specrails-desktop 2.29.0 → 2.29.2

package/server/dist/rail-pr-decision.js

@@ -38,7 +38,7 @@ exports.isPrDecisionAction = isPrDecisionAction;
 exports.executePrDecision = executePrDecision;
 /**
  * Execute a user's ask-first PR decision (safe-pr-review-flow) against its
- * authoritative `rail_pr_deliveries` row: the FOUR actions both decision
+ * authoritative `rail_pr_deliveries` row: the actions both decision
  * surfaces (the dashboard rail row and the launching agent-chat card) POST to
  * `/rails/pr-decision`.
  *
@@ -57,8 +57,8 @@ exports.executePrDecision = executePrDecision;
  *                conflict). Without it, a repo with no GitHub remote wedges
  *                forever in retry(local-only)/discard — no way to ACCEPT work.
  *
- * Every mutation rides the compare-and-set `transitionDecision` (a raced
- * concurrent decision loses with a 409) and re-broadcasts the durable
+ * Every mutation rides a lease-owned compare-and-set (a raced concurrent
+ * decision loses with a 409 before effects) and re-broadcasts the durable
  * `rail.pr_state` snapshot so both surfaces converge; agent-chat-originated
  * rows also update their inline decision card in place. Deps are injected
  * (db/git/exec/broadcast/jira/agent-chat) so the whole matrix is unit-testable
@@ -78,10 +78,18 @@ const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const ticket_store_1 = require("./ticket-store");
 const workspace_resolution_1 = require("./workspace-resolution");
 const agent_chat_registry_1 = require("./agent-chat-registry");
-exports.PR_DECISION_ACTIONS = ['create-pr', 'publish', 'discard', 'poll-merge', 'merge-local'];
+const ids_1 = require("./ids");
+const repo_lock_1 = require("./repo-lock");
+const rail_pr_ticket_effects_1 = require("./rail-pr-ticket-effects");
+const pr_lifecycle_1 = require("./pr-lifecycle");
+exports.PR_DECISION_ACTIONS = ['create-pr', 'publish', 'discard', 'dismiss', 'poll-merge', 'reopen', 'merge-local', 'acknowledge-no-changes'];
 function isPrDecisionAction(v) {
     return typeof v === 'string' && exports.PR_DECISION_ACTIONS.includes(v);
 }
+// Action handlers keep using one finalization helper, but the operation lease
+// must be absent from every emitted snapshot. Calls made while a lease is held
+// are deferred until executePrDecision's finally releases that exact token.
+const deferredFinalizations = new Set();
 function staleDecision(current) {
     return { status: 409, body: { error: 'stale_decision', current } };
 }
@@ -101,21 +109,31 @@ function ghFailed(r) {
 function actionAllowed(action, row) {
     switch (action) {
         case 'create-pr':
-            return row.decision === 'on_review' || row.decision === 'pr_failed' ||
+            return row.decision === 'on_review' ||
+                (row.decision === 'pr_failed' && (row.delivery_outcome === 'retryable_failure' || row.delivery_outcome === 'unknown')) ||
                 (row.decision === 'pr_draft' && row.pr_url === null);
         case 'publish':
             return row.decision === 'pr_draft' && row.pr_url !== null;
         case 'discard':
             return row.decision === 'on_review' || row.decision === 'pr_draft' ||
-                row.decision === 'pr_ready' || row.decision === 'implementation_failed' ||
+                row.decision === 'pr_ready' || row.decision === 'pr_closed' || row.decision === 'no_changes' ||
+                row.decision === 'implementation_failed' ||
                 row.decision === 'pr_failed';
+        case 'dismiss':
+            return row.is_continuation === 1 && row.decision !== 'building' &&
+                row.decision !== 'merged' && row.decision !== 'discarded' && row.decision !== 'superseded' &&
+                row.delivery_outcome !== 'blocked';
         case 'poll-merge':
-            return (row.decision === 'pr_draft' || row.decision === 'pr_ready') && row.pr_url !== null;
+            return (row.decision === 'pr_draft' || row.decision === 'pr_ready' || row.decision === 'pr_closed') && row.pr_url !== null;
+        case 'reopen':
+            return row.decision === 'pr_closed' && row.pr_url !== null;
         case 'merge-local':
             // Remote-less acceptance ONLY: once a real PR exists (pr_url), GitHub is
             // the merge authority — merging under an open PR would leave it dangling.
             return row.pr_url === null &&
                 (row.decision === 'on_review' || row.decision === 'pr_failed' || row.decision === 'pr_draft');
+        case 'acknowledge-no-changes':
+            return row.decision === 'no_changes' && row.is_continuation !== 1;
     }
 }
 async function executePrDecision(deps, input) {
@@ -128,12 +146,43 @@ async function executePrDecision(deps, input) {
         return staleDecision(row.decision);
     if (!actionAllowed(input.action, row))
         return illegalAction(row.decision);
-    switch (input.action) {
-        case 'create-pr': return runCreatePr(deps, row);
-        case 'publish': return runPublish(deps, row);
-        case 'discard': return runDiscard(deps, row);
-        case 'poll-merge': return runPollMerge(deps, row);
-        case 'merge-local': return runMergeLocal(deps, row);
+    // Claim before any git/GitHub/cleanup/ticket effect. The visible decision is
+    // unchanged while the winner works, but a second surface cannot start.
+    const operationToken = (0, ids_1.newId)();
+    if (!(0, rail_pr_store_1.claimPrDeliveryOperation)(deps.db, row.id, row.decision, input.action, operationToken)) {
+        const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+        if (!current || current.decision !== input.expectedDecision) {
+            return staleDecision(current?.decision ?? row.decision);
+        }
+        return {
+            status: 409,
+            body: { error: 'operation_in_progress', current: current.decision, operation: current.operation },
+        };
+    }
+    const claimedRow = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+    if (!claimedRow || claimedRow.operation_token !== operationToken) {
+        return { status: 409, body: { error: 'operation_in_progress', current: claimedRow?.decision ?? row.decision } };
+    }
+    try {
+        switch (input.action) {
+            case 'create-pr': return await runCreatePr(deps, claimedRow);
+            case 'publish': return await runPublish(deps, claimedRow);
+            case 'discard': return await runDiscard(deps, claimedRow);
+            case 'dismiss': return await runDismiss(deps, claimedRow);
+            case 'poll-merge': return await runPollMerge(deps, claimedRow);
+            case 'reopen': return await runReopen(deps, claimedRow);
+            case 'merge-local': return await runMergeLocal(deps, claimedRow);
+            case 'acknowledge-no-changes': return await runAcknowledgeNoChanges(deps, claimedRow);
+        }
+        return illegalAction(row.decision);
+    }
+    finally {
+        try {
+            (0, rail_pr_store_1.releasePrDeliveryOperation)(deps.db, row.id, operationToken);
+        }
+        catch { /* durable state remains authoritative */ }
+        if (deferredFinalizations.delete(row.id))
+            finalizeTransition(deps, row.id);
     }
 }
 /**
@@ -141,11 +190,30 @@ async function executePrDecision(deps, input) {
  * between the pre-check and here — surface the same 409 with the fresh state.
  */
 function casTransition(deps, row, next, patch = {}) {
-    if ((0, rail_pr_store_1.transitionDecision)(deps.db, row.id, row.decision, next, patch))
+    if (row.operation_token && (0, rail_pr_store_1.transitionClaimedDecision)(deps.db, row.id, row.decision, next, row.operation_token, patch))
+        return null;
+    const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+    return staleDecision(current?.decision ?? row.decision);
+}
+function casTransitionWithTicketEffect(deps, row, next, patch, effect) {
+    if (row.operation_token &&
+        (0, rail_pr_ticket_effects_1.transitionClaimedDecisionWithTicketEffect)(deps.db, row.id, row.decision, next, row.operation_token, patch, effect))
         return null;
     const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
     return staleDecision(current?.decision ?? row.decision);
 }
+function applyTerminalTicketEffect(deps, row, terminalDecision, cleanupWarnings) {
+    const result = (0, rail_pr_ticket_effects_1.applyRailPrTicketEffect)(deps, row.id);
+    if (result.ok)
+        return;
+    cleanupWarnings.push(`ticket status update pending: ${result.error ?? 'unknown ticket-store error'}`);
+    if (!row.operation_token)
+        return;
+    (0, rail_pr_store_1.transitionClaimedDecision)(deps.db, row.id, terminalDecision, terminalDecision, row.operation_token, {
+        statusCode: 'cleanup_incomplete',
+        cleanupWarnings,
+    });
+}
 /**
  * Post-transition fan-out: re-broadcast the durable rail.pr_state snapshot
  * (both surfaces converge on it) and, for agent-chat-originated launches,
@@ -156,6 +224,10 @@ function finalizeTransition(deps, id) {
     if (!row)
         return undefined;
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    if (row.operation_token) {
+        deferredFinalizations.add(id);
+        return snap;
+    }
     deps.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(deps.project.id, snap));
     if (row.origin_conversation_id) {
         const agent = (deps.agentChat ?? agent_chat_registry_1.getAgentChatManager)();
@@ -174,45 +246,189 @@ function batchWorktreeRoot(slug) {
     // Mirrors rail-isolated-launch's worktreesRoot — derivable, never stored.
     return path.join((0, artifact_registry_1.resolveHome)(), '.specrails', 'projects', slug, 'worktrees');
 }
-async function resolveExistingPrDecisionAfterPush(deps, row) {
-    if (!row.pr_url)
-        return 'pr_ready';
-    const r = await deps.exec.run('gh', ['pr', 'view', row.pr_url, '--json', 'isDraft,state'], deps.project.path);
-    if (r.code !== 0)
-        return 'pr_ready';
-    try {
-        const parsed = JSON.parse(r.stdout);
-        if (parsed.isDraft === true)
-            return 'pr_draft';
-    }
-    catch {
-        /* fall through to the conservative published/open state */
+/** A legacy record's `succeeded` bit meant delivery eligibility. New records
+ * state that eligibility directly; blocked/no-change units are never swept as
+ * a side effect of delivering another unit in the same batch. */
+function unitWasDelivered(unit) {
+    return unit.deliveryOutcome === undefined ? unit.succeeded : unit.deliveryOutcome === 'ready';
+}
+/** Branch deletion is ownership-based, never name-derived. Legacy rows without
+ * ownership evidence degrade to preservation. A multi-unit assembled head is
+ * owned when it is distinct from every recorded unit branch. */
+function ownedDeliveryBranches(row, snap, cleanupWarnings) {
+    const unknownOwnership = row.is_continuation !== 1
+        ? snap.branches.filter((unit) => unitWasDelivered(unit) && unit.branchOwnership === undefined)
+        : [];
+    if (cleanupWarnings && unknownOwnership.length > 0) {
+        cleanupWarnings.push(`branch cleanup preserved ${unknownOwnership.length} legacy ${unknownOwnership.length === 1 ? 'branch' : 'branches'} because ownership was not recorded`);
     }
-    return 'pr_ready';
+    const owned = new Set(snap.branches
+        .filter((unit) => unit.branchOwnership === 'created' && unitWasDelivered(unit))
+        .map((unit) => unit.branch));
+    if (row.is_continuation !== 1 && snap.branches.length > 1 && row.branch &&
+        !snap.branches.some((unit) => unit.branch === row.branch))
+        owned.add(row.branch);
+    return owned;
+}
+function releasableWorktreeIds(deps, snap) {
+    const preservedBranches = new Set(snap.branches.filter((unit) => !unitWasDelivered(unit)).map((unit) => unit.branch));
+    return snap.worktreeIds.filter((id) => {
+        const wt = (0, rail_worktrees_store_1.getRailWorktree)(deps.db, id);
+        return !wt || !preservedBranches.has(wt.branch);
+    });
+}
+async function observePrLifecycle(deps, prUrl) {
+    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, prUrl);
+    return observed.ok ? { state: observed.state, isDraft: observed.isDraft } : null;
+}
+function mergedEvidenceDetail(observation) {
+    return observation.includesExpectedSha === null
+        ? 'GitHub did not return enough commit evidence to prove the previous PR included the verified implementation commit'
+        : 'the previous PR merged without the verified implementation commit';
+}
+async function rerouteFromStalePr(deps, row, detail, exactWasPushed) {
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap),
+    });
+    const partial = row.implementation_outcome === 'partially_succeeded';
+    const conflict = casTransition(deps, row, 'on_review', {
+        prUrl: null,
+        prNumber: null,
+        prState: exactWasPushed ? 'pushed' : 'local-only',
+        deliveryOutcome: partial ? 'partial' : 'ready',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : partial ? 'partial_success' : 'ready_for_review',
+        statusDetail: `${detail}; create a new draft PR from the preserved exact commit`,
+        cleanupWarnings,
+        // The replacement PR belongs to this generation. Per-unit branch ownership
+        // remains unchanged so a borrowed/pre-existing ref is still never deleted.
+        isContinuation: false,
+    });
+    if (conflict)
+        return conflict;
+    const after = finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'on_review',
+            prUrl: null,
+            prState: after?.prState ?? (exactWasPushed ? 'pushed' : 'local-only'),
+            rerouted: true,
+            detail,
+        },
+    };
+}
+async function settleObservedExistingPr(deps, row, observation) {
+    const next = observation.state === 'MERGED' || observation.isDraft === false ? 'pr_ready' : 'pr_draft';
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap),
+    });
+    const conflict = casTransition(deps, row, next, {
+        prState: 'pr-created',
+        deliveryOutcome: 'delivered',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : next === 'pr_ready' ? 'pr_ready' : 'existing_pr_updated',
+        cleanupWarnings,
+    });
+    if (conflict)
+        return conflict;
+    const after = finalizeTransition(deps, row.id);
+    return { status: 200, body: { ok: true, decision: next, prUrl: after?.prUrl ?? row.pr_url, prState: 'pr-created' } };
+}
+function persistRetryablePrObservationFailure(deps, row, detail) {
+    const conflict = casTransition(deps, row, 'pr_failed', {
+        deliveryOutcome: 'retryable_failure',
+        statusCode: 'push_failed',
+        statusDetail: detail,
+    });
+    if (conflict)
+        return conflict;
+    finalizeTransition(deps, row.id);
+    return { status: 200, body: { ok: true, decision: 'pr_failed', prUrl: row.pr_url, detail } };
+}
+function persistMovedPrHead(deps, row, detail) {
+    const conflict = casTransition(deps, row, 'pr_failed', {
+        deliveryOutcome: 'blocked',
+        statusCode: 'branch_verification_failed',
+        statusDetail: detail,
+    });
+    if (conflict)
+        return conflict;
+    finalizeTransition(deps, row.id);
+    return { status: 200, body: { ok: true, decision: 'pr_failed', prUrl: row.pr_url, detail } };
 }
 async function retryExistingPrFollowupPush(deps, row) {
     if (!row.branch || !row.pr_url)
         return { status: 502, body: { error: 'push_failed', detail: 'missing PR branch/url' } };
+    if (!row.delivery_sha) {
+        const detail = 'missing verified delivery SHA; refusing to resolve a mutable branch for retry';
+        const conflict = casTransition(deps, row, 'pr_failed', {
+            deliveryOutcome: 'blocked',
+            statusCode: 'branch_verification_failed',
+            statusDetail: detail,
+        });
+        if (conflict)
+            return conflict;
+        finalizeTransition(deps, row.id);
+        return { status: 409, body: { error: 'missing_verified_sha', decision: 'pr_failed', prUrl: row.pr_url, detail } };
+    }
+    const beforePush = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!beforePush.ok) {
+        return persistRetryablePrObservationFailure(deps, row, `could not confirm the existing PR is open before retry: ${beforePush.detail}`);
+    }
+    if (!(0, pr_lifecycle_1.isExactOpenPr)(beforePush, row.branch, row.base_branch)) {
+        if (beforePush.state === 'MERGED' && beforePush.includesExpectedSha === true) {
+            return settleObservedExistingPr(deps, row, beforePush);
+        }
+        if (beforePush.state === 'MERGED') {
+            return rerouteFromStalePr(deps, row, mergedEvidenceDetail(beforePush), false);
+        }
+        if (beforePush.state === 'CLOSED') {
+            return rerouteFromStalePr(deps, row, 'the previous PR closed before this implementation was delivered', false);
+        }
+        return persistMovedPrHead(deps, row, 'the existing PR no longer matches its recorded head/base; the verified commit was not pushed');
+    }
     const pushed = await (0, pr_publisher_1.pushBranch)(deps.exec, {
         repoDir: deps.project.path,
         branch: row.branch,
         baseBranch: row.base_branch,
+        sourceSha: row.delivery_sha,
     });
     if (pushed.state === 'local-only') {
-        const conflict = casTransition(deps, row, 'pr_failed', { prState: 'local-only' });
+        const conflict = casTransition(deps, row, 'pr_failed', {
+            prState: 'local-only',
+            deliveryOutcome: 'retryable_failure',
+            statusCode: 'push_failed',
+            statusDetail: pushed.reason,
+        });
         if (conflict)
             return conflict;
         finalizeTransition(deps, row.id);
         return { status: 200, body: { ok: true, decision: 'pr_failed', prUrl: row.pr_url, detail: pushed.reason } };
     }
-    const next = await resolveExistingPrDecisionAfterPush(deps, row);
-    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    const conflict = casTransition(deps, row, next, { prState: 'pr-created' });
-    if (conflict)
-        return conflict;
-    await (0, rail_worktree_release_1.releaseRailWorktrees)({ db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: snap.worktreeIds });
-    const after = finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: next, prUrl: after?.prUrl ?? row.pr_url, prState: 'pr-created' } };
+    const afterPush = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!afterPush.ok) {
+        return persistRetryablePrObservationFailure(deps, row, `exact commit was pushed, but the PR lifecycle could not be confirmed: ${afterPush.detail}`);
+    }
+    if ((0, pr_lifecycle_1.isExactOpenPr)(afterPush, row.branch, row.base_branch)) {
+        if (afterPush.headRefOid?.toLowerCase() !== row.delivery_sha.toLowerCase()) {
+            return persistMovedPrHead(deps, row, 'the PR head moved after the exact push; the verified commit is preserved but no longer proven as the remote head');
+        }
+        return settleObservedExistingPr(deps, row, afterPush);
+    }
+    if (afterPush.state === 'MERGED' && afterPush.includesExpectedSha === true) {
+        return settleObservedExistingPr(deps, row, afterPush);
+    }
+    if (afterPush.state === 'MERGED') {
+        return rerouteFromStalePr(deps, row, mergedEvidenceDetail(afterPush), true);
+    }
+    if (afterPush.state === 'CLOSED') {
+        return rerouteFromStalePr(deps, row, 'the previous PR closed before this implementation was delivered', true);
+    }
+    return persistMovedPrHead(deps, row, 'the existing PR no longer matches its recorded head/base after the exact push');
 }
 /**
  * Load the PR's ticket data (title/labels/description) from the ticket store,
@@ -254,63 +470,69 @@ async function branchExists(deps, branch) {
     const r = await deps.git.run(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], deps.project.path);
     return r.code === 0;
 }
-/**
- * Recovery for a recorded unit branch that no longer exists (the wedged
- * local-only retry: the settled record drifted from the branch that really
- * carries the commits, or the branch was deleted externally). Scan the ticket's
- * rail_worktrees ledger (newest first) for ANY other branch a rail allocated
- * for the same ticket that still exists AND has commits ahead of the base —
- * that branch is the real carrier of the work. Null when nothing recoverable.
- */
-async function findRecoverableBranch(deps, unit, baseBranch) {
-    let candidates = [];
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+async function commitObjectExists(deps, sha) {
+    if (!COMMIT_SHA_RE.test(sha))
+        return false;
     try {
-        candidates = (0, rail_worktrees_store_1.listRailWorktreesForTicket)(deps.db, unit.ticketId);
+        return (await deps.git.run(['cat-file', '-e', `${sha}^{commit}`], deps.project.path)).code === 0;
     }
     catch {
-        return null;
+        return false;
     }
-    for (const wt of candidates) {
-        if (!wt.branch || wt.branch === unit.branch || wt.branch === baseBranch)
-            continue;
-        if (!(await branchExists(deps, wt.branch)))
-            continue;
-        const ahead = await deps.git.run(['rev-list', '--count', `${baseBranch}..${wt.branch}`], deps.project.path);
-        const n = ahead.code === 0 ? parseInt(ahead.stdout.trim(), 10) : NaN;
-        if (Number.isFinite(n) && n > 0)
-            return wt.branch;
+}
+/** Resolve a legacy mutable ref once into an immutable object. New settlement
+ * rows already carry finalSha and never take this compatibility path. */
+async function captureBranchSha(deps, branch) {
+    try {
+        const result = await deps.git.run(['rev-parse', '--verify', `refs/heads/${branch}`], deps.project.path);
+        const sha = result.code === 0 ? result.stdout.trim() : '';
+        return COMMIT_SHA_RE.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
     }
-    return null;
 }
 async function runCreatePr(deps, row) {
     if (row.decision === 'pr_failed' && row.pr_url && row.branch) {
         return retryExistingPrFollowupPush(deps, row);
     }
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    // Pre-flight: every succeeded unit branch must actually exist before we push
-    // it — a missing ref can only degrade to local-only again, so a retry on a
-    // wedged row would loop forever. When a recorded branch is gone, recover the
-    // REAL branch from the ticket's worktree ledger (see findRecoverableBranch)
-    // and persist the substitution on the row; unrecoverable → honest pr_failed.
+    // Resolve every deliverable unit to an immutable object. New rows carry the
+    // verified final SHA from settlement; legacy rows may capture their recorded
+    // ref once. Never substitute another historical branch merely because it
+    // belongs to the same ticket.
     let effectiveBranches = snap.branches;
-    let branchesRecovered = false;
-    for (const unit of snap.branches) {
+    let branchEvidenceCaptured = false;
+    for (let index = 0; index < snap.branches.length; index++) {
+        const unit = snap.branches[index];
         if (!unit.succeeded)
             continue;
-        if (await branchExists(deps, unit.branch))
-            continue;
-        const real = await findRecoverableBranch(deps, unit, row.base_branch);
-        if (!real) {
-            const detail = `branch '${unit.branch}' (ticket #${unit.ticketId}) no longer exists locally and no other rail branch for the ticket holds commits — nothing to deliver`;
-            const conflict = casTransition(deps, row, 'pr_failed');
+        let sourceSha = unit.finalSha && COMMIT_SHA_RE.test(unit.finalSha) ? unit.finalSha : null;
+        if (sourceSha) {
+            if (!(await commitObjectExists(deps, sourceSha)))
+                sourceSha = null;
+        }
+        else {
+            sourceSha = await captureBranchSha(deps, unit.branch);
+            if (sourceSha && !(await commitObjectExists(deps, sourceSha)))
+                sourceSha = null;
+        }
+        if (!sourceSha) {
+            const detail = `the verified commit for branch '${unit.branch}' (ticket #${unit.ticketId}) is unavailable; refusing to deliver a mutable or unrelated ref`;
+            const conflict = casTransition(deps, row, 'pr_failed', {
+                deliveryOutcome: 'blocked', statusCode: 'branch_verification_failed', statusDetail: detail,
+            });
             if (conflict)
                 return conflict;
             finalizeTransition(deps, row.id);
             return { status: 200, body: { ok: true, decision: 'pr_failed', detail } };
         }
-        console.warn(`[rail-pr-decision] recorded branch '${unit.branch}' missing — recovered '${real}' from the ticket ${unit.ticketId} worktree ledger`);
-        effectiveBranches = effectiveBranches.map((b) => (b === unit ? { ...b, branch: real } : b));
-        branchesRecovered = true;
+        if (unit.finalSha !== sourceSha)
+            branchEvidenceCaptured = true;
+        effectiveBranches = effectiveBranches.map((branch, branchIndex) => branchIndex === index
+            ? { ...branch, finalSha: sourceSha }
+            : branch);
     }
     // Succeeded COVERED tickets for the PR title/body: a single unit covers every
     // launch ticket (scope='all'), per-ticket units cover exactly their own.
@@ -322,16 +544,7 @@ async function runCreatePr(deps, row) {
     // The batch name is derived ONLY for multi-unit deliveries — the single-ticket
     // path delivers straight from its unit branch and must never even compute one.
     const batchPreferred = succeededUnits.length > 1 ? (0, pr_naming_1.batchBranchNameFor)(ticketData) : null;
-    // Retry hazard: deliverRailAsPr assembles with `worktree add -b` (no -B) and a
-    // prior degraded delivery KEEPS the batch branch — so a retry would die on
-    // "branch already exists". Defensively drop the stale batch branch first
-    // (batch deliveries only). HARD GUARDS: NEVER a branch present in the row's
-    // unit records (deleting one would destroy the commits about to be delivered)
-    // and NEVER the integration branch; a missing branch is tolerated.
     const unitBranches = new Set(effectiveBranches.map((b) => b.branch));
-    if (batchPreferred && batchPreferred !== row.base_branch && !unitBranches.has(batchPreferred)) {
-        await deps.git.run(['branch', '-D', batchPreferred], deps.project.path).catch(() => { });
-    }
     // Per-ticket covering branch for the body's honest Tests digest: per-ticket
     // units map 1:1; a single 'all'-scope unit covers every launch ticket.
     const branchFor = (ticketId) => {
@@ -358,38 +571,75 @@ async function runCreatePr(deps, row) {
     });
     let next;
     // Underlying git/gh failure detail for a degraded or failed delivery —
-    // relayed on the response body so the decision surfaces can say WHY instead
-    // of a bare "retry". Never persisted (the durable columns stay state-only).
+    // relayed on the response and persisted as bounded secondary diagnostics.
     let detail = null;
     const patch = {};
-    // Persist any pre-flight substitution so the row records the branch that
-    // actually carries the commits — the next retry/discard works from reality.
-    if (branchesRecovered)
+    if (branchEvidenceCaptured)
         patch.branches = effectiveBranches;
     try {
-        const result = await (0, rail_pr_delivery_1.deliverRailAsPr)(deps.git, deps.exec, {
-            baseRepo: deps.project.path,
-            integrationBranch: row.base_branch,
-            railKey: row.rail_key,
-            batchBranch: batchPreferred ?? undefined,
-            batchWorktreeRoot: batchWorktreeRoot(deps.project.slug),
-            branches: effectiveBranches,
-            title,
-            body,
-        });
+        // A degraded multi-unit attempt already owns an assembled batch branch.
+        // Retry that exact head so exact head/base PR discovery remains idempotent;
+        // never `branch -D` a merely name-matching ref, which could destroy a user's
+        // unrelated or subsequently edited local branch.
+        let degradedBatchSha = null;
+        if (batchPreferred && row.branch && row.pr_url === null &&
+            (row.pr_state === 'pushed' || row.pr_state === 'local-only') &&
+            row.branch !== row.base_branch && !unitBranches.has(row.branch)) {
+            if (row.delivery_sha && await commitObjectExists(deps, row.delivery_sha)) {
+                degradedBatchSha = row.delivery_sha;
+            }
+            else {
+                degradedBatchSha = await captureBranchSha(deps, row.branch);
+            }
+        }
+        const result = degradedBatchSha
+            ? {
+                state: 'delivered',
+                branch: row.branch,
+                pr: await (0, pr_publisher_1.publishDraftPr)(deps.exec, {
+                    repoDir: deps.project.path,
+                    branch: row.branch,
+                    baseBranch: row.base_branch,
+                    title,
+                    body,
+                    sourceSha: degradedBatchSha,
+                }),
+                ticketIds: succeededTicketIds,
+            }
+            : await (0, rail_pr_delivery_1.deliverRailAsPr)(deps.git, deps.exec, {
+                baseRepo: deps.project.path,
+                integrationBranch: row.base_branch,
+                railKey: row.rail_key,
+                batchBranch: batchPreferred ?? undefined,
+                batchWorktreeRoot: batchWorktreeRoot(deps.project.slug),
+                branches: effectiveBranches.map((unit) => ({
+                    ...unit,
+                    sourceSha: unit.finalSha ?? undefined,
+                })),
+                title,
+                body,
+            });
         if (result.state === 'delivered') {
-            next = 'pr_draft';
+            next = result.pr.state === 'pr-created' && result.pr.isDraft === false ? 'pr_ready' : 'pr_draft';
             patch.branch = result.branch;
             patch.prState = result.pr.state;
+            const resultSha = degradedBatchSha
+                ?? (succeededUnits.length === 1 ? succeededUnits[0].finalSha ?? null : await captureBranchSha(deps, result.branch));
+            if (resultSha && await commitObjectExists(deps, resultSha))
+                patch.deliverySha = resultSha;
             if (result.pr.state === 'pr-created' && result.pr.prUrl) {
                 patch.prUrl = result.pr.prUrl;
                 patch.prNumber = parsePrNumber(result.pr.prUrl);
+                patch.deliveryOutcome = 'delivered';
+                patch.statusCode = next === 'pr_ready' ? 'pr_ready' : 'pr_draft_ready';
             }
             else {
                 // Degraded (pushed / local-only): no PR exists — only retry or discard.
                 patch.prUrl = null;
                 patch.prNumber = null;
                 detail = result.pr.reason ?? null;
+                patch.deliveryOutcome = 'retryable_failure';
+                patch.statusCode = result.pr.state === 'local-only' ? 'push_failed' : 'delivery_failed';
             }
         }
         else {
@@ -397,6 +647,11 @@ async function runCreatePr(deps, row) {
             // succeeded unit, but a wedged row must not 500) → retryable failure.
             next = 'pr_failed';
             detail = result.reason;
+            const retryable = !result.reason.startsWith('merge-conflict:') &&
+                !result.reason.startsWith('batch-branch-collision:') &&
+                result.reason !== 'missing-batch-branch' && result.state === 'assembly-failed';
+            patch.deliveryOutcome = retryable ? 'retryable_failure' : 'blocked';
+            patch.statusCode = 'delivery_failed';
         }
     }
     catch (err) {
@@ -405,13 +660,19 @@ async function runCreatePr(deps, row) {
         console.error('[rail-pr-decision] create-pr delivery failed:', err);
         next = 'pr_failed';
         detail = err instanceof Error ? err.message : String(err);
+        patch.deliveryOutcome = 'blocked';
+        patch.statusCode = 'delivery_failed';
+    }
+    if (detail)
+        patch.statusDetail = detail;
+    if ((next === 'pr_draft' || next === 'pr_ready') && patch.prUrl) {
+        patch.cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+            db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: releasableWorktreeIds(deps, snap),
+        });
     }
     const conflict = casTransition(deps, row, next, patch);
     if (conflict)
         return conflict;
-    if (next === 'pr_draft' && patch.prUrl) {
-        await (0, rail_worktree_release_1.releaseRailWorktrees)({ db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: snap.worktreeIds });
-    }
     const after = finalizeTransition(deps, row.id);
     // Tickets stay on_review — a draft PR is still awaiting the engineer's merge.
     return {
@@ -426,158 +687,310 @@ async function runCreatePr(deps, row) {
     };
 }
 async function runPublish(deps, row) {
-    const r = await deps.exec.run('gh', ['pr', 'ready', row.pr_url], deps.project.path);
-    if (r.code !== 0)
-        return ghFailed(r); // no transition — the draft is still a draft
+    let r;
+    try {
+        r = await deps.exec.run('gh', ['pr', 'ready', row.pr_url], deps.project.path);
+    }
+    catch (err) {
+        r = { code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) };
+    }
+    if (r.code !== 0) {
+        // Crash/timeout ambiguity: `gh` may have made the PR ready before the local
+        // command reported failure. Adopt exact remote truth instead of retrying
+        // forever on "already ready".
+        const lifecycle = await observePrLifecycle(deps, row.pr_url);
+        if (lifecycle?.state === 'CLOSED') {
+            const conflict = casTransition(deps, row, 'pr_closed', {
+                deliveryOutcome: 'delivered', statusCode: 'pr_closed',
+            });
+            if (conflict)
+                return conflict;
+            finalizeTransition(deps, row.id);
+            return { status: 200, body: { ok: true, decision: 'pr_closed', closed: true, prUrl: row.pr_url } };
+        }
+        if (lifecycle?.state !== 'OPEN' || lifecycle.isDraft)
+            return ghFailed(r);
+    }
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    const conflict = casTransition(deps, row, 'pr_ready');
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: releasableWorktreeIds(deps, snap),
+    });
+    const conflict = casTransition(deps, row, 'pr_ready', {
+        deliveryOutcome: 'delivered', statusCode: 'pr_ready', cleanupWarnings,
+    });
     if (conflict)
         return conflict;
-    await (0, rail_worktree_release_1.releaseRailWorktrees)({ db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: snap.worktreeIds });
     finalizeTransition(deps, row.id);
     return { status: 200, body: { ok: true, decision: 'pr_ready', prUrl: row.pr_url } };
 }
-async function runDiscard(deps, row) {
+async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
     const implementationFailed = row.decision === 'implementation_failed';
-    // 1. Close the PR (drops its head branch) when one exists. Best-effort — a
-    //    gh failure must never leave the discard half-done.
-    //
-    // Implementation-failed rows are different: the implement run produced no
-    // deliverable update. If the row belongs to an existing-PR continuation it may
-    // still carry that PR's url/branch from launch time; clearing the failed card
-    // must not close or delete the user's existing review branch.
-    if (row.pr_url && !implementationFailed) {
+    const preserveBorrowedReview = row.is_continuation === 1;
+    const cleanupWarnings = [];
+    // A continuation borrows an existing PR/head. Discarding its local iteration
+    // may remove Specrails' worktree, but never closes or deletes borrowed review
+    // state. Fresh deliveries retain the original destructive semantics.
+    if (row.pr_url && !implementationFailed && !preserveBorrowedReview) {
         try {
             const r = await deps.exec.run('gh', ['pr', 'close', row.pr_url, '--delete-branch'], deps.project.path);
             if (r.code !== 0) {
-                console.warn(`[rail-pr-decision] gh pr close failed (continuing discard): ${(r.stderr.trim() || r.stdout.trim()).split('\n')[0]}`);
+                const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
+                cleanupWarnings.push(`PR close ${row.pr_url}: ${detail}`);
+                console.warn(`[rail-pr-decision] gh pr close failed (continuing discard): ${detail}`);
             }
         }
         catch (err) {
+            cleanupWarnings.push(`PR close ${row.pr_url}: ${err instanceof Error ? err.message : String(err)}`);
             console.warn('[rail-pr-decision] gh pr close threw (continuing discard):', err);
         }
     }
     // 2. Remove the launch's worktrees (still on disk unless a restart already
     //    swept them) and close their ledger rows — the reconcile-style removal,
     //    branch deletion deferred to step 3 (a checked-out branch can't be -D'd).
-    const branchSet = new Set(implementationFailed ? [] : snap.branches.map((b) => b.branch));
+    const deleteOwnedBranches = !implementationFailed && !preserveBorrowedReview;
+    const branchSet = deleteOwnedBranches ? ownedDeliveryBranches(row, snap, cleanupWarnings) : new Set();
     for (const wtId of snap.worktreeIds) {
         const wt = (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId);
         if (!wt)
             continue;
-        if (!implementationFailed)
-            branchSet.add(wt.branch);
-        await (0, worktree_manager_1.removeWorktree)(deps.git, {
-            repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
-        }).catch(() => { });
+        if (wt.merge_state === 'needs-review' && opts.removeNeedsReview !== true)
+            continue;
+        if (wt.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
+            continue;
+        try {
+            await (0, worktree_manager_1.removeWorktree)(deps.git, {
+                repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            cleanupWarnings.push(`worktree ${wt.worktree_path}: ${detail}`);
+            console.warn(`[rail-pr-decision] discard could not remove worktree ${wt.worktree_path}: ${detail}`);
+            continue;
+        }
         if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
             (0, rail_worktrees_store_1.updateRailWorktreeState)(deps.db, wt.id, 'failed');
     }
-    // 3. Delete every branch the delivery references: per-unit source branches,
-    //    the assembled head and the (possibly stale) batch branch — recomputed
-    //    best-effort from the same ticket data the create-pr path names it from
-    //    (the delivered head is already covered by row.branch). Missing branches
-    //    are tolerated; the integration branch is NEVER deleted.
-    if (!implementationFailed) {
-        if (row.branch)
-            branchSet.add(row.branch);
-        const succeededUnits = snap.branches.filter((b) => b.succeeded);
-        if (succeededUnits.length > 1) {
+    // 3. Delete only branches this delivery durably records as created: owned
+    //    per-unit sources and, for a multi-unit fresh delivery, its exact
+    //    assembled head. A preferred name is never recomputed here because it
+    //    may belong to the user. Missing branches are tolerated; the integration
+    //    branch is NEVER deleted.
+    if (deleteOwnedBranches) {
+        for (const branch of branchSet) {
+            if (!branch || branch === row.base_branch)
+                continue;
             try {
-                branchSet.add((0, pr_naming_1.batchBranchNameFor)(loadPrTicketData(deps, succeededUnits.map((b) => b.ticketId))));
+                const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
+                if (deleted.code !== 0) {
+                    cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+                }
             }
-            catch {
-                /* best-effort defense-in-depth only */
+            catch (err) {
+                cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        for (const branch of branchSet) {
-            if (!branch || branch === row.base_branch)
+    }
+    const terminalPatch = {
+        deliveryOutcome: 'not_started',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'discarded',
+        cleanupWarnings,
+    };
+    const conflict = preserveBorrowedReview
+        ? casTransition(deps, row, 'discarded', terminalPatch)
+        : casTransitionWithTicketEffect(deps, row, 'discarded', terminalPatch, {
+            deliveryId: row.id,
+            ticketIds: snap.ticketIds,
+            targetStatus: 'todo',
+            // The dashboard labels discard-from-no_changes as Refine. Jira must
+            // mirror that truthful backlog return and never apply discardStatus.
+            jiraAction: row.decision === 'no_changes' ? 'refine' : 'discard',
+            prUrl: null,
+        });
+    if (conflict)
+        return conflict;
+    if (!preserveBorrowedReview)
+        applyTerminalTicketEffect(deps, row, 'discarded', cleanupWarnings);
+    finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'discarded',
+            ...(cleanupWarnings.length > 0 ? { cleanupWarnings } : {}),
+            ...(preserveBorrowedReview ? { preservedBorrowedReview: true } : {}),
+        },
+    };
+}
+async function runDismiss(deps, row) {
+    // Legality restricts dismiss to a clean/retryable continuation. Reuse the
+    // ownership-safe discard path; its external PR, head and tickets are borrowed.
+    return runDiscard(deps, row, { removeNeedsReview: false });
+}
+async function runAcknowledgeNoChanges(deps, row) {
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db,
+        git: deps.git,
+        repoDir: deps.project.path,
+        worktreeIds: snap.worktreeIds,
+    });
+    // A fresh no-change branch is disposable only while Git still proves that it
+    // has no commits ahead of the integration base. If the user added work after
+    // settlement, preserve it and disclose the incomplete cleanup.
+    for (const branch of ownedDeliveryBranches(row, snap, cleanupWarnings)) {
+        if (!branch || branch === row.base_branch)
+            continue;
+        try {
+            const ahead = await deps.git.run(['rev-list', '--count', `${row.base_branch}..${branch}`], deps.project.path);
+            if (ahead.code !== 0 || Number.parseInt(ahead.stdout.trim(), 10) !== 0) {
+                cleanupWarnings.push(`branch ${branch}: retained because no-change cleanup could not prove it has zero commits ahead of ${row.base_branch}`);
                 continue;
-            await deps.git.run(['branch', '-D', branch], deps.project.path).catch(() => { });
+            }
+            const deleted = await deps.git.run(['branch', '-d', branch], deps.project.path);
+            if (deleted.code !== 0) {
+                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    const conflict = casTransition(deps, row, 'discarded');
+    const conflict = casTransitionWithTicketEffect(deps, row, 'completed', {
+        deliveryOutcome: 'no_changes',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'no_changes',
+        cleanupWarnings,
+    }, {
+        deliveryId: row.id,
+        ticketIds: snap.ticketIds,
+        targetStatus: 'done',
+        jiraAction: 'completed',
+        prUrl: null,
+    });
     if (conflict)
         return conflict;
+    applyTerminalTicketEffect(deps, row, 'completed', cleanupWarnings);
     finalizeTransition(deps, row.id);
-    // 4. Revert the parked tickets to the backlog + mirror to Jira (outbox-only;
-    //    the local write above is ours).
-    const changed = applyTicketTransition(deps, snap.ticketIds, 'todo');
-    try {
-        deps.jiraSyncManager?.onRailDiscard(changed, row.id);
-    }
-    catch (err) {
-        console.error('[rail-pr-decision] jira onRailDiscard failed:', err);
-    }
-    return { status: 200, body: { ok: true, decision: 'discarded' } };
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'completed',
+            noChanges: true,
+            ...(cleanupWarnings.length > 0 ? { cleanupWarnings } : {}),
+        },
+    };
 }
 async function runPollMerge(deps, row) {
-    const r = await deps.exec.run('gh', ['pr', 'view', row.pr_url, '--json', 'state,mergedAt'], deps.project.path);
-    if (r.code !== 0)
-        return ghFailed(r); // no transition
-    let state;
-    try {
-        state = JSON.parse(r.stdout).state;
+    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!observed.ok)
+        return { status: 502, body: { error: 'gh_failed', detail: observed.detail } };
+    const { state, isDraft } = observed;
+    if (state === 'CLOSED') {
+        const conflict = casTransition(deps, row, 'pr_closed', {
+            deliveryOutcome: 'delivered', statusCode: 'pr_closed',
+        });
+        if (conflict)
+            return conflict;
+        finalizeTransition(deps, row.id);
+        return { status: 200, body: { ok: true, decision: 'pr_closed', merged: false, closed: true, prUrl: row.pr_url } };
     }
-    catch {
-        return { status: 502, body: { error: 'gh_failed', detail: 'unparseable gh pr view output' } };
+    if (state === 'OPEN') {
+        // A successful reopen can be observed even if the explicit action lost its
+        // follow-up `gh view` response. Polling heals pr_closed from remote truth.
+        if (row.decision === 'pr_closed') {
+            const next = isDraft ? 'pr_draft' : 'pr_ready';
+            const conflict = casTransition(deps, row, next, {
+                deliveryOutcome: 'delivered', statusCode: isDraft ? 'pr_draft_ready' : 'pr_ready',
+            });
+            if (conflict)
+                return conflict;
+            finalizeTransition(deps, row.id);
+            return { status: 200, body: { ok: true, decision: next, merged: false, reopened: true, prUrl: row.pr_url } };
+        }
+        return { status: 200, body: { ok: true, decision: row.decision, merged: false } };
     }
     if (state !== 'MERGED') {
-        // Not merged (OPEN/CLOSED/unknown) → observation only, nothing changes.
-        return { status: 200, body: { ok: true, decision: row.decision, merged: false } };
+        return { status: 502, body: { error: 'gh_failed', detail: `unexpected PR state: ${state}` } };
     }
-    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    const branchSet = new Set(snap.branches.map((b) => b.branch));
-    if (row.branch)
-        branchSet.add(row.branch);
-    const succeededUnits = snap.branches.filter((b) => b.succeeded);
-    if (succeededUnits.length > 1) {
-        try {
-            branchSet.add((0, pr_naming_1.batchBranchNameFor)(loadPrTicketData(deps, succeededUnits.map((b) => b.ticketId))));
-        }
-        catch {
-            /* best-effort cleanup only */
-        }
+    // A PR can merge just before a continuation push; GitHub may then accept a
+    // later update to the head branch even though that object was never part of
+    // the merge. Never move tickets to Done from state=MERGED alone.
+    if (!row.delivery_sha) {
+        return persistMovedPrHead(deps, row, 'the merged PR has no persisted verified delivery SHA; refusing to infer delivery from a mutable branch');
     }
-    await (0, rail_worktree_release_1.releaseRailWorktrees)({ db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: snap.worktreeIds, state: 'merged' });
+    if (observed.includesExpectedSha !== true) {
+        return rerouteFromStalePr(deps, row, mergedEvidenceDetail(observed), true);
+    }
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap), state: 'merged',
+    });
+    const branchSet = ownedDeliveryBranches(row, snap, cleanupWarnings);
     for (const branch of branchSet) {
         if (!branch || branch === row.base_branch)
             continue;
-        await deps.git.run(['branch', '-D', branch], deps.project.path).catch(() => { });
+        try {
+            const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
+            if (deleted.code !== 0) {
+                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
-    const conflict = casTransition(deps, row, 'merged');
+    const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
+        deliveryOutcome: 'delivered',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+        cleanupWarnings,
+    }, {
+        deliveryId: row.id,
+        ticketIds: snap.ticketIds,
+        targetStatus: 'done',
+        jiraAction: 'merged',
+        prUrl: row.pr_url,
+    });
     if (conflict)
         return conflict;
+    applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
     finalizeTransition(deps, row.id);
-    const changed = applyTicketTransition(deps, snap.ticketIds, 'done');
+    return { status: 200, body: { ok: true, decision: 'merged', merged: true, prUrl: row.pr_url } };
+}
+async function runReopen(deps, row) {
+    let reopened;
     try {
-        deps.jiraSyncManager?.onRailMerged(changed, row.id, row.pr_url);
+        reopened = await deps.exec.run('gh', ['pr', 'reopen', row.pr_url], deps.project.path);
     }
     catch (err) {
-        console.error('[rail-pr-decision] jira onRailMerged failed:', err);
+        reopened = { code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) };
     }
-    return { status: 200, body: { ok: true, decision: 'merged', merged: true, prUrl: row.pr_url } };
+    const lifecycle = await observePrLifecycle(deps, row.pr_url);
+    if (lifecycle?.state !== 'OPEN') {
+        if (reopened.code !== 0)
+            return ghFailed(reopened);
+        return { status: 502, body: { error: 'gh_failed', detail: `PR did not reopen (state ${lifecycle?.state ?? 'unknown'})` } };
+    }
+    const next = lifecycle.isDraft ? 'pr_draft' : 'pr_ready';
+    const conflict = casTransition(deps, row, next, {
+        deliveryOutcome: 'delivered', statusCode: lifecycle.isDraft ? 'pr_draft_ready' : 'pr_ready',
+    });
+    if (conflict)
+        return conflict;
+    finalizeTransition(deps, row.id);
+    return { status: 200, body: { ok: true, decision: next, reopened: true, prUrl: row.pr_url } };
 }
-/**
- * Remote-less acceptance: merge the delivery's branches into the integration
- * branch DIRECTLY in the user's checkout. This is the one decision that touches
- * the user's working tree, so it is triple-guarded and transactional-ish:
- *
- *   - The checkout must have the integration branch checked out (a branch can
- *     only be checked out in one worktree — merging via a temp worktree is
- *     impossible while the user holds it) → 409 `merge_local_blocked` otherwise.
- *   - The working tree must be CLEAN → 409 `merge_local_blocked` otherwise.
- *   - Merge = the assembled head when one exists (row.branch), else each
- *     succeeded unit branch sequentially, `--no-ff --no-edit`. Any conflict →
- *     `merge --abort` + 502 `merge_failed`, NO transition (retry or discard).
- *
- * Success mirrors poll-merge's MERGED arm: decision → merged (prUrl stays
- * null), worktrees/branches swept, tickets → done, Jira onRailMerged(null).
- */
 async function runMergeLocal(deps, row) {
+    return (0, repo_lock_1.withRepoLock)(deps.project.path, () => runMergeLocalLocked(deps, row));
+}
+async function runMergeLocalLocked(deps, row) {
+    deps.assertAdmission?.();
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    // Guards on the user's checkout.
+    const cleanupWarnings = [];
+    // Snapshot the checkout the user authorized. The same three invariants are
+    // revalidated immediately before the one final fast-forward.
     const head = await deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], deps.project.path);
     const currentBranch = head.code === 0 ? head.stdout.trim() : '';
     if (currentBranch !== row.base_branch) {
@@ -590,72 +1003,186 @@ async function runMergeLocal(deps, row) {
     if (status.code !== 0 || status.stdout.trim() !== '') {
         return { status: 409, body: { error: 'merge_local_blocked', reason: 'dirty', base: row.base_branch } };
     }
-    // What to merge: the assembled head carries every unit already; without one
-    // (straight from on_review) merge each succeeded unit branch in order.
+    const startingHead = await deps.git.run(['rev-parse', '--verify', 'HEAD'], deps.project.path);
+    const startingSha = startingHead.code === 0 ? startingHead.stdout.trim() : '';
+    if (!/^[0-9a-f]{40,64}$/i.test(startingSha)) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: row.base_branch } };
+    }
+    // What to merge: immutable object ids only. The assembled head carries every
+    // unit already; without one, merge each settled unit's exact final SHA.
     let toMerge;
-    if (row.branch && (await branchExists(deps, row.branch))) {
-        toMerge = [row.branch];
+    let deliveryHeadSha = null;
+    if (row.delivery_sha && await commitObjectExists(deps, row.delivery_sha)) {
+        deliveryHeadSha = row.delivery_sha;
+    }
+    else if (row.branch) {
+        deliveryHeadSha = await captureBranchSha(deps, row.branch);
+    }
+    if (deliveryHeadSha) {
+        toMerge = [deliveryHeadSha];
     }
     else {
         toMerge = [];
         for (const unit of snap.branches.filter((b) => b.succeeded)) {
-            let branch = unit.branch;
-            if (!(await branchExists(deps, branch)))
-                branch = await findRecoverableBranch(deps, unit, row.base_branch);
-            if (!branch) {
+            let sourceSha = unit.finalSha && COMMIT_SHA_RE.test(unit.finalSha) ? unit.finalSha : null;
+            if (sourceSha) {
+                if (!(await commitObjectExists(deps, sourceSha)))
+                    sourceSha = null;
+            }
+            else {
+                sourceSha = await captureBranchSha(deps, unit.branch);
+            }
+            if (!sourceSha) {
                 return {
                     status: 502,
-                    body: { error: 'merge_failed', detail: `branch '${unit.branch}' (ticket #${unit.ticketId}) no longer exists locally — nothing to merge` },
+                    body: { error: 'merge_failed', detail: `verified commit for '${unit.branch}' (ticket #${unit.ticketId}) is unavailable` },
                 };
             }
-            toMerge.push(branch);
+            toMerge.push(sourceSha);
         }
     }
     if (toMerge.length === 0) {
         return { status: 502, body: { error: 'merge_failed', detail: 'no succeeded branch to merge' } };
     }
+    // Assemble every merge away from the user's checkout. A conflict can only
+    // dirty this disposable detached worktree, never the integration branch.
+    const safeId = row.id.replace(/[^A-Za-z0-9-]/g, '').slice(0, 64) || 'delivery';
+    const assemblyPath = path.join(deps.assemblyRoot ?? batchWorktreeRoot(deps.project.slug), `local-merge-${safeId}-${(0, ids_1.newId)()}`);
+    const added = await deps.git.run(['worktree', 'add', '--detach', assemblyPath, startingSha], deps.project.path);
+    if (added.code !== 0) {
+        const detail = (added.stderr.trim() || added.stdout.trim()).split('\n')[0] || `exit ${added.code}`;
+        return { status: 502, body: { error: 'merge_failed', detail: `creating isolated assembly: ${detail}` } };
+    }
+    const removeAssembly = async () => {
+        try {
+            const removed = await deps.git.run(['worktree', 'remove', '--force', assemblyPath], deps.project.path);
+            if (removed.code !== 0) {
+                cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${(removed.stderr.trim() || removed.stdout.trim()).split('\n')[0] || `exit ${removed.code}`}`);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    };
+    const persistAssemblyFailure = (detail) => {
+        const conflict = casTransition(deps, row, row.decision, {
+            deliveryOutcome: 'blocked', statusCode: 'delivery_failed', statusDetail: detail, cleanupWarnings,
+        });
+        if (conflict)
+            return conflict;
+        finalizeTransition(deps, row.id);
+        return null;
+    };
     for (const branch of toMerge) {
-        const r = await deps.git.run(['merge', '--no-ff', '--no-edit', branch], deps.project.path);
+        const r = await deps.git.run(['merge', '--no-ff', '--no-edit', branch], assemblyPath);
         if (r.code !== 0) {
-            await deps.git.run(['merge', '--abort'], deps.project.path).catch(() => { });
+            try {
+                const aborted = await deps.git.run(['merge', '--abort'], assemblyPath);
+                if (aborted.code !== 0)
+                    cleanupWarnings.push(`assembly abort ${branch}: exit ${aborted.code}`);
+            }
+            catch (err) {
+                cleanupWarnings.push(`assembly abort ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            await removeAssembly();
             const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
+            const conflict = persistAssemblyFailure(`merging '${branch}': ${detail}`);
+            if (conflict)
+                return conflict;
             return { status: 502, body: { error: 'merge_failed', detail: `merging '${branch}': ${detail}` } };
         }
     }
-    // Post-merge sweep (same shape as discard steps 2-3): the work now lives on
+    const assembled = await deps.git.run(['rev-parse', '--verify', 'HEAD'], assemblyPath);
+    const assembledSha = assembled.code === 0 ? assembled.stdout.trim() : '';
+    if (!/^[0-9a-f]{40,64}$/i.test(assembledSha)) {
+        await removeAssembly();
+        const detail = 'isolated assembly produced no verifiable HEAD';
+        const conflict = persistAssemblyFailure(detail);
+        if (conflict)
+            return conflict;
+        return { status: 502, body: { error: 'merge_failed', detail } };
+    }
+    const [finalBranch, finalStatus, finalHead] = await Promise.all([
+        deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], deps.project.path),
+        deps.git.run(['status', '--porcelain'], deps.project.path),
+        deps.git.run(['rev-parse', '--verify', 'HEAD'], deps.project.path),
+    ]);
+    const changedReason = finalBranch.code !== 0 || finalBranch.stdout.trim() !== row.base_branch
+        ? 'wrong_branch'
+        : finalStatus.code !== 0 || finalStatus.stdout.trim() !== ''
+            ? 'dirty'
+            : finalHead.code !== 0 || finalHead.stdout.trim() !== startingSha
+                ? 'head_changed'
+                : null;
+    if (changedReason) {
+        await removeAssembly();
+        if (cleanupWarnings.length > 0) {
+            const conflict = casTransition(deps, row, row.decision, { cleanupWarnings });
+            if (conflict)
+                return conflict;
+            finalizeTransition(deps, row.id);
+        }
+        return { status: 409, body: { error: 'merge_local_blocked', reason: changedReason, base: row.base_branch } };
+    }
+    const advanced = await deps.git.run(['merge', '--ff-only', assembledSha], deps.project.path);
+    if (advanced.code !== 0) {
+        await removeAssembly();
+        const detail = (advanced.stderr.trim() || advanced.stdout.trim()).split('\n')[0] || `exit ${advanced.code}`;
+        const conflict = persistAssemblyFailure(`advancing '${row.base_branch}': ${detail}`);
+        if (conflict)
+            return conflict;
+        return { status: 502, body: { error: 'merge_failed', detail: `advancing '${row.base_branch}': ${detail}` } };
+    }
+    await removeAssembly();
+    // Post-advance sweep: the work now lives on
     // the integration branch, so the launch's worktrees + branches are spent.
-    const branchSet = new Set(toMerge);
-    for (const b of snap.branches)
-        branchSet.add(b.branch);
-    if (row.branch)
-        branchSet.add(row.branch);
-    for (const wtId of snap.worktreeIds) {
+    const branchSet = ownedDeliveryBranches(row, snap, cleanupWarnings);
+    for (const wtId of releasableWorktreeIds(deps, snap)) {
         const wt = (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId);
         if (!wt)
             continue;
-        branchSet.add(wt.branch);
-        await (0, worktree_manager_1.removeWorktree)(deps.git, {
-            repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
-        }).catch(() => { });
+        try {
+            await (0, worktree_manager_1.removeWorktree)(deps.git, {
+                repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
+            });
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            cleanupWarnings.push(`worktree ${wt.worktree_path}: ${detail}`);
+            console.warn(`[rail-pr-decision] merge-local could not remove worktree ${wt.worktree_path}: ${detail}`);
+            continue;
+        }
         if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
             (0, rail_worktrees_store_1.updateRailWorktreeState)(deps.db, wt.id, 'merged');
     }
     for (const branch of branchSet) {
         if (!branch || branch === row.base_branch)
             continue;
-        await deps.git.run(['branch', '-D', branch], deps.project.path).catch(() => { });
+        try {
+            const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
+            if (deleted.code !== 0) {
+                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
-    const conflict = casTransition(deps, row, 'merged');
+    const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
+        deliveryOutcome: 'delivered',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+        cleanupWarnings,
+    }, {
+        deliveryId: row.id,
+        ticketIds: snap.ticketIds,
+        targetStatus: 'done',
+        jiraAction: 'merged',
+        prUrl: null,
+    });
     if (conflict)
         return conflict;
+    applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
     finalizeTransition(deps, row.id);
-    const changed = applyTicketTransition(deps, snap.ticketIds, 'done');
-    try {
-        deps.jiraSyncManager?.onRailMerged(changed, row.id, null);
-    }
-    catch (err) {
-        console.error('[rail-pr-decision] jira onRailMerged (local) failed:', err);
-    }
     return { status: 200, body: { ok: true, decision: 'merged', merged: true, local: true } };
 }
 function resolveTicketFile(deps) {
@@ -664,44 +1191,3 @@ function resolveTicketFile(deps) {
     const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: deps.project.slug, path: deps.project.path });
     return exec.relocated ? exec.ticketsPath : (0, ticket_store_1.resolveTicketStoragePath)(deps.project.path);
 }
-/**
- * Move the launch's on_review tickets to `todo` (discard) or `done` (merged),
- * broadcasting ticket_updated per changed spec — mirroring onLoopRunFinished's
- * revert style in project-registry. ONLY tickets still parked at on_review move
- * (a manually re-triaged spec is respected). Best-effort: a ticket-store
- * failure is logged, never fatal (the decision row already transitioned).
- */
-function applyTicketTransition(deps, ticketIds, to) {
-    const changed = [];
-    if (ticketIds.length === 0)
-        return changed;
-    try {
-        const ticketFile = resolveTicketFile(deps);
-        const now = new Date().toISOString();
-        const store = (0, ticket_store_1.mutateStore)(ticketFile, (s) => {
-            for (const tid of ticketIds) {
-                const ticket = s.tickets[String(tid)];
-                if (!ticket || ticket.status !== 'on_review')
-                    continue;
-                ticket.status = to;
-                ticket.updated_at = now;
-                changed.push(tid);
-            }
-        });
-        for (const tid of changed) {
-            const ticket = store.tickets[String(tid)];
-            if (!ticket)
-                continue;
-            deps.broadcast({
-                type: 'ticket_updated',
-                ticket: ticket,
-                projectId: deps.project.id,
-                timestamp: ticket.updated_at,
-            });
-        }
-    }
-    catch (err) {
-        console.error('[rail-pr-decision] failed to apply ticket transition:', err);
-    }
-    return changed;
-}