specrails-desktop 2.29.2 → 2.29.3

package/server/dist/active-pr-continuation.js

@@ -1,13 +1,48 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.resolveActivePrContinuationTargets = resolveActivePrContinuationTargets;
 const jira_db_1 = require("./jira/jira-db");
 const rail_pr_store_1 = require("./rail-pr-store");
 const integration_branch_1 = require("./integration-branch");
+const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const pr_lifecycle_1 = require("./pr-lifecycle");
+const fs = __importStar(require("fs"));
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
 const PR_MATCH_RANK = {
-    'title-similarity': 1,
-    'ticket-ref': 2,
+    'jira-key': 1,
     'pr-number': 3,
 };
 function parsePrNumber(prUrl) {
@@ -16,28 +51,18 @@ function parsePrNumber(prUrl) {
     const m = /\/pull\/(\d+)/.exec(prUrl);
     return m ? parseInt(m[1], 10) : null;
 }
-function normalizedText(v) {
-    return typeof v === 'string' ? v.toLowerCase() : '';
-}
-function words(v) {
-    return normalizedText(v)
-        .replace(/[^a-z0-9]+/g, ' ')
-        .split(/\s+/)
-        .filter((w) => w.length >= 4);
-}
-function ticketRefs(db, ticketId, spec) {
-    const refs = new Set([`#${ticketId}`, `[${ticketId}]`, `ticket ${ticketId}`, `spec ${ticketId}`]);
-    let jiraKey = spec?.jira_key ?? null;
+function jiraRefs(db, ticketId, spec) {
+    const refs = new Set();
+    if (spec?.jira_key?.trim())
+        refs.add(spec.jira_key.trim());
     try {
         const link = (0, jira_db_1.getLinkByLocalId)(db, ticketId);
         if (link && !link.tombstoned && link.jiraKey)
-            jiraKey = link.jiraKey;
+            refs.add(link.jiraKey);
     }
     catch {
         /* tolerated */
     }
-    if (jiraKey?.trim())
-        refs.add(jiraKey.trim());
     return [...refs];
 }
 function mentionedPrNumbers(spec) {
@@ -67,23 +92,13 @@ function prMatchKind(db, ticketId, spec, pr) {
     const prNumber = typeof pr.number === 'number' ? pr.number : parsePrNumber(pr.url);
     if (prNumber !== null && mentionedPrs.has(prNumber))
         return 'pr-number';
-    const haystack = `${pr.title ?? ''}\n${pr.body ?? ''}\n${pr.headRefName ?? ''}`.toLowerCase();
-    for (const ref of ticketRefs(db, ticketId, spec)) {
-        const needle = ref.toLowerCase();
-        if (needle.startsWith('#') || needle.startsWith('[')) {
-            if (haystack.includes(needle))
-                return 'ticket-ref';
-        }
-        else if (new RegExp(`(^|[^a-z0-9])${needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^a-z0-9]|$)`, 'i').test(haystack)) {
-            return 'ticket-ref';
-        }
+    const haystack = `${pr.title ?? ''}\n${pr.body ?? ''}\n${pr.headRefName ?? ''}`;
+    for (const key of jiraRefs(db, ticketId, spec)) {
+        const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        if (new RegExp(`(^|[^a-z0-9])${escaped}([^a-z0-9]|$)`, 'i').test(haystack))
+            return 'jira-key';
     }
-    const titleWords = words(spec?.title);
-    if (titleWords.length < 3)
-        return null;
-    const prWords = new Set(words(`${pr.title ?? ''} ${pr.body ?? ''}`));
-    const hits = titleWords.filter((w) => prWords.has(w)).length;
-    return hits >= Math.max(3, Math.ceil(titleWords.length * 0.7)) ? 'title-similarity' : null;
+    return null;
 }
 function canProbeGithubForContinuation(db, ticketId, spec) {
     if (spec?.status === 'on_review')
@@ -93,11 +108,6 @@ function canProbeGithubForContinuation(db, ticketId, spec) {
     // Jira-linked ticket and later only accept explicit PR references.
     return spec?.status === 'in_progress' && hasJiraRef(db, ticketId, spec);
 }
-function matchAllowedForTicket(spec, kind) {
-    if (spec?.status === 'on_review')
-        return true;
-    return kind !== 'title-similarity';
-}
 async function localBranchExists(git, repoDir, branch) {
     const r = await git.run(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], repoDir);
     return r.code === 0;
@@ -106,7 +116,21 @@ async function remoteBranchExists(git, repoDir, branch) {
     const r = await git.run(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${branch}`], repoDir);
     return r.code === 0;
 }
-async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBranch, prUrl, prNumber, isDraft, source) {
+async function observeRef(git, repoDir, ref) {
+    try {
+        const result = await git.run(['rev-parse', '--verify', '--quiet', ref], repoDir);
+        if (result.code === 1)
+            return { state: 'missing' };
+        if (result.code !== 0)
+            return { state: 'invalid' };
+        const sha = result.stdout.trim().toLowerCase();
+        return COMMIT_SHA_RE.test(sha) ? { state: 'exact', sha } : { state: 'invalid' };
+    }
+    catch {
+        return { state: 'invalid' };
+    }
+}
+async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBranch, prUrl, prNumber, isDraft, deliverySha, deliveryId, source) {
     const head = branch?.trim();
     const base = baseBranch?.trim();
     if (!head || !base || head === base)
@@ -115,35 +139,135 @@ async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBr
         return null;
     const remoteRef = fetchOk && await remoteBranchExists(git, repoDir, head) ? `origin/${head}` : undefined;
     if (await localBranchExists(git, repoDir, head)) {
-        return { ticketId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, source };
+        return { ticketId, deliveryId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, deliverySha, source };
     }
     if (remoteRef)
-        return { ticketId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, source };
+        return { ticketId, deliveryId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, deliverySha, source };
     return null;
 }
-function internalDeliveryTargets(db, ticketIds) {
+function hasRetainedOrUnsettledWorktree(db, worktreeIds) {
+    return worktreeIds.some((id) => {
+        const worktree = (0, rail_worktrees_store_1.getRailWorktree)(db, id);
+        if (!worktree)
+            return false;
+        return !['released', 'merged', 'failed'].includes(worktree.merge_state) || fs.existsSync(worktree.worktree_path);
+    });
+}
+function internalDeliveryTargets(db, rows, ticketIds) {
     const wanted = new Set(ticketIds);
     const out = new Map();
-    for (const row of (0, rail_pr_store_1.listActivePrDeliveries)(db)) {
+    for (const row of rows) {
         const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
         if (!snap.prUrl || !snap.branch)
             continue;
+        // A still-mounted or unsettled prior worktree can contain bytes not
+        // represented by delivery_sha. Never let the next agent iteration absorb
+        // them merely because HEAD/ref still happen to match the remote PR.
+        if (hasRetainedOrUnsettledWorktree(db, snap.worktreeIds))
+            continue;
         for (const ticketId of snap.ticketIds) {
             if (!wanted.has(ticketId) || out.has(ticketId))
                 continue;
             out.set(ticketId, {
                 ticketId,
+                deliveryId: row.id,
                 branch: snap.branch,
                 baseBranch: snap.baseBranch,
                 prUrl: snap.prUrl,
                 prNumber: snap.prNumber,
                 isDraft: snap.decision === 'pr_draft',
+                deliverySha: snap.deliverySha,
                 source: 'rail-pr-delivery',
             });
         }
     }
     return out;
 }
+function ticketTargetKey(ticketIds) {
+    if (ticketIds.length === 0)
+        return null;
+    const seen = new Set();
+    for (const value of ticketIds) {
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value > 0)
+            seen.add(value);
+    }
+    return seen.size > 0 ? [...seen].sort((a, b) => a - b).join(',') : null;
+}
+function exactTicketTargetKey(ticketIds) {
+    const key = ticketTargetKey(ticketIds);
+    if (!key || key.split(',').length !== ticketIds.length)
+        return null;
+    return key;
+}
+/** Recover only the newest terminal generation for the exact launch target.
+ * A newer fresh/other generation intentionally prevents an older continuation
+ * from lending its PR. Of terminal continuations, only an explicitly discarded
+ * one can be resumed: merged/completed/superseded history remains history. */
+function latestHistoricalContinuation(db, ticketIds) {
+    const targetKey = exactTicketTargetKey(ticketIds);
+    if (!targetKey)
+        return { ownsTarget: false, candidate: null };
+    const latest = (0, rail_pr_store_1.getLatestTerminalPrDeliveryTouchingTicketSet)(db, ticketIds);
+    if (!latest)
+        return { ownsTarget: false, candidate: null };
+    // The newest exact-target generation is authoritative even when it is a
+    // fresh lineage. It must shadow every older continuation and also prevent a
+    // fuzzy GitHub/Jira fallback from rediscovering that stale PR.
+    if (latest.is_continuation !== 1)
+        return { ownsTarget: true, candidate: null };
+    if (latest.decision !== 'discarded')
+        return { ownsTarget: true, candidate: null };
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(latest);
+    if (exactTicketTargetKey(snap.ticketIds) !== targetKey || latest.operation_token !== null) {
+        return { ownsTarget: true, candidate: null };
+    }
+    if (hasRetainedOrUnsettledWorktree(db, snap.worktreeIds)) {
+        return { ownsTarget: true, candidate: null };
+    }
+    const branch = snap.branch;
+    const baseBranch = snap.baseBranch;
+    const prUrl = snap.prUrl;
+    const deliverySha = snap.deliverySha?.toLowerCase() ?? null;
+    if (!branch || branch.trim() !== branch || !(0, integration_branch_1.isValidBranchName)(branch) ||
+        !baseBranch || baseBranch.trim() !== baseBranch || !(0, integration_branch_1.isValidBranchName)(baseBranch) ||
+        branch === baseBranch ||
+        !prUrl || prUrl.trim() !== prUrl ||
+        snap.prNumber === null || parsePrNumber(prUrl) !== snap.prNumber ||
+        !deliverySha || !COMMIT_SHA_RE.test(deliverySha))
+        return { ownsTarget: true, candidate: null };
+    return {
+        ownsTarget: true,
+        candidate: { deliveryId: latest.id, branch, baseBranch, prUrl, prNumber: snap.prNumber, deliverySha },
+    };
+}
+/** Historical recovery is stricter than ordinary active continuation
+ * materialization. Every available fetched/local ref must still name the exact
+ * immutable GitHub head; a stale, ahead, diverged, or unreadable ref fails
+ * closed rather than allowing worktree allocation to infer or rewrite it. */
+async function materializeHistoricalContinuation(input, candidate, isDraft) {
+    const local = await observeRef(input.git, input.repoDir, `refs/heads/${candidate.branch}`);
+    if (local.state === 'invalid' || (local.state === 'exact' && local.sha !== candidate.deliverySha))
+        return null;
+    const remote = input.fetchOk
+        ? await observeRef(input.git, input.repoDir, `refs/remotes/origin/${candidate.branch}`)
+        : { state: 'missing' };
+    if (remote.state === 'invalid' || (remote.state === 'exact' && remote.sha !== candidate.deliverySha))
+        return null;
+    if (local.state !== 'exact' && remote.state !== 'exact')
+        return null;
+    return new Map(input.ticketIds.map((ticketId) => [ticketId, {
+            ticketId,
+            deliveryId: candidate.deliveryId,
+            branch: candidate.branch,
+            baseBranch: candidate.baseBranch,
+            ...(remote.state === 'exact' ? { baseRef: `origin/${candidate.branch}` } : {}),
+            prUrl: candidate.prUrl,
+            prNumber: candidate.prNumber,
+            isDraft,
+            deliverySha: candidate.deliverySha,
+            source: 'rail-pr-delivery',
+        }]));
+}
 const PR_JSON_FIELDS = 'number,title,body,headRefName,baseRefName,url,isDraft,state';
 async function listOpenPrs(exec, repoDir) {
     const r = await exec.run('gh', ['pr', 'list', '--state', 'open', '--limit', '200', '--json', PR_JSON_FIELDS], repoDir);
@@ -198,32 +322,77 @@ function mergeOpenPrs(prs) {
 /**
  * Detects tickets whose next implementation pass should continue an already
  * open PR branch instead of creating fresh work from the integration branch.
- * It is intentionally fail-open: no gh, no auth, ambiguous branch state, or no
- * confident PR match all return no target, preserving the normal new-work flow.
+ * External discovery is fail-open when no durable Specrails lineage exists.
+ * Once an active or newest overlapping historical generation owns the target,
+ * however, missing/ambiguous GitHub or ref evidence is authoritative negative
+ * evidence and blocks fuzzy fallback to a different PR.
  */
 async function resolveActivePrContinuationTargets(input) {
     const out = new Map();
-    const internal = internalDeliveryTargets(input.db, input.ticketIds);
+    const activeRows = (0, rail_pr_store_1.listActivePrDeliveries)(input.db);
+    const internal = internalDeliveryTargets(input.db, activeRows, input.ticketIds);
     const lifecycleByUrl = new Map();
     for (const [ticketId, target] of internal) {
         if (!target.prUrl)
             continue;
         let lifecycle = lifecycleByUrl.get(target.prUrl);
         if (!lifecycle) {
-            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, target.prUrl);
+            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, target.prUrl, target.deliverySha);
             lifecycleByUrl.set(target.prUrl, lifecycle);
         }
         const observed = await lifecycle;
         // A ledger row is only a hint. GitHub remains lifecycle authority: a stale
         // draft/ready row for a CLOSED/MERGED or different head/base PR must not be
         // superseded and must not lend its branch to another implementation run.
-        if (!observed.ok || !(0, pr_lifecycle_1.isExactOpenPr)(observed, target.branch, target.baseBranch))
+        if (!target.deliverySha || !observed.ok ||
+            !(0, pr_lifecycle_1.isExactOpenPr)(observed, target.branch, target.baseBranch) ||
+            observed.includesExpectedSha !== true ||
+            observed.headRefOid?.toLowerCase() !== target.deliverySha.toLowerCase())
             continue;
-        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, target.branch, target.baseBranch, target.prUrl, target.prNumber, observed.isDraft, 'rail-pr-delivery');
+        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, target.branch, target.baseBranch, target.prUrl, target.prNumber, observed.isDraft, target.deliverySha, target.deliveryId, 'rail-pr-delivery');
         if (materialized)
             out.set(ticketId, materialized);
     }
-    const remaining = input.ticketIds.filter((id) => !out.has(id));
+    // Dismiss/Discard closes the continuation generation but deliberately keeps
+    // its borrowed PR alive. Recover that exact target only when no active row
+    // owns any requested ticket and the latest terminal generation for the whole
+    // target is the discarded continuation. Failed historical verification is
+    // still authoritative negative evidence: do not fall through to fuzzy PR
+    // discovery and accidentally borrow a same-Jira foreign PR.
+    const wanted = new Set(input.ticketIds);
+    const activeTouchesTarget = activeRows.some((row) => ((0, rail_pr_store_1.toPrDeliverySnapshot)(row).ticketIds.some((ticketId) => wanted.has(ticketId))));
+    const historicalOwned = new Set();
+    const activeOwned = new Set();
+    if (activeTouchesTarget)
+        input.ticketIds.forEach((ticketId) => activeOwned.add(ticketId));
+    if (!activeTouchesTarget && out.size === 0) {
+        const historical = latestHistoricalContinuation(input.db, input.ticketIds);
+        if (historical.ownsTarget)
+            input.ticketIds.forEach((ticketId) => historicalOwned.add(ticketId));
+        if (historical.candidate) {
+            const candidate = historical.candidate;
+            let lifecycle = lifecycleByUrl.get(candidate.prUrl);
+            if (!lifecycle) {
+                lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, candidate.prUrl, candidate.deliverySha);
+                lifecycleByUrl.set(candidate.prUrl, lifecycle);
+            }
+            const observed = await lifecycle;
+            if (observed.ok &&
+                (0, pr_lifecycle_1.isExactOpenPr)(observed, candidate.branch, candidate.baseBranch) &&
+                observed.headRefOid?.toLowerCase() === candidate.deliverySha &&
+                observed.includesExpectedSha === true) {
+                const materialized = await materializeHistoricalContinuation(input, candidate, observed.isDraft);
+                if (materialized) {
+                    for (const [ticketId, target] of materialized)
+                        out.set(ticketId, target);
+                }
+            }
+        }
+    }
+    // A durable Specrails delivery that fails exact verification must never be
+    // downgraded into an inferred "external" match for the same ticket/PR. The
+    // visible delivery card owns reconciliation of that stale immutable SHA.
+    const remaining = input.ticketIds.filter((id) => (!out.has(id) && !internal.has(id) && !historicalOwned.has(id) && !activeOwned.has(id)));
     const candidateIds = remaining.filter((id) => canProbeGithubForContinuation(input.db, id, input.getTicketSpec(id)));
     if (candidateIds.length === 0)
         return out;
@@ -240,7 +409,7 @@ async function resolveActivePrContinuationTargets(input) {
         const spec = input.getTicketSpec(ticketId);
         const matches = openPrs.flatMap((pr) => {
             const kind = prMatchKind(input.db, ticketId, spec, pr);
-            return kind && matchAllowedForTicket(spec, kind) ? [{ pr, kind }] : [];
+            return kind ? [{ pr, kind }] : [];
         });
         if (matches.length === 0)
             continue;
@@ -249,7 +418,23 @@ async function resolveActivePrContinuationTargets(input) {
         if (best.length !== 1)
             continue;
         const pr = best[0].pr;
-        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, pr.headRefName, pr.baseRefName || input.integrationBranch, pr.url ?? null, typeof pr.number === 'number' ? pr.number : parsePrNumber(pr.url), typeof pr.isDraft === 'boolean' ? pr.isDraft : null, 'github-open-pr');
+        const prUrl = pr.url?.trim();
+        const branch = pr.headRefName?.trim();
+        const baseBranch = pr.baseRefName?.trim() || input.integrationBranch;
+        if (!prUrl || !branch || !baseBranch)
+            continue;
+        let lifecycle = lifecycleByUrl.get(prUrl);
+        if (!lifecycle) {
+            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, prUrl);
+            lifecycleByUrl.set(prUrl, lifecycle);
+        }
+        const observed = await lifecycle;
+        // `gh pr list` is discovery evidence only. Freeze the exact live remote
+        // head through an authoritative view before borrowing any local branch;
+        // otherwise an unrelated local-ahead commit could be carried into the PR.
+        if (!observed.ok || !observed.headRefOid || !(0, pr_lifecycle_1.isExactOpenPr)(observed, branch, baseBranch))
+            continue;
+        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, branch, baseBranch, prUrl, typeof pr.number === 'number' ? pr.number : parsePrNumber(prUrl), observed.isDraft, observed.headRefOid, null, 'github-open-pr');
         if (materialized)
             out.set(ticketId, materialized);
     }

package/server/dist/agent-chat-manager.js

@@ -696,6 +696,11 @@ class AgentChatManager {
                 console.log(`[agent-chat] pr-decision card skipped — conversation gone (${conversationId})`);
                 return;
             }
+            const existing = this._findPrDecisionCards(conversationId, envelope.prDeliveryId);
+            if (existing.length > 0) {
+                this.updatePrDecisionCard(conversationId, envelope);
+                return;
+            }
             (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'system', content: JSON.stringify(envelope) });
             this._broadcastPrDecision(conversationId, envelope);
         }
@@ -714,33 +719,45 @@ class AgentChatManager {
         if (this._disposed)
             return;
         try {
-            const existing = (0, agent_store_1.findAgentSystemMessage)(this._db, conversationId, (content) => {
-                try {
-                    const parsed = JSON.parse(content);
-                    return parsed.kind === 'pr_decision' && parsed.prDeliveryId === envelope.prDeliveryId;
-                }
-                catch {
-                    return false;
-                }
-            });
-            if (!existing) {
+            const existing = this._findPrDecisionCards(conversationId, envelope.prDeliveryId);
+            if (existing.length === 0) {
                 this.postPrDecisionCard(conversationId, envelope);
                 return;
             }
             const serialized = JSON.stringify(envelope);
+            // Keep the newest history anchor: client cold-load dedupe uses the same
+            // newest-row rule, so a crash between hydration and this repair cannot
+            // make an older blocked envelope authoritative again.
+            const canonical = existing[existing.length - 1];
+            const duplicateIds = existing.slice(0, -1).map((message) => message.id);
             // Startup recovery may inspect historical deliveries to heal a card that
             // missed its terminal update. Identical projection is not new activity:
             // avoid a redundant DB write and, crucially, do not broadcast an unread
             // event for an old card on every app launch.
-            if (existing.content === serialized)
+            if (canonical.content === serialized && duplicateIds.length === 0)
                 return;
-            (0, agent_store_1.updateAgentMessageContent)(this._db, existing.id, serialized);
+            this._db.transaction(() => {
+                if (canonical.content !== serialized)
+                    (0, agent_store_1.updateAgentMessageContent)(this._db, canonical.id, serialized);
+                (0, agent_store_1.deleteAgentMessagesByIds)(this._db, duplicateIds);
+            })();
             this._broadcastPrDecision(conversationId, envelope);
         }
         catch (err) {
             console.error(`[agent-chat] updatePrDecisionCard failed (${conversationId}):`, err);
         }
     }
+    _findPrDecisionCards(conversationId, prDeliveryId) {
+        return (0, agent_store_1.findAgentSystemMessages)(this._db, conversationId, (content) => {
+            try {
+                const parsed = JSON.parse(content);
+                return parsed.kind === 'pr_decision' && parsed.prDeliveryId === prDeliveryId;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
     _broadcastPrDecision(conversationId, envelope) {
         this._broadcast({
             type: 'agent_pr_decision',

package/server/dist/agent-store.js

@@ -7,7 +7,9 @@ exports.updateAgentConversation = updateAgentConversation;
 exports.deleteAgentConversation = deleteAgentConversation;
 exports.addAgentMessage = addAgentMessage;
 exports.listAgentMessages = listAgentMessages;
+exports.findAgentSystemMessages = findAgentSystemMessages;
 exports.findAgentSystemMessage = findAgentSystemMessage;
+exports.deleteAgentMessagesByIds = deleteAgentMessagesByIds;
 exports.updateAgentMessageContent = updateAgentMessageContent;
 const crypto_1 = require("crypto");
 const agent_tier_1 = require("./agent-tier");
@@ -94,16 +96,29 @@ function listAgentMessages(db, conversationId) {
         .all(conversationId).map(mapMessage);
 }
 /**
- * First `system`-role message in a conversation whose content satisfies
+ * Every `system`-role message in a conversation whose content satisfies
  * `predicate` (oldest first). The store stays payload-agnostic — callers own
  * the content parsing (e.g. matching a PR-decision card by prDeliveryId).
  */
-function findAgentSystemMessage(db, conversationId, predicate = () => true) {
+function findAgentSystemMessages(db, conversationId, predicate = () => true) {
     const rows = db
         .prepare("SELECT * FROM agent_messages WHERE conversation_id = ? AND role = 'system' ORDER BY created_at ASC, rowid ASC")
         .all(conversationId);
-    const hit = rows.find((r) => predicate(r.content));
-    return hit ? mapMessage(hit) : undefined;
+    return rows.filter((row) => predicate(row.content)).map(mapMessage);
+}
+function findAgentSystemMessage(db, conversationId, predicate = () => true) {
+    return findAgentSystemMessages(db, conversationId, predicate)[0];
+}
+/** Delete exact message ids without bumping conversation activity. Callers use
+ * this only to consolidate duplicate derived system cards, never user turns. */
+function deleteAgentMessagesByIds(db, messageIds) {
+    if (messageIds.length === 0)
+        return 0;
+    const remove = db.prepare('DELETE FROM agent_messages WHERE id = ?');
+    let deleted = 0;
+    for (const id of messageIds)
+        deleted += remove.run(id).changes;
+    return deleted;
 }
 /**
  * Replace a message's content in place (inline-card state updates). Does NOT

package/server/dist/db.js

@@ -1405,6 +1405,27 @@ const MIGRATIONS = [
         }
         backfillTerminalRailPrTicketEffects(db);
     },
+    // Migration 53: an allocation rollback is the one legal way a previously
+    // superseded delivery can become active again. Persist the failed replacement
+    // id on the restored predecessor so clients can distinguish that explicit
+    // rollback from an ordinary stale non-terminal replay.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all()
+            .map((row) => row.name));
+        if (!cols.has('restored_from_delivery_id')) {
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN restored_from_delivery_id TEXT`);
+        }
+    },
+    // Migration 54: automatic worktree release quarantines authenticated overlay
+    // roots instead of deleting them. Persist the bounded archive locations so
+    // recovery remains discoverable after restart and card refresh.
+    (db) => {
+        const cols = new Set(db.prepare(`PRAGMA table_info(rail_pr_deliveries)`).all()
+            .map((row) => row.name));
+        if (!cols.has('safety_archives')) {
+            db.exec(`ALTER TABLE rail_pr_deliveries ADD COLUMN safety_archives TEXT NOT NULL DEFAULT '[]'`);
+        }
+    },
 ];
 function applyMigrations(db) {
     // Ensure the migrations table exists (migration 1 creates it, but we need