specrails-desktop 2.36.0 → 2.42.2

package/server/dist/rail-pr-decision.js

@@ -35,7 +35,9 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.PR_DECISION_ACTIONS = void 0;
 exports.isPrDecisionAction = isPrDecisionAction;
+exports.actionAllowed = actionAllowed;
 exports.executePrDecision = executePrDecision;
+exports.sweepMergedChainAncestors = sweepMergedChainAncestors;
 /**
  * Execute a user's ask-first PR decision (safe-pr-review-flow) against its
  * authoritative `rail_pr_deliveries` row: the actions both decision
@@ -52,9 +54,9 @@ exports.executePrDecision = executePrDecision;
  *                the on_review tickets to todo.
  *   poll-merge → `gh pr view` — MERGED promotes the tickets to done.
  *   merge-local→ the REMOTE-LESS acceptance path: merge the delivered branches
- *                into the integration branch directly in the user's checkout
- *                (guarded: correct branch checked out + clean tree, abort on
- *                conflict). Without it, a repo with no GitHub remote wedges
+ *                into the integration branch after isolated assembly. Compatible
+ *                local changes survive; another current branch stays untouched.
+ *                Without it, a repo with no GitHub remote wedges
  *                forever in retry(local-only)/discard — no way to ACCEPT work.
  *
  * Every mutation rides a lease-owned compare-and-set (a raced concurrent
@@ -82,9 +84,12 @@ const workspace_resolution_1 = require("./workspace-resolution");
 const agent_chat_registry_1 = require("./agent-chat-registry");
 const ids_1 = require("./ids");
 const repo_lock_1 = require("./repo-lock");
+const integration_branch_1 = require("./integration-branch");
 const rail_pr_ticket_effects_1 = require("./rail-pr-ticket-effects");
 const pr_lifecycle_1 = require("./pr-lifecycle");
 const rail_pr_recovery_git_1 = require("./rail-pr-recovery-git");
+const milestone_chain_store_1 = require("./milestone-chain-store");
+const rail_pr_store_2 = require("./rail-pr-store");
 exports.PR_DECISION_ACTIONS = ['create-pr', 'publish', 'discard', 'dismiss', 'poll-merge', 'reopen', 'merge-local', 'acknowledge-no-changes', 'recover-and-retry'];
 function safetyArchiveRecorder(deps, row) {
     return (archive) => {
@@ -155,6 +160,12 @@ async function executePrDecision(deps, input) {
     const row = (0, rail_pr_store_1.getPrDelivery)(deps.db, input.prDeliveryId);
     if (!row)
         return { status: 404, body: { error: 'Unknown prDeliveryId' } };
+    if (row.parent_delivery_id && deps.repositoryChildOf !== row.parent_delivery_id)
+        return { status: 409, body: { error: 'repository_delivery_requires_parent', parentDeliveryId: row.parent_delivery_id } };
+    if (!row.parent_delivery_id && row.execution_manifest) {
+        const { executeRepositoryGroupDecision } = await Promise.resolve().then(() => __importStar(require('./multi-repo-delivery')));
+        return executeRepositoryGroupDecision(deps, input);
+    }
     // Compare-and-set pre-check: the caller decided against a snapshot — if the
     // row moved on (the other surface answered first), it must reconcile, not act.
     if (row.decision !== input.expectedDecision)
@@ -212,6 +223,8 @@ function casTransition(deps, row, next, patch = {}) {
     return staleDecision(current?.decision ?? row.decision);
 }
 function casTransitionWithTicketEffect(deps, row, next, patch, effect) {
+    if (deps.repositoryChildOf)
+        return casTransition(deps, row, next, patch);
     if (row.operation_token &&
         (0, rail_pr_ticket_effects_1.transitionClaimedDecisionWithTicketEffect)(deps.db, row.id, row.decision, next, row.operation_token, patch, effect))
         return null;
@@ -219,6 +232,8 @@ function casTransitionWithTicketEffect(deps, row, next, patch, effect) {
     return staleDecision(current?.decision ?? row.decision);
 }
 function applyTerminalTicketEffect(deps, row, terminalDecision, cleanupWarnings) {
+    if (deps.repositoryChildOf)
+        return;
     const result = (0, rail_pr_ticket_effects_1.applyRailPrTicketEffect)(deps, row.id);
     if (result.ok)
         return;
@@ -244,6 +259,8 @@ function finalizeTransition(deps, id) {
         deferredFinalizations.add(id);
         return snap;
     }
+    if (deps.repositoryChildOf)
+        return snap;
     deps.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(deps.project.id, snap));
     if (row.origin_conversation_id) {
         const agent = (deps.agentChat ?? agent_chat_registry_1.getAgentChatManager)();
@@ -1616,6 +1633,7 @@ async function runDiscard(deps, row, opts = { removeNeedsReview: true }) {
         });
     if (conflict)
         return conflict;
+    pauseChainsOnDiscard(deps, row);
     if (!preserveExternalReview)
         applyTerminalTicketEffect(deps, row, 'discarded', cleanupWarnings);
     finalizeTransition(deps, row.id);
@@ -1720,6 +1738,7 @@ async function settleMergedPr(deps, row) {
     await releaseDeliveredRecoveryLineage(deps, row, row.delivery_sha);
     applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
     finalizeTransition(deps, row.id);
+    await sweepMergedChainAncestors(deps, row);
     return {
         status: 200,
         body: {
@@ -1908,38 +1927,102 @@ async function runMergeLocal(deps, row) {
     return (0, repo_lock_1.withRepoLock)(deps.project.path, () => runMergeLocalLocked(deps, row));
 }
 async function runMergeLocalLocked(deps, row) {
+    // A stacked milestone delivery targets the chain integration branch, not
+    // the previous feature branch recorded as its PR base. Freeze that target
+    // for the whole locked operation and every pre/post-advance check.
+    const integrationTarget = mergeLocalTargetBranch(deps, row);
     deps.assertAdmission?.();
+    if (!(0, integration_branch_1.isValidBranchName)(integrationTarget) || integrationTarget === 'HEAD' || integrationTarget.startsWith('refs/')) {
+        return {
+            status: 409,
+            body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget,
+                detail: 'Configure a local integration branch before accepting this delivery.' },
+        };
+    }
+    const head = await deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], deps.project.path);
+    if (head.code !== 0 && head.code !== 1) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget } };
+    }
+    if (head.stdout.trim() === `refs/heads/${integrationTarget}`)
+        return runMergeLocalIntoCheckout(deps, row, deps.project.path, integrationTarget);
+    // Claim the designated base in an ordinary linked checkout. Git refuses if
+    // another worktree already holds it; never update-ref a checked-out branch
+    // behind its owner's back or switch/stash the user's current work.
+    const safeId = row.id.replace(/[^A-Za-z0-9-]/g, '').slice(0, 64) || 'delivery';
+    const target = path.join(deps.assemblyRoot ?? batchWorktreeRoot(deps.project.slug), `local-base-${safeId}-${(0, ids_1.newId)()}`);
+    const added = await deps.git.run(['worktree', 'add', target, integrationTarget], deps.project.path);
+    if (added.code !== 0) {
+        return {
+            status: 409,
+            body: {
+                error: 'merge_local_blocked', reason: 'integration_branch_busy', base: integrationTarget,
+                detail: added.stderr.trim() || added.stdout.trim() || 'The integration branch could not be opened safely.',
+            },
+        };
+    }
+    let result;
+    try {
+        result = await runMergeLocalIntoCheckout(deps, row, target, integrationTarget);
+        return result;
+    }
+    finally {
+        // Even failed assembly must release the temporary base checkout. Non-force
+        // removal preserves files if an external process wrote there during merge.
+        let warning = null;
+        try {
+            const removed = await deps.git.run(['worktree', 'remove', target], deps.project.path);
+            if (removed.code !== 0)
+                warning = `integration worktree ${target}: ${removed.stderr.trim() || removed.stdout.trim() || `exit ${removed.code}`}`;
+        }
+        catch (err) {
+            warning = `integration worktree ${target}: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        if (warning) {
+            safetyArchiveRecorder(deps, row)(target);
+            const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+            if (current?.operation_token === row.operation_token) {
+                const warnings = [...(0, rail_pr_store_1.toPrDeliverySnapshot)(current).cleanupWarnings, warning];
+                casTransition(deps, current, current.decision, { cleanupWarnings: warnings, statusCode: 'cleanup_incomplete' });
+                finalizeTransition(deps, row.id);
+                if (result)
+                    result.body.cleanupWarnings = warnings;
+            }
+        }
+    }
+}
+async function runMergeLocalIntoCheckout(deps, row, targetRepo, integrationTarget) {
     const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
     const cleanupWarnings = [];
-    // Snapshot the checkout the user authorized. The same three invariants are
-    // revalidated immediately before the one final fast-forward.
-    const head = await deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], deps.project.path);
-    const currentBranch = head.code === 0 ? head.stdout.trim() : '';
-    if (currentBranch !== row.base_branch) {
+    // Snapshot branch/HEAD before assembly. Local edits are allowed: the final
+    // non-forced fast-forward leaves unrelated work intact and Git atomically
+    // refuses any overwrite, including ignored files.
+    const head = await deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo);
+    const currentBranch = head.code === 0 ? head.stdout.trim().replace(/^refs\/heads\//, '') : '';
+    if (currentBranch !== integrationTarget) {
         return {
             status: 409,
-            body: { error: 'merge_local_blocked', reason: 'wrong_branch', current: currentBranch || null, base: row.base_branch },
+            body: { error: 'merge_local_blocked', reason: 'wrong_branch', current: currentBranch || null, base: integrationTarget },
         };
     }
-    const status = await deps.git.run(['status', '--porcelain'], deps.project.path);
-    if (status.code !== 0 || status.stdout.trim() !== '') {
-        return { status: 409, body: { error: 'merge_local_blocked', reason: 'dirty', base: row.base_branch } };
+    const status = await deps.git.run(['status', '--porcelain'], targetRepo);
+    if (status.code !== 0) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'status_unavailable', base: integrationTarget } };
     }
-    const startingHead = await deps.git.run(['rev-parse', '--verify', 'HEAD'], deps.project.path);
+    const startingHead = await deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo);
     const startingSha = startingHead.code === 0 ? startingHead.stdout.trim() : '';
     if (!/^[0-9a-f]{40,64}$/i.test(startingSha)) {
-        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: row.base_branch } };
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget } };
     }
     // What to merge: immutable object ids only. The assembled head carries every
     // unit already; without one, merge each settled unit's exact final SHA.
     let toMerge;
     let deliveryHeadSha = null;
-    if (row.delivery_sha && await commitObjectExists(deps, row.delivery_sha)) {
+    if (row.delivery_sha) {
+        if (!COMMIT_SHA_RE.test(row.delivery_sha) || !(await commitObjectExists(deps, row.delivery_sha))) {
+            return { status: 502, body: { error: 'merge_failed', detail: 'The verified delivery commit is unavailable; no branch fallback was merged.' } };
+        }
         deliveryHeadSha = row.delivery_sha;
     }
-    else if (row.branch) {
-        deliveryHeadSha = await captureBranchSha(deps, row.branch);
-    }
     if (deliveryHeadSha) {
         toMerge = [deliveryHeadSha];
     }
@@ -1951,9 +2034,6 @@ async function runMergeLocalLocked(deps, row) {
                 if (!(await commitObjectExists(deps, sourceSha)))
                     sourceSha = null;
             }
-            else {
-                sourceSha = await captureBranchSha(deps, unit.branch);
-            }
             if (!sourceSha) {
                 return {
                     status: 502,
@@ -1975,15 +2055,21 @@ async function runMergeLocalLocked(deps, row) {
         const detail = (added.stderr.trim() || added.stdout.trim()).split('\n')[0] || `exit ${added.code}`;
         return { status: 502, body: { error: 'merge_failed', detail: `creating isolated assembly: ${detail}` } };
     }
+    let assemblyRemovalAttempted = false;
     const removeAssembly = async () => {
+        if (assemblyRemovalAttempted)
+            return;
+        assemblyRemovalAttempted = true;
         try {
-            const removed = await deps.git.run(['worktree', 'remove', '--force', assemblyPath], deps.project.path);
+            const removed = await deps.git.run(['worktree', 'remove', assemblyPath], deps.project.path);
             if (removed.code !== 0) {
                 cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${(removed.stderr.trim() || removed.stdout.trim()).split('\n')[0] || `exit ${removed.code}`}`);
+                safetyArchiveRecorder(deps, row)(assemblyPath);
             }
         }
         catch (err) {
             cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${err instanceof Error ? err.message : String(err)}`);
+            safetyArchiveRecorder(deps, row)(assemblyPath);
         }
     };
     const persistAssemblyFailure = (detail) => {
@@ -1995,97 +2081,136 @@ async function runMergeLocalLocked(deps, row) {
         finalizeTransition(deps, row.id);
         return null;
     };
-    for (const branch of toMerge) {
-        const r = await deps.git.run(['merge', '--no-ff', '--no-edit', branch], assemblyPath);
-        if (r.code !== 0) {
-            try {
-                const aborted = await deps.git.run(['merge', '--abort'], assemblyPath);
-                if (aborted.code !== 0)
-                    cleanupWarnings.push(`assembly abort ${branch}: exit ${aborted.code}`);
+    try {
+        for (const branch of toMerge) {
+            const r = await deps.git.run(['merge', '--no-ff', '--no-edit', branch], assemblyPath);
+            if (r.code !== 0) {
+                try {
+                    const aborted = await deps.git.run(['merge', '--abort'], assemblyPath);
+                    if (aborted.code !== 0)
+                        cleanupWarnings.push(`assembly abort ${branch}: exit ${aborted.code}`);
+                }
+                catch (err) {
+                    cleanupWarnings.push(`assembly abort ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await removeAssembly();
+                const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
+                const conflict = persistAssemblyFailure(`merging '${branch}': ${detail}`);
+                if (conflict)
+                    return conflict;
+                return { status: 502, body: { error: 'merge_failed', detail: `merging '${branch}': ${detail}` } };
             }
-            catch (err) {
-                cleanupWarnings.push(`assembly abort ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const assembled = await deps.git.run(['rev-parse', '--verify', 'HEAD'], assemblyPath);
+        const assembledSha = assembled.code === 0 ? assembled.stdout.trim() : '';
+        if (!/^[0-9a-f]{40,64}$/i.test(assembledSha)) {
+            await removeAssembly();
+            const detail = 'isolated assembly produced no verifiable HEAD';
+            const conflict = persistAssemblyFailure(detail);
+            if (conflict)
+                return conflict;
+            return { status: 502, body: { error: 'merge_failed', detail } };
+        }
+        const [finalBranch, finalStatus, finalHead] = await Promise.all([
+            deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo),
+            deps.git.run(['status', '--porcelain'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo),
+        ]);
+        const changedReason = finalBranch.code !== 0 || finalBranch.stdout.trim() !== `refs/heads/${integrationTarget}`
+            ? 'wrong_branch'
+            : finalStatus.code !== 0
+                ? 'status_unavailable'
+                : finalHead.code !== 0 || finalHead.stdout.trim() !== startingSha
+                    ? 'head_changed'
+                    : null;
+        if (changedReason) {
+            await removeAssembly();
+            if (cleanupWarnings.length > 0) {
+                const conflict = casTransition(deps, row, row.decision, { cleanupWarnings });
+                if (conflict)
+                    return conflict;
+                finalizeTransition(deps, row.id);
             }
+            return { status: 409, body: { error: 'merge_local_blocked', reason: changedReason, base: integrationTarget } };
+        }
+        const advanced = await deps.git.run(['merge', '--ff-only', '--no-overwrite-ignore', assembledSha], targetRepo);
+        if (advanced.code !== 0) {
             await removeAssembly();
-            const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
-            const conflict = persistAssemblyFailure(`merging '${branch}': ${detail}`);
+            if (/would be overwritten|local changes|untracked working tree/i.test(`${advanced.stderr}\n${advanced.stdout}`)) {
+                return {
+                    status: 409,
+                    body: {
+                        error: 'merge_local_blocked', reason: 'dirty', base: integrationTarget,
+                        detail: (advanced.stderr.trim() || advanced.stdout.trim()).slice(0, 1200),
+                    },
+                };
+            }
+            const detail = (advanced.stderr.trim() || advanced.stdout.trim()).split('\n')[0] || `exit ${advanced.code}`;
+            const conflict = persistAssemblyFailure(`advancing '${integrationTarget}': ${detail}`);
             if (conflict)
                 return conflict;
-            return { status: 502, body: { error: 'merge_failed', detail: `merging '${branch}': ${detail}` } };
+            return { status: 502, body: { error: 'merge_failed', detail: `advancing '${integrationTarget}': ${detail}` } };
         }
-    }
-    const assembled = await deps.git.run(['rev-parse', '--verify', 'HEAD'], assemblyPath);
-    const assembledSha = assembled.code === 0 ? assembled.stdout.trim() : '';
-    if (!/^[0-9a-f]{40,64}$/i.test(assembledSha)) {
-        await removeAssembly();
-        const detail = 'isolated assembly produced no verifiable HEAD';
-        const conflict = persistAssemblyFailure(detail);
-        if (conflict)
-            return conflict;
-        return { status: 502, body: { error: 'merge_failed', detail } };
-    }
-    const [finalBranch, finalStatus, finalHead] = await Promise.all([
-        deps.git.run(['rev-parse', '--abbrev-ref', 'HEAD'], deps.project.path),
-        deps.git.run(['status', '--porcelain'], deps.project.path),
-        deps.git.run(['rev-parse', '--verify', 'HEAD'], deps.project.path),
-    ]);
-    const changedReason = finalBranch.code !== 0 || finalBranch.stdout.trim() !== row.base_branch
-        ? 'wrong_branch'
-        : finalStatus.code !== 0 || finalStatus.stdout.trim() !== ''
-            ? 'dirty'
-            : finalHead.code !== 0 || finalHead.stdout.trim() !== startingSha
-                ? 'head_changed'
-                : null;
-    if (changedReason) {
-        await removeAssembly();
-        if (cleanupWarnings.length > 0) {
-            const conflict = casTransition(deps, row, row.decision, { cleanupWarnings });
+        const [acceptedBranch, acceptedHead, acceptedBase] = await Promise.all([
+            deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', `refs/heads/${integrationTarget}`], deps.project.path),
+        ]);
+        if (acceptedBranch.code !== 0 || acceptedBranch.stdout.trim() !== `refs/heads/${integrationTarget}` ||
+            acceptedHead.code !== 0 || acceptedHead.stdout.trim().toLowerCase() !== assembledSha.toLowerCase() ||
+            acceptedBase.code !== 0 || acceptedBase.stdout.trim().toLowerCase() !== assembledSha.toLowerCase()) {
+            // An external checkout/ref edit can race the final preflight. A successful
+            // Git exit is insufficient evidence that the authorized base was updated.
+            // Preserve the assembled object and all source worktrees/branches for a
+            // retry; never roll back the external edit or mark tickets done.
+            assemblyRemovalAttempted = true;
+            safetyArchiveRecorder(deps, row)(assemblyPath);
+            const detail = `The integration checkout changed during the final advance. The assembled result is preserved at ${assemblyPath}.`;
+            cleanupWarnings.push(detail);
+            const conflict = casTransition(deps, row, row.decision, { cleanupWarnings, statusCode: 'delivery_failed', statusDetail: detail });
             if (conflict)
                 return conflict;
             finalizeTransition(deps, row.id);
+            return { status: 409, body: { error: 'merge_local_blocked', reason: 'head_changed', base: integrationTarget, detail } };
         }
-        return { status: 409, body: { error: 'merge_local_blocked', reason: changedReason, base: row.base_branch } };
-    }
-    const advanced = await deps.git.run(['merge', '--ff-only', assembledSha], deps.project.path);
-    if (advanced.code !== 0) {
         await removeAssembly();
-        const detail = (advanced.stderr.trim() || advanced.stdout.trim()).split('\n')[0] || `exit ${advanced.code}`;
-        const conflict = persistAssemblyFailure(`advancing '${row.base_branch}': ${detail}`);
+        // Post-advance sweep: the work now lives on
+        // the integration branch, so the launch's worktrees + branches are spent.
+        cleanupWarnings.push(...await (0, rail_worktree_release_1.releaseRailWorktrees)({
+            db: deps.db,
+            git: deps.git,
+            repoDir: deps.project.path,
+            worktreeIds: releasableWorktreeIds(deps, snap),
+            state: 'merged',
+            expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+            overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+            settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+            onSafetyArchive: safetyArchiveRecorder(deps, row),
+        }));
+        await deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings);
+        const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
+            deliveryOutcome: 'delivered',
+            statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+            cleanupWarnings,
+        }, {
+            deliveryId: row.id,
+            ticketIds: snap.ticketIds,
+            targetStatus: 'done',
+            jiraAction: 'merged',
+            prUrl: null,
+        });
         if (conflict)
             return conflict;
-        return { status: 502, body: { error: 'merge_failed', detail: `advancing '${row.base_branch}': ${detail}` } };
+        applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
+        finalizeTransition(deps, row.id);
+        await sweepMergedChainAncestors(deps, row);
+        return { status: 200, body: { ok: true, decision: 'merged', merged: true, local: true } };
+    }
+    finally {
+        // Runner exceptions (spawn failures/timeouts) must release the temporary
+        // assembly as well. A failed non-force removal leaves a recorded archive.
+        await removeAssembly();
     }
-    await removeAssembly();
-    // Post-advance sweep: the work now lives on
-    // the integration branch, so the launch's worktrees + branches are spent.
-    cleanupWarnings.push(...await (0, rail_worktree_release_1.releaseRailWorktrees)({
-        db: deps.db,
-        git: deps.git,
-        repoDir: deps.project.path,
-        worktreeIds: releasableWorktreeIds(deps, snap),
-        state: 'merged',
-        expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
-        overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
-        settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
-        onSafetyArchive: safetyArchiveRecorder(deps, row),
-    }));
-    await deleteOwnedBranchesIfUnchanged(deps, row, snap, cleanupWarnings);
-    const conflict = casTransitionWithTicketEffect(deps, row, 'merged', {
-        deliveryOutcome: 'delivered',
-        statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
-        cleanupWarnings,
-    }, {
-        deliveryId: row.id,
-        ticketIds: snap.ticketIds,
-        targetStatus: 'done',
-        jiraAction: 'merged',
-        prUrl: null,
-    });
-    if (conflict)
-        return conflict;
-    applyTerminalTicketEffect(deps, row, 'merged', cleanupWarnings);
-    finalizeTransition(deps, row.id);
-    return { status: 200, body: { ok: true, decision: 'merged', merged: true, local: true } };
 }
 function resolveTicketFile(deps) {
     if (deps.ticketFile)
@@ -2093,3 +2218,143 @@ function resolveTicketFile(deps) {
     const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: deps.project.slug, path: deps.project.path });
     return exec.relocated ? exec.ticketsPath : (0, ticket_store_1.resolveTicketStoragePath)(deps.project.path);
 }
+// ─── Milestone chain hooks (premium-milestone-progress D4) ───────────────────
+/** Decisions a stacked sibling can sit at while its head is already merged. */
+const SWEEPABLE_DECISIONS = new Set(['on_review', 'pr_draft', 'pr_ready', 'pr_closed']);
+/**
+ * Merging a STACKED delivery also lands every earlier chunk it was built on.
+ * Walk the chain(s) this delivery belongs to and settle each still-undecided
+ * sibling whose delivered head commit is PROVABLY an ancestor of the chain's
+ * integration branch (`git merge-base --is-ancestor`) as `merged` — the same
+ * CAS + ticket effect (`done`) + Jira hook a direct merge runs. Chain-local by
+ * design; siblings whose head is not an ancestor are left untouched. Returns
+ * the swept delivery ids. Never throws.
+ */
+async function sweepMergedChainAncestors(deps, mergedRow) {
+    const swept = [];
+    if (deps.repositoryChildOf)
+        return swept;
+    let chains;
+    try {
+        chains = (0, milestone_chain_store_1.listChainsTouchingDelivery)(deps.db, mergedRow.id);
+    }
+    catch {
+        return swept;
+    }
+    for (const chain of chains) {
+        const integration = chain.integration_branch;
+        if (!integration)
+            continue;
+        for (const entry of (0, milestone_chain_store_1.parseLaunched)(chain)) {
+            if (!entry.deliveryId || entry.deliveryId === mergedRow.id || swept.includes(entry.deliveryId))
+                continue;
+            const other = (0, rail_pr_store_2.getPrDelivery)(deps.db, entry.deliveryId);
+            if (!other || (0, rail_pr_store_2.isTerminalPrDecision)(other.decision) || !SWEEPABLE_DECISIONS.has(other.decision))
+                continue;
+            const snap = (0, rail_pr_store_2.toPrDeliverySnapshot)(other);
+            // An assembled delivery SHA proves the whole chunk. Without that head,
+            // every unit needs its own immutable proof; accepting just the first
+            // ancestor could mark unmerged tickets done and delete their branches.
+            const requiredShas = snap.deliverySha ? [snap.deliverySha] : snap.units.map((unit) => unit.finalSha);
+            const validShas = requiredShas.filter((sha) => typeof sha === 'string' && COMMIT_SHA_RE.test(sha));
+            if (requiredShas.length === 0 || validShas.length !== requiredShas.length)
+                continue;
+            let allAncestors = true;
+            try {
+                for (const sha of new Set(validShas)) {
+                    const r = await deps.git.run(['merge-base', '--is-ancestor', sha, integration], deps.project.path);
+                    if (r.code !== 0) {
+                        allAncestors = false;
+                        break;
+                    }
+                }
+            }
+            catch {
+                allAncestors = false;
+            }
+            if (!allAncestors)
+                continue;
+            const token = (0, ids_1.newId)();
+            if (!(0, rail_pr_store_2.claimPrDeliveryOperation)(deps.db, other.id, other.decision, 'poll-merge', token))
+                continue;
+            let released = false;
+            try {
+                const claimed = { ...other, operation_token: token };
+                const cleanupWarnings = await (0, rail_worktree_release_1.releaseRailWorktrees)({
+                    db: deps.db, git: deps.git, repoDir: deps.project.path,
+                    worktreeIds: releasableWorktreeIds(deps, snap), state: 'merged',
+                    expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+                    overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+                    settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+                    onSafetyArchive: safetyArchiveRecorder(deps, claimed),
+                });
+                await deleteOwnedBranchesIfUnchanged(deps, claimed, snap, cleanupWarnings);
+                const conflict = casTransitionWithTicketEffect(deps, claimed, 'merged', {
+                    deliveryOutcome: 'delivered',
+                    statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+                    statusDetail: `merged as part of ${mergedRow.rail_key}`,
+                    cleanupWarnings,
+                }, {
+                    deliveryId: claimed.id,
+                    ticketIds: snap.ticketIds,
+                    targetStatus: 'done',
+                    jiraAction: 'merged',
+                    prUrl: claimed.pr_url,
+                });
+                if (conflict)
+                    continue;
+                applyTerminalTicketEffect(deps, claimed, 'merged', cleanupWarnings);
+                // Release BEFORE finalizing: a row still holding a lease defers its
+                // broadcast to the lease owner's finally, which here would never come.
+                (0, rail_pr_store_2.releasePrDeliveryOperation)(deps.db, other.id, token);
+                released = true;
+                finalizeTransition(deps, other.id);
+                swept.push(other.id);
+            }
+            catch (err) {
+                console.error(`[milestone-chain] ancestor sweep failed for ${other.id}:`, err);
+            }
+            finally {
+                if (!released)
+                    (0, rail_pr_store_2.releasePrDeliveryOperation)(deps.db, other.id, token);
+            }
+        }
+    }
+    return swept;
+}
+/** A discarded delivery that a chain's later chunks build on pauses those
+ *  chains (`head_discarded`, head rewound to the previous chunk's branch). */
+function pauseChainsOnDiscard(deps, row) {
+    if (deps.repositoryChildOf)
+        return;
+    try {
+        const branchOf = (id) => {
+            const other = (0, rail_pr_store_2.getPrDelivery)(deps.db, id);
+            if (!other)
+                return null;
+            const s = (0, rail_pr_store_2.toPrDeliverySnapshot)(other);
+            return s.branch ?? s.units.find((u) => u.succeeded && u.branch)?.branch ?? null;
+        };
+        const paused = (0, milestone_chain_store_1.pauseChainsForDiscardedHead)(deps.db, row.id, branchOf);
+        for (const chain of paused) {
+            deps.broadcast({ type: 'milestone.chain_changed', projectId: deps.project.id, chain: (0, milestone_chain_store_1.toChainSnapshot)(chain), timestamp: new Date().toISOString() });
+        }
+    }
+    catch (err) {
+        console.error('[milestone-chain] discard hook failed:', err);
+    }
+}
+/** Local-integration target: a chain-launched (stacked) delivery integrates
+ *  into the chain's integration branch, never into its feature base. */
+function mergeLocalTargetBranch(deps, row) {
+    if (deps.repositoryChildOf)
+        return deps.repositoryIntegrationBranch ?? row.base_branch;
+    try {
+        for (const chain of (0, milestone_chain_store_1.listChainsTouchingDelivery)(deps.db, row.id)) {
+            if (chain.integration_branch)
+                return chain.integration_branch;
+        }
+    }
+    catch { /* fall through */ }
+    return row.base_branch;
+}