specrails-desktop 2.29.2 → 2.29.4

package/server/dist/rail-pr-decision.js

@@ -65,6 +65,7 @@ exports.executePrDecision = executePrDecision;
  * without git/gh/net — the route in rails-router validates and delegates here.
  */
 const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
 const artifact_registry_1 = require("./artifact-registry");
 const worktree_manager_1 = require("./worktree-manager");
 const pr_publisher_1 = require("./pr-publisher");
@@ -82,7 +83,15 @@ const ids_1 = require("./ids");
 const repo_lock_1 = require("./repo-lock");
 const rail_pr_ticket_effects_1 = require("./rail-pr-ticket-effects");
 const pr_lifecycle_1 = require("./pr-lifecycle");
-exports.PR_DECISION_ACTIONS = ['create-pr', 'publish', 'discard', 'dismiss', 'poll-merge', 'reopen', 'merge-local', 'acknowledge-no-changes'];
+const rail_pr_recovery_git_1 = require("./rail-pr-recovery-git");
+exports.PR_DECISION_ACTIONS = ['create-pr', 'publish', 'discard', 'dismiss', 'poll-merge', 'reopen', 'merge-local', 'acknowledge-no-changes', 'recover-and-retry'];
+function safetyArchiveRecorder(deps, row) {
+    return (archive) => {
+        if (!(0, rail_pr_store_1.appendPrDeliverySafetyArchive)(deps.db, row.id, archive)) {
+            throw new Error(`delivery ${row.id} disappeared while recording safety archive ${archive}`);
+        }
+    };
+}
 function isPrDecisionAction(v) {
     return typeof v === 'string' && exports.PR_DECISION_ACTIONS.includes(v);
 }
@@ -121,8 +130,7 @@ function actionAllowed(action, row) {
                 row.decision === 'pr_failed';
         case 'dismiss':
             return row.is_continuation === 1 && row.decision !== 'building' &&
-                row.decision !== 'merged' && row.decision !== 'discarded' && row.decision !== 'superseded' &&
-                row.delivery_outcome !== 'blocked';
+                row.decision !== 'merged' && row.decision !== 'discarded' && row.decision !== 'superseded';
         case 'poll-merge':
             return (row.decision === 'pr_draft' || row.decision === 'pr_ready' || row.decision === 'pr_closed') && row.pr_url !== null;
         case 'reopen':
@@ -134,6 +142,12 @@ function actionAllowed(action, row) {
                 (row.decision === 'on_review' || row.decision === 'pr_failed' || row.decision === 'pr_draft');
         case 'acknowledge-no-changes':
             return row.decision === 'no_changes' && row.is_continuation !== 1;
+        case 'recover-and-retry':
+            return row.decision === 'pr_failed' && row.delivery_outcome === 'blocked' &&
+                (row.status_code === 'settlement_interrupted' || row.status_code === 'recovery_unavailable') &&
+                row.is_continuation === 1 &&
+                (row.implementation_outcome === 'succeeded' || row.implementation_outcome === 'partially_succeeded') &&
+                row.pr_url !== null && row.branch !== null;
     }
 }
 async function executePrDecision(deps, input) {
@@ -173,6 +187,7 @@ async function executePrDecision(deps, input) {
             case 'reopen': return await runReopen(deps, claimedRow);
             case 'merge-local': return await runMergeLocal(deps, claimedRow);
             case 'acknowledge-no-changes': return await runAcknowledgeNoChanges(deps, claimedRow);
+            case 'recover-and-retry': return await runRecoverAndRetry(deps, claimedRow);
         }
         return illegalAction(row.decision);
     }
@@ -270,6 +285,49 @@ function ownedDeliveryBranches(row, snap, cleanupWarnings) {
         owned.add(row.branch);
     return owned;
 }
+function immutableHeadForOwnedBranch(row, snap, branch) {
+    if (branch === row.branch && row.delivery_sha && COMMIT_SHA_RE.test(row.delivery_sha)) {
+        return row.delivery_sha.toLowerCase();
+    }
+    const unitHeads = new Set(snap.branches
+        .filter((unit) => unitWasDelivered(unit) && unit.branch === branch && unit.finalSha && COMMIT_SHA_RE.test(unit.finalSha))
+        .map((unit) => unit.finalSha.toLowerCase()));
+    return unitHeads.size === 1 ? [...unitHeads][0] : null;
+}
+async function deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings, protectedBranches = new Set()) {
+    for (const branch of ownedDeliveryBranches(row, snap, cleanupWarnings)) {
+        if (!branch || branch === row.base_branch)
+            continue;
+        // A failed release leaves the linked worktree mounted for inspection. Do
+        // not even attempt to delete its checked-out branch: preserving the files
+        // while erasing their durable ref would make the recovery story depend on
+        // Git's incidental checked-out-branch rejection.
+        if (protectedBranches.has(branch)) {
+            cleanupWarnings.push(`branch ${branch}: retained with its worktree for inspection`);
+            continue;
+        }
+        try {
+            const expectedHead = immutableHeadForOwnedBranch(row, snap, branch);
+            if (!expectedHead) {
+                cleanupWarnings.push(`branch ${branch}: retained because no unambiguous immutable delivered HEAD was recorded`);
+                continue;
+            }
+            const observed = await deps.git.run(['rev-parse', '--verify', `refs/heads/${branch}`], deps.project.path);
+            const observedHead = observed.code === 0 ? observed.stdout.trim().toLowerCase() : '';
+            if (!COMMIT_SHA_RE.test(observedHead) || observedHead !== expectedHead) {
+                cleanupWarnings.push(`branch ${branch}: retained because its current tip no longer matches delivered HEAD ${expectedHead.slice(0, 12)}`);
+                continue;
+            }
+            const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
+            if (deleted.code !== 0) {
+                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
 function releasableWorktreeIds(deps, snap) {
     const preservedBranches = new Set(snap.branches.filter((unit) => !unitWasDelivered(unit)).map((unit) => unit.branch));
     return snap.worktreeIds.filter((id) => {
@@ -277,10 +335,6 @@ function releasableWorktreeIds(deps, snap) {
         return !wt || !preservedBranches.has(wt.branch);
     });
 }
-async function observePrLifecycle(deps, prUrl) {
-    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, prUrl);
-    return observed.ok ? { state: observed.state, isDraft: observed.isDraft } : null;
-}
 function mergedEvidenceDetail(observation) {
     return observation.includesExpectedSha === null
         ? 'GitHub did not return enough commit evidence to prove the previous PR included the verified implementation commit'
@@ -291,15 +345,20 @@ async function rerouteFromStalePr(deps, row, detail, exactWasPushed) {
     const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
         db: deps.db, git: deps.git, repoDir: deps.project.path,
         worktreeIds: releasableWorktreeIds(deps, snap),
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
     });
     const partial = row.implementation_outcome === 'partially_succeeded';
+    const preserved = row.delivery_sha ? 'the preserved exact commit' : 'the preserved recorded branch';
     const conflict = casTransition(deps, row, 'on_review', {
         prUrl: null,
         prNumber: null,
         prState: exactWasPushed ? 'pushed' : 'local-only',
         deliveryOutcome: partial ? 'partial' : 'ready',
         statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : partial ? 'partial_success' : 'ready_for_review',
-        statusDetail: `${detail}; create a new draft PR from the preserved exact commit`,
+        statusDetail: `${detail}; create a new draft PR from ${preserved}`,
         cleanupWarnings,
         // The replacement PR belongs to this generation. Per-unit branch ownership
         // remains unchanged so a borrowed/pre-existing ref is still never deleted.
@@ -320,23 +379,78 @@ async function rerouteFromStalePr(deps, row, detail, exactWasPushed) {
         },
     };
 }
-async function settleObservedExistingPr(deps, row, observation) {
+async function settleObservedExistingPr(deps, row, observation, pushed) {
     const next = observation.state === 'MERGED' || observation.isDraft === false ? 'pr_ready' : 'pr_draft';
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
     const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
         db: deps.db, git: deps.git, repoDir: deps.project.path,
         worktreeIds: releasableWorktreeIds(deps, snap),
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
     });
     const conflict = casTransition(deps, row, next, {
         prState: 'pr-created',
         deliveryOutcome: 'delivered',
         statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : next === 'pr_ready' ? 'pr_ready' : 'existing_pr_updated',
+        statusDetail: null,
         cleanupWarnings,
     });
     if (conflict)
         return conflict;
+    await releaseDeliveredRecoveryLineage(deps, row, row.delivery_sha);
     const after = finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: next, prUrl: after?.prUrl ?? row.pr_url, prState: 'pr-created' } };
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: next,
+            prUrl: after?.prUrl ?? row.pr_url,
+            prState: 'pr-created',
+            deliveryVerified: true,
+            verifiedSha: row.delivery_sha,
+            remoteHeadSha: observation.headRefOid,
+            pushed,
+        },
+    };
+}
+async function settleObservedClosedPr(deps, row, observation) {
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap),
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
+    });
+    const conflict = casTransition(deps, row, 'pr_closed', {
+        prState: 'pr-created',
+        deliveryOutcome: 'delivered',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'pr_closed',
+        statusDetail: null,
+        cleanupWarnings,
+    });
+    if (conflict)
+        return conflict;
+    await releaseDeliveredRecoveryLineage(deps, row, row.delivery_sha);
+    const after = finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'pr_closed',
+            closed: true,
+            merged: false,
+            prUrl: after?.prUrl ?? row.pr_url,
+            prState: 'pr-created',
+            deliveryVerified: true,
+            verifiedSha: row.delivery_sha,
+            remoteHeadSha: observation.headRefOid,
+            pushed: false,
+        },
+    };
 }
 function persistRetryablePrObservationFailure(deps, row, detail) {
     const conflict = casTransition(deps, row, 'pr_failed', {
@@ -360,6 +474,580 @@ function persistMovedPrHead(deps, row, detail) {
     finalizeTransition(deps, row.id);
     return { status: 200, body: { ok: true, decision: 'pr_failed', prUrl: row.pr_url, detail } };
 }
+function persistRecoveryBlocked(deps, row, detail, deliverySha) {
+    const conflict = casTransition(deps, row, 'pr_failed', {
+        deliveryOutcome: 'blocked',
+        statusCode: 'recovery_unavailable',
+        statusDetail: detail,
+        ...(deliverySha !== undefined ? { deliverySha } : {}),
+        isContinuation: true,
+    });
+    if (conflict)
+        return conflict;
+    finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'pr_failed',
+            prUrl: row.pr_url,
+            recoveryUnavailable: true,
+            detail,
+        },
+    };
+}
+function persistProtectedRecoveryRetry(deps, row, snap, matchingUnitIndexes, runId, candidateSha, detail) {
+    const recoveredIndexes = new Set(matchingUnitIndexes);
+    const recoveredBranches = snap.branches.map((unit, index) => recoveredIndexes.has(index)
+        ? {
+            ...unit,
+            runId,
+            branch: row.branch,
+            succeeded: true,
+            implementationOutcome: 'succeeded',
+            deliveryOutcome: 'ready',
+            finalSha: candidateSha,
+            changed: unit.changed ?? (unit.initialSha ? unit.initialSha.toLowerCase() !== candidateSha.toLowerCase() : true),
+            failureCode: null,
+            branchOwnership: 'borrowed-pr',
+        }
+        : unit);
+    const conflict = casTransition(deps, row, 'pr_failed', {
+        branches: recoveredBranches,
+        deliverySha: candidateSha,
+        deliveryOutcome: 'retryable_failure',
+        statusCode: 'settlement_interrupted',
+        statusDetail: detail,
+        isContinuation: true,
+    });
+    if (conflict)
+        return conflict;
+    finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'pr_failed',
+            prUrl: row.pr_url,
+            recovered: true,
+            detail,
+        },
+    };
+}
+async function exactRefSha(deps, cwd, ref) {
+    try {
+        const result = await deps.git.run(['rev-parse', '--verify', ref], cwd);
+        const sha = result.code === 0 ? result.stdout.trim() : '';
+        return COMMIT_SHA_RE.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function isFastForwardCandidate(deps, baselineSha, candidateSha) {
+    if (baselineSha === candidateSha)
+        return true;
+    try {
+        return (await deps.git.run(['merge-base', '--is-ancestor', baselineSha, candidateSha], deps.project.path)).code === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function releaseDeliveredRecoveryLineage(deps, row, deliveredSha) {
+    if (!deliveredSha || !COMMIT_SHA_RE.test(deliveredSha))
+        return;
+    const currentProtection = await (0, rail_pr_recovery_git_1.inspectRecoveryCommitProtection)(deps.git, deps.project.path, row.id);
+    if (currentProtection.kind === 'present' &&
+        currentProtection.sha.toLowerCase() === deliveredSha.toLowerCase()) {
+        await (0, rail_pr_recovery_git_1.releaseRecoveryCommit)(deps.git, deps.project.path, row.id, deliveredSha);
+    }
+    const visited = new Set([row.id]);
+    let predecessorId = row.supersedes_delivery_id;
+    for (let depth = 0; predecessorId && depth < 32 && !visited.has(predecessorId); depth++) {
+        visited.add(predecessorId);
+        const predecessor = (0, rail_pr_store_1.getPrDelivery)(deps.db, predecessorId);
+        if (!predecessor)
+            break;
+        if (predecessor.decision !== 'discarded' && predecessor.decision !== 'superseded')
+            break;
+        const protection = await (0, rail_pr_recovery_git_1.inspectRecoveryCommitProtection)(deps.git, deps.project.path, predecessor.id);
+        if (protection.kind === 'present' && await isFastForwardCandidate(deps, protection.sha, deliveredSha)) {
+            await (0, rail_pr_recovery_git_1.releaseRecoveryCommit)(deps.git, deps.project.path, predecessor.id, protection.sha);
+        }
+        predecessorId = predecessor.supersedes_delivery_id;
+    }
+}
+function parseRegisteredGitWorktrees(stdout) {
+    const worktrees = [];
+    let current = null;
+    const finish = () => {
+        if (current)
+            worktrees.push(current);
+        current = null;
+    };
+    for (const field of stdout.split('\0')) {
+        if (field === '') {
+            finish();
+            continue;
+        }
+        if (field.startsWith('worktree ')) {
+            finish();
+            current = { worktreePath: field.slice('worktree '.length), head: null, branch: null };
+            continue;
+        }
+        if (!current)
+            continue;
+        if (field.startsWith('HEAD '))
+            current.head = field.slice('HEAD '.length);
+        if (field.startsWith('branch '))
+            current.branch = field.slice('branch '.length);
+    }
+    finish();
+    return worktrees;
+}
+/** Authenticate a ledger path as a live, non-symlink worktree registered by
+ * this exact repository. The main checkout and ordinary directories fail
+ * closed. Callers repeat this immediately before staging to close the useful
+ * path-replacement window between inspection and mutation. */
+async function authenticateRecoveryWorktree(deps, ledgerPath, expectedBranch, expectedHead) {
+    if (!path.isAbsolute(ledgerPath)) {
+        return { ok: false, detail: 'the recorded worktree path is not absolute' };
+    }
+    let realPath;
+    let projectRealPath;
+    try {
+        const ledgerStat = fs.lstatSync(ledgerPath);
+        if (ledgerStat.isSymbolicLink()) {
+            return { ok: false, detail: 'the recorded worktree path is a symbolic link' };
+        }
+        if (!ledgerStat.isDirectory()) {
+            return { ok: false, detail: 'the recorded worktree path is not a directory' };
+        }
+        realPath = fs.realpathSync(ledgerPath);
+        projectRealPath = fs.realpathSync(deps.project.path);
+        if (!fs.statSync(realPath).isDirectory()) {
+            return { ok: false, detail: 'the canonical worktree path is not a directory' };
+        }
+    }
+    catch {
+        return { ok: false, detail: 'the recorded worktree path could not be resolved safely' };
+    }
+    if (realPath === projectRealPath) {
+        return { ok: false, detail: 'the recorded worktree path resolves to the main project checkout' };
+    }
+    let listed;
+    try {
+        listed = await deps.git.run(['worktree', 'list', '--porcelain', '-z'], deps.project.path);
+    }
+    catch {
+        return { ok: false, detail: 'Git worktree registration could not be verified' };
+    }
+    if (listed.code !== 0) {
+        return { ok: false, detail: 'Git worktree registration could not be verified' };
+    }
+    const matches = parseRegisteredGitWorktrees(listed.stdout).filter((registered) => {
+        try {
+            return fs.realpathSync(registered.worktreePath) === realPath;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (matches.length !== 1) {
+        return { ok: false, detail: 'the recorded path is not uniquely registered as a Git worktree of this project' };
+    }
+    const registered = matches[0];
+    if (registered.branch !== `refs/heads/${expectedBranch}`) {
+        return { ok: false, detail: 'the registered Git worktree is not on the recorded delivery branch' };
+    }
+    if (!registered.head || !COMMIT_SHA_RE.test(registered.head)) {
+        return { ok: false, detail: 'the registered Git worktree has no verifiable commit identity' };
+    }
+    if (expectedHead && registered.head.toLowerCase() !== expectedHead.toLowerCase()) {
+        return { ok: false, detail: 'the registered Git worktree changed commits before staging' };
+    }
+    return { ok: true, realPath, head: registered.head };
+}
+/**
+ * Explicit recovery for a legacy successful continuation whose automatic
+ * causal scan could not freeze a commit. Unlike Checkout, this operates only
+ * on the delivery-owned isolated worktree/branch and never changes the user's
+ * main checkout. The user's confirmation authorizes adopting already-committed
+ * progress on that exact branch, but only as a non-force fast-forward of the
+ * live PR head.
+ */
+async function runRecoverAndRetry(deps, row) {
+    if (!row.pr_url || !row.branch || !row.operation_token)
+        return illegalAction(row.decision);
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const runIds = [...new Set(snap.runIds.filter((runId) => typeof runId === 'string' && runId.length > 0))];
+    if (runIds.length !== 1) {
+        return persistRecoveryBlocked(deps, row, `Commit & retry push requires exactly one recorded implementation run; found ${runIds.length}. No local evidence was changed.`);
+    }
+    const runId = runIds[0];
+    const matchingUnitIndexes = snap.branches
+        .map((branch, index) => branch.branch === row.branch && branch.runId === runId ? index : -1)
+        .filter((index) => index >= 0);
+    if (matchingUnitIndexes.length === 0) {
+        return persistRecoveryBlocked(deps, row, 'Commit & retry push could not prove an exact recorded unit for this run and PR branch. No local evidence was changed.');
+    }
+    const matchingUnits = matchingUnitIndexes.map((index) => snap.branches[index]);
+    const recordedFinalValues = matchingUnits.map((unit) => unit.finalSha);
+    const hasAnyRecordedFinal = recordedFinalValues.some((sha) => sha != null);
+    const recordedFinalShas = [...new Set(recordedFinalValues
+            .filter((sha) => typeof sha === 'string' && COMMIT_SHA_RE.test(sha))
+            .map((sha) => sha.toLowerCase()))];
+    const recordedFinalEvidenceUnsafe = hasAnyRecordedFinal && (recordedFinalValues.some((sha) => typeof sha !== 'string' || !COMMIT_SHA_RE.test(sha)) ||
+        recordedFinalShas.length !== 1);
+    // Durable final evidence is one sufficient ownership proof, not a veto over
+    // the independent exact run-marker proof. Incomplete/disagreeing migrated
+    // unit fields are ignored here; a unique causal commit may still recover the
+    // result without adopting any of those disputed SHAs.
+    const recordedFinalSha = recordedFinalEvidenceUnsafe ? null : recordedFinalShas[0] ?? null;
+    let discovery = null;
+    const discoverCandidate = async () => {
+        if (!discovery) {
+            discovery = await (0, rail_pr_recovery_git_1.discoverRunMarkedCommit)(deps.git, deps.project.path, runId);
+        }
+        return discovery;
+    };
+    const ownedWorktrees = snap.worktreeIds
+        .map((worktreeId) => (0, rail_worktrees_store_1.getRailWorktree)(deps.db, worktreeId))
+        .filter((worktree) => Boolean(worktree && worktree.branch === row.branch && worktree.run_id === runId));
+    const presentWorktrees = ownedWorktrees.filter((worktree) => {
+        try {
+            fs.lstatSync(worktree.worktree_path);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+    const worktree = presentWorktrees[0] ?? null;
+    let preprotectedCandidateSha = null;
+    let preprotectedCandidateSource = null;
+    // Discover and pin an exact object before any network dependency, even when
+    // a ledger path still exists. A recreated/unsafe/dirty path must not hide an
+    // older run-owned orphan or leave it exposed to Git GC.
+    {
+        if (recordedFinalSha && await commitObjectExists(deps, recordedFinalSha)) {
+            preprotectedCandidateSha = recordedFinalSha;
+            preprotectedCandidateSource = 'recorded-final';
+        }
+        else {
+            const found = await discoverCandidate();
+            if (found.kind === 'ambiguous') {
+                return persistRecoveryBlocked(deps, row, `Git found ${found.count} different run-marked commits. No ambiguous object, branch, or worktree was changed.`);
+            }
+            if (found.kind === 'scan_failed') {
+                return persistRecoveryBlocked(deps, row, `${found.detail}. No branch, worktree, or object was changed.`);
+            }
+            if (found.kind === 'unique') {
+                preprotectedCandidateSha = found.sha;
+                preprotectedCandidateSource = 'run-marker';
+            }
+        }
+        if (preprotectedCandidateSha) {
+            const protection = await (0, rail_pr_recovery_git_1.protectRecoveryCommit)(deps.git, deps.project.path, row.id, preprotectedCandidateSha);
+            if (!protection.ok) {
+                return persistRecoveryBlocked(deps, row, `${protection.detail}. The candidate object and every user-visible branch were left unchanged.`);
+            }
+        }
+    }
+    if (presentWorktrees.length > 1) {
+        return persistRecoveryBlocked(deps, row, 'Multiple live worktrees claim this run and branch, so Specrails refused to choose one. Every local result remains intact.', preprotectedCandidateSha);
+    }
+    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, preprotectedCandidateSha);
+    if (!observed.ok) {
+        if (preprotectedCandidateSha) {
+            if (worktree) {
+                return persistRecoveryBlocked(deps, row, `Protected an exact run-owned commit, but a live worktree also exists and the PR could not be observed: ${observed.detail}. Both local results were preserved and neither was selected or pushed.`, preprotectedCandidateSha);
+            }
+            const durablyProvenNoChange = row.implementation_outcome === 'succeeded' &&
+                matchingUnitIndexes.length === snap.branches.length &&
+                matchingUnits.every((unit) => (unit.changed === false &&
+                    unit.initialSha?.toLowerCase() === preprotectedCandidateSha.toLowerCase() &&
+                    unit.finalSha?.toLowerCase() === preprotectedCandidateSha.toLowerCase()));
+            const detail = `Recovered and protected the exact run-owned commit, but the recorded PR could not be observed: ${observed.detail}; retry will revalidate before any push.`;
+            if (durablyProvenNoChange) {
+                return persistRecoveryBlocked(deps, row, detail, preprotectedCandidateSha);
+            }
+            return persistProtectedRecoveryRetry(deps, row, snap, matchingUnitIndexes, runId, preprotectedCandidateSha, detail);
+        }
+        return persistRecoveryBlocked(deps, row, `The existing PR could not be verified before local recovery: ${observed.detail}. No local evidence was changed.`);
+    }
+    if (!(0, pr_lifecycle_1.isExactOpenPr)(observed, row.branch, row.base_branch) || !observed.headRefOid) {
+        if (preprotectedCandidateSha) {
+            if (worktree) {
+                return persistRecoveryBlocked(deps, row, 'A protected run-owned commit and a live worktree both exist while the recorded PR lifecycle changed. Specrails preserved both and refused to choose or push either automatically.', preprotectedCandidateSha);
+            }
+            const frozen = persistProtectedRecoveryRetry(deps, row, snap, matchingUnitIndexes, runId, preprotectedCandidateSha, 'Protected the exact run-owned commit; revalidating the changed PR lifecycle before any push.');
+            if (frozen.status !== 200 || frozen.body.decision !== 'pr_failed')
+                return frozen;
+            const recoveredRow = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+            if (!recoveredRow || recoveredRow.operation_token !== row.operation_token) {
+                return staleDecision(recoveredRow?.decision ?? row.decision);
+            }
+            return retryExistingPrFollowupPush(deps, recoveredRow);
+        }
+        return persistRecoveryBlocked(deps, row, 'The recorded PR is no longer an exact open head/base recovery target. No local evidence was changed.');
+    }
+    const baselineSha = observed.headRefOid;
+    // Ensure the live remote baseline object is available for the ancestry proof
+    // without advancing any local branch or touching the main checkout.
+    if (!(await commitObjectExists(deps, baselineSha))) {
+        try {
+            await deps.git.run(['fetch', 'origin', `refs/heads/${row.branch}`], deps.project.path);
+        }
+        catch { /* the exact object check below remains authoritative */ }
+    }
+    if (!(await commitObjectExists(deps, baselineSha))) {
+        return persistRecoveryBlocked(deps, row, 'The live PR head object is unavailable locally, so fast-forward recovery cannot be proven. No local evidence was changed.', preprotectedCandidateSha);
+    }
+    let candidateSha = preprotectedCandidateSha;
+    let candidateOwned = preprotectedCandidateSha !== null;
+    let candidateSource = preprotectedCandidateSource ?? 'baseline';
+    let committed = false;
+    if (worktree) {
+        const authenticated = await authenticateRecoveryWorktree(deps, worktree.worktree_path, row.branch);
+        if (!authenticated.ok) {
+            return persistRecoveryBlocked(deps, row, `The preserved path at ${worktree.worktree_path} could not be authenticated safely: ${authenticated.detail}. Nothing was staged, pushed, or removed.`, preprotectedCandidateSha);
+        }
+        const authenticatedPath = authenticated.realPath;
+        const [actualBranch, worktreeHead, branchHead] = await Promise.all([
+            deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], authenticatedPath).catch(() => ({ code: 1, stdout: '', stderr: '' })),
+            exactRefSha(deps, authenticatedPath, 'HEAD'),
+            exactRefSha(deps, deps.project.path, `refs/heads/${row.branch}`),
+        ]);
+        if (actualBranch.code !== 0 || actualBranch.stdout.trim() !== row.branch ||
+            !worktreeHead || !branchHead || worktreeHead !== branchHead ||
+            authenticated.head.toLowerCase() !== worktreeHead.toLowerCase()) {
+            return persistRecoveryBlocked(deps, row, `The preserved worktree at ${worktree.worktree_path} is not on the exact recorded branch/HEAD. It was left untouched.`, preprotectedCandidateSha);
+        }
+        if (preprotectedCandidateSha &&
+            worktreeHead.toLowerCase() !== preprotectedCandidateSha.toLowerCase()) {
+            return persistRecoveryBlocked(deps, row, `A protected run-owned commit and a different live worktree result both exist. Specrails preserved both and refused to choose or bundle them automatically. Inspect ${worktree.worktree_path} before retrying or discarding either result.`, preprotectedCandidateSha);
+        }
+        if (!(await isFastForwardCandidate(deps, baselineSha, worktreeHead))) {
+            return persistRecoveryBlocked(deps, row, `The preserved branch diverges from the live PR head. The worktree at ${worktree.worktree_path} was left untouched.`, preprotectedCandidateSha);
+        }
+        let skipWorktreeCommit = false;
+        if (worktreeHead === baselineSha) {
+            candidateOwned = true;
+            candidateSource = 'baseline';
+        }
+        else if (recordedFinalSha && worktreeHead.toLowerCase() === recordedFinalSha) {
+            candidateOwned = true;
+            candidateSource = 'recorded-final';
+        }
+        else {
+            const found = await discoverCandidate();
+            if (found.kind === 'unique' && found.sha === worktreeHead.toLowerCase()) {
+                candidateOwned = true;
+                candidateSource = 'run-marker';
+            }
+            else if (found.kind === 'unique') {
+                // A later/unrelated checked-out tip must not be bundled into the
+                // recovered result. Preserve it untouched and use only the exact
+                // run-owned object discovered independently.
+                candidateSha = found.sha;
+                candidateOwned = true;
+                candidateSource = 'run-marker';
+                skipWorktreeCommit = true;
+            }
+            else {
+                const reason = found.kind === 'ambiguous'
+                    ? `Git found ${found.count} run-marked commits, so no unique worktree baseline could be chosen.`
+                    : found.kind === 'scan_failed'
+                        ? `${found.detail}.`
+                        : 'The preserved worktree branch advanced beyond every delivery-owned commit.';
+                return persistRecoveryBlocked(deps, row, `${reason} The worktree at ${worktree.worktree_path} was left untouched.`);
+            }
+        }
+        if (!skipWorktreeCommit) {
+            deps.assertAdmission?.();
+            const reauthenticated = await authenticateRecoveryWorktree(deps, worktree.worktree_path, row.branch, worktreeHead);
+            if (!reauthenticated.ok || reauthenticated.realPath !== authenticatedPath) {
+                const detail = reauthenticated.ok
+                    ? 'the canonical worktree path changed before staging'
+                    : reauthenticated.detail;
+                return persistRecoveryBlocked(deps, row, `The preserved path at ${worktree.worktree_path} failed final authentication: ${detail}. Nothing was staged, pushed, or removed.`);
+            }
+            deps.assertAdmission?.();
+            const overlayExcludes = [...new Set(matchingUnits.flatMap((unit) => unit.overlayExcludes ?? []))];
+            const commit = await (0, worktree_manager_1.commitWorktreeAndVerify)(deps.git, reauthenticated.realPath, `specrails: recovered follow-up (run ${runId})`, overlayExcludes);
+            if (!commit.clean) {
+                return persistRecoveryBlocked(deps, row, `The preserved worktree could not be committed safely: ${commit.error ?? (commit.dirty.join(', ') || 'deliverable changes remain')}. It was left intact at ${worktree.worktree_path}.`);
+            }
+            committed = commit.committed;
+            const [afterBranch, afterHead, afterBranchHead] = await Promise.all([
+                deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], reauthenticated.realPath).catch(() => ({ code: 1, stdout: '', stderr: '' })),
+                exactRefSha(deps, reauthenticated.realPath, 'HEAD'),
+                exactRefSha(deps, deps.project.path, `refs/heads/${row.branch}`),
+            ]);
+            if (afterBranch.code !== 0 || afterBranch.stdout.trim() !== row.branch ||
+                !afterHead || afterHead !== afterBranchHead) {
+                return persistRecoveryBlocked(deps, row, `The recovery commit exists, but final branch verification failed. It remains preserved at ${worktree.worktree_path}.`);
+            }
+            candidateSha = afterHead;
+            if (committed) {
+                candidateOwned = true;
+                candidateSource = 'worktree';
+            }
+            if (candidateSource === 'baseline' && recordedFinalSha && afterHead.toLowerCase() === recordedFinalSha) {
+                candidateSource = 'recorded-final';
+            }
+            candidateOwned = candidateOwned || committed || candidateSource !== 'baseline' || afterHead === baselineSha;
+        }
+    }
+    else {
+        candidateSha ??= await exactRefSha(deps, deps.project.path, `refs/heads/${row.branch}`);
+    }
+    // A consistent durable final SHA outranks a mutable branch name. This also
+    // lets another checkout recover an object whose branch was later reset.
+    if (!committed && recordedFinalSha &&
+        await commitObjectExists(deps, recordedFinalSha) &&
+        (!candidateOwned || candidateSha === baselineSha)) {
+        candidateSha = recordedFinalSha;
+        candidateOwned = true;
+        candidateSource = 'recorded-final';
+    }
+    // Before claiming absence, inspect the same complete causal surface as
+    // startup. A unique run-marked object may survive after both the worktree and
+    // visible branch were removed.
+    const baselineHasDurableFinalProof = candidateSha === baselineSha && recordedFinalSha === baselineSha;
+    if (!candidateSha || (candidateSha === baselineSha && !baselineHasDurableFinalProof) || !candidateOwned) {
+        const found = await discoverCandidate();
+        if (found.kind === 'ambiguous') {
+            return persistRecoveryBlocked(deps, row, `Git found ${found.count} different run-marked commits. No ambiguous object, branch, or worktree was changed.`);
+        }
+        if (found.kind === 'scan_failed') {
+            return persistRecoveryBlocked(deps, row, `${found.detail}. No branch, worktree, or object was changed.`);
+        }
+        if (found.kind === 'unique') {
+            candidateSha = found.sha;
+            candidateOwned = true;
+            candidateSource = 'run-marker';
+        }
+        else if (candidateSha && candidateSha !== baselineSha && !candidateOwned) {
+            return persistRecoveryBlocked(deps, row, 'The recorded local branch advanced beyond the run-owned result. The later branch tip was preserved and was not committed or pushed.');
+        }
+    }
+    if (!candidateSha || !(await commitObjectExists(deps, candidateSha))) {
+        return persistRecoveryBlocked(deps, row, 'No delivery-owned commit is available in this clone’s refs, reflogs, worktrees, or unreachable objects. The result may still exist on the computer where the run executed; nothing here was changed or removed.');
+    }
+    if (candidateSha === baselineSha) {
+        const provesNoChanges = row.implementation_outcome === 'succeeded' &&
+            matchingUnitIndexes.length === snap.branches.length &&
+            matchingUnits.every((unit) => (unit.changed === false &&
+                unit.initialSha?.toLowerCase() === baselineSha.toLowerCase() &&
+                unit.finalSha?.toLowerCase() === baselineSha.toLowerCase()));
+        if (provesNoChanges) {
+            const noChangeIndexes = new Set(matchingUnitIndexes);
+            const noChangeBranches = snap.branches.map((unit, index) => noChangeIndexes.has(index)
+                ? {
+                    ...unit,
+                    succeeded: true,
+                    implementationOutcome: 'succeeded',
+                    deliveryOutcome: 'no_changes',
+                    initialSha: baselineSha,
+                    finalSha: baselineSha,
+                    changed: false,
+                    failureCode: null,
+                }
+                : unit);
+            const conflict = casTransition(deps, row, 'no_changes', {
+                branches: noChangeBranches,
+                deliverySha: baselineSha,
+                deliveryOutcome: 'no_changes',
+                statusCode: 'no_changes',
+                statusDetail: null,
+                isContinuation: true,
+            });
+            if (conflict)
+                return conflict;
+            await releaseDeliveredRecoveryLineage(deps, row, baselineSha);
+            finalizeTransition(deps, row.id);
+            return {
+                status: 200,
+                body: {
+                    ok: true,
+                    decision: 'no_changes',
+                    prUrl: row.pr_url,
+                    noChanges: true,
+                    deliveryVerified: true,
+                    verifiedSha: baselineSha,
+                    pushed: false,
+                },
+            };
+        }
+        const alreadyDelivered = recordedFinalSha === baselineSha || candidateSource === 'run-marker';
+        if (!alreadyDelivered) {
+            return persistRecoveryBlocked(deps, row, 'This clone contains only the current PR head and no additional run-owned result. The original execution computer may still retain its worktree or orphan commit; nothing here was changed or removed.');
+        }
+    }
+    else {
+        const protection = preprotectedCandidateSha &&
+            preprotectedCandidateSha.toLowerCase() !== candidateSha.toLowerCase()
+            ? await (0, rail_pr_recovery_git_1.advanceRecoveryCommitProtection)(deps.git, deps.project.path, row.id, preprotectedCandidateSha, candidateSha)
+            : await (0, rail_pr_recovery_git_1.protectRecoveryCommit)(deps.git, deps.project.path, row.id, candidateSha);
+        if (!protection.ok) {
+            return persistRecoveryBlocked(deps, row, `${protection.detail}. The candidate object and every user-visible branch were left unchanged.`, preprotectedCandidateSha);
+        }
+    }
+    if (!(await isFastForwardCandidate(deps, baselineSha, candidateSha))) {
+        return persistRecoveryBlocked(deps, row, 'The exact run-owned recovery commit is not a fast-forward of the live PR head. It remains protected locally and nothing was pushed or removed.', candidateSha);
+    }
+    const recoveredIndexes = new Set(matchingUnitIndexes);
+    const recoveredBranches = snap.branches.map((unit, index) => recoveredIndexes.has(index)
+        ? {
+            ...unit,
+            runId,
+            branch: row.branch,
+            succeeded: true,
+            implementationOutcome: 'succeeded',
+            deliveryOutcome: 'ready',
+            // Equality with the live PR head can mean the exact run commit was
+            // already delivered; it is not no-change evidence. Preserve a durable
+            // initial SHA when available and infer the observed baseline only for
+            // a still-missing descendant. The proven no-change branch returned
+            // above before reaching this mapping.
+            initialSha: unit.initialSha ?? (candidateSha !== baselineSha ? baselineSha : null),
+            finalSha: candidateSha,
+            changed: true,
+            failureCode: null,
+            branchOwnership: 'borrowed-pr',
+            ...(worktree ? { worktreePath: worktree.worktree_path } : {}),
+        }
+        : unit);
+    // Freeze before the network mutation. A crash after this write leaves a
+    // normal immutable Retry push card; a crash before it leaves the run-marked
+    // commit discoverable by startup recovery.
+    if (!(0, rail_pr_store_1.transitionClaimedDecision)(deps.db, row.id, row.decision, 'pr_failed', row.operation_token, {
+        branches: recoveredBranches,
+        deliverySha: candidateSha,
+        deliveryOutcome: 'retryable_failure',
+        statusCode: 'settlement_interrupted',
+        statusDetail: candidateSource === 'worktree'
+            ? `Committed the preserved worktree as ${candidateSha.slice(0, 8)}; validating the exact PR before push.`
+            : candidateSource === 'run-marker'
+                ? `Protected the unique run-owned commit ${candidateSha.slice(0, 8)}; validating the exact PR before push.`
+                : `Recovered the durable final commit ${candidateSha.slice(0, 8)}; validating the exact PR before push.`,
+        isContinuation: true,
+    })) {
+        const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+        return staleDecision(current?.decision ?? row.decision);
+    }
+    if (worktree)
+        (0, rail_worktrees_store_1.updateRailWorktreeState)(deps.db, worktree.id, 'built');
+    const recoveredRow = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+    if (!recoveredRow || recoveredRow.operation_token !== row.operation_token) {
+        return staleDecision(recoveredRow?.decision ?? row.decision);
+    }
+    deps.assertAdmission?.();
+    return retryExistingPrFollowupPush(deps, recoveredRow);
+}
 async function retryExistingPrFollowupPush(deps, row) {
     if (!row.branch || !row.pr_url)
         return { status: 502, body: { error: 'push_failed', detail: 'missing PR branch/url' } };
@@ -380,21 +1068,51 @@ async function retryExistingPrFollowupPush(deps, row) {
         return persistRetryablePrObservationFailure(deps, row, `could not confirm the existing PR is open before retry: ${beforePush.detail}`);
     }
     if (!(0, pr_lifecycle_1.isExactOpenPr)(beforePush, row.branch, row.base_branch)) {
-        if (beforePush.state === 'MERGED' && beforePush.includesExpectedSha === true) {
-            return settleObservedExistingPr(deps, row, beforePush);
+        const identityMatches = (0, pr_lifecycle_1.matchesRecordedPrIdentity)(beforePush, row.branch, row.base_branch);
+        if (beforePush.state === 'MERGED' && identityMatches && beforePush.includesExpectedSha === true) {
+            return settleMergedPr(deps, row);
         }
         if (beforePush.state === 'MERGED') {
-            return rerouteFromStalePr(deps, row, mergedEvidenceDetail(beforePush), false);
+            return rerouteFromStalePr(deps, row, identityMatches ? mergedEvidenceDetail(beforePush) : 'the previous PR merged after its recorded head/base identity changed', false);
         }
         if (beforePush.state === 'CLOSED') {
+            if (identityMatches && beforePush.includesExpectedSha === true) {
+                return settleObservedClosedPr(deps, row, beforePush);
+            }
             return rerouteFromStalePr(deps, row, 'the previous PR closed before this implementation was delivered', false);
         }
-        return persistMovedPrHead(deps, row, 'the existing PR no longer matches its recorded head/base; the verified commit was not pushed');
+        return rerouteFromStalePr(deps, row, 'the existing open PR no longer matches its recorded head/base identity', false);
+    }
+    if (beforePush.includesExpectedSha === true) {
+        return settleObservedExistingPr(deps, row, beforePush, false);
+    }
+    if (!beforePush.headRefOid) {
+        return persistRetryablePrObservationFailure(deps, row, 'the open PR did not expose a verifiable head commit; Retry push will revalidate before mutation');
+    }
+    if (!(await commitObjectExists(deps, beforePush.headRefOid))) {
+        try {
+            await deps.git.run(['fetch', 'origin', `refs/heads/${row.branch}`], deps.project.path);
+        }
+        catch { /* the immutable object check below remains authoritative */ }
+    }
+    if (!(await commitObjectExists(deps, beforePush.headRefOid))) {
+        return persistRetryablePrObservationFailure(deps, row, 'the live PR head object is unavailable locally; Retry push will revalidate before mutation');
+    }
+    if (!(await isFastForwardCandidate(deps, beforePush.headRefOid, row.delivery_sha))) {
+        const detail = 'the exact delivery commit is not a fast-forward of the live PR head; it was not pushed';
+        return row.is_continuation === 1
+            ? persistRecoveryBlocked(deps, row, `${detail} and remains protected`, row.delivery_sha)
+            : persistMovedPrHead(deps, row, detail);
+    }
+    const remote = await (0, pr_lifecycle_1.verifyPushRemoteForPr)(deps.exec, deps.project.path, row.pr_url);
+    if (!remote.ok) {
+        return persistRetryablePrObservationFailure(deps, row, `refusing to push until the PR repository and origin are proven identical: ${remote.detail}`);
     }
     const pushed = await (0, pr_publisher_1.pushBranch)(deps.exec, {
         repoDir: deps.project.path,
         branch: row.branch,
         baseBranch: row.base_branch,
+        remote: remote.pushTarget,
         sourceSha: row.delivery_sha,
     });
     if (pushed.state === 'local-only') {
@@ -414,21 +1132,25 @@ async function retryExistingPrFollowupPush(deps, row) {
         return persistRetryablePrObservationFailure(deps, row, `exact commit was pushed, but the PR lifecycle could not be confirmed: ${afterPush.detail}`);
     }
     if ((0, pr_lifecycle_1.isExactOpenPr)(afterPush, row.branch, row.base_branch)) {
-        if (afterPush.headRefOid?.toLowerCase() !== row.delivery_sha.toLowerCase()) {
-            return persistMovedPrHead(deps, row, 'the PR head moved after the exact push; the verified commit is preserved but no longer proven as the remote head');
+        if (afterPush.includesExpectedSha !== true) {
+            return persistRetryablePrObservationFailure(deps, row, 'the exact push completed, but the PR does not yet expose the verified commit as its head; Retry push remains safe and uses the preserved SHA');
         }
-        return settleObservedExistingPr(deps, row, afterPush);
+        return settleObservedExistingPr(deps, row, afterPush, true);
     }
-    if (afterPush.state === 'MERGED' && afterPush.includesExpectedSha === true) {
-        return settleObservedExistingPr(deps, row, afterPush);
+    const identityMatches = (0, pr_lifecycle_1.matchesRecordedPrIdentity)(afterPush, row.branch, row.base_branch);
+    if (afterPush.state === 'MERGED' && identityMatches && afterPush.includesExpectedSha === true) {
+        return settleMergedPr(deps, row);
     }
     if (afterPush.state === 'MERGED') {
-        return rerouteFromStalePr(deps, row, mergedEvidenceDetail(afterPush), true);
+        return rerouteFromStalePr(deps, row, identityMatches ? mergedEvidenceDetail(afterPush) : 'the previous PR merged after its recorded head/base identity changed', true);
     }
     if (afterPush.state === 'CLOSED') {
+        if (identityMatches && afterPush.includesExpectedSha === true) {
+            return settleObservedClosedPr(deps, row, afterPush);
+        }
         return rerouteFromStalePr(deps, row, 'the previous PR closed before this implementation was delivered', true);
     }
-    return persistMovedPrHead(deps, row, 'the existing PR no longer matches its recorded head/base after the exact push');
+    return rerouteFromStalePr(deps, row, 'the existing open PR no longer matches its recorded head/base identity after the exact push', true);
 }
 /**
  * Load the PR's ticket data (title/labels/description) from the ticket store,
@@ -504,11 +1226,19 @@ async function runCreatePr(deps, row) {
     // belongs to the same ticket.
     let effectiveBranches = snap.branches;
     let branchEvidenceCaptured = false;
+    const singleDeliverable = snap.branches.filter((unit) => unit.succeeded).length === 1;
+    const frozenSingleSha = singleDeliverable && row.delivery_sha && COMMIT_SHA_RE.test(row.delivery_sha) &&
+        await commitObjectExists(deps, row.delivery_sha)
+        ? row.delivery_sha
+        : null;
     for (let index = 0; index < snap.branches.length; index++) {
         const unit = snap.branches[index];
         if (!unit.succeeded)
             continue;
-        let sourceSha = unit.finalSha && COMMIT_SHA_RE.test(unit.finalSha) ? unit.finalSha : null;
+        // A detached/stale single-unit delivery already has authoritative immutable
+        // evidence. Prefer it over both legacy unit gaps and a branch ref that may
+        // have advanced while the card waited for the user's decision.
+        let sourceSha = frozenSingleSha ?? (unit.finalSha && COMMIT_SHA_RE.test(unit.finalSha) ? unit.finalSha : null);
         if (sourceSha) {
             if (!(await commitObjectExists(deps, sourceSha)))
                 sourceSha = null;
@@ -668,11 +1398,20 @@ async function runCreatePr(deps, row) {
     if ((next === 'pr_draft' || next === 'pr_ready') && patch.prUrl) {
         patch.cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
             db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: releasableWorktreeIds(deps, snap),
+            expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(effectiveBranches),
+            overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(effectiveBranches),
+            settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(effectiveBranches),
+            onSafetyArchive: safetyArchiveRecorder(deps, row),
         });
+        if (patch.cleanupWarnings.length > 0)
+            patch.statusCode = 'cleanup_incomplete';
     }
     const conflict = casTransition(deps, row, next, patch);
     if (conflict)
         return conflict;
+    if ((next === 'pr_draft' || next === 'pr_ready') && patch.prUrl) {
+        await releaseDeliveredRecoveryLineage(deps, row, patch.deliverySha ?? row.delivery_sha);
+    }
     const after = finalizeTransition(deps, row.id);
     // Tickets stay on_review — a draft PR is still awaiting the engineer's merge.
     return {
@@ -687,6 +1426,32 @@ async function runCreatePr(deps, row) {
     };
 }
 async function runPublish(deps, row) {
+    if (!row.delivery_sha || !row.branch) {
+        return persistMovedPrHead(deps, row, 'the draft PR has no immutable delivery SHA/head identity; refusing to mutate unverifiable review state');
+    }
+    const beforePublish = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!beforePublish.ok) {
+        return { status: 502, body: { error: 'gh_failed', detail: beforePublish.detail } };
+    }
+    if (!(0, pr_lifecycle_1.matchesRecordedPrIdentity)(beforePublish, row.branch, row.base_branch)) {
+        return rerouteFromStalePr(deps, row, `the recorded PR is ${beforePublish.state.toLowerCase()} but no longer matches its original head/base identity`, beforePublish.includesExpectedSha === true);
+    }
+    if (beforePublish.state === 'MERGED') {
+        return beforePublish.includesExpectedSha === true
+            ? settleMergedPr(deps, row)
+            : rerouteFromStalePr(deps, row, mergedEvidenceDetail(beforePublish), false);
+    }
+    if (beforePublish.state === 'CLOSED') {
+        return beforePublish.includesExpectedSha === true
+            ? settleObservedClosedPr(deps, row, beforePublish)
+            : rerouteFromStalePr(deps, row, 'the draft PR closed without the verified implementation commit', false);
+    }
+    if (beforePublish.includesExpectedSha !== true) {
+        return persistRetryablePrObservationFailure(deps, row, 'the draft PR no longer exposes the verified implementation commit; Retry push is available and will use the preserved exact SHA');
+    }
+    if (beforePublish.isDraft === false) {
+        return settleObservedExistingPr(deps, row, beforePublish, false);
+    }
     let r;
     try {
         r = await deps.exec.run('gh', ['pr', 'ready', row.pr_url], deps.project.path);
@@ -694,46 +1459,53 @@ async function runPublish(deps, row) {
     catch (err) {
         r = { code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) };
     }
-    if (r.code !== 0) {
-        // Crash/timeout ambiguity: `gh` may have made the PR ready before the local
-        // command reported failure. Adopt exact remote truth instead of retrying
-        // forever on "already ready".
-        const lifecycle = await observePrLifecycle(deps, row.pr_url);
-        if (lifecycle?.state === 'CLOSED') {
-            const conflict = casTransition(deps, row, 'pr_closed', {
-                deliveryOutcome: 'delivered', statusCode: 'pr_closed',
-            });
-            if (conflict)
-                return conflict;
-            finalizeTransition(deps, row.id);
-            return { status: 200, body: { ok: true, decision: 'pr_closed', closed: true, prUrl: row.pr_url } };
-        }
-        if (lifecycle?.state !== 'OPEN' || lifecycle.isDraft)
+    // `gh pr ready` is externally mutating and may return an ambiguous error.
+    // Re-observe exact remote truth in every case before changing the ledger.
+    const afterPublish = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!afterPublish.ok) {
+        if (r.code !== 0)
             return ghFailed(r);
+        return { status: 502, body: { error: 'gh_failed', detail: `PR readiness could not be verified: ${afterPublish.detail}` } };
     }
-    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
-        db: deps.db, git: deps.git, repoDir: deps.project.path, worktreeIds: releasableWorktreeIds(deps, snap),
-    });
-    const conflict = casTransition(deps, row, 'pr_ready', {
-        deliveryOutcome: 'delivered', statusCode: 'pr_ready', cleanupWarnings,
-    });
-    if (conflict)
-        return conflict;
-    finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: 'pr_ready', prUrl: row.pr_url } };
+    if (!(0, pr_lifecycle_1.matchesRecordedPrIdentity)(afterPublish, row.branch, row.base_branch)) {
+        return rerouteFromStalePr(deps, row, `the PR identity changed while publishing it for review (${afterPublish.state.toLowerCase()})`, afterPublish.includesExpectedSha === true);
+    }
+    if (afterPublish.state === 'MERGED') {
+        return afterPublish.includesExpectedSha === true
+            ? settleMergedPr(deps, row)
+            : rerouteFromStalePr(deps, row, mergedEvidenceDetail(afterPublish), false);
+    }
+    if (afterPublish.state === 'CLOSED') {
+        return afterPublish.includesExpectedSha === true
+            ? settleObservedClosedPr(deps, row, afterPublish)
+            : rerouteFromStalePr(deps, row, 'the PR closed without the verified implementation commit while being published', false);
+    }
+    if (afterPublish.includesExpectedSha !== true) {
+        return persistRetryablePrObservationFailure(deps, row, 'the PR no longer exposes the verified implementation commit after publishing; Retry push is available');
+    }
+    if (afterPublish.isDraft) {
+        if (r.code !== 0)
+            return ghFailed(r);
+        return { status: 502, body: { error: 'gh_failed', detail: 'PR remained a draft after publishing' } };
+    }
+    return settleObservedExistingPr(deps, row, afterPublish, false);
 }
 async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
     const implementationFailed = row.decision === 'implementation_failed';
-    const preserveBorrowedReview = row.is_continuation === 1;
+    // PR lifecycle ownership and head-ref ownership are separate. Startup repairs
+    // historical continuation rows before admission opens; only that durable bit
+    // borrows the PR/ticket lifecycle. Per-unit ownership below independently
+    // prevents deletion of borrowed/pre-existing head refs for fresh replacements.
+    const preserveExternalReview = row.is_continuation === 1;
     const cleanupWarnings = [];
     // A continuation borrows an existing PR/head. Discarding its local iteration
     // may remove Specrails' worktree, but never closes or deletes borrowed review
-    // state. Fresh deliveries retain the original destructive semantics.
-    if (row.pr_url && !implementationFailed && !preserveBorrowedReview) {
+    // state. A fresh PR is closed without GitHub's unleased --delete-branch: its
+    // remote head may have advanced since the card was rendered.
+    if (row.pr_url && !implementationFailed && !preserveExternalReview) {
         try {
-            const r = await deps.exec.run('gh', ['pr', 'close', row.pr_url, '--delete-branch'], deps.project.path);
+            const r = await deps.exec.run('gh', ['pr', 'close', row.pr_url], deps.project.path);
             if (r.code !== 0) {
                 const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
                 cleanupWarnings.push(`PR close ${row.pr_url}: ${detail}`);
@@ -745,59 +1517,83 @@ async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
             console.warn('[rail-pr-decision] gh pr close threw (continuing discard):', err);
         }
     }
-    // 2. Remove the launch's worktrees (still on disk unless a restart already
-    //    swept them) and close their ledger rows — the reconcile-style removal,
-    //    branch deletion deferred to step 3 (a checked-out branch can't be -D'd).
-    const deleteOwnedBranches = !implementationFailed && !preserveBorrowedReview;
-    const branchSet = deleteOwnedBranches ? ownedDeliveryBranches(row, snap, cleanupWarnings) : new Set();
-    for (const wtId of snap.worktreeIds) {
-        const wt = (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId);
-        if (!wt)
-            continue;
-        if (wt.merge_state === 'needs-review' && opts.removeNeedsReview !== true)
-            continue;
-        if (wt.merge_state !== 'needs-review' && (0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
-            continue;
-        try {
-            await (0, worktree_manager_1.removeWorktree)(deps.git, {
-                repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
-            });
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            cleanupWarnings.push(`worktree ${wt.worktree_path}: ${detail}`);
-            console.warn(`[rail-pr-decision] discard could not remove worktree ${wt.worktree_path}: ${detail}`);
-            continue;
-        }
-        if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
-            (0, rail_worktrees_store_1.updateRailWorktreeState)(deps.db, wt.id, 'failed');
+    // 2. Release only worktrees whose live tracked/untracked/ignored state and
+    //    exact HEAD/ref still match durable settlement evidence. Explicit
+    //    discard is not permission to contradict the confirmation copy by
+    //    force-removing subsequently changed local work. Authenticated overlays
+    //    take the same lossless quarantine path as automatic settlement.
+    const deleteOwnedBranches = !implementationFailed && !preserveExternalReview;
+    const skippedNeedsReview = opts.removeNeedsReview === true
+        ? []
+        : snap.worktreeIds
+            .map((wtId) => (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId))
+            .filter((wt) => wt?.merge_state === 'needs-review');
+    for (const worktree of skippedNeedsReview) {
+        cleanupWarnings.push(`worktree ${worktree.worktree_path}: preserved for inspection because it already requires review`);
     }
-    // 3. Delete only branches this delivery durably records as created: owned
-    //    per-unit sources and, for a multi-unit fresh delivery, its exact
-    //    assembled head. A preferred name is never recomputed here because it
-    //    may belong to the user. Missing branches are tolerated; the integration
-    //    branch is NEVER deleted.
+    const skippedIds = new Set(skippedNeedsReview.map((wt) => wt.id));
+    const worktreeIds = snap.worktreeIds.filter((wtId) => !skippedIds.has(wtId));
+    cleanupWarnings.push(...await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db,
+        git: deps.git,
+        repoDir: deps.project.path,
+        worktreeIds,
+        state: 'failed',
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
+    }));
+    const retainedWorktreeBranches = new Set(snap.worktreeIds
+        .map((wtId) => (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId))
+        .filter((wt) => Boolean(wt && (wt.merge_state === 'needs-review' || fs.existsSync(wt.worktree_path))))
+        .map((wt) => wt.branch));
+    // 3. Delete only branches this delivery durably records as created, and only
+    //    while their live tips still equal the immutable delivered commits.
+    //    Later user/collaborator commits are retained with a cleanup warning.
     if (deleteOwnedBranches) {
-        for (const branch of branchSet) {
-            if (!branch || branch === row.base_branch)
-                continue;
-            try {
-                const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
-                if (deleted.code !== 0) {
-                    cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
+        await deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings, retainedWorktreeBranches);
+    }
+    // Explicit Discard local result is also the only authority (besides proven
+    // delivery) to release a pinned orphan. A crash can occur after the atomic
+    // ref creation but before delivery_sha is written, so recover that ownership
+    // only from this delivery's exact durable final SHA or run-marker evidence.
+    if (opts.removeNeedsReview === true) {
+        let recoverySha = row.delivery_sha && COMMIT_SHA_RE.test(row.delivery_sha)
+            ? row.delivery_sha.toLowerCase()
+            : null;
+        if (!recoverySha && row.is_continuation === 1 &&
+            (row.status_code === 'settlement_interrupted' || row.status_code === 'recovery_unavailable')) {
+            const protection = await (0, rail_pr_recovery_git_1.inspectRecoveryCommitProtection)(deps.git, deps.project.path, row.id);
+            if (protection.kind === 'present') {
+                const durableFinalShas = [...new Set(snap.branches
+                        .map((unit) => unit.finalSha)
+                        .filter((sha) => typeof sha === 'string' && COMMIT_SHA_RE.test(sha))
+                        .map((sha) => sha.toLowerCase()))];
+                const runIds = [...new Set(snap.runIds.filter(Boolean))];
+                const exactDurableFinal = durableFinalShas.length === 1 && durableFinalShas[0] === protection.sha;
+                const exactRunMarker = runIds.length === 1 && await (0, rail_pr_recovery_git_1.commitCarriesRunMarker)(deps.git, deps.project.path, protection.sha, runIds[0]);
+                if (exactDurableFinal || exactRunMarker) {
+                    recoverySha = protection.sha;
+                }
+                else {
+                    cleanupWarnings.push(`recovery ref ${protection.ref}: preserved because its commit could not be proven to belong to this delivery`);
                 }
             }
-            catch (err) {
-                cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+            else if (protection.kind === 'unreadable') {
+                cleanupWarnings.push(`recovery ref ${protection.ref}: preserved because its exact commit could not be read safely`);
             }
         }
+        if (recoverySha && !await (0, rail_pr_recovery_git_1.releaseRecoveryCommit)(deps.git, deps.project.path, row.id, recoverySha)) {
+            cleanupWarnings.push('the delivery recovery ref changed or could not be removed; it was preserved for inspection');
+        }
     }
     const terminalPatch = {
         deliveryOutcome: 'not_started',
         statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'discarded',
         cleanupWarnings,
     };
-    const conflict = preserveBorrowedReview
+    const conflict = preserveExternalReview
         ? casTransition(deps, row, 'discarded', terminalPatch)
         : casTransitionWithTicketEffect(deps, row, 'discarded', terminalPatch, {
             deliveryId: row.id,
@@ -810,7 +1606,7 @@ async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
         });
     if (conflict)
         return conflict;
-    if (!preserveBorrowedReview)
+    if (!preserveExternalReview)
         applyTerminalTicketEffect(deps, row, 'discarded', cleanupWarnings);
     finalizeTransition(deps, row.id);
     return {
@@ -819,7 +1615,7 @@ async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
             ok: true,
             decision: 'discarded',
             ...(cleanupWarnings.length > 0 ? { cleanupWarnings } : {}),
-            ...(preserveBorrowedReview ? { preservedBorrowedReview: true } : {}),
+            ...(preserveExternalReview ? { preservedBorrowedReview: true, preservedExternalReview: true } : {}),
         },
     };
 }
@@ -835,6 +1631,10 @@ async function runAcknowledgeNoChanges(deps, row) {
         git: deps.git,
         repoDir: deps.project.path,
         worktreeIds: snap.worktreeIds,
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
     });
     // A fresh no-change branch is disposable only while Git still proves that it
     // has no commits ahead of the integration base. If the user added work after
@@ -882,21 +1682,90 @@ async function runAcknowledgeNoChanges(deps, row) {
         },
     };
 }
+async function settleMergedPr(deps, row) {
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db, git: deps.git, repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap), state: 'merged',
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
+    });
+    await deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings);
+    const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
+        deliveryOutcome: 'delivered',
+        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+        statusDetail: null,
+        cleanupWarnings,
+    }, {
+        deliveryId: row.id,
+        ticketIds: snap.ticketIds,
+        targetStatus: 'done',
+        jiraAction: 'merged',
+        prUrl: row.pr_url,
+    });
+    if (conflict)
+        return conflict;
+    await releaseDeliveredRecoveryLineage(deps, row, row.delivery_sha);
+    applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
+    finalizeTransition(deps, row.id);
+    return {
+        status: 200,
+        body: {
+            ok: true,
+            decision: 'merged',
+            merged: true,
+            prUrl: row.pr_url,
+            ...(row.delivery_sha ? {
+                deliveryVerified: true,
+                verifiedSha: row.delivery_sha,
+                pushed: false,
+            } : {}),
+        },
+    };
+}
 async function runPollMerge(deps, row) {
     const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
     if (!observed.ok)
         return { status: 502, body: { error: 'gh_failed', detail: observed.detail } };
     const { state, isDraft } = observed;
+    if (!row.branch) {
+        return persistMovedPrHead(deps, row, `the ${state.toLowerCase()} PR has no recorded delivery branch; refusing to infer recoverable work`);
+    }
+    if (!row.delivery_sha) {
+        // A legacy OPEN row cannot be retried without an immutable object. Once the
+        // attached PR is terminal, however, keeping that stale URL would strand the
+        // only recorded branch behind Discard. Detach it so Create PR can perform
+        // the existing one-time legacy ref capture, without claiming any delivery.
+        if (state === 'CLOSED' || state === 'MERGED') {
+            return rerouteFromStalePr(deps, row, `the previous PR is ${state.toLowerCase()} and this legacy delivery has no persisted verified SHA`, false);
+        }
+        return persistMovedPrHead(deps, row, 'the open PR has no persisted verified delivery SHA; refusing to infer delivery from a mutable branch');
+    }
+    if (!(0, pr_lifecycle_1.matchesRecordedPrIdentity)(observed, row.branch, row.base_branch)) {
+        return rerouteFromStalePr(deps, row, `the recorded PR is ${state.toLowerCase()} but no longer matches its original head/base identity`, observed.includesExpectedSha === true);
+    }
     if (state === 'CLOSED') {
-        const conflict = casTransition(deps, row, 'pr_closed', {
-            deliveryOutcome: 'delivered', statusCode: 'pr_closed',
-        });
-        if (conflict)
-            return conflict;
-        finalizeTransition(deps, row.id);
-        return { status: 200, body: { ok: true, decision: 'pr_closed', merged: false, closed: true, prUrl: row.pr_url } };
+        if (observed.includesExpectedSha !== true) {
+            return rerouteFromStalePr(deps, row, 'the previous PR closed without the verified implementation commit', false);
+        }
+        return settleObservedClosedPr(deps, row, observed);
     }
     if (state === 'OPEN') {
+        if (observed.includesExpectedSha !== true) {
+            const detail = 'the open PR no longer exposes the verified implementation commit; Retry push is available and will use the preserved exact SHA';
+            const result = persistRetryablePrObservationFailure(deps, row, detail);
+            return {
+                ...result,
+                body: {
+                    ...result.body,
+                    deliveryVerified: false,
+                    verifiedSha: row.delivery_sha,
+                    remoteHeadSha: observed.headRefOid,
+                },
+            };
+        }
         // A successful reopen can be observed even if the explicit action lost its
         // follow-up `gh view` response. Polling heals pr_closed from remote truth.
         if (row.decision === 'pr_closed') {
@@ -907,9 +1776,33 @@ async function runPollMerge(deps, row) {
             if (conflict)
                 return conflict;
             finalizeTransition(deps, row.id);
-            return { status: 200, body: { ok: true, decision: next, merged: false, reopened: true, prUrl: row.pr_url } };
+            return {
+                status: 200,
+                body: {
+                    ok: true,
+                    decision: next,
+                    merged: false,
+                    reopened: true,
+                    prUrl: row.pr_url,
+                    deliveryVerified: true,
+                    verifiedSha: row.delivery_sha,
+                    remoteHeadSha: observed.headRefOid,
+                    pushed: false,
+                },
+            };
         }
-        return { status: 200, body: { ok: true, decision: row.decision, merged: false } };
+        return {
+            status: 200,
+            body: {
+                ok: true,
+                decision: row.decision,
+                merged: false,
+                deliveryVerified: true,
+                verifiedSha: row.delivery_sha,
+                remoteHeadSha: observed.headRefOid,
+                pushed: false,
+            },
+        };
     }
     if (state !== 'MERGED') {
         return { status: 502, body: { error: 'gh_failed', detail: `unexpected PR state: ${state}` } };
@@ -917,49 +1810,43 @@ async function runPollMerge(deps, row) {
     // A PR can merge just before a continuation push; GitHub may then accept a
     // later update to the head branch even though that object was never part of
     // the merge. Never move tickets to Done from state=MERGED alone.
-    if (!row.delivery_sha) {
-        return persistMovedPrHead(deps, row, 'the merged PR has no persisted verified delivery SHA; refusing to infer delivery from a mutable branch');
-    }
     if (observed.includesExpectedSha !== true) {
-        return rerouteFromStalePr(deps, row, mergedEvidenceDetail(observed), true);
+        return rerouteFromStalePr(deps, row, mergedEvidenceDetail(observed), false);
     }
-    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
-    const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
-        db: deps.db, git: deps.git, repoDir: deps.project.path,
-        worktreeIds: releasableWorktreeIds(deps, snap), state: 'merged',
-    });
-    const branchSet = ownedDeliveryBranches(row, snap, cleanupWarnings);
-    for (const branch of branchSet) {
-        if (!branch || branch === row.base_branch)
-            continue;
-        try {
-            const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
-            if (deleted.code !== 0) {
-                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
-            }
-        }
-        catch (err) {
-            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
-        deliveryOutcome: 'delivered',
-        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
-        cleanupWarnings,
-    }, {
-        deliveryId: row.id,
-        ticketIds: snap.ticketIds,
-        targetStatus: 'done',
-        jiraAction: 'merged',
-        prUrl: row.pr_url,
-    });
-    if (conflict)
-        return conflict;
-    applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
-    finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: 'merged', merged: true, prUrl: row.pr_url } };
+    return settleMergedPr(deps, row);
 }
 async function runReopen(deps, row) {
+    if (!row.delivery_sha || !row.branch) {
+        return rerouteFromStalePr(deps, row, 'the closed PR cannot be reopened safely because its immutable delivery SHA/head identity is unavailable', false);
+    }
+    const beforeReopen = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!beforeReopen.ok) {
+        return { status: 502, body: { error: 'gh_failed', detail: beforeReopen.detail } };
+    }
+    if (!(0, pr_lifecycle_1.matchesRecordedPrIdentity)(beforeReopen, row.branch, row.base_branch) ||
+        beforeReopen.includesExpectedSha !== true) {
+        return rerouteFromStalePr(deps, row, 'the closed PR no longer proves the recorded head/base and verified implementation commit', false);
+    }
+    if (beforeReopen.state === 'MERGED')
+        return settleMergedPr(deps, row);
+    if (beforeReopen.state === 'OPEN') {
+        const next = beforeReopen.isDraft ? 'pr_draft' : 'pr_ready';
+        const conflict = casTransition(deps, row, next, {
+            deliveryOutcome: 'delivered', statusCode: beforeReopen.isDraft ? 'pr_draft_ready' : 'pr_ready',
+            statusDetail: null,
+        });
+        if (conflict)
+            return conflict;
+        finalizeTransition(deps, row.id);
+        return {
+            status: 200,
+            body: {
+                ok: true, decision: next, reopened: true, prUrl: row.pr_url,
+                deliveryVerified: true, verifiedSha: row.delivery_sha,
+                remoteHeadSha: beforeReopen.headRefOid, pushed: false,
+            },
+        };
+    }
     let reopened;
     try {
         reopened = await deps.exec.run('gh', ['pr', 'reopen', row.pr_url], deps.project.path);
@@ -967,20 +1854,45 @@ async function runReopen(deps, row) {
     catch (err) {
         reopened = { code: 1, stdout: '', stderr: err instanceof Error ? err.message : String(err) };
     }
-    const lifecycle = await observePrLifecycle(deps, row.pr_url);
-    if (lifecycle?.state !== 'OPEN') {
+    const observed = await (0, pr_lifecycle_1.observePrLifecycle)(deps.exec, deps.project.path, row.pr_url, row.delivery_sha);
+    if (!observed.ok) {
         if (reopened.code !== 0)
             return ghFailed(reopened);
-        return { status: 502, body: { error: 'gh_failed', detail: `PR did not reopen (state ${lifecycle?.state ?? 'unknown'})` } };
+        return { status: 502, body: { error: 'gh_failed', detail: observed.detail } };
+    }
+    const identityMatches = (0, pr_lifecycle_1.matchesRecordedPrIdentity)(observed, row.branch, row.base_branch);
+    if (observed.state === 'MERGED') {
+        if (identityMatches && observed.includesExpectedSha === true)
+            return settleMergedPr(deps, row);
+        return rerouteFromStalePr(deps, row, identityMatches ? mergedEvidenceDetail(observed) : 'the PR identity changed while it was being reopened', false);
+    }
+    if (observed.state === 'CLOSED') {
+        if (!identityMatches || observed.includesExpectedSha !== true) {
+            return rerouteFromStalePr(deps, row, 'the PR remained closed without proving the recorded head/base and verified implementation commit', false);
+        }
+        if (reopened.code !== 0)
+            return ghFailed(reopened);
+        return { status: 502, body: { error: 'gh_failed', detail: 'PR remained closed after reopen' } };
     }
-    const next = lifecycle.isDraft ? 'pr_draft' : 'pr_ready';
+    if (!identityMatches || observed.includesExpectedSha !== true) {
+        return rerouteFromStalePr(deps, row, 'the reopened PR no longer proves the recorded head/base and verified implementation commit', true);
+    }
+    const next = observed.isDraft ? 'pr_draft' : 'pr_ready';
     const conflict = casTransition(deps, row, next, {
-        deliveryOutcome: 'delivered', statusCode: lifecycle.isDraft ? 'pr_draft_ready' : 'pr_ready',
+        deliveryOutcome: 'delivered', statusCode: observed.isDraft ? 'pr_draft_ready' : 'pr_ready',
+        statusDetail: null,
     });
     if (conflict)
         return conflict;
     finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: next, reopened: true, prUrl: row.pr_url } };
+    return {
+        status: 200,
+        body: {
+            ok: true, decision: next, reopened: true, prUrl: row.pr_url,
+            deliveryVerified: true, verifiedSha: row.delivery_sha,
+            remoteHeadSha: observed.headRefOid, pushed: false,
+        },
+    };
 }
 async function runMergeLocal(deps, row) {
     return (0, repo_lock_1.withRepoLock)(deps.project.path, () => runMergeLocalLocked(deps, row));
@@ -1136,38 +2048,18 @@ async function runMergeLocalLocked(deps, row) {
     await removeAssembly();
     // Post-advance sweep: the work now lives on
     // the integration branch, so the launch's worktrees + branches are spent.
-    const branchSet = ownedDeliveryBranches(row, snap, cleanupWarnings);
-    for (const wtId of releasableWorktreeIds(deps, snap)) {
-        const wt = (0, rail_worktrees_store_1.getRailWorktree)(deps.db, wtId);
-        if (!wt)
-            continue;
-        try {
-            await (0, worktree_manager_1.removeWorktree)(deps.git, {
-                repoDir: deps.project.path, worktreePath: wt.worktree_path, branch: wt.branch, deleteBranch: false,
-            });
-        }
-        catch (err) {
-            const detail = err instanceof Error ? err.message : String(err);
-            cleanupWarnings.push(`worktree ${wt.worktree_path}: ${detail}`);
-            console.warn(`[rail-pr-decision] merge-local could not remove worktree ${wt.worktree_path}: ${detail}`);
-            continue;
-        }
-        if (!(0, rail_worktrees_store_1.isTerminalMergeState)(wt.merge_state))
-            (0, rail_worktrees_store_1.updateRailWorktreeState)(deps.db, wt.id, 'merged');
-    }
-    for (const branch of branchSet) {
-        if (!branch || branch === row.base_branch)
-            continue;
-        try {
-            const deleted = await deps.git.run(['branch', '-D', branch], deps.project.path);
-            if (deleted.code !== 0) {
-                cleanupWarnings.push(`branch ${branch}: ${(deleted.stderr.trim() || deleted.stdout.trim()).split('\n')[0] || `exit ${deleted.code}`}`);
-            }
-        }
-        catch (err) {
-            cleanupWarnings.push(`branch ${branch}: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
+    cleanupWarnings.push(...await (0, rail_worktree_release_1.releaseRailWorktrees)({
+        db: deps.db,
+        git: deps.git,
+        repoDir: deps.project.path,
+        worktreeIds: releasableWorktreeIds(deps, snap),
+        state: 'merged',
+        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+        onSafetyArchive: safetyArchiveRecorder(deps, row),
+    }));
+    await deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings);
     const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
         deliveryOutcome: 'delivered',
         statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',