trimmed.match(/^#{1,6}\s+(.+)$/);
+    if (headingMatch) {
+      inFixedSection = /fixed on-branch/i.test(headingMatch[1]);
+      continue;
+    }
+    if (inFixedSection) continue;
     let severity = null;
     if (trimmed.startsWith('🟠')) severity = 'high';
     else if (trimmed.startsWith('🟡')) severity = 'medium';

package/.agents/scripts/lib/framework-version.js

@@ -0,0 +1,210 @@
+// .agents/scripts/lib/framework-version.js
+/**
+ * framework-version.js — single source of truth for the running Mandrel
+ * framework version and the ticket-body authoring stamp.
+ *
+ * Two concerns live here:
+ *
+ * 1. **Version resolution.** Under npm distribution the root `package.json`
+ *    is the canonical version marker. {@link resolveFrameworkVersion} reads it
+ *    and degrades to `'unknown'` (never throws) so a missing/unreadable
+ *    manifest can never crash an authoring or hydration path. The private
+ *    `getVersion()` in `lib/orchestration/context-hydration-engine.js`
+ *    delegates here (DRY — one manifest reader).
+ *
+ * 2. **Ticket-body stamp.** Epics and Stories are stamped **once at authoring
+ *    time** with the running version and the authoring date, via a hybrid
+ *    surface:
+ *      - a hidden machine-readable field in the trailing
+ *        `<!-- meta: {"mandrel_version":"…","authored_at":"…"} -->` block
+ *        (the source of truth, queryable by tooling), and
+ *      - a single visible footer line
+ *        `> 🏷️ Authored with Mandrel v<version> · <YYYY-MM-DD>` so a human
+ *        reading the raw GitHub issue sees the provenance without any tooling.
+ *
+ *    The stamp is **immutable**: {@link stampFrameworkVersion} is a no-op when
+ *    the body already carries a `mandrel_version`, so a later re-render or
+ *    Epic-body edit preserves the originally-authored version verbatim rather
+ *    than bumping it to whatever version happens to be running.
+ *
+ * This module imports only Node builtins so it can be pulled in from the
+ * story-body serializer, the ticket provider, and the Epic ideation renderer
+ * without risking an import cycle.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Returned when the package manifest is absent or unreadable. */
+export const FALLBACK_VERSION = 'unknown';
+
+/**
+ * Trailing machine-metadata comment block: `<!-- meta: {...} -->`. Mirrors the
+ * regex the Story-body parser uses so both surfaces recognise the same block.
+ */
+const META_BLOCK_RE = /<!--\s*meta:\s*(\{[\s\S]*?\})\s*-->/;
+
+/**
+ * The visible authoring marker line. A blockquote so GitHub renders it as a
+ * callout. Used both to detect an already-emitted marker (for the strip step)
+ * and, in the Story-body parser, to skip the line during section parsing so it
+ * never pollutes the last structured section.
+ */
+export const AUTHORED_MARKER_LINE_RE = /^\s*>\s*🏷️\s+Authored with Mandrel\b/;
+
+/**
+ * Compute the default path to the root `package.json`. This module ships inside
+ * the `mandrel` package at `<pkgRoot>/.agents/scripts/lib/framework-version.js`,
+ * so the manifest sits three directories up — the same layout in the dev repo
+ * and the published tarball.
+ *
+ * @returns {string}
+ */
+function defaultPkgPath() {
+  const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+  return path.resolve(moduleDir, '../../..', 'package.json');
+}
+
+/**
+ * Resolve the running framework version from the root `package.json`. Degrades
+ * to {@link FALLBACK_VERSION} (never throws) on any read or parse failure so a
+ * missing/unreadable manifest can never crash an authoring or hydration path.
+ *
+ * @param {{ pkgPath?: string }} [opts] - `pkgPath` override (test seam).
+ * @returns {string}
+ */
+export function resolveFrameworkVersion({ pkgPath } = {}) {
+  try {
+    const resolved = typeof pkgPath === 'string' ? pkgPath : defaultPkgPath();
+    const parsed = JSON.parse(fs.readFileSync(resolved, 'utf8'));
+    return typeof parsed.version === 'string' && parsed.version.trim()
+      ? parsed.version.trim()
+      : FALLBACK_VERSION;
+  } catch {
+    return FALLBACK_VERSION;
+  }
+}
+
+/**
+ * Format an authoring date as `YYYY-MM-DD` (UTC). Matches the date shape the
+ * rest of the authoring path uses (e.g. `qa-session`).
+ *
+ * @param {Date} [date=new Date()]
+ * @returns {string}
+ */
+export function formatAuthoredDate(date = new Date()) {
+  const d =
+    date instanceof Date && !Number.isNaN(date.getTime()) ? date : new Date();
+  return d.toISOString().slice(0, 10);
+}
+
+/**
+ * Build the visible authoring marker line for a given stamp. Centralised so
+ * the string is byte-identical across the two producers (the Story-body
+ * serializer and {@link stampFrameworkVersion}).
+ *
+ * @param {{ version: string, authoredAt: string }} stamp
+ * @returns {string}
+ */
+export function authoredMarkerLine({ version, authoredAt }) {
+  return `> 🏷️ Authored with Mandrel v${version} · ${authoredAt}`;
+}
+
+/**
+ * Read the framework stamp from a body's trailing meta block. Returns
+ * `{ version, authoredAt }` when a non-empty `mandrel_version` is present, or
+ * `null` when the body carries no stamp (or the meta block is malformed).
+ * `authoredAt` is `null` when the version is present but the date is absent.
+ *
+ * @param {string} markdown
+ * @returns {{ version: string, authoredAt: string|null }|null}
+ */
+export function extractFrameworkStamp(markdown) {
+  if (typeof markdown !== 'string') return null;
+  const match = markdown.match(META_BLOCK_RE);
+  if (!match) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(match[1]);
+  } catch {
+    return null;
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return null;
+  }
+  const version =
+    typeof parsed.mandrel_version === 'string' && parsed.mandrel_version.trim()
+      ? parsed.mandrel_version.trim()
+      : null;
+  if (version === null) return null;
+  const authoredAt =
+    typeof parsed.authored_at === 'string' && parsed.authored_at.trim()
+      ? parsed.authored_at.trim()
+      : null;
+  return { version, authoredAt };
+}
+
+/**
+ * Stamp a ticket body (Epic or Story markdown) with the framework version and
+ * authoring date — **once**. When the body already carries a `mandrel_version`
+ * the body is returned verbatim (immutability: never re-derive or bump an
+ * already-authored stamp). Otherwise the version keys are merged into (or
+ * create) the trailing `<!-- meta -->` block — appended **last** so the key
+ * order stays stable with the Story-body serializer — and the visible marker
+ * line is (re)emitted just above it.
+ *
+ * The `version` / `authoredAt` overrides let a caller (e.g. the Epic edit path)
+ * preserve a previously-authored stamp; both default to the running version and
+ * today's date when omitted.
+ *
+ * @param {string} markdown
+ * @param {{ version?: string, authoredAt?: string }} [stamp]
+ * @returns {string}
+ */
+export function stampFrameworkVersion(markdown, stamp = {}) {
+  const body = typeof markdown === 'string' ? markdown : '';
+
+  // Immutability: a body that already carries a version is preserved verbatim.
+  if (extractFrameworkStamp(body) !== null) return body;
+
+  const version =
+    typeof stamp?.version === 'string' && stamp.version.trim()
+      ? stamp.version.trim()
+      : resolveFrameworkVersion();
+  const authoredAt =
+    typeof stamp?.authoredAt === 'string' && stamp.authoredAt.trim()
+      ? stamp.authoredAt.trim()
+      : formatAuthoredDate();
+
+  // Merge into any existing (version-less) meta block, appending the version
+  // keys last for stable key order.
+  const metaMatch = body.match(META_BLOCK_RE);
+  const meta = {};
+  if (metaMatch) {
+    try {
+      const parsed = JSON.parse(metaMatch[1]);
+      if (
+        parsed !== null &&
+        typeof parsed === 'object' &&
+        !Array.isArray(parsed)
+      ) {
+        Object.assign(meta, parsed);
+      }
+    } catch {
+      // Malformed meta comment — drop it and re-emit a clean block.
+    }
+  }
+  meta.mandrel_version = version;
+  meta.authored_at = authoredAt;
+
+  // Strip any existing meta block / marker so both re-append canonically.
+  const head = body
+    .replace(META_BLOCK_RE, '')
+    .replace(new RegExp(AUTHORED_MARKER_LINE_RE.source, 'm'), '')
+    .replace(/\n{3,}/g, '\n\n')
+    .trimEnd();
+
+  const marker = authoredMarkerLine({ version, authoredAt });
+  return `${head}\n\n${marker}\n\n<!-- meta: ${JSON.stringify(meta)} -->`;
+}

package/.agents/scripts/lib/orchestration/context-hydration-engine.js

@@ -19,7 +19,6 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 import { getCommands } from '../config/commands.js';
 import {
   getLimits,
@@ -28,6 +27,7 @@ import {
   resolveConfig,
 } from '../config-resolver.js';
 import { sliceEpicBodyForDelivery } from '../epic-body-sections.js';
+import { resolveFrameworkVersion } from '../framework-version.js';
 import { Logger } from '../Logger.js';
 import {
   buildEnvelope,
@@ -133,31 +133,16 @@ export function formatSkillCapsulesSection(entries) {
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the framework version from the installed package's `package.json`.
- *
- * Under npm distribution `package.json` is the single source of truth for the
- * framework version (the legacy plaintext version marker is retired). This
- * module ships inside the `mandrel` package at
- * `<pkgRoot>/.agents/scripts/lib/orchestration/context-hydration-engine.js`,
- * so the package manifest sits four directories up — the same layout in the
- * dev repo and in the published tarball. Read that manifest's `version`.
- *
- * Falls back to `'unknown'` when the manifest is absent or unreadable so a
- * missing package.json never crashes hydration.
+ * Resolve the framework version. Delegates to the shared
+ * {@link resolveFrameworkVersion} helper (single owner of the root
+ * `package.json` read) so the hydrator and the ticket-body stamp read the same
+ * source. Retained as a thin named wrapper so the mismatch-warning call sites
+ * below read against a stable local name.
  *
  * @returns {string}
  */
 function getVersion() {
-  try {
-    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
-    const pkgPath = path.resolve(moduleDir, '../../../..', 'package.json');
-    const parsed = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-    return typeof parsed.version === 'string' && parsed.version.trim()
-      ? parsed.version.trim()
-      : 'unknown';
-  } catch {
-    return 'unknown';
-  }
+  return resolveFrameworkVersion();
 }
 
 /**

package/.agents/scripts/lib/orchestration/epic-cleanup.js

@@ -152,6 +152,40 @@ export function findWorktreePathForBranch(branch, worktrees) {
   return null;
 }
 
+/**
+ * Classify a `git branch -D <branch>` result. Pure — no IO. Exported as the
+ * clean unit-test seam for the not-found rule (this module carries a
+ * `node:coverage ignore file` header, so the git-side glue is not directly
+ * covered).
+ *
+ * Story #4393 — on the `/deliver` post-merge reap path a branch is routinely
+ * *already gone* (a prior sweep, a re-run, or GitHub's `--delete-branch`
+ * already dropped it). `git branch -D` then exits non-zero with a "not found"
+ * stderr. That is an **already-reaped success**, not a reap failure: counting
+ * it as a failure forces `reapEpicBranches().ok` false, which makes
+ * BranchCleaner classify `failed`, which flips the merged Epic to
+ * `agent::blocked` and reopens it. Only a not-found stderr is absorbed as
+ * success; every other non-zero exit stays a genuine failure.
+ *
+ * @param {{ status: number, stderr?: string }} branchDel
+ * @returns {{ branchDeleted: boolean, alreadyAbsent: boolean, stderr?: string }}
+ */
+export function classifyBranchDeletion(branchDel) {
+  if (branchDel?.status === 0) {
+    return { branchDeleted: true, alreadyAbsent: false };
+  }
+  const stderr = (branchDel?.stderr ?? '').trim();
+  // git's own message for a missing ref: "error: branch 'foo' not found."
+  if (/\bnot found\b/i.test(stderr)) {
+    return { branchDeleted: true, alreadyAbsent: true };
+  }
+  return {
+    branchDeleted: false,
+    alreadyAbsent: false,
+    ...(stderr ? { stderr } : {}),
+  };
+}
+
 /**
  * Reap a single branch. Best-effort worktree remove → fallback to `--force`
  * → fallback to filesystem rm → `git worktree prune` → `git branch -D`.
@@ -164,7 +198,7 @@ export function findWorktreePathForBranch(branch, worktrees) {
  *   rmSyncFn?: (path: string, opts: object) => void,
  *   logger?: { info?: Function, warn?: Function },
  * }} opts
- * @returns {{ branch: string, worktreeReaped: boolean, branchDeleted: boolean, method: string, stderr?: string }}
+ * @returns {{ branch: string, worktreeReaped: boolean, branchDeleted: boolean, alreadyAbsent: boolean, method: string, stderr?: string }}
  */
 export function reapBranch(opts) {
   const { branch, cwd, worktreePath, gitSpawn, rmSyncFn, logger } = opts;
@@ -201,16 +235,18 @@ export function reapBranch(opts) {
     gitSpawn(cwd, 'worktree', 'prune');
   }
 
-  // Drop the local branch.
+  // Drop the local branch. An already-absent branch (git → "not found") is
+  // already reaped — classifyBranchDeletion absorbs it as success so a benign
+  // missing ref never counts as a reap failure (Story #4393).
   const branchDel = gitSpawn(cwd, 'branch', '-D', branch);
-  const branchDeleted = branchDel.status === 0;
-  const stderr =
-    !branchDeleted && branchDel.stderr ? branchDel.stderr.trim() : undefined;
+  const { branchDeleted, alreadyAbsent, stderr } =
+    classifyBranchDeletion(branchDel);
 
   return {
     branch,
     worktreeReaped,
     branchDeleted,
+    alreadyAbsent,
     method: method ?? 'unknown',
     ...(stderr ? { stderr } : {}),
   };

package/.agents/scripts/lib/orchestration/epic-spec-reconciler-diff.js

@@ -81,6 +81,10 @@
  */
 
 import { composeStoryBody } from '../../providers/github/tickets.js';
+import {
+  extractFrameworkStamp,
+  stampFrameworkVersion,
+} from '../framework-version.js';
 import { assertPlanLabelAllowList } from './epic-spec-reconciler-discriminator.js';
 import {
   closeOp,
@@ -233,12 +237,21 @@ function stripFooter(body) {
  * `composeStoryBody` directly makes that divergence structurally
  * impossible going forward.
  *
+ * Story #4382 — the create-time authoring stamp (`mandrel_version` /
+ * `authored_at` meta field + visible marker) is provenance, not spec-derived
+ * content, so this UPDATE path never mints or bumps it (which would also break
+ * this function's purity — the stamp uses a clock). Instead the stamp already
+ * present on the **live** GH body (`obsBody`) is preserved verbatim, and a
+ * legacy stamp-less body is left stamp-less (no backfill — see the Story's
+ * Out-of-Scope). Footer recomposition therefore runs in `stamp: false` mode.
+ *
  * @param {{entity: string, parentSlug?: string|null, dependsOn?: string[]}} specEntity
  * @param {string} specBody
  * @param {{state?: StateInput}} ctx
+ * @param {string} [obsBody] - The live GH body, source of the preserved stamp.
  * @returns {string}
  */
-function composeBodyWithFooter(specEntity, specBody, ctx) {
+function composeBodyWithFooter(specEntity, specBody, ctx, obsBody = '') {
   const state = ctx?.state ?? {};
   const mapping = state.mapping ?? {};
   const parentSlug = specEntity.parentSlug ?? null;
@@ -264,7 +277,25 @@ function composeBodyWithFooter(specEntity, specBody, ctx) {
   // included) or emits a canonical-form body. With the strip, the
   // function is idempotent against its own output.
   const head = stripFooter(specBody);
-  return composeStoryBody({ body: head, parentId, epicId, dependencies });
+  // Preserve the live body's create-time authoring stamp (Story #4382). When
+  // the spec head already carries it, `stampFrameworkVersion` is a no-op
+  // (immutable); when it doesn't, the stamp is restored from the live body so
+  // the recomposed form matches GH and no spurious body Update fires. A
+  // legacy body with no stamp stays stamp-less (no backfill).
+  const priorStamp = extractFrameworkStamp(obsBody);
+  const stampedHead = priorStamp
+    ? stampFrameworkVersion(head, {
+        version: priorStamp.version,
+        authoredAt: priorStamp.authoredAt,
+      })
+    : head;
+  return composeStoryBody({
+    body: stampedHead,
+    parentId,
+    epicId,
+    dependencies,
+    stamp: false,
+  });
 }
 
 /**
@@ -329,7 +360,7 @@ function fieldChanges(specEntity, obs, mapping, ctx = {}) {
       // Emit a body change only when the canonical form differs from
       // what is on GH today — and write the canonical form back, so the
       // footer cascade-readers depend on stays intact across resumes.
-      const after = composeBodyWithFooter(specEntity, specBody, ctx);
+      const after = composeBodyWithFooter(specEntity, specBody, ctx, obsBody);
       if (after !== obsBody) {
         changes.body = { before: obsBody, after };
       }

package/.agents/scripts/lib/orchestration/git-cleanup/phases/branches.js

@@ -21,6 +21,7 @@ import {
 } from './branches-reap.js';
 import { computeProtectedReason } from './filters.js';
 import {
+  branchLastCommitAt,
   branchTipSha,
   classifyLatestPr,
   currentBranch as defaultCurrentBranch,
@@ -28,14 +29,18 @@ import {
   listMergedBranches,
   listRemoteBranches,
   probeAllPrs,
+  probeContentEquivalent,
   probeLatestPr,
   pruneRemoteTracking,
   readProtectedConfig,
+  refExists,
   removeWorktree,
   worktreesByBranch,
 } from './git-probes.js';
 import { parsePrunedRefs } from './prune.js';
 
+const TAG = '[git-cleanup]';
+
 function skipEntryFromVerdict(branch, verdict) {
   const entry = { branch, reason: verdict.reason };
   if (verdict.prNumber != null) entry.prNumber = verdict.prNumber;
@@ -44,8 +49,37 @@ function skipEntryFromVerdict(branch, verdict) {
   return entry;
 }
 
+/**
+ * Story #4395 — the third detection signal. Reached only when the branch
+ * has no reapable PR verdict and is not an ancestor of `<base>` (or
+ * `origin/<base>`). Probes content-equivalence via `git merge-tree
+ * --write-tree` and, when the probe is conclusive and the merge is a
+ * no-op, classifies the branch as `content-merged` instead of falling
+ * through to the `not-merged` skip.
+ */
+function evaluateContentEquivalence({
+  branch,
+  baseBranch,
+  cwd,
+  contentEquivalentFn,
+  branchLastCommitFn,
+}) {
+  const verdict = contentEquivalentFn({ cwd, base: baseBranch, branch });
+  if (verdict?.supported && verdict.equivalent) {
+    return { detectedBy: 'content-merged' };
+  }
+  return {
+    skip: {
+      branch,
+      reason: 'not-merged',
+      lastCommitAt: branchLastCommitFn(cwd, branch),
+    },
+  };
+}
+
 function evaluateLocalBranch({
   branch,
+  baseBranch,
   classify,
   filter,
   mergedByGit,
@@ -54,6 +88,8 @@ function evaluateLocalBranch({
   wtMap,
   remoteName,
   branchTipShaFn,
+  contentEquivalentFn,
+  branchLastCommitFn,
 }) {
   const protectedReason = classify(branch);
   if (protectedReason) return { skip: { branch, reason: protectedReason } };
@@ -78,7 +114,15 @@ function evaluateLocalBranch({
   } else if (mergedByGit.has(branch)) {
     detectedBy = 'git-merged';
   } else {
-    return { skip: { branch, reason: 'not-merged' } };
+    const out = evaluateContentEquivalence({
+      branch,
+      baseBranch,
+      cwd,
+      contentEquivalentFn,
+      branchLastCommitFn,
+    });
+    if (out.skip) return out;
+    detectedBy = out.detectedBy;
   }
   const wt = wtMap.get(branch);
   return {
@@ -156,7 +200,43 @@ function collectRemoteOnlyCandidates({
  * the per-branch fallback for head refs absent from the bulk page (a PR
  * that fell outside the fetch window), so correctness is preserved for
  * every branch. Injecting `prProbe` bypasses the bulk fetch entirely.
+ *
+ * Story #4395 adds three refinements:
+ *   - **Content-equivalence signal.** A local branch with no reapable PR
+ *     verdict and no ancestry match gets one more chance via
+ *     {@link probeContentEquivalent} (`git merge-tree --write-tree`):
+ *     when merging it into `baseBranch` would be a content no-op, it is
+ *     classified `detectedBy: 'content-merged'` instead of skipped.
+ *   - **Fresh ancestry anchor.** The ancestry signal (`git branch --merged`)
+ *     is unioned against `origin/<base>` (via `refExistsFn` + `mergedLister`)
+ *     whenever that remote-tracking ref exists, so a stale local `<base>`
+ *     no longer hides a branch already merged on the remote.
+ *   - **Graceful `gh` degradation.** A throwing `gh` runner (auth failure,
+ *     rate limit, missing binary) inside the bulk index fetch or the
+ *     per-branch fallback is caught, logged once, and degrades to
+ *     git-only signals (ancestry + content-equivalence) rather than
+ *     aborting the whole plan. The returned envelope's `ghDegraded` flag
+ *     records whether this happened.
  */
+function buildGuardedPrProbe({ cwd, prIndexFn, prFallback, onDegrade }) {
+  let prIndex;
+  try {
+    prIndex = prIndexFn(cwd);
+  } catch (err) {
+    onDegrade(err);
+    prIndex = new Map();
+  }
+  return (branch, c) => {
+    if (prIndex.has(branch)) return prIndex.get(branch);
+    try {
+      return prFallback(branch, c);
+    } catch (err) {
+      onDegrade(err);
+      return null;
+    }
+  };
+}
+
 export function planCleanup(ctx) {
   const {
     cwd,
@@ -170,18 +250,26 @@ export function planCleanup(ctx) {
     prIndexFn = probeAllPrs,
     prFallback = probeLatestPr,
     branchTipShaFn = branchTipSha,
+    contentEquivalentFn = probeContentEquivalent,
+    branchLastCommitFn = branchLastCommitAt,
+    refExistsFn = refExists,
     filter = () => true,
     includeRemoteOnly = false,
     remoteLister = listRemoteBranches,
     remoteName = 'origin',
+    logger = Logger,
   } = ctx;
+  let ghDegraded = false;
+  const onDegrade = (err) => {
+    if (ghDegraded) return;
+    ghDegraded = true;
+    logger.warn?.(
+      `${TAG} ⚠️ gh probe failed (${err?.message ?? err}); continuing with git-only signals`,
+    );
+  };
   const prProbe =
     injectedPrProbe ??
-    (() => {
-      const prIndex = prIndexFn(cwd);
-      return (branch, c) =>
-        prIndex.has(branch) ? prIndex.get(branch) : prFallback(branch, c);
-    })();
+    buildGuardedPrProbe({ cwd, prIndexFn, prFallback, onDegrade });
   const resolvedCurrent = currentBranchFn(cwd);
   const resolvedConfigured = protectedConfigFn(cwd);
   const classify = (branch) =>
@@ -193,6 +281,10 @@ export function planCleanup(ctx) {
     });
   const wtMap = worktreesFn(cwd);
   const mergedByGit = new Set(mergedLister(cwd, baseBranch));
+  const remoteBaseRef = `${remoteName}/${baseBranch}`;
+  if (refExistsFn(cwd, remoteBaseRef)) {
+    for (const b of mergedLister(cwd, remoteBaseRef)) mergedByGit.add(b);
+  }
   const localBranches = localLister(cwd);
   const localSet = new Set(localBranches);
   const candidates = [];
@@ -200,6 +292,7 @@ export function planCleanup(ctx) {
   for (const branch of localBranches) {
     const out = evaluateLocalBranch({
       branch,
+      baseBranch,
       classify,
       filter,
       mergedByGit,
@@ -208,6 +301,8 @@ export function planCleanup(ctx) {
       wtMap,
       remoteName,
       branchTipShaFn,
+      contentEquivalentFn,
+      branchLastCommitFn,
     });
     if (out.skip) skipped.push(out.skip);
     else candidates.push(out.candidate);
@@ -227,7 +322,7 @@ export function planCleanup(ctx) {
       }),
     );
   }
-  return { candidates, skipped };
+  return { candidates, skipped, ghDegraded };
 }
 
 /**