specrails-desktop 2.29.2 → 2.29.4

package/server/dist/active-pr-continuation.js

@@ -1,13 +1,60 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExplicitPrTargetError = void 0;
+exports.resolveExplicitPrTarget = resolveExplicitPrTarget;
+exports.listPrCandidatesForTickets = listPrCandidatesForTickets;
 exports.resolveActivePrContinuationTargets = resolveActivePrContinuationTargets;
 const jira_db_1 = require("./jira/jira-db");
 const rail_pr_store_1 = require("./rail-pr-store");
 const integration_branch_1 = require("./integration-branch");
+const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const pr_lifecycle_1 = require("./pr-lifecycle");
+const fs = __importStar(require("fs"));
+class ExplicitPrTargetError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ExplicitPrTargetError';
+        this.code = code;
+    }
+}
+exports.ExplicitPrTargetError = ExplicitPrTargetError;
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
 const PR_MATCH_RANK = {
-    'title-similarity': 1,
-    'ticket-ref': 2,
+    'jira-key': 1,
     'pr-number': 3,
 };
 function parsePrNumber(prUrl) {
@@ -16,28 +63,18 @@ function parsePrNumber(prUrl) {
     const m = /\/pull\/(\d+)/.exec(prUrl);
     return m ? parseInt(m[1], 10) : null;
 }
-function normalizedText(v) {
-    return typeof v === 'string' ? v.toLowerCase() : '';
-}
-function words(v) {
-    return normalizedText(v)
-        .replace(/[^a-z0-9]+/g, ' ')
-        .split(/\s+/)
-        .filter((w) => w.length >= 4);
-}
-function ticketRefs(db, ticketId, spec) {
-    const refs = new Set([`#${ticketId}`, `[${ticketId}]`, `ticket ${ticketId}`, `spec ${ticketId}`]);
-    let jiraKey = spec?.jira_key ?? null;
+function jiraRefs(db, ticketId, spec) {
+    const refs = new Set();
+    if (spec?.jira_key?.trim())
+        refs.add(spec.jira_key.trim());
     try {
         const link = (0, jira_db_1.getLinkByLocalId)(db, ticketId);
         if (link && !link.tombstoned && link.jiraKey)
-            jiraKey = link.jiraKey;
+            refs.add(link.jiraKey);
     }
     catch {
         /* tolerated */
     }
-    if (jiraKey?.trim())
-        refs.add(jiraKey.trim());
     return [...refs];
 }
 function mentionedPrNumbers(spec) {
@@ -67,23 +104,13 @@ function prMatchKind(db, ticketId, spec, pr) {
     const prNumber = typeof pr.number === 'number' ? pr.number : parsePrNumber(pr.url);
     if (prNumber !== null && mentionedPrs.has(prNumber))
         return 'pr-number';
-    const haystack = `${pr.title ?? ''}\n${pr.body ?? ''}\n${pr.headRefName ?? ''}`.toLowerCase();
-    for (const ref of ticketRefs(db, ticketId, spec)) {
-        const needle = ref.toLowerCase();
-        if (needle.startsWith('#') || needle.startsWith('[')) {
-            if (haystack.includes(needle))
-                return 'ticket-ref';
-        }
-        else if (new RegExp(`(^|[^a-z0-9])${needle.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}([^a-z0-9]|$)`, 'i').test(haystack)) {
-            return 'ticket-ref';
-        }
+    const haystack = `${pr.title ?? ''}\n${pr.body ?? ''}\n${pr.headRefName ?? ''}`;
+    for (const key of jiraRefs(db, ticketId, spec)) {
+        const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+        if (new RegExp(`(^|[^a-z0-9])${escaped}([^a-z0-9]|$)`, 'i').test(haystack))
+            return 'jira-key';
     }
-    const titleWords = words(spec?.title);
-    if (titleWords.length < 3)
-        return null;
-    const prWords = new Set(words(`${pr.title ?? ''} ${pr.body ?? ''}`));
-    const hits = titleWords.filter((w) => prWords.has(w)).length;
-    return hits >= Math.max(3, Math.ceil(titleWords.length * 0.7)) ? 'title-similarity' : null;
+    return null;
 }
 function canProbeGithubForContinuation(db, ticketId, spec) {
     if (spec?.status === 'on_review')
@@ -93,11 +120,6 @@ function canProbeGithubForContinuation(db, ticketId, spec) {
     // Jira-linked ticket and later only accept explicit PR references.
     return spec?.status === 'in_progress' && hasJiraRef(db, ticketId, spec);
 }
-function matchAllowedForTicket(spec, kind) {
-    if (spec?.status === 'on_review')
-        return true;
-    return kind !== 'title-similarity';
-}
 async function localBranchExists(git, repoDir, branch) {
     const r = await git.run(['rev-parse', '--verify', '--quiet', `refs/heads/${branch}`], repoDir);
     return r.code === 0;
@@ -106,7 +128,21 @@ async function remoteBranchExists(git, repoDir, branch) {
     const r = await git.run(['rev-parse', '--verify', '--quiet', `refs/remotes/origin/${branch}`], repoDir);
     return r.code === 0;
 }
-async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBranch, prUrl, prNumber, isDraft, source) {
+async function observeRef(git, repoDir, ref) {
+    try {
+        const result = await git.run(['rev-parse', '--verify', '--quiet', ref], repoDir);
+        if (result.code === 1)
+            return { state: 'missing' };
+        if (result.code !== 0)
+            return { state: 'invalid' };
+        const sha = result.stdout.trim().toLowerCase();
+        return COMMIT_SHA_RE.test(sha) ? { state: 'exact', sha } : { state: 'invalid' };
+    }
+    catch {
+        return { state: 'invalid' };
+    }
+}
+async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBranch, prUrl, prNumber, isDraft, deliverySha, deliveryId, source) {
     const head = branch?.trim();
     const base = baseBranch?.trim();
     if (!head || !base || head === base)
@@ -115,36 +151,198 @@ async function materializeTarget(git, repoDir, fetchOk, ticketId, branch, baseBr
         return null;
     const remoteRef = fetchOk && await remoteBranchExists(git, repoDir, head) ? `origin/${head}` : undefined;
     if (await localBranchExists(git, repoDir, head)) {
-        return { ticketId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, source };
+        return { ticketId, deliveryId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, deliverySha, source };
     }
     if (remoteRef)
-        return { ticketId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, source };
+        return { ticketId, deliveryId, branch: head, baseBranch: base, baseRef: remoteRef, prUrl, prNumber, isDraft, deliverySha, source };
     return null;
 }
-function internalDeliveryTargets(db, ticketIds) {
+/**
+ * Resolve an EXPLICITLY user-designated PR number into a continuation target.
+ * This is the user's answer, not a discovery guess: it bypasses the automatic
+ * inference gates (`canProbeGithubForContinuation`, spec-text matching) but
+ * keeps the same authoritative validation ladder — the PR must be verifiably
+ * OPEN on the SAME repository with a materializable head. Every failure throws
+ * `ExplicitPrTargetError` with a distinct code; callers reject the launch
+ * before any delivery row or worktree exists.
+ */
+async function resolveExplicitPrTarget(input) {
+    const { prNumber } = input;
+    // 1. Resolve the PR number to its canonical URL (identity for the delivery
+    //    row and for every later lifecycle observation / poll-merge).
+    let lookup;
+    try {
+        lookup = await input.exec.run('gh', ['pr', 'view', String(prNumber), '--json', 'url,number'], input.repoDir);
+    }
+    catch (err) {
+        throw new ExplicitPrTargetError('target_pr_not_found', `PR #${prNumber} could not be looked up: ${(err instanceof Error ? err.message : String(err)).slice(0, 256)}`);
+    }
+    if (lookup.code !== 0) {
+        const detail = (lookup.stderr.trim() || lookup.stdout.trim()).split('\n')[0].slice(0, 256);
+        throw new ExplicitPrTargetError('target_pr_not_found', `PR #${prNumber} could not be looked up: ${detail || `gh exited ${lookup.code}`}`);
+    }
+    let prUrl;
+    try {
+        const parsed = JSON.parse(lookup.stdout);
+        if (typeof parsed.url !== 'string' || !parsed.url.trim() || parsed.number !== prNumber) {
+            throw new Error('unexpected gh payload');
+        }
+        prUrl = parsed.url.trim();
+    }
+    catch {
+        throw new ExplicitPrTargetError('target_pr_invalid', `GitHub returned an unusable identity for PR #${prNumber}`);
+    }
+    // 2. Authoritative lifecycle observation — state, fork boundary, exact head.
+    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, prUrl);
+    if (!observed.ok) {
+        throw new ExplicitPrTargetError('target_pr_not_found', `PR #${prNumber} lifecycle could not be confirmed: ${observed.detail}`);
+    }
+    if (observed.state !== 'OPEN') {
+        throw new ExplicitPrTargetError('target_pr_not_open', `PR #${prNumber} is ${observed.state.toLowerCase()}, not open`);
+    }
+    // `null` means GitHub did not prove the head belongs to this repository —
+    // conservative rejection: a fork head is not pushable with origin rights.
+    if (observed.isCrossRepository !== false) {
+        throw new ExplicitPrTargetError('target_pr_fork', `PR #${prNumber} head lives on a fork (or same-repo could not be proven); fork PRs are not pushable`);
+    }
+    const head = observed.headRefName?.trim();
+    const base = observed.baseRefName?.trim() || input.integrationBranch;
+    if (!head || !base || head === base || !(0, integration_branch_1.isValidBranchName)(head) || !(0, integration_branch_1.isValidBranchName)(base) || !observed.headRefOid) {
+        throw new ExplicitPrTargetError('target_pr_invalid', `PR #${prNumber} head/base refs are unusable (head=${head ?? '?'}, base=${base ?? '?'})`);
+    }
+    // 3. Materialize exactly like automatic continuations: the head branch must
+    //    exist locally or be fetchable from origin; the worktree verification
+    //    later pins it to the observed head OID.
+    const target = await materializeTarget(input.git, input.repoDir, input.fetchOk, 0, head, base, prUrl, prNumber, observed.isDraft, observed.headRefOid, null, 'explicit-target');
+    if (!target) {
+        throw new ExplicitPrTargetError('target_pr_unfetchable', `PR #${prNumber} head branch ${head} is neither present locally nor fetchable from origin`);
+    }
+    return target;
+}
+function hasRetainedOrUnsettledWorktree(db, worktreeIds) {
+    return worktreeIds.some((id) => {
+        const worktree = (0, rail_worktrees_store_1.getRailWorktree)(db, id);
+        if (!worktree)
+            return false;
+        return !['released', 'merged', 'failed'].includes(worktree.merge_state) || fs.existsSync(worktree.worktree_path);
+    });
+}
+function internalDeliveryTargets(db, rows, ticketIds) {
     const wanted = new Set(ticketIds);
     const out = new Map();
-    for (const row of (0, rail_pr_store_1.listActivePrDeliveries)(db)) {
+    for (const row of rows) {
         const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
         if (!snap.prUrl || !snap.branch)
             continue;
+        // A still-mounted or unsettled prior worktree can contain bytes not
+        // represented by delivery_sha. Never let the next agent iteration absorb
+        // them merely because HEAD/ref still happen to match the remote PR.
+        if (hasRetainedOrUnsettledWorktree(db, snap.worktreeIds))
+            continue;
         for (const ticketId of snap.ticketIds) {
             if (!wanted.has(ticketId) || out.has(ticketId))
                 continue;
             out.set(ticketId, {
                 ticketId,
+                deliveryId: row.id,
                 branch: snap.branch,
                 baseBranch: snap.baseBranch,
                 prUrl: snap.prUrl,
                 prNumber: snap.prNumber,
                 isDraft: snap.decision === 'pr_draft',
+                deliverySha: snap.deliverySha,
                 source: 'rail-pr-delivery',
             });
         }
     }
     return out;
 }
-const PR_JSON_FIELDS = 'number,title,body,headRefName,baseRefName,url,isDraft,state';
+function ticketTargetKey(ticketIds) {
+    if (ticketIds.length === 0)
+        return null;
+    const seen = new Set();
+    for (const value of ticketIds) {
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value > 0)
+            seen.add(value);
+    }
+    return seen.size > 0 ? [...seen].sort((a, b) => a - b).join(',') : null;
+}
+function exactTicketTargetKey(ticketIds) {
+    const key = ticketTargetKey(ticketIds);
+    if (!key || key.split(',').length !== ticketIds.length)
+        return null;
+    return key;
+}
+/** Recover only the newest terminal generation for the exact launch target.
+ * A newer fresh/other generation intentionally prevents an older continuation
+ * from lending its PR. Of terminal continuations, only an explicitly discarded
+ * one can be resumed: merged/completed/superseded history remains history. */
+function latestHistoricalContinuation(db, ticketIds) {
+    const targetKey = exactTicketTargetKey(ticketIds);
+    if (!targetKey)
+        return { ownsTarget: false, candidate: null };
+    const latest = (0, rail_pr_store_1.getLatestTerminalPrDeliveryTouchingTicketSet)(db, ticketIds);
+    if (!latest)
+        return { ownsTarget: false, candidate: null };
+    // The newest exact-target generation is authoritative even when it is a
+    // fresh lineage. It must shadow every older continuation and also prevent a
+    // fuzzy GitHub/Jira fallback from rediscovering that stale PR.
+    if (latest.is_continuation !== 1)
+        return { ownsTarget: true, candidate: null };
+    if (latest.decision !== 'discarded')
+        return { ownsTarget: true, candidate: null };
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(latest);
+    if (exactTicketTargetKey(snap.ticketIds) !== targetKey || latest.operation_token !== null) {
+        return { ownsTarget: true, candidate: null };
+    }
+    if (hasRetainedOrUnsettledWorktree(db, snap.worktreeIds)) {
+        return { ownsTarget: true, candidate: null };
+    }
+    const branch = snap.branch;
+    const baseBranch = snap.baseBranch;
+    const prUrl = snap.prUrl;
+    const deliverySha = snap.deliverySha?.toLowerCase() ?? null;
+    if (!branch || branch.trim() !== branch || !(0, integration_branch_1.isValidBranchName)(branch) ||
+        !baseBranch || baseBranch.trim() !== baseBranch || !(0, integration_branch_1.isValidBranchName)(baseBranch) ||
+        branch === baseBranch ||
+        !prUrl || prUrl.trim() !== prUrl ||
+        snap.prNumber === null || parsePrNumber(prUrl) !== snap.prNumber ||
+        !deliverySha || !COMMIT_SHA_RE.test(deliverySha))
+        return { ownsTarget: true, candidate: null };
+    return {
+        ownsTarget: true,
+        candidate: { deliveryId: latest.id, branch, baseBranch, prUrl, prNumber: snap.prNumber, deliverySha },
+    };
+}
+/** Historical recovery is stricter than ordinary active continuation
+ * materialization. Every available fetched/local ref must still name the exact
+ * immutable GitHub head; a stale, ahead, diverged, or unreadable ref fails
+ * closed rather than allowing worktree allocation to infer or rewrite it. */
+async function materializeHistoricalContinuation(input, candidate, isDraft) {
+    const local = await observeRef(input.git, input.repoDir, `refs/heads/${candidate.branch}`);
+    if (local.state === 'invalid' || (local.state === 'exact' && local.sha !== candidate.deliverySha))
+        return null;
+    const remote = input.fetchOk
+        ? await observeRef(input.git, input.repoDir, `refs/remotes/origin/${candidate.branch}`)
+        : { state: 'missing' };
+    if (remote.state === 'invalid' || (remote.state === 'exact' && remote.sha !== candidate.deliverySha))
+        return null;
+    if (local.state !== 'exact' && remote.state !== 'exact')
+        return null;
+    return new Map(input.ticketIds.map((ticketId) => [ticketId, {
+            ticketId,
+            deliveryId: candidate.deliveryId,
+            branch: candidate.branch,
+            baseBranch: candidate.baseBranch,
+            ...(remote.state === 'exact' ? { baseRef: `origin/${candidate.branch}` } : {}),
+            prUrl: candidate.prUrl,
+            prNumber: candidate.prNumber,
+            isDraft,
+            deliverySha: candidate.deliverySha,
+            source: 'rail-pr-delivery',
+        }]));
+}
+const PR_JSON_FIELDS = 'number,title,body,headRefName,baseRefName,url,isDraft,state,isCrossRepository';
 async function listOpenPrs(exec, repoDir) {
     const r = await exec.run('gh', ['pr', 'list', '--state', 'open', '--limit', '200', '--json', PR_JSON_FIELDS], repoDir);
     if (r.code !== 0)
@@ -195,35 +393,120 @@ function mergeOpenPrs(prs) {
     }
     return out;
 }
+/**
+ * Display-only candidate discovery for the launch UI's "deliver into existing
+ * PR" picker. Reuses the same matchers as automatic continuation (PR-number
+ * mention in the spec text, Jira key in the PR title/body/head) but WITHOUT
+ * the ticket-status gate — suggestions are informational and never
+ * auto-selected, so the strict gates guarding automatic adoption don't apply.
+ * Matched PRs sort first; the remaining open PRs follow for manual pick.
+ */
+async function listPrCandidatesForTickets(input) {
+    const mentioned = new Set();
+    for (const ticketId of input.ticketIds) {
+        for (const n of mentionedPrNumbers(input.getTicketSpec(ticketId)))
+            mentioned.add(n);
+    }
+    const openPrs = mergeOpenPrs([
+        ...await listOpenPrs(input.exec, input.repoDir),
+        ...await mentionedOpenPrs(input.exec, input.repoDir, mentioned),
+    ]);
+    const matched = [];
+    const rest = [];
+    for (const pr of openPrs) {
+        const number = typeof pr.number === 'number' ? pr.number : parsePrNumber(pr.url);
+        const url = pr.url?.trim();
+        const head = pr.headRefName?.trim();
+        if (!number || !url || !head)
+            continue;
+        const candidate = {
+            number,
+            title: pr.title?.trim() || `PR #${number}`,
+            headRefName: head,
+            baseRefName: pr.baseRefName?.trim() || '',
+            url,
+            isDraft: pr.isDraft === true,
+            isCrossRepository: pr.isCrossRepository !== false,
+        };
+        const isMatch = input.ticketIds.some((ticketId) => (prMatchKind(input.db, ticketId, input.getTicketSpec(ticketId), pr) !== null));
+        (isMatch ? matched : rest).push(candidate);
+    }
+    return [...matched, ...rest];
+}
 /**
  * Detects tickets whose next implementation pass should continue an already
  * open PR branch instead of creating fresh work from the integration branch.
- * It is intentionally fail-open: no gh, no auth, ambiguous branch state, or no
- * confident PR match all return no target, preserving the normal new-work flow.
+ * External discovery is fail-open when no durable Specrails lineage exists.
+ * Once an active or newest overlapping historical generation owns the target,
+ * however, missing/ambiguous GitHub or ref evidence is authoritative negative
+ * evidence and blocks fuzzy fallback to a different PR.
  */
 async function resolveActivePrContinuationTargets(input) {
     const out = new Map();
-    const internal = internalDeliveryTargets(input.db, input.ticketIds);
+    const activeRows = (0, rail_pr_store_1.listActivePrDeliveries)(input.db);
+    const internal = internalDeliveryTargets(input.db, activeRows, input.ticketIds);
     const lifecycleByUrl = new Map();
     for (const [ticketId, target] of internal) {
         if (!target.prUrl)
             continue;
         let lifecycle = lifecycleByUrl.get(target.prUrl);
         if (!lifecycle) {
-            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, target.prUrl);
+            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, target.prUrl, target.deliverySha);
             lifecycleByUrl.set(target.prUrl, lifecycle);
         }
         const observed = await lifecycle;
         // A ledger row is only a hint. GitHub remains lifecycle authority: a stale
         // draft/ready row for a CLOSED/MERGED or different head/base PR must not be
         // superseded and must not lend its branch to another implementation run.
-        if (!observed.ok || !(0, pr_lifecycle_1.isExactOpenPr)(observed, target.branch, target.baseBranch))
+        if (!target.deliverySha || !observed.ok ||
+            !(0, pr_lifecycle_1.isExactOpenPr)(observed, target.branch, target.baseBranch) ||
+            observed.includesExpectedSha !== true ||
+            observed.headRefOid?.toLowerCase() !== target.deliverySha.toLowerCase())
             continue;
-        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, target.branch, target.baseBranch, target.prUrl, target.prNumber, observed.isDraft, 'rail-pr-delivery');
+        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, target.branch, target.baseBranch, target.prUrl, target.prNumber, observed.isDraft, target.deliverySha, target.deliveryId, 'rail-pr-delivery');
         if (materialized)
             out.set(ticketId, materialized);
     }
-    const remaining = input.ticketIds.filter((id) => !out.has(id));
+    // Dismiss/Discard closes the continuation generation but deliberately keeps
+    // its borrowed PR alive. Recover that exact target only when no active row
+    // owns any requested ticket and the latest terminal generation for the whole
+    // target is the discarded continuation. Failed historical verification is
+    // still authoritative negative evidence: do not fall through to fuzzy PR
+    // discovery and accidentally borrow a same-Jira foreign PR.
+    const wanted = new Set(input.ticketIds);
+    const activeTouchesTarget = activeRows.some((row) => ((0, rail_pr_store_1.toPrDeliverySnapshot)(row).ticketIds.some((ticketId) => wanted.has(ticketId))));
+    const historicalOwned = new Set();
+    const activeOwned = new Set();
+    if (activeTouchesTarget)
+        input.ticketIds.forEach((ticketId) => activeOwned.add(ticketId));
+    if (!activeTouchesTarget && out.size === 0) {
+        const historical = latestHistoricalContinuation(input.db, input.ticketIds);
+        if (historical.ownsTarget)
+            input.ticketIds.forEach((ticketId) => historicalOwned.add(ticketId));
+        if (historical.candidate) {
+            const candidate = historical.candidate;
+            let lifecycle = lifecycleByUrl.get(candidate.prUrl);
+            if (!lifecycle) {
+                lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, candidate.prUrl, candidate.deliverySha);
+                lifecycleByUrl.set(candidate.prUrl, lifecycle);
+            }
+            const observed = await lifecycle;
+            if (observed.ok &&
+                (0, pr_lifecycle_1.isExactOpenPr)(observed, candidate.branch, candidate.baseBranch) &&
+                observed.headRefOid?.toLowerCase() === candidate.deliverySha &&
+                observed.includesExpectedSha === true) {
+                const materialized = await materializeHistoricalContinuation(input, candidate, observed.isDraft);
+                if (materialized) {
+                    for (const [ticketId, target] of materialized)
+                        out.set(ticketId, target);
+                }
+            }
+        }
+    }
+    // A durable Specrails delivery that fails exact verification must never be
+    // downgraded into an inferred "external" match for the same ticket/PR. The
+    // visible delivery card owns reconciliation of that stale immutable SHA.
+    const remaining = input.ticketIds.filter((id) => (!out.has(id) && !internal.has(id) && !historicalOwned.has(id) && !activeOwned.has(id)));
     const candidateIds = remaining.filter((id) => canProbeGithubForContinuation(input.db, id, input.getTicketSpec(id)));
     if (candidateIds.length === 0)
         return out;
@@ -240,7 +523,7 @@ async function resolveActivePrContinuationTargets(input) {
         const spec = input.getTicketSpec(ticketId);
         const matches = openPrs.flatMap((pr) => {
             const kind = prMatchKind(input.db, ticketId, spec, pr);
-            return kind && matchAllowedForTicket(spec, kind) ? [{ pr, kind }] : [];
+            return kind ? [{ pr, kind }] : [];
         });
         if (matches.length === 0)
             continue;
@@ -249,7 +532,23 @@ async function resolveActivePrContinuationTargets(input) {
         if (best.length !== 1)
             continue;
         const pr = best[0].pr;
-        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, pr.headRefName, pr.baseRefName || input.integrationBranch, pr.url ?? null, typeof pr.number === 'number' ? pr.number : parsePrNumber(pr.url), typeof pr.isDraft === 'boolean' ? pr.isDraft : null, 'github-open-pr');
+        const prUrl = pr.url?.trim();
+        const branch = pr.headRefName?.trim();
+        const baseBranch = pr.baseRefName?.trim() || input.integrationBranch;
+        if (!prUrl || !branch || !baseBranch)
+            continue;
+        let lifecycle = lifecycleByUrl.get(prUrl);
+        if (!lifecycle) {
+            lifecycle = (0, pr_lifecycle_1.observePrLifecycle)(input.exec, input.repoDir, prUrl);
+            lifecycleByUrl.set(prUrl, lifecycle);
+        }
+        const observed = await lifecycle;
+        // `gh pr list` is discovery evidence only. Freeze the exact live remote
+        // head through an authoritative view before borrowing any local branch;
+        // otherwise an unrelated local-ahead commit could be carried into the PR.
+        if (!observed.ok || !observed.headRefOid || !(0, pr_lifecycle_1.isExactOpenPr)(observed, branch, baseBranch))
+            continue;
+        const materialized = await materializeTarget(input.git, input.repoDir, input.fetchOk, ticketId, branch, baseBranch, prUrl, typeof pr.number === 'number' ? pr.number : parsePrNumber(prUrl), observed.isDraft, observed.headRefOid, null, 'github-open-pr');
         if (materialized)
             out.set(ticketId, materialized);
     }

package/server/dist/agent-chat-manager.js

@@ -696,6 +696,11 @@ class AgentChatManager {
                 console.log(`[agent-chat] pr-decision card skipped — conversation gone (${conversationId})`);
                 return;
             }
+            const existing = this._findPrDecisionCards(conversationId, envelope.prDeliveryId);
+            if (existing.length > 0) {
+                this.updatePrDecisionCard(conversationId, envelope);
+                return;
+            }
             (0, agent_store_1.addAgentMessage)(this._db, { conversationId, role: 'system', content: JSON.stringify(envelope) });
             this._broadcastPrDecision(conversationId, envelope);
         }
@@ -714,33 +719,45 @@ class AgentChatManager {
         if (this._disposed)
             return;
         try {
-            const existing = (0, agent_store_1.findAgentSystemMessage)(this._db, conversationId, (content) => {
-                try {
-                    const parsed = JSON.parse(content);
-                    return parsed.kind === 'pr_decision' && parsed.prDeliveryId === envelope.prDeliveryId;
-                }
-                catch {
-                    return false;
-                }
-            });
-            if (!existing) {
+            const existing = this._findPrDecisionCards(conversationId, envelope.prDeliveryId);
+            if (existing.length === 0) {
                 this.postPrDecisionCard(conversationId, envelope);
                 return;
             }
             const serialized = JSON.stringify(envelope);
+            // Keep the newest history anchor: client cold-load dedupe uses the same
+            // newest-row rule, so a crash between hydration and this repair cannot
+            // make an older blocked envelope authoritative again.
+            const canonical = existing[existing.length - 1];
+            const duplicateIds = existing.slice(0, -1).map((message) => message.id);
             // Startup recovery may inspect historical deliveries to heal a card that
             // missed its terminal update. Identical projection is not new activity:
             // avoid a redundant DB write and, crucially, do not broadcast an unread
             // event for an old card on every app launch.
-            if (existing.content === serialized)
+            if (canonical.content === serialized && duplicateIds.length === 0)
                 return;
-            (0, agent_store_1.updateAgentMessageContent)(this._db, existing.id, serialized);
+            this._db.transaction(() => {
+                if (canonical.content !== serialized)
+                    (0, agent_store_1.updateAgentMessageContent)(this._db, canonical.id, serialized);
+                (0, agent_store_1.deleteAgentMessagesByIds)(this._db, duplicateIds);
+            })();
             this._broadcastPrDecision(conversationId, envelope);
         }
         catch (err) {
             console.error(`[agent-chat] updatePrDecisionCard failed (${conversationId}):`, err);
         }
     }
+    _findPrDecisionCards(conversationId, prDeliveryId) {
+        return (0, agent_store_1.findAgentSystemMessages)(this._db, conversationId, (content) => {
+            try {
+                const parsed = JSON.parse(content);
+                return parsed.kind === 'pr_decision' && parsed.prDeliveryId === prDeliveryId;
+            }
+            catch {
+                return false;
+            }
+        });
+    }
     _broadcastPrDecision(conversationId, envelope) {
         this._broadcast({
             type: 'agent_pr_decision',

package/server/dist/agent-operator-prompt.js

@@ -396,6 +396,15 @@ summary later.
   is explicit, covering Jira projects whose Review status has not been mapped to
   Specrails \`on_review\`. You do NOT need to know or pass the branch name. If
   there is no confident open PR match, the normal new-work flow is preserved.
+- **Deliver into an existing PR (explicit target).** When the user names an
+  existing PR as the destination ("extend PR #151", "push this into the open
+  PR"), pass \`targetPrNumber\` on \`specrails_rails(launch)\` — NEVER launch
+  without it in that case, because a plain launch creates a DUPLICATE PR. The
+  rail then works on that PR's head branch and settle pushes to it. The PR must
+  be open and same-repo; the launch fails closed with \`target_pr_not_found\` /
+  \`target_pr_not_open\` / \`target_pr_fork\` / \`target_pr_invalid\` /
+  \`target_pr_unfetchable\` — report the reason, do not retry with a fresh
+  launch unless the user explicitly chooses a new PR.
 - **PR-aware relaunch classification.** Before classifying or relaunching a
   follow-up for an \`on_review\` spec or active PR, inspect that PR's head
   branch/diff/files, not only \`main\`. Treat OpenSpec artifacts added or

package/server/dist/agent-store.js

@@ -7,7 +7,9 @@ exports.updateAgentConversation = updateAgentConversation;
 exports.deleteAgentConversation = deleteAgentConversation;
 exports.addAgentMessage = addAgentMessage;
 exports.listAgentMessages = listAgentMessages;
+exports.findAgentSystemMessages = findAgentSystemMessages;
 exports.findAgentSystemMessage = findAgentSystemMessage;
+exports.deleteAgentMessagesByIds = deleteAgentMessagesByIds;
 exports.updateAgentMessageContent = updateAgentMessageContent;
 const crypto_1 = require("crypto");
 const agent_tier_1 = require("./agent-tier");
@@ -94,16 +96,29 @@ function listAgentMessages(db, conversationId) {
         .all(conversationId).map(mapMessage);
 }
 /**
- * First `system`-role message in a conversation whose content satisfies
+ * Every `system`-role message in a conversation whose content satisfies
  * `predicate` (oldest first). The store stays payload-agnostic — callers own
  * the content parsing (e.g. matching a PR-decision card by prDeliveryId).
  */
-function findAgentSystemMessage(db, conversationId, predicate = () => true) {
+function findAgentSystemMessages(db, conversationId, predicate = () => true) {
     const rows = db
         .prepare("SELECT * FROM agent_messages WHERE conversation_id = ? AND role = 'system' ORDER BY created_at ASC, rowid ASC")
         .all(conversationId);
-    const hit = rows.find((r) => predicate(r.content));
-    return hit ? mapMessage(hit) : undefined;
+    return rows.filter((row) => predicate(row.content)).map(mapMessage);
+}
+function findAgentSystemMessage(db, conversationId, predicate = () => true) {
+    return findAgentSystemMessages(db, conversationId, predicate)[0];
+}
+/** Delete exact message ids without bumping conversation activity. Callers use
+ * this only to consolidate duplicate derived system cards, never user turns. */
+function deleteAgentMessagesByIds(db, messageIds) {
+    if (messageIds.length === 0)
+        return 0;
+    const remove = db.prepare('DELETE FROM agent_messages WHERE id = ?');
+    let deleted = 0;
+    for (const id of messageIds)
+        deleted += remove.run(id).changes;
+    return deleted;
 }
 /**
  * Replace a message's content in place (inline-card state updates). Does NOT