pr-shepherd 0.56.1 → 0.56.3

package/bin/cli/help.d.mts

@@ -11,8 +11,9 @@ Usage:
   pr-shepherd apply journal [PR] --file <path> [--dry-run] [--format text|json]
   pr-shepherd apply check-blocker [PR] --check <name> --blocked-by <ref>
   pr-shepherd apply check-blocker [PR] --check <name> --clear
+  pr-shepherd apply queue-removal [PR] --require-sha <head> --queue-commit <commit> --removed-at <unix>
 
-Run 'pr-shepherd apply <review|files|journal|check-blocker> --help' for command-specific details.
+Run 'pr-shepherd apply <review|files|journal|check-blocker|queue-removal> --help' for command-specific details.
 --help, -h                      Print this help and exit before GitHub I/O.`;
     readonly "apply review": `pr-shepherd apply review
 
@@ -80,6 +81,20 @@ Usage:
 
 \`--clear\` removes that check's record and leaves other checks alone.
 --help, -h                      Print this help and exit before any I/O.`;
+    readonly "apply queue-removal": `pr-shepherd apply queue-removal
+
+Acknowledge one current CI-driven merge-queue removal for a native-stack PR.
+This writes local state only after a fresh GitHub read confirms the supplied head,
+queue commit, and removal timestamp still identify the current removal.
+
+Usage:
+  pr-shepherd apply queue-removal [PR] --require-sha <head> --queue-commit <commit> --removed-at <unix>
+
+--require-sha <sha>       Full 40-character lowercase PR head SHA observed with the failure.
+--queue-commit <sha>      Full 40-character lowercase synthetic merge-group commit SHA.
+--removed-at <unix>       Removal time in Unix seconds.
+--format text|json        Output format. Default: text.
+--help, -h                Print this help and exit before any I/O.`;
     readonly "build-suggestion-patches": `pr-shepherd build-suggestion-patches
 
 Build an ordered list of patches and commit instructions from GitHub review suggestions.
@@ -212,7 +227,7 @@ Flags:
 
 PR may be a number or GitHub pull request URL. When omitted, the current branch PR is inferred.
 Exit code: 0 on success; nonzero on failure (sysexits.h — see docs/exit-codes.md).`;
-    readonly iterate: "pr-shepherd iterate\n\nRun one iterate tick for a pull request. The no-subcommand form polls; use this subcommand for a single tick.\nThe output contains one action and an action-specific ## Instructions section.\n\nUsage:\n  pr-shepherd iterate [PR] [iterate-flags]\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n  --merge                        Shepherd through readiness, then emit a merge or merge-queue command.\n  --format text|json             Output Markdown text or JSON. Default: text.\n  --verbose                      Include verbose iterate fields.\n  --help, -h                     Print this help and exit before GitHub, git, config, or log I/O.\n\nDurations accept s/m/h suffixes: 30s, 4.5m, 1h. A bare number is minutes; decimals are allowed only with an explicit unit (4.5m).\n\nActions:\n  WAIT        No immediate action; continue with the next poll.\n  MARK_READY  Draft PR was marked ready; continue with the next poll.\n  READY       Clean PR is inside the ready-delay. Schedule the rerun for when remainingSeconds elapses. Do not invent unrelated work. Already-owned later work may continue.\n  FIX_CODE    Agent action is required; follow the instructions, then continue polling.\n  CANCEL      Stop polling: merged/closed or ready-delay elapsed.\n  ESCALATE    Stop polling until a human provides direction.\n  MERGE       Run the emitted merge/queue command, then continue monitoring.\n\nExit codes:\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT or READY\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\n  15  MERGE\n  A command/validation/GitHub failure exits with a sysexits.h code instead (see docs/exit-codes.md).";
+    readonly iterate: "pr-shepherd iterate\n\nRun one iterate tick for a pull request. The no-subcommand form polls; use this subcommand for a single tick.\nThe output contains one action and an action-specific ## Instructions section.\n\nUsage:\n  pr-shepherd iterate [PR] [iterate-flags]\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n  --merge                        Shepherd through readiness, then emit a merge or merge-queue command.\n  --format text|json             Output Markdown text or JSON. Default: text.\n  --verbose                      Include verbose iterate fields.\n  --help, -h                     Print this help and exit before GitHub, git, config, or log I/O.\n\nDurations accept s/m/h suffixes: 30s, 4.5m, 1h. A bare number is minutes; decimals are allowed only with an explicit unit (4.5m).\n\nActions:\n  WAIT        No immediate action; continue with the next poll.\n  MARK_READY  Draft PR was marked ready; continue with the next poll.\n  READY       Clean PR is inside the ready-delay. Schedule the rerun for when remainingSeconds elapses. Do not invent unrelated work. Already-owned later work may continue.\n  FIX_CODE    Agent action is required; follow the instructions, then continue polling.\n  CANCEL      Stop polling this pull request: merged/closed or ready-delay elapsed. Continue remaining work from the original request.\n  ESCALATE    Stop polling until a human provides direction.\n  MERGE       Run the emitted merge/queue command, then continue monitoring.\n\nExit codes:\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT or READY\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\n  15  MERGE\n  A command/validation/GitHub failure exits with a sysexits.h code instead (see docs/exit-codes.md).";
     readonly poll: "pr-shepherd poll\n\nRun iterate repeatedly for one PR, or read compact summaries for an explicit PR set or native\nGitHub stack. Aggregate mode returns when any row needs work, every row is terminal, or timeout.\nPoll exits as soon as iterate returns READY, MARK_READY, CANCEL, or ESCALATE, or when timeout\nreturns the last WAIT result. FIX_CODE starts a --debounce settle window (default:\npoll.debounceSeconds; built-in 1m): poll keeps\niterating at --interval, then runs one more tick after the window and returns that result.\nWith --until-terminal or --merge, poll also continues through MARK_READY.\n\nUsage:\n  pr-shepherd poll [PR ...] [poll-flags] [iterate-flags]\n  pr-shepherd poll --stack PR [poll-flags] [iterate-flags]\n\nPoll flags:\n  --stack PR                    Select all entries in PR's native GitHub stack, bottom to top.\n  --interval <duration>          Sleep between WAIT ticks. Bare number = seconds. Default: poll.intervalSeconds (built-in 60s). Stack and multi-PR polls multiply that by poll.stackIntervalFactor (built-in 2) unless this flag is set.\n  --timeout <duration>           Maximum wall-clock wait for WAIT ticks. Bare number = seconds. Default: poll.timeoutSeconds (built-in 4.5m).\n  --debounce <duration>          Settle window after first FIX_CODE or stack SHEPHERD before returning. Bare number = seconds. Default: poll.debounceSeconds (built-in 60s). 0 disables.\n  --quiet-status                 Print only changed WAIT snapshots. Overrides poll.quietStatus.\n  --no-quiet-status              Print every WAIT snapshot. Overrides poll.quietStatus.\n  --until-terminal               Continue through WAIT/MARK_READY until READY/FIX_CODE/MERGE/CANCEL/ESCALATE or stack SHEPHERD.\n\nForwarded iterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n  --merge                        Shepherd through readiness, then emit a merge or merge-queue command.\n  --format text|json             Output Markdown text or JSON. Default: text.\n  --verbose                      Include verbose iterate fields and detailed per-tick lines.\n  --help, -h                     Print this help and exit before GitHub, git, config, or log I/O.\n\nDurations accept s/m/h suffixes: 30s, 4.5m, 1h. A bare number uses each flag's default unit (seconds\nfor --interval/--timeout/--debounce, minutes for --ready-delay/--stall-timeout); decimals are allowed only with\nan explicit unit (4.5m).\nEach WAIT tick writes a stderr line naming what it is waiting on by default; poll.quietStatus can change that default, --quiet-status/--no-quiet-status override it, and --verbose emits detailed per-tick lines.\nFIX_CODE debounce writes a remaining-seconds line to stderr. --timeout does not cut an in-flight debounce short.\nWith --until-terminal, --timeout is ignored for WAIT ticks and polling continues until READY, FIX_CODE, MERGE, CANCEL, or ESCALATE. With --merge, --timeout still bounds WAIT ticks; it only continues through MARK_READY while polling remains within that timeout.\n\nExit codes: same as iterate (the final tick's action/reason decides the code).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT or READY (including a WAIT returned by --timeout)\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\n  15  MERGE\n  16  SHEPHERD (--stack only: run the listed one-PR sessions, then rerun the selector)\n  A command/validation/GitHub failure exits with a sysexits.h code instead (see docs/exit-codes.md).";
     readonly clean: `pr-shepherd clean
 
@@ -277,7 +292,7 @@ On POSIX, the final body-file path entry must be a readable regular file in a tr
 symlinks, FIFOs, devices, and unreadable paths exit 66. Unsupported platforms fail closed with exit 66.
 --help, -h                      Print this help and exit before any I/O.`;
     readonly "log-file": "pr-shepherd log-file\n\nPrint the per-worktree append-only debug log path for the current repository.\nThe log is created by the first non-help pr-shepherd command that initializes logging.\n\nUsage:\n  pr-shepherd log-file [--format text|json]\n\nFlags:\n  --format text|json   Print a raw path or {\"path\": \"...\"} JSON. Default: text.\n  --help, -h           Print this help and exit before logging setup.\n\nEnvironment:\n  PR_SHEPHERD_LOG_DISABLED=1 disables logging.\n  PR_SHEPHERD_STATE_DIR overrides the base state directory.\n\nExit code: 0 on success; 1 if repository identity cannot be resolved.";
-    readonly top: "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR ...] [poll-flags] [iterate-flags]\n  pr-shepherd --stack PR [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd apply check-blocker [PR] --check <name> (--blocked-by <ref>|--clear)\n  pr-shepherd journal extract --body-file <path>\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR ...]             Poll one PR, an explicit same-repository set, or a native stack.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Mark selected changed files as viewed.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  apply check-blocker  Record that a failing check is blocked on an external PR or issue.\n  journal extract      Extract a validated Shepherd Journal from a local PR-body file as JSON.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number, owner/repo#number, or a GitHub pull request URL.\n  Multiple PRs must name one repository. --stack PR selects every entry in PR's native stack.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n  --merge                        Shepherd through readiness, then emit a merge or merge-queue command.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: poll.intervalSeconds (built-in 60s). Stack and multi-PR polls multiply that by poll.stackIntervalFactor (built-in 2) unless this flag is set.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: poll.timeoutSeconds (built-in 4.5m).\n  --debounce <duration>          Settle window after first FIX_CODE or stack SHEPHERD before returning. Bare number = seconds. Default: poll.debounceSeconds (built-in 60s). 0 disables.\n  --quiet-status                 Print only changed WAIT snapshots. Overrides poll.quietStatus.\n  --no-quiet-status              Print every WAIT snapshot. Overrides poll.quietStatus.\n  --until-terminal               Continue through WAIT/MARK_READY until READY/FIX_CODE/MERGE/CANCEL/ESCALATE or stack SHEPHERD.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT or READY\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\n  15  MERGE\n  16  SHEPHERD (--stack only: run the listed one-PR sessions, then rerun the selector)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";
+    readonly top: "pr-shepherd\n\nAutonomous PR CI monitor and review-comment resolver for agentic coding tools.\n\nUsage:\n  pr-shepherd --version | -v\n  pr-shepherd --help | -h\n  pr-shepherd [PR ...] [poll-flags] [iterate-flags]\n  pr-shepherd --stack PR [poll-flags] [iterate-flags]\n  pr-shepherd iterate [PR] [iterate-flags]\n  pr-shepherd apply review [PR] [review-flags]\n  pr-shepherd apply files [PR] [files...] [--tests] [--match REGEX]\n  pr-shepherd apply journal [PR] <item> [--dry-run] [--format text|json]\n  pr-shepherd apply check-blocker [PR] --check <name> (--blocked-by <ref>|--clear)\n  pr-shepherd apply queue-removal [PR] --require-sha <head> --queue-commit <commit> --removed-at <unix>\n  pr-shepherd journal extract --body-file <path>\n  pr-shepherd build-suggestion-patches [PR] --thread-id ID --message MSG [groups...]\n  pr-shepherd admin clean <pr|branch|current|repo|all> [value] [flags]\n  pr-shepherd admin log-file [--format text|json]\n\nCommands:\n  [PR ...]             Poll one PR, an explicit same-repository set, or a native stack.\n  iterate              Run one iterate tick (single-tick alias).\n  apply review         Apply review-state mutations after fixes.\n  apply files          Mark selected changed files as viewed.\n  apply journal        Append a list item to the Shepherd Journal details block of a PR body.\n  apply check-blocker  Record that a failing check is blocked on an external PR or issue.\n  apply queue-removal  Acknowledge one current CI-driven native-stack queue removal.\n  journal extract      Extract a validated Shepherd Journal from a local PR-body file as JSON.\n  build-suggestion-patches\n                       Convert ordered GitHub suggestion threads into patches and commit instructions.\n  admin clean          Remove pr-shepherd state files.\n  admin log-file       Print the per-worktree debug log path.\n\nPR argument:\n  PR may be a number, owner/repo#number, or a GitHub pull request URL.\n  Multiple PRs must name one repository. --stack PR selects every entry in PR's native stack.\n  When omitted, pr-shepherd infers the current branch's pull request.\n\nCommon flags:\n  --format text|json   Output Markdown text or JSON. Default: text.\n  --verbose            Include verbose iterate fields and detailed poll-tick lines.\n  --help, -h           Print help and exit before any GitHub, git, config, or log I/O.\n\nIterate flags:\n  --ready-delay <duration>       Settle window before a clean PR cancels. Bare number = minutes. Example: 15m.\n  --stall-timeout <duration>     Escalate repeated unchanged failures after this duration. Bare number = minutes. 0 disables.\n  --no-auto-mark-ready           Do not convert draft PRs to ready for review.\n  --no-auto-cancel-actionable    Legacy no-op; workflow runs are never cancelled.\n  --merge                        Shepherd through readiness, then emit a merge or merge-queue command.\n\nPolling flags:\n  --interval <duration>          Delay between WAIT ticks. Bare number = seconds. Default: poll.intervalSeconds (built-in 60s). Stack and multi-PR polls multiply that by poll.stackIntervalFactor (built-in 2) unless this flag is set.\n  --timeout <duration>           Poll wall-clock cap for WAIT ticks. Bare number = seconds. Default: poll.timeoutSeconds (built-in 4.5m).\n  --debounce <duration>          Settle window after first FIX_CODE or stack SHEPHERD before returning. Bare number = seconds. Default: poll.debounceSeconds (built-in 60s). 0 disables.\n  --quiet-status                 Print only changed WAIT snapshots. Overrides poll.quietStatus.\n  --no-quiet-status              Print every WAIT snapshot. Overrides poll.quietStatus.\n  --until-terminal               Continue through WAIT/MARK_READY until READY/FIX_CODE/MERGE/CANCEL/ESCALATE or stack SHEPHERD.\n\nClean variants:\n  pr [number]          Remove state for one PR. Defaults to current branch PR.\n  branch [name]        Remove state for a branch's PR. Defaults to current branch.\n  current              Alias for branch against the current branch.\n  repo                 Remove all state for the current repository.\n  all                  Remove all pr-shepherd state.\n\nExit codes: 0 done, 10-19 PR state, 64-78 shepherd failed (sysexits.h).\n  0   CANCEL (merged or ready-delay elapsed)\n  10  WAIT or READY\n  11  MARK_READY\n  12  FIX_CODE\n  13  ESCALATE\n  14  CANCEL (closed without merging)\n  15  MERGE\n  16  SHEPHERD (--stack only: run the listed one-PR sessions, then rerun the selector)\nSee docs/exit-codes.md for the full sysexits.h error-code table.\n\nDuration examples: 30s, 4.5m, 1h. A bare number uses each flag's default unit (see above); decimals are allowed with an explicit unit (4.5m).\n\nRun 'pr-shepherd <command> --help' for command-specific details.";
 };
 /** Resolve help keys for nested public commands before any command I/O. */
 export declare function helpKeyForArgs(args: string[]): keyof typeof USAGE;

package/bin/cli/help.mjs

@@ -15,6 +15,8 @@ export function helpKeyForArgs(args) {
         return "apply journal";
     if (args[0] === "apply" && args[1] === "check-blocker")
         return "apply check-blocker";
+    if (args[0] === "apply" && args[1] === "queue-removal")
+        return "apply queue-removal";
     if (args[0] === "journal" && args[1] === "extract")
         return "journal extract";
     if (args[0] === "admin" && args[1] === "clean")

package/bin/cli/iterate-instructions.mjs

@@ -48,7 +48,10 @@ export function buildSimpleIterateInstructions(result) {
             return instructions;
         }
         case "cancel":
-            return ["Stop — the PR loop is complete. No further polling is needed."];
+            return [
+                "Stop polling this pull request — its poll is complete.",
+                "Continue any remaining pull requests or issues from the original request.",
+            ];
         case "escalate": {
             const pending = result.escalate.pendingReviewCommands;
             if (!pending)

package/bin/cli/iterate-lean.mjs

@@ -152,6 +152,9 @@ export function projectIterateLean(result, opts) {
                         protectedRuns: result.fix.protectedRuns,
                     }),
                     ...(result.fix.requeue && { requeue: result.fix.requeue }),
+                    ...(result.fix.queueRemovalAcknowledgment && {
+                        queueRemovalAcknowledgment: result.fix.queueRemovalAcknowledgment,
+                    }),
                     ...(result.fix.checks.length > 0 && { checks: result.fix.checks }),
                     ...(result.fix.changesRequestedReviews.length > 0 && {
                         changesRequestedReviews: result.fix.changesRequestedReviews,

package/bin/cli/iterate-merge-formatter.mjs

@@ -40,6 +40,8 @@ export function appendMergeQueueHeader(lines, result) {
         parts.push("checks incomplete (first 100 shown)");
     if (queue.headUpdatedAfterRemoval)
         parts.push("head updated after removal");
+    if (queue.removalAcknowledged)
+        parts.push("removal acknowledged");
     lines.push(`**merge queue** ${parts.join(" · ")}`);
     if (queue.autoMergeRequest) {
         lines.push(`**auto-merge** method \`${queue.autoMergeRequest.mergeMethod}\` · enabledAtUnix \`${queue.autoMergeRequest.enabledAtUnix}\`${queue.autoMergeRequest.enabledBy ? ` · by \`@${queue.autoMergeRequest.enabledBy}\`` : ""}`);

package/bin/cli/queue-removal-handler.d.mts

@@ -0,0 +1,2 @@
+/** `apply queue-removal`; help exits before argument validation and GitHub I/O. */
+export declare function handleQueueRemoval(args: string[]): Promise<void>;

package/bin/cli/queue-removal-handler.mjs

@@ -0,0 +1,86 @@
+import { EXIT, errorToExitCode } from "../exit-codes.mjs";
+import { applyQueueRemovalAck } from "../commands/apply-queue-removal.mjs";
+import { getFlag, parseCommonArgs } from "./args.mjs";
+import { maybePrintHelp, USAGE } from "./help.mjs";
+const FLAGS = new Set(["--require-sha", "--queue-commit", "--removed-at"]);
+/** `apply queue-removal`; help exits before argument validation and GitHub I/O. */
+export async function handleQueueRemoval(args) {
+    if (maybePrintHelp(args, "apply queue-removal"))
+        return;
+    const { prNumber, global, extra } = parseCommonArgs(args);
+    const flagError = validateFlags(extra);
+    if (flagError) {
+        usage(flagError);
+        return;
+    }
+    const headSha = getFlag(extra, "--require-sha");
+    const queueCommitOid = getFlag(extra, "--queue-commit");
+    const removedAtText = getFlag(extra, "--removed-at");
+    if (headSha === null || !/^[0-9a-f]{40}$/.test(headSha)) {
+        usage("--require-sha must be a full 40-character lowercase hex SHA.", EXIT.DATAERR);
+        return;
+    }
+    if (queueCommitOid === null || !/^[0-9a-f]{40}$/.test(queueCommitOid)) {
+        usage("--queue-commit must be a full 40-character lowercase hex SHA.", EXIT.DATAERR);
+        return;
+    }
+    if (removedAtText === null || !/^[1-9]\d*$/.test(removedAtText)) {
+        usage("--removed-at must be a positive Unix timestamp in seconds.", EXIT.DATAERR);
+        return;
+    }
+    const removedAtUnix = Number(removedAtText);
+    if (!Number.isSafeInteger(removedAtUnix)) {
+        usage("--removed-at must be a positive Unix timestamp in seconds.", EXIT.DATAERR);
+        return;
+    }
+    try {
+        const result = await applyQueueRemovalAck({
+            prNumber,
+            targetRepository: global.targetRepository,
+            headSha,
+            queueCommitOid,
+            removedAtUnix,
+        });
+        const body = global.format === "json"
+            ? JSON.stringify(result, null, 2)
+            : [
+                `PR: ${result.repo}#${result.pr}`,
+                `headSha: ${result.acknowledgment.headSha}`,
+                `queueCommitOid: ${result.acknowledgment.queueCommitOid}`,
+                `removedAtUnix: ${result.acknowledgment.removedAtUnix}`,
+            ].join("\n");
+        process.stdout.write(`${body}\n`);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        process.stderr.write(`pr-shepherd: apply queue-removal: ${message}\n`);
+        process.exitCode = errorToExitCode(err);
+    }
+}
+function validateFlags(args) {
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (!arg.startsWith("--"))
+            return `unexpected argument: "${arg}"`;
+        const eq = arg.indexOf("=");
+        const name = eq === -1 ? arg : arg.slice(0, eq);
+        if (!FLAGS.has(name))
+            return `unknown flag: "${name}"`;
+        if (eq !== -1) {
+            if (arg.slice(eq + 1) === "")
+                return `${name} requires a value.`;
+            continue;
+        }
+        const value = args[i + 1];
+        if (value === undefined || value.startsWith("--"))
+            return `${name} requires a value.`;
+        i += 1;
+    }
+    return null;
+}
+function usage(message, exitCode = EXIT.USAGE) {
+    process.stderr.write(`pr-shepherd: apply queue-removal: ${message}\n`);
+    if (exitCode === EXIT.USAGE)
+        process.stderr.write(`${USAGE["apply queue-removal"]}\n`);
+    process.exitCode = exitCode;
+}

package/bin/cli-parser.mjs

@@ -14,6 +14,7 @@ import { handleJournalExtract } from "./cli/journal-extract-handler.mjs";
 import { handlePoll } from "./cli/poll-handler.mjs";
 import { warnPrrcThreadIds, validateRequireSha, rejectPrrcMinimizeIds, } from "./cli/resolve-validators.mjs";
 import { handleCheckBlocker } from "./cli/check-blocker-handler.mjs";
+import { handleQueueRemoval } from "./cli/queue-removal-handler.mjs";
 import { setupLog } from "./log/setup.mjs";
 // ---------------------------------------------------------------------------
 // Entry
@@ -135,6 +136,9 @@ async function handleApply(args) {
         case "check-blocker":
             await handleCheckBlocker(args.slice(1));
             return;
+        case "queue-removal":
+            await handleQueueRemoval(args.slice(1));
+            return;
         default:
             process.stderr.write(`Unknown apply action: ${action ?? "(none)"}\n`);
             process.stderr.write(`${USAGE.apply}\n`);

package/bin/commands/apply-queue-removal.d.mts

@@ -0,0 +1,18 @@
+import { type QueueRemovalAcknowledgment } from "../state/queue-removal-ack.mts";
+export interface ApplyQueueRemovalInput {
+    prNumber?: number;
+    targetRepository?: {
+        owner: string;
+        name: string;
+    };
+    headSha: string;
+    queueCommitOid: string;
+    removedAtUnix: number;
+}
+export interface ApplyQueueRemovalResult {
+    pr: number;
+    repo: string;
+    acknowledgment: QueueRemovalAcknowledgment;
+}
+/** Validate an observed native-stack CI queue removal before recording the caller's acknowledgment. */
+export declare function applyQueueRemovalAck(input: ApplyQueueRemovalInput): Promise<ApplyQueueRemovalResult>;

package/bin/commands/apply-queue-removal.mjs

@@ -0,0 +1,44 @@
+import { EXIT, ShepherdError } from "../exit-codes.mjs";
+import { fetchPrBatch } from "../github/batch.mjs";
+import { queueRemovalAppliesToHead } from "../github/queue-removal-freshness.mjs";
+import { getCurrentPrNumber, getRepoInfo } from "../github/client.mjs";
+import { isCiQueueRemovalReason, writeQueueRemovalAcknowledgment, } from "../state/queue-removal-ack.mjs";
+/** Validate an observed native-stack CI queue removal before recording the caller's acknowledgment. */
+export async function applyQueueRemovalAck(input) {
+    const repo = input.targetRepository ?? (await getRepoInfo());
+    const pr = input.prNumber ?? (await getCurrentPrNumber());
+    if (pr === null) {
+        throw new ShepherdError("No open PR found for current branch. Pass a PR number explicitly.", EXIT.UNAVAILABLE);
+    }
+    const { data } = await fetchPrBatch(pr, repo);
+    const removal = data.latestMergeQueueRemoval;
+    if (data.state !== "OPEN" ||
+        !data.stack ||
+        data.isMergeQueueEnabled !== true ||
+        data.isInMergeQueue === true ||
+        !removal ||
+        !isCiQueueRemovalReason(removal.reason) ||
+        data.headRefOid !== input.headSha ||
+        removal.beforeCommitOid !== input.queueCommitOid ||
+        removal.createdAtUnix !== input.removedAtUnix ||
+        !queueRemovalAppliesToHead({
+            parentOids: removal.beforeCommitParentOids,
+            headOid: data.headRefOid,
+            ...(data.activity?.latestCommitCommittedAtUnix != null && {
+                headCommittedAtUnix: data.activity.latestCommitCommittedAtUnix,
+            }),
+            ...(data.headPushedAtUnix !== undefined && { headPushedAtUnix: data.headPushedAtUnix }),
+            removedAtUnix: removal.createdAtUnix,
+        })) {
+        throw new ShepherdError("The supplied queue-removal evidence is stale or is not a current CI-driven removal for this native-stack PR.", EXIT.UNAVAILABLE);
+    }
+    const acknowledgment = {
+        headSha: input.headSha,
+        queueCommitOid: input.queueCommitOid,
+        removedAtUnix: input.removedAtUnix,
+    };
+    if (!(await writeQueueRemovalAcknowledgment({ owner: repo.owner, repo: repo.name, pr }, acknowledgment))) {
+        throw new ShepherdError("Could not write queue-removal acknowledgment state.", EXIT.UNAVAILABLE);
+    }
+    return { pr, repo: `${repo.owner}/${repo.name}`, acknowledgment };
+}

package/bin/commands/check-fingerprint.mjs

@@ -10,6 +10,8 @@ function reportAllowsFingerprintSkip(report) {
         return false;
     if (report.mergeQueue?.inQueue === true)
         return false;
+    if (report.mergeQueue?.removalAcknowledged === true)
+        return false;
     return (report.threads.actionable.length === 0 &&
         report.threads.resolutionOnly.length === 0 &&
         report.threads.firstLook.length === 0 &&

package/bin/commands/check.mjs

@@ -1,5 +1,6 @@
 import { fetchPrBatch } from "../github/batch.mjs";
 import { queueRemovalAppliesToHead } from "../github/queue-removal-freshness.mjs";
+import { readQueueRemovalAcknowledgment, matchesQueueRemovalAcknowledgment, isCiQueueRemovalReason, } from "../state/queue-removal-ack.mjs";
 import { storePrFingerprint } from "../state/pr-fingerprint.mjs";
 import { tryReuseFingerprintReport } from "./check-fingerprint.mjs";
 import { collectUnreportedRequired, refreshCachedUnreported } from "./check-unreported.mjs";
@@ -91,9 +92,19 @@ export async function runCheck(opts, context) {
             }),
             removedAtUnix: latestRemoval.createdAtUnix,
         }));
+    const removalAcknowledged = Boolean(batchData.stack &&
+        latestRemoval?.beforeCommitOid &&
+        isCiQueueRemovalReason(latestRemoval.reason) &&
+        !batchData.isInMergeQueue &&
+        !headUpdatedAfterRemoval &&
+        matchesQueueRemovalAcknowledgment(await readQueueRemovalAcknowledgment(stateKey), {
+            headSha: batchData.headRefOid,
+            queueCommitOid: latestRemoval.beforeCommitOid,
+            removedAtUnix: latestRemoval.createdAtUnix,
+        }));
     const queueRawChecks = batchData.isInMergeQueue
         ? (batchData.mergeQueueChecks ?? [])
-        : latestRemoval && !headUpdatedAfterRemoval
+        : latestRemoval && !headUpdatedAfterRemoval && !removalAcknowledged
             ? (batchData.removedMergeQueueChecks ?? [])
             : [];
     // Keep supersession grouping commit-local, but accept merge_group only for the
@@ -356,6 +367,7 @@ export async function runCheck(opts, context) {
                     checksIncomplete: true,
                 }),
                 ...(headUpdatedAfterRemoval && { headUpdatedAfterRemoval: true }),
+                ...(removalAcknowledged && { removalAcknowledged: true }),
             },
         }),
         ...(unreported.unreportedRequiredChecks && {

package/bin/commands/iterate/check-evidence.d.mts

@@ -0,0 +1,4 @@
+import type { AgentCheck } from "../../types.mts";
+export declare function hasLogEvidence(check: AgentCheck): boolean;
+/** An external provider link is inspectable even when Actions log downloads are unavailable. */
+export declare function hasQueueRecoveryEvidence(check: AgentCheck): boolean;

package/bin/commands/iterate/check-evidence.mjs

@@ -0,0 +1,8 @@
+export function hasLogEvidence(check) {
+    return (Boolean(check.logExcerpt?.trim()) ||
+        (check.relatedJobs ?? []).some((job) => Boolean(job.logExcerpt?.trim())));
+}
+/** An external provider link is inspectable even when Actions log downloads are unavailable. */
+export function hasQueueRecoveryEvidence(check) {
+    return hasLogEvidence(check) || (check.runId === null && Boolean(check.detailsUrl?.trim()));
+}

package/bin/commands/iterate/fix-code.mjs

@@ -6,6 +6,8 @@ import { checkEscalateTriggers, validateBaseBranch, buildEscalateSuggestion, bui
 import { buildResolveCommand } from "./classify.mjs";
 import { buildThreadMutationRouting, threadHasAuthorizedMutation, } from "./thread-mutation-routing.mjs";
 import { buildFixInstructions } from "./render.mjs";
+import { buildRemovedQueueRecovery, buildStackQueueRemovalAcknowledgment } from "./merge.mjs";
+import { hasLogEvidence } from "./check-evidence.mjs";
 import { buildReleasedBlockerInstruction } from "./check-instructions.mjs";
 import { buildNativeStackLayerRebase } from "./native-stack-rebase.mjs";
 import { lookupUpperLayerTrunkConflict } from "./stack-trunk-conflict.mjs";
@@ -19,10 +21,6 @@ import { canRerunWorkflows } from "../../checks/conclusions.mjs";
 import { loadConfig } from "../../config/load.mjs";
 import { formatPrUrl } from "../../pr-reference.mjs";
 const EMPTY_RELEASED = new Set();
-function hasLogEvidence(check) {
-    return (Boolean(check.logExcerpt?.trim()) ||
-        (check.relatedJobs ?? []).some((job) => Boolean(job.logExcerpt?.trim())));
-}
 function checkRequiresHumanFollowUp(check) {
     if (check.rerunCommand)
         return false;
@@ -171,6 +169,8 @@ export async function handleFixCode(ctx) {
         if (releasedCheckNames.has(c.name))
             return c;
         return rerunAuthorized &&
+            // Rerunning queue CI cannot restore a removed entry and overwrites its failure evidence.
+            c.scope !== "merge_group" &&
             c.runId &&
             actionsRunIds.has(c.runId) &&
             // GitHub increments run_attempt after every rerun. Recommend at most one rerun by limiting
@@ -306,6 +306,20 @@ export async function handleFixCode(ctx) {
         ? buildNativeStackLayerRebase(report.repo, { number: prNumber, baseBranch: baseLookup.branch }, stack, trunkConflict)
         : undefined;
     const instructions = buildFixInstructions(threads, actionableComments, checks, changesRequestedReviews, baseLookup.branch, resolveCommand, hasConflicts, prReference, cancelled.length, firstLookThreads, firstLookComments, firstLookSummaries, editedSummaries, inProgressRunIds, resolutionOnlyThreads, resolveOnlyCommand, behindBaseHint, isBehind, report.viewerAuthorization?.viewerCanUpdate === true, exhaustedAttempts.length > 0, stackRebase);
+    const requeue = buildRemovedQueueRecovery(report, failingAgentChecks, opts.merge);
+    const queueRemovalAcknowledgment = buildStackQueueRemovalAcknowledgment(report, failingAgentChecks);
+    if (queueRemovalAcknowledgment) {
+        const completion = instructions.pop();
+        instructions.push("If the merge-group failure belongs to this PR, fix and push its head, then iterate. Otherwise, if no code changed and no other blocker remains, run `acknowledge queue removal:` exactly as printed. This records only the disposition of that removed queue commit; finish this one-PR session to validate current source CI and record its READY receipt, then return to the aggregate `--stack` selector with its original options. In merge mode it verifies lower-layer readiness before merging. Do not enqueue or merge this layer directly.");
+        if (completion !== undefined)
+            instructions.push(completion);
+    }
+    if (requeue) {
+        const completion = instructions.pop();
+        instructions.push("If the merge-group failure belongs to this PR, fix and push the PR head, then iterate. Otherwise, if no code changed and no other blocker remains, run the `requeue:` command exactly as printed. If gh reports auto-merge is disabled instead of adding the PR to the queue, run the `requeue API fallback:` command. Both commands require the observed PR head SHA; if the head changed, iterate for a fresh command.");
+        if (completion !== undefined)
+            instructions.push(completion);
+    }
     if (failingAgentChecks.some((check) => releasedCheckNames.has(check.name))) {
         const completion = instructions.pop();
         instructions.push(buildReleasedBlockerInstruction(prNumber));
@@ -342,6 +356,8 @@ export async function handleFixCode(ctx) {
             editedSummaries,
             surfacedApprovals,
             checks,
+            ...(requeue && { requeue }),
+            ...(queueRemovalAcknowledgment && { queueRemovalAcknowledgment }),
             changesRequestedReviews,
             resolveCommand,
             ...(resolveOnlyCommand !== undefined ? { resolveOnlyCommand } : undefined),

package/bin/commands/iterate/index.mjs

@@ -109,7 +109,9 @@ async function runIterateCore(opts) {
         editedSummaries.length > 0 ||
         (config.iterate.minimizeApprovals && surfacedApprovals.length > 0);
     const hasActionableWork = hasReadinessWork || report.comments.firstLook.length > 0;
-    const activeMerge = Boolean(opts.merge && (report.mergeQueue?.inQueue || report.mergeQueue?.autoMergeRequest));
+    const activeMerge = Boolean(opts.merge &&
+        (report.mergeQueue?.inQueue ||
+            (report.mergeQueue?.autoMergeRequest && !report.mergeQueue.removalAcknowledged)));
     const staleAncestry = await findStaleNativeStackAncestry(report, {
         owner: repoOwner,
         name: repoName,
@@ -307,6 +309,18 @@ async function recordReadyReceipt(key, report, context) {
         if (!isCurrentSummaryReady(raw, summary.checks ?? {}, summary.review ?? {}))
             return false;
         const removalEvent = currentQueueRemovalEvent(raw);
+        // Bind recovery to the exact evidence the one-PR check accepted. A new ejection
+        // between that check and this fresh snapshot must get its own acknowledgment.
+        if (report.mergeQueue?.removalAcknowledged) {
+            const accepted = report.mergeQueue.latestRemoval;
+            if (raw.isInMergeQueue ||
+                !accepted ||
+                !removalEvent ||
+                removalEvent.beforeCommit?.oid !== accepted.beforeCommitOid ||
+                Math.floor(Date.parse(removalEvent.createdAt) / 1000) !== accepted.createdAtUnix ||
+                removalEvent.reason !== accepted.reason)
+                return false;
+        }
         await writeReadyReceipt({
             version: 1,
             ...key,

package/bin/commands/iterate/merge-state.mjs

@@ -115,7 +115,10 @@ export async function handleActiveMergeState(input) {
         };
     }
     const removal = report.mergeQueue?.latestRemoval;
-    if (!enabled || !removal || report.mergeQueue?.headUpdatedAfterRemoval)
+    if (!enabled ||
+        !removal ||
+        report.mergeQueue?.headUpdatedAfterRemoval ||
+        report.mergeQueue?.removalAcknowledged)
         return null;
     await clearStallState(stallKey);
     const escalateBase = {

package/bin/commands/iterate/merge.d.mts

@@ -1,5 +1,5 @@
 import { type MergeMethod } from "../../config/merge-method.mts";
-import type { IterateResult, IterateResultBase, MergeCommandPlan } from "../../types.mts";
+import type { AgentCheck, IterateResult, IterateResultBase, MergeCommandPlan, ShepherdReport } from "../../types.mts";
 interface MergePlanInput {
     pr: number;
     repo: string;
@@ -16,6 +16,12 @@ export declare function buildMergeCommandPlan(input: MergePlanInput): MergeComma
 export declare function renderMergeCommand(command: {
     argv: string[];
 }): string;
+/** Offer a guarded queue command; the caller decides whether the failure warrants a PR fix. */
+export declare function buildRemovedQueueRecovery(report: ShepherdReport, checks: AgentCheck[], merge: boolean | undefined): MergeCommandPlan | undefined;
+/** Bind a caller's disposition to one removed stack queue commit, without submitting a merge. */
+export declare function buildStackQueueRemovalAcknowledgment(report: ShepherdReport, checks: AgentCheck[]): {
+    argv: string[];
+} | undefined;
 export declare function unavailableMergeResult(base: IterateResultBase, report: {
     pr: number;
     repo: string;

package/bin/commands/iterate/merge.mjs

@@ -2,7 +2,9 @@ import { loadConfig } from "../../config/load.mjs";
 import { findMergeStrategies } from "../../config/merge-command-args.mjs";
 import { chooseMergeMethod, configuredMergeMethod, } from "../../config/merge-method.mjs";
 import { formatPrUrl } from "../../pr-reference.mjs";
-import { renderShellCommand } from "../../cli/runner.mjs";
+import { renderShellCommand, buildPrShepherdCommand } from "../../cli/runner.mjs";
+import { hasQueueRecoveryEvidence } from "./check-evidence.mjs";
+import { isCiQueueRemovalReason } from "../../state/queue-removal-ack.mjs";
 import { buildEscalateHumanMessage } from "./escalate.mjs";
 const ENQUEUE_MUTATION = "mutation EnqueuePullRequest($pullRequestId: ID!, $expectedHeadOid: GitObjectID!) { enqueuePullRequest(input: { pullRequestId: $pullRequestId, expectedHeadOid: $expectedHeadOid }) { mergeQueueEntry { id } } }";
 export function buildMergeCommandPlan(input) {
@@ -55,6 +57,62 @@ export function buildMergeCommandPlan(input) {
 export function renderMergeCommand(command) {
     return renderShellCommand(command.argv);
 }
+/** Offer a guarded queue command; the caller decides whether the failure warrants a PR fix. */
+export function buildRemovedQueueRecovery(report, checks, merge) {
+    if (report.mergeStatus.mergeRequirements?.stack)
+        return undefined;
+    if (!removedQueueRecoveryAvailable(report, checks, merge))
+        return undefined;
+    const plan = buildMergeCommandPlan({
+        pr: report.pr,
+        repo: report.repo,
+        nodeId: report.nodeId,
+        headSha: report.headSha,
+        queue: true,
+    });
+    return "unavailable" in plan ? undefined : plan;
+}
+/** Bind a caller's disposition to one removed stack queue commit, without submitting a merge. */
+export function buildStackQueueRemovalAcknowledgment(report, checks) {
+    if (!report.mergeStatus.mergeRequirements?.stack)
+        return undefined;
+    // This records a local disposition, without enqueueing; aggregate child sessions omit --merge.
+    if (!removedQueueRecoveryAvailable(report, checks, true))
+        return undefined;
+    const removal = report.mergeQueue.latestRemoval;
+    return buildPrShepherdCommand([
+        "apply",
+        "queue-removal",
+        formatPrUrl(report.repo, report.pr),
+        "--require-sha",
+        report.headSha,
+        "--queue-commit",
+        removal.beforeCommitOid,
+        "--removed-at",
+        String(removal.createdAtUnix),
+    ]);
+}
+function removedQueueRecoveryAvailable(report, checks, merge) {
+    const queue = report.mergeQueue;
+    const removedCommit = queue?.latestRemoval?.beforeCommitOid;
+    if (!merge ||
+        !queue?.enabled ||
+        queue.inQueue ||
+        queue.headUpdatedAfterRemoval ||
+        // GitHub exposes a raw string, not a capability to reverse a human's queue removal.
+        // Only known CI-driven reasons authorize offering automated recovery.
+        !isCiQueueRemovalReason(queue.latestRemoval?.reason) ||
+        !queue.latestRemoval ||
+        queue.latestRemoval.createdAtUnix <= 0 ||
+        !removedCommit ||
+        !report.headSha ||
+        !report.nodeId ||
+        !checks.some((check) => check.scope === "merge_group" && check.commitOid === removedCommit))
+        return false;
+    return checks
+        .filter((check) => check.scope === "merge_group" && check.commitOid === removedCommit)
+        .every(hasQueueRecoveryEvidence);
+}
 export function unavailableMergeResult(base, report, unavailable) {
     const escalateBase = {
         triggers: ["merge-method-unavailable"],

package/bin/github/gql/poll-summary-check-contexts.gql

@@ -12,6 +12,8 @@ fragment PollSummaryCheckContexts on StatusCheckRollupContextConnection {
       status
       conclusion
       detailsUrl
+      startedAt
+      completedAt
       checkSuite {
         createdAt
         workflowRun {