specrails-desktop 2.34.0 → 2.35.0

package/server/dist/providers/claude-adapter.js

@@ -12,6 +12,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.claudeAdapter = void 0;
 exports._normaliseClaudeModel = normaliseModel;
+exports._resolveClaudeSpawnModel = resolveSpawnModel;
 const child_process_1 = require("child_process");
 const path_1 = __importDefault(require("path"));
 const WHICH_CMD = process.platform === 'win32' ? 'where' : 'which';
@@ -33,6 +34,7 @@ function normaliseModel(model) {
             return 'sonnet';
         case 'claude-fable-5':
             return 'fable';
+        case 'claude-opus-5':
         case 'claude-opus-4-8':
         case 'claude-opus-4-5':
         case 'claude-opus-4-1-20250805':
@@ -46,6 +48,24 @@ function normaliseModel(model) {
             return model || 'sonnet';
     }
 }
+/**
+ * Catalog aliases whose GENERATION Specrails pins explicitly.
+ *
+ * The catalog value (`opus`) stays the stored, validated and displayed identity
+ * — profiles, project settings, conversation rows and analytics all keep using
+ * it, and `normaliseModel` collapses the pinned id back to it. Only the spawn
+ * argument is expanded, so picking "Claude Opus" is a product decision about
+ * WHICH Opus runs instead of delegating that to whatever generation the CLI's
+ * bare `opus` alias currently points at.
+ */
+const PINNED_ALIAS_MODEL_IDS = {
+    opus: 'claude-opus-5',
+};
+/** Catalog value (or concrete id) in, spawn model id out. */
+function resolveSpawnModel(model) {
+    const alias = normaliseModel(model);
+    return PINNED_ALIAS_MODEL_IDS[alias] ?? alias;
+}
 /**
  * Common flags + the effective tool boundary for this spawn.
  *
@@ -95,7 +115,7 @@ function commonFlagsFor(opts) {
 }
 function buildClaudeArgs(action, opts) {
     const args = [];
-    const model = normaliseModel(opts.model);
+    const model = resolveSpawnModel(opts.model);
     // Titles are unconditionally pure-output. Centralising the policy here keeps
     // both ChatManager and AgentChatManager from accidentally regaining tools.
     const commonFlags = commonFlagsFor(action === 'auto-title' ? { ...opts, toolPolicy: 'none' } : opts);
@@ -272,14 +292,51 @@ function parseClaudeStreamLine(line) {
         const tool = blocks.find((b) => b.type === 'tool_use');
         if (tool?.name) {
             const input = JSON.stringify(parsed.message?.content?.[0]?.input ?? {});
-            return withAssistantUsage({ kind: 'tool-use', name: tool.name, inputPreview: input.slice(0, 200) }, msg);
+            return withAssistantUsage({
+                kind: 'tool-use',
+                name: tool.name,
+                inputPreview: input.slice(0, 200),
+                ...(typeof tool.id === 'string'
+                    ? { toolUseId: tool.id }
+                    : {}),
+            }, msg);
         }
         return withAssistantUsage({ kind: 'other', type, raw: parsed }, msg);
     }
     if (type === 'tool_use') {
         const name = parsed.name ?? '<unnamed>';
         const input = JSON.stringify(parsed.input ?? {});
-        return { kind: 'tool-use', name, inputPreview: input.slice(0, 200) };
+        return {
+            kind: 'tool-use',
+            name,
+            inputPreview: input.slice(0, 200),
+            ...(typeof parsed.id === 'string' ? { toolUseId: parsed.id } : {}),
+        };
+    }
+    // `user`-role frames carry tool RESULTS back to the model. Surface a bounded
+    // text projection so activity surfaces (agent chat's execution log) can show
+    // what a tool returned; frames without a tool_result block stay 'other'.
+    if (type === 'user') {
+        const msg = parsed.message;
+        const blocks = Array.isArray(msg?.content) ? msg.content : [];
+        const resultBlock = blocks.find((b) => b.type === 'tool_result');
+        if (resultBlock) {
+            const content = resultBlock.content;
+            const text = typeof content === 'string'
+                ? content
+                : Array.isArray(content)
+                    ? content
+                        .filter((c) => c.type === 'text' && typeof c.text === 'string')
+                        .map((c) => c.text)
+                        .join('\n')
+                    : '';
+            return {
+                kind: 'tool-result',
+                outputPreview: text.slice(0, 600),
+                ...(typeof resultBlock.tool_use_id === 'string' ? { toolUseId: resultBlock.tool_use_id } : {}),
+                ...(resultBlock.is_error === true ? { isError: true } : {}),
+            };
+        }
     }
     return { kind: 'other', type, raw: parsed };
 }

package/server/dist/queue-manager.js

@@ -26,6 +26,7 @@ const result_event_1 = require("./result-event");
 const crypto_1 = require("crypto");
 const providers_1 = require("./providers");
 const runtime_1 = require("./providers/runtime");
+const agent_defaults_1 = require("./agent-defaults");
 const codex_otel_bridge_1 = require("./codex-otel-bridge");
 const db_1 = require("./db");
 const interactive_job_session_1 = require("./interactive-job-session");
@@ -250,6 +251,7 @@ class QueueManager {
      *  For codex it controls the catalog model used at spawn time and as the
      *  fallback model name stamped onto the ai_invocations row. */
     _resolvedModel;
+    _agentDefaults;
     _onJobFinished;
     /** Project-owned durable effects that are part of every queue admission
      *  (for example, recovery/rail ownership). Invoked after queued_jobs has
@@ -356,6 +358,7 @@ class QueueManager {
         this._getDesktopDailyBudget = options?.getDesktopDailyBudget ?? null;
         this._adapter = (0, providers_1.getAdapter)(options?.provider ?? 'claude');
         this._resolvedModel = options?.resolvedModel ?? null;
+        this._agentDefaults = options?.agentDefaults ?? null;
         this._onJobFinished = options?.onJobFinished ?? null;
         this._onJobAdmission = options?.onJobAdmission ?? null;
         this._onBudgetExceeded = options?.onBudgetExceeded ?? null;
@@ -2272,9 +2275,22 @@ class QueueManager {
         // Per-job model override (consumed once) takes precedence — used by the
         // freestyle model picker so the user can choose haiku/sonnet/opus per launch.
         const modelOverride = this._jobModelSelection.get(jobId);
-        const fallbackRailModel = adapter.id === 'claude' && this._db
-            ? (0, db_1.getProjectSettings)(this._db).orchestratorModel
-            : (this._resolvedModel ?? adapter.defaultModel());
+        // Global Specrails Agents defaults (app Settings ▸ Specrails Agents) —
+        // read AT SPAWN TIME (no restart) and layered BELOW every project-level
+        // choice, ABOVE the built-in adapter default.
+        let globalAgentDefaults = null;
+        try {
+            globalAgentDefaults = this._agentDefaults?.(adapter.id) ?? null;
+        }
+        catch {
+            globalAgentDefaults = null;
+        }
+        const claudeProjectSettings = adapter.id === 'claude' && this._db ? (0, db_1.getProjectSettings)(this._db) : null;
+        const fallbackRailModel = claudeProjectSettings
+            ? (claudeProjectSettings.orchestratorModelExplicit
+                ? claudeProjectSettings.orchestratorModel
+                : globalAgentDefaults?.pipelineModel ?? claudeProjectSettings.orchestratorModel)
+            : (this._resolvedModel ?? globalAgentDefaults?.pipelineModel ?? adapter.defaultModel());
         // Relocate-artifacts: when relocated, claude is spawned from the workspace
         // so add `--add-dir <repoDir>` so its tools can still reach repo files by
         // absolute path. (gemini/codex get env-only tweaks at spawn time below.)
@@ -2301,7 +2317,24 @@ class QueueManager {
                 if (selection !== null && coreSupports) {
                     // selection is string (explicit) or undefined (default resolution)
                     const { resolveProfile, snapshotForJob, persistJobProfile, } = require('./profile-manager');
-                    const resolved = resolveProfile(execution.cwd, selection ?? undefined, adapter.id);
+                    let resolved = resolveProfile(execution.cwd, selection ?? undefined, adapter.id);
+                    // Global agent defaults: fill per-agent model gaps in the resolved
+                    // profile, or synthesize a baseline profile when the project has
+                    // none. Explicit profile choices always win; inert when the global
+                    // layer is off (byte-identical legacy behaviour).
+                    if (globalAgentDefaults && adapter.capabilities.profiles === true) {
+                        if (resolved) {
+                            const merged = (0, agent_defaults_1.mergeProfileWithAgentDefaults)(resolved.profile, globalAgentDefaults);
+                            if (merged.changed)
+                                resolved = { name: resolved.name, profile: merged.profile };
+                        }
+                        else if (Object.keys(globalAgentDefaults.agentModels).length > 0) {
+                            resolved = {
+                                name: agent_defaults_1.GLOBAL_DEFAULTS_PROFILE_NAME,
+                                profile: (0, agent_defaults_1.synthesizeProfileFromDefaults)(adapter, globalAgentDefaults),
+                            };
+                        }
+                    }
                     if (resolved) {
                         profileSnapshotPath = snapshotForJob(this._projectSlug, jobId, resolved);
                         profileName = resolved.name;
@@ -2322,10 +2355,19 @@ class QueueManager {
         // explicit per-job override > resolved profile orchestrator > project/default.
         // resolveProfile validates the profile model against this adapter's catalog.
         const railModel = modelOverride ?? profileOrchestratorModel ?? fallbackRailModel;
+        // Pipeline-level reasoning effort from the global layer (rails never had a
+        // per-job effort knob, so this is purely additive). Validated against the
+        // FINAL model — claude/codex sub-agents inherit the process-level effort,
+        // kimi rides its env knob via buildProviderEnv, gemini has no effort.
+        const globalRailEffort = globalAgentDefaults?.pipelineEffort
+            && (0, runtime_1.isReasoningEffortValidForModel)(adapter, railModel, globalAgentDefaults.pipelineEffort)
+            ? globalAgentDefaults.pipelineEffort
+            : undefined;
         const railSpawnOptions = {
             prompt: railPrompt,
             systemPrompt: systemAppend || undefined,
             model: railModel,
+            ...(globalRailEffort ? { reasoning_effort: globalRailEffort } : {}),
             extraArgs: railExtraArgs.length > 0 ? railExtraArgs : undefined,
         };
         const args = adapter.buildArgs('rail-job', railSpawnOptions);
@@ -2544,6 +2586,7 @@ class QueueManager {
                 // spawn and APPEND on top of the CLI default instead of replacing it.
                 systemPrompt: isFreestyle ? (systemAppend || undefined) : undefined,
                 model: railModel,
+                ...(globalRailEffort ? { reasoning_effort: globalRailEffort } : {}),
                 extraArgs: !isFreestyle && systemAppend
                     ? ['--append-system-prompt', systemAppend, ...(railExtraArgs ?? [])]
                     : (railExtraArgs.length > 0 ? railExtraArgs : undefined),

package/server/dist/rail-isolated-launch.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrContinuationIsolationError = void 0;
+exports.buildSpecSnapshot = buildSpecSnapshot;
 exports.launchIsolatedRail = launchIsolatedRail;
 exports.reconcileRailWorktrees = reconcileRailWorktrees;
 /**
@@ -70,6 +71,7 @@ const rail_worktrees_store_1 = require("./rail-worktrees-store");
 const pr_naming_1 = require("./pr-naming");
 const jira_db_1 = require("./jira/jira-db");
 const db_1 = require("./db");
+const delivery_evidence_1 = require("./delivery-evidence");
 const integration_branch_1 = require("./integration-branch");
 const repo_lock_1 = require("./repo-lock");
 const rail_isolation_1 = require("./rail-isolation");
@@ -79,6 +81,7 @@ const rail_merge_orchestrator_1 = require("./rail-merge-orchestrator");
 const loop_executors_1 = require("./loop-executors");
 const worktree_overlay_1 = require("./worktree-overlay");
 const worktree_node_modules_1 = require("./worktree-node-modules");
+const revision_seed_1 = require("./revision-seed");
 const workspace_resolution_1 = require("./workspace-resolution");
 const feature_flags_1 = require("./feature-flags");
 const file_provenance_1 = require("./file-provenance");
@@ -125,6 +128,66 @@ function unitNamingInput(ctx, ticketId) {
     }
     return { ticketId, title: spec?.title ?? null, labels: spec?.labels ?? null, jiraKey };
 }
+/**
+ * Assemble the revision briefing from the generation being revised. Reads only
+ * durable rows, tolerates every one of them being absent (a legacy row carries
+ * no snapshot or evidence), and never throws — a thinner briefing is far better
+ * than a failed revision launch.
+ */
+function buildRevisionSeedForLaunch(db, revision, ticketIds) {
+    try {
+        const previous = (0, rail_pr_store_1.getPrDelivery)(db, revision.ofDeliveryId);
+        const branches = previous
+            ? [...new Set(JSON.parse(previous.branches || '[]').map((b) => b.branch).filter(Boolean))]
+            : [];
+        // Revision depth walks the supersession chain, bounded so a corrupted
+        // lineage can never spin here.
+        let depth = 1;
+        let cursor = previous;
+        for (let hops = 0; hops < 20 && cursor?.revision_of; hops++) {
+            depth += 1;
+            cursor = (0, rail_pr_store_1.getPrDelivery)(db, cursor.revision_of) ?? undefined;
+        }
+        return (0, revision_seed_1.buildRevisionSeed)({
+            note: revision.note,
+            specSnapshot: previous ? (0, rail_pr_store_1.readSpecSnapshot)(previous.spec_snapshot) : null,
+            ticketIds: [...ticketIds],
+            branches,
+            baseBranch: previous?.base_branch ?? 'the integration branch',
+            branchDiffSummary: null,
+            evidence: previous ? (0, delivery_evidence_1.readSettleEvidence)(previous.settle_evidence) : null,
+            revisionNumber: depth,
+        });
+    }
+    catch {
+        // Absolute floor: the user's instruction still reaches the run.
+        return revision.note;
+    }
+}
+/**
+ * Launch-time freeze of every covered ticket for the delivery row's
+ * spec_snapshot column (migration 56). The review packet's "what you asked"
+ * section renders this snapshot, never the live store — a spec edited mid-run
+ * must not rewrite what the delivery was asked to do. Failure-tolerant: an
+ * unreadable ticket degrades to a bare-id entry.
+ */
+function buildSpecSnapshot(ctx, ticketIds) {
+    return ticketIds.map((ticketId) => {
+        let spec;
+        try {
+            spec = ctx.getTicketSpec(ticketId);
+        }
+        catch {
+            /* tolerated — snapshot stays bare */
+        }
+        return {
+            ticketId,
+            title: spec?.title ?? null,
+            description: spec?.description ?? null,
+            labels: Array.isArray(spec?.labels) ? spec.labels : [],
+        };
+    });
+}
 /**
  * Commit messages are consumed by GitHub↔Jira development panels. Branch names
  * already carry the Jira key for new work; commits must too, especially when
@@ -301,7 +364,7 @@ function branchRecords(results) {
         branchOwnership: result.run.branchOwnership,
         worktreePath: result.run.handle.worktreePath,
         overlayExcludes: result.run.overlayExcludes,
-        overlayCleanupEvidence: result.run.overlayCleanupEvidence,
+        overlayCleanupEvidence: [...result.run.overlayCleanupEvidence, ...result.run.warmLinkEvidence],
         settlementIgnoredPaths: result.run.settlementIgnoredPaths ?? null,
     })));
 }
@@ -323,7 +386,18 @@ async function launchIsolatedRail(input, io = {}) {
     const baseRepo = ctx.project.path;
     const slug = ctx.project.slug;
     const worktreesRoot = path.join((0, artifact_registry_1.resolveHome)(), '.specrails', 'projects', slug, 'worktrees');
-    const constants = (0, loop_constants_1.loadConstantMap)(ctx.desktopDb);
+    // A revision run is seeded with a full briefing (the instruction PLUS the
+    // frozen spec, the branch that carries the work and what the previous run
+    // actually reported) rather than the bare sentence — the run starts a FRESH
+    // provider session by contract, so durable context is the only thing it has.
+    // Per-RUN data, so it is layered over the project's constant map for this
+    // launch only and never persisted as a constant.
+    const constants = input.revision
+        ? {
+            ...(0, loop_constants_1.loadConstantMap)(ctx.desktopDb),
+            REVISION_REQUEST: buildRevisionSeedForLaunch(ctx.db, input.revision, ticketIds),
+        }
+        : (0, loop_constants_1.loadConstantMap)(ctx.desktopDb);
     // Capture the PR-delivery mode ONCE at launch entry so a mid-flight env flip
     // can never split one launch across the two delivery paths.
     const prMode = (0, rail_isolation_1.isRailPrDeliveryEnabled)();
@@ -582,9 +656,16 @@ async function launchIsolatedRail(input, io = {}) {
                     supersedesDeliveryId: launchContinuation?.source === 'rail-pr-delivery'
                         ? launchContinuation.deliveryId
                         : null,
+                    specSnapshot: buildSpecSnapshot(ctx, ticketIds),
+                    ...(input.revision ? { revisionNote: input.revision.note, revisionOf: input.revision.ofDeliveryId } : {}),
                 }, input.requiredPrContinuation
                     ? { id: input.requiredPrContinuation.deliveryId, decision: input.requiredPrContinuation.decision }
-                    : null);
+                    // A revision replaces the generation it revises, atomically, so the rail
+                    // never shows two active deliveries and a failed revision restores the
+                    // predecessor through the shipped rollback path.
+                    : input.revision
+                        ? { id: input.revision.ofDeliveryId, decision: input.revision.decision }
+                        : null);
                 prDeliveryId = generation.delivery.id;
                 supersededDelivery = generation.superseded;
                 input.onPrDeliveryCreated?.(prDeliveryId);
@@ -695,10 +776,17 @@ async function launchIsolatedRail(input, io = {}) {
                         // into the fresh worktree (best-effort; a failure just leaves the run
                         // on the legacy cold start). Linked paths join the overlay exclusion
                         // list so they inherit the commit-time guarantees.
+                        let warmLinkEvidence = [];
                         try {
                             const nm = (io.linkNodeModules ?? worktree_node_modules_1.linkNodeModulesIntoWorktree)(baseRepo, handle.worktreePath);
-                            if (nm.linked.length > 0)
-                                overlayExcludes = overlayExcludes.concat(nm.linked);
+                            // `authenticated` (not `linked`) is the authorized set: it also covers
+                            // links a previous pass created, which a resumed launch would
+                            // otherwise leave both un-excluded from the commit and unauthorized
+                            // for release.
+                            const authorized = nm.authenticated ?? nm.linked ?? [];
+                            if (authorized.length > 0)
+                                overlayExcludes = overlayExcludes.concat(authorized);
+                            warmLinkEvidence = nm.evidence ?? [];
                             if (nm.warnings.length > 0)
                                 notifyOverlayDegraded(unit.ticketId, nm.warnings);
                         }
@@ -732,6 +820,7 @@ async function launchIsolatedRail(input, io = {}) {
                             handle,
                             overlayExcludes,
                             overlayCleanupEvidence,
+                            warmLinkEvidence,
                             provenanceSnapshot,
                             continuationTarget,
                             baseRef: continuationTarget?.baseRef ?? worktreeBaseRef.baseRef,
@@ -876,6 +965,13 @@ async function launchIsolatedRail(input, io = {}) {
                 instructionsFilename: overlayInstructions,
             }, a.overlayCleanupEvidence);
         }
+        // Warm-dependency links are re-proven against the base repo (their source),
+        // not the framework overlay source. A link the engine replaced with a real
+        // install loses its authorization here and correctly preserves the worktree.
+        if (a.warmLinkEvidence.length > 0) {
+            a.warmLinkEvidence = (0, worktree_node_modules_1.authenticateWarmNodeModulesLinks)(baseRepo, a.handle.worktreePath)
+                .filter((live) => a.warmLinkEvidence.some((prior) => prior.path === live.path && prior.kind === live.kind && prior.digest === live.digest));
+        }
         let commit;
         try {
             commit = await (0, worktree_manager_1.commitWorktreeAndVerify)(git, a.handle.worktreePath, worktreeCommitMessage(ctx, a.ticketId, a.runId, implementationOutcome === 'failed'), a.overlayExcludes);
@@ -1347,7 +1443,25 @@ async function launchIsolatedRail(input, io = {}) {
             const expectedHeadByBranch = (0, rail_worktree_release_1.durableBranchHeads)(settledBranchRecords);
             const overlayEvidenceByBranch = (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(settledBranchRecords);
             const settlementIgnoredByBranch = (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(settledBranchRecords);
+            // Review-packet evidence harvest (deterministic, no model calls) — MUST
+            // run while the reviewable worktrees are still mounted, i.e. before the
+            // releaseRailWorktrees calls below. harvestDeliveryEvidence never throws
+            // by contract; the belt-and-braces catch keeps settle unconditional.
+            const harvest = io.harvestEvidence ?? delivery_evidence_1.harvestDeliveryEvidence;
+            let settleEvidence;
+            try {
+                settleEvidence = harvest({ readEvents: (runId) => (0, db_1.getJobEvents)(ctx.db, runId) }, results.map((result) => ({
+                    ticketId: result.run.ticketId,
+                    runId: result.run.runId,
+                    worktreePath: result.run.handle.worktreePath,
+                })));
+            }
+            catch (e) {
+                console.warn(`[rail-isolated] evidence harvest failed: ${e instanceof Error ? e.message : String(e)}`);
+                settleEvidence = undefined;
+            }
             const patch = {
+                settleEvidence,
                 branches: settledBranchRecords,
                 worktreeIds,
                 implementationOutcome,

package/server/dist/rail-pr-store.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PrDeliveryGenerationConflict = exports.ACTIVE_PR_DECISIONS = exports.TERMINAL_PR_DECISIONS = void 0;
+exports.PrDeliveryGenerationConflict = exports.ACTIVE_PR_DECISIONS = exports.TERMINAL_PR_DECISIONS = exports.REVISION_NOTE_CAP = void 0;
+exports.boundSpecSnapshot = boundSpecSnapshot;
+exports.boundRevisionNote = boundRevisionNote;
+exports.readSpecSnapshot = readSpecSnapshot;
 exports.isTerminalPrDecision = isTerminalPrDecision;
 exports.createPrDelivery = createPrDelivery;
 exports.createPrDeliveryGeneration = createPrDeliveryGeneration;
@@ -26,6 +29,34 @@ exports.toPrDeliverySnapshot = toPrDeliverySnapshot;
 exports.toRailPrStateMessage = toRailPrStateMessage;
 exports.toPrDecisionCardEnvelope = toPrDecisionCardEnvelope;
 const ids_1 = require("./ids");
+/** Defensive per-ticket cap; contract-layer specs run long but bounded. */
+const SPEC_SNAPSHOT_DESCRIPTION_CAP = 32_768;
+function boundSpecSnapshot(entries) {
+    return entries.map((entry) => ({
+        ticketId: entry.ticketId,
+        title: entry.title,
+        description: entry.description == null ? null : entry.description.slice(0, SPEC_SNAPSHOT_DESCRIPTION_CAP),
+        labels: entry.labels.slice(0, 32),
+    }));
+}
+/** A revision instruction is one sentence of intent, not a document. Bound it so
+ *  a pasted essay cannot bloat every snapshot that carries the row. */
+exports.REVISION_NOTE_CAP = 2000;
+function boundRevisionNote(note) {
+    return note.replace(/[\r\n\t\0]+/g, ' ').replace(/\s{2,}/g, ' ').trim().slice(0, exports.REVISION_NOTE_CAP);
+}
+/** Parse a persisted spec_snapshot column value (null-tolerant). */
+function readSpecSnapshot(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed) ? parsed : null;
+    }
+    catch {
+        return null;
+    }
+}
 /** States after which the delivery is closed (no further decision possible). */
 exports.TERMINAL_PR_DECISIONS = new Set(['completed', 'merged', 'discarded', 'superseded']);
 /** States in which the delivery still awaits (or is executing) a user decision. */
@@ -53,9 +84,12 @@ function createPrDelivery(db, input) {
        id, rail_index, loop_id, rail_key, ticket_ids, base_branch,
        loop_name, origin_surface, origin_conversation_id,
        implementation_outcome, delivery_outcome, status_code,
-       is_continuation, supersedes_delivery_id
+       is_continuation, supersedes_delivery_id, spec_snapshot,
+       revision_note, revision_of
      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'running', 'pending',
-       'implementation_running', ?, ?)`).run(id, input.railIndex, input.loopId ?? null, input.railKey, JSON.stringify(input.ticketIds), input.baseBranch, input.loopName, input.originSurface, input.originConversationId ?? null, input.isContinuation ? 1 : 0, input.supersedesDeliveryId ?? null);
+       'implementation_running', ?, ?, ?, ?, ?)`).run(id, input.railIndex, input.loopId ?? null, input.railKey, JSON.stringify(input.ticketIds), input.baseBranch, input.loopName, input.originSurface, input.originConversationId ?? null, input.isContinuation ? 1 : 0, input.supersedesDeliveryId ?? null, input.specSnapshot && input.specSnapshot.length > 0
+        ? JSON.stringify(boundSpecSnapshot(input.specSnapshot))
+        : null, input.revisionNote ? boundRevisionNote(input.revisionNote) : null, input.revisionOf ?? null);
     return getPrDelivery(db, id);
 }
 class PrDeliveryGenerationConflict extends Error {
@@ -345,6 +379,7 @@ const PATCH_COLUMNS = {
     operationStartedAtMs: 'operation_started_at_ms',
     cleanupWarnings: 'cleanup_warnings',
     safetyArchives: 'safety_archives',
+    settleEvidence: 'settle_evidence',
 };
 function patchValue(key, patch) {
     const raw = patch[key];
@@ -358,6 +393,8 @@ function patchValue(key, patch) {
         return raw == null ? null : boundPrDiagnostic(String(raw));
     if (key === 'isContinuation')
         return raw ? 1 : 0;
+    if (key === 'settleEvidence')
+        return raw == null ? null : JSON.stringify(raw);
     return raw;
 }
 /** Bounded, single-line diagnostics are safe to persist/broadcast as secondary

package/server/dist/rail-worktree-release.js

@@ -42,6 +42,7 @@ const worktree_manager_1 = require("./worktree-manager");
 const path = __importStar(require("path"));
 const fs = __importStar(require("fs"));
 const worktree_overlay_1 = require("./worktree-overlay");
+const worktree_node_modules_1 = require("./worktree-node-modules");
 const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
 /** Collapse per-unit settlement evidence into one unambiguous immutable HEAD per
  * branch. Conflicting or malformed records intentionally yield no authorization. */
@@ -157,8 +158,23 @@ async function verifyReleaseEvidence(input, worktree) {
     if (!expected || !COMMIT_SHA_RE.test(expected)) {
         return { failure: 'no durable settled HEAD is recorded for its branch', overlayEntries: [] };
     }
-    const overlayEntries = (input.overlayEvidenceByBranch.get(worktree.branch) ?? [])
+    const persistedEntries = (input.overlayEvidenceByBranch.get(worktree.branch) ?? [])
         .filter((entry) => (0, worktree_overlay_1.matchesOverlayCleanupEvidence)(worktree.worktree_path, entry));
+    // Warm-dependency links are authenticated LIVE against the base repo, on top
+    // of whatever was persisted. Two reasons this is derived and not persisted-
+    // only: a repo's ordinary `node_modules/` DIRECTORY ignore pattern does not
+    // ignore a SYMLINK of that name, so the link reads as untracked dirt and
+    // permanently blocked release (and therefore branch checkout); and worktrees
+    // that settled before the links carried evidence are stuck at `needs-review`
+    // where no persisted fix could ever reach them. The proof is identical to the
+    // persisted one — a symlink resolving to the base checkout's identically-
+    // named dependency directory — so nothing weaker is being accepted here.
+    const warmEntries = (input.authenticateWarmLinks ?? worktree_node_modules_1.authenticateWarmNodeModulesLinks)(input.repoDir, worktree.worktree_path);
+    const seenPaths = new Set(persistedEntries.map((entry) => entry.path));
+    const overlayEntries = [
+        ...persistedEntries,
+        ...warmEntries.filter((entry) => !seenPaths.has(entry.path)),
+    ];
     const overlayExcludes = overlayEntries.map((entry) => entry.path);
     try {
         const status = await input.git.run([