specrails-desktop 2.55.0 → 2.55.1

package/server/dist/modules/delivery/adapters/decisions/evidence.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMMIT_SHA_RE = void 0;
+exports.exactRefSha = exactRefSha;
+exports.isFastForwardCandidate = isFastForwardCandidate;
+exports.releaseDeliveredRecoveryLineage = releaseDeliveredRecoveryLineage;
+exports.parseRegisteredGitWorktrees = parseRegisteredGitWorktrees;
+exports.authenticateRecoveryWorktree = authenticateRecoveryWorktree;
+exports.commitObjectExists = commitObjectExists;
+exports.captureBranchSha = captureBranchSha;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const rail_pr_store_1 = require("../../runtime/rail-pr-store");
+const rail_pr_recovery_git_1 = require("../../runtime/rail-pr-recovery-git");
+exports.COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+async function exactRefSha(deps, cwd, ref) {
+    try {
+        const result = await deps.git.run(['rev-parse', '--verify', ref], cwd);
+        const sha = result.code === 0 ? result.stdout.trim() : '';
+        return exports.COMMIT_SHA_RE.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function isFastForwardCandidate(deps, baselineSha, candidateSha) {
+    if (baselineSha === candidateSha)
+        return true;
+    try {
+        return (await deps.git.run(['merge-base', '--is-ancestor', baselineSha, candidateSha], deps.project.path)).code === 0;
+    }
+    catch {
+        return false;
+    }
+}
+async function releaseDeliveredRecoveryLineage(deps, row, deliveredSha) {
+    if (!deliveredSha || !exports.COMMIT_SHA_RE.test(deliveredSha))
+        return;
+    const currentProtection = await (0, rail_pr_recovery_git_1.inspectRecoveryCommitProtection)(deps.git, deps.project.path, row.id);
+    if (currentProtection.kind === 'present' &&
+        currentProtection.sha.toLowerCase() === deliveredSha.toLowerCase()) {
+        await (0, rail_pr_recovery_git_1.releaseRecoveryCommit)(deps.git, deps.project.path, row.id, deliveredSha);
+    }
+    const visited = new Set([row.id]);
+    let predecessorId = row.supersedes_delivery_id;
+    for (let depth = 0; predecessorId && depth < 32 && !visited.has(predecessorId); depth++) {
+        visited.add(predecessorId);
+        const predecessor = (0, rail_pr_store_1.getPrDelivery)(deps.db, predecessorId);
+        if (!predecessor)
+            break;
+        if (predecessor.decision !== 'discarded' && predecessor.decision !== 'superseded')
+            break;
+        const protection = await (0, rail_pr_recovery_git_1.inspectRecoveryCommitProtection)(deps.git, deps.project.path, predecessor.id);
+        if (protection.kind === 'present' && await isFastForwardCandidate(deps, protection.sha, deliveredSha)) {
+            await (0, rail_pr_recovery_git_1.releaseRecoveryCommit)(deps.git, deps.project.path, predecessor.id, protection.sha);
+        }
+        predecessorId = predecessor.supersedes_delivery_id;
+    }
+}
+function parseRegisteredGitWorktrees(stdout) {
+    const worktrees = [];
+    let current = null;
+    const finish = () => {
+        if (current)
+            worktrees.push(current);
+        current = null;
+    };
+    for (const field of stdout.split('\0')) {
+        if (field === '') {
+            finish();
+            continue;
+        }
+        if (field.startsWith('worktree ')) {
+            finish();
+            current = { worktreePath: field.slice('worktree '.length), head: null, branch: null };
+            continue;
+        }
+        if (!current)
+            continue;
+        if (field.startsWith('HEAD '))
+            current.head = field.slice('HEAD '.length);
+        if (field.startsWith('branch '))
+            current.branch = field.slice('branch '.length);
+    }
+    finish();
+    return worktrees;
+}
+/** Authenticate a ledger path as a live, non-symlink worktree registered by
+ * this exact repository. The main checkout and ordinary directories fail
+ * closed. Callers repeat this immediately before staging to close the useful
+ * path-replacement window between inspection and mutation. */
+async function authenticateRecoveryWorktree(deps, ledgerPath, expectedBranch, expectedHead) {
+    if (!path.isAbsolute(ledgerPath)) {
+        return { ok: false, detail: 'the recorded worktree path is not absolute' };
+    }
+    let realPath;
+    let projectRealPath;
+    try {
+        const ledgerStat = fs.lstatSync(ledgerPath);
+        if (ledgerStat.isSymbolicLink()) {
+            return { ok: false, detail: 'the recorded worktree path is a symbolic link' };
+        }
+        if (!ledgerStat.isDirectory()) {
+            return { ok: false, detail: 'the recorded worktree path is not a directory' };
+        }
+        realPath = fs.realpathSync(ledgerPath);
+        projectRealPath = fs.realpathSync(deps.project.path);
+        if (!fs.statSync(realPath).isDirectory()) {
+            return { ok: false, detail: 'the canonical worktree path is not a directory' };
+        }
+    }
+    catch {
+        return { ok: false, detail: 'the recorded worktree path could not be resolved safely' };
+    }
+    if (realPath === projectRealPath) {
+        return { ok: false, detail: 'the recorded worktree path resolves to the main project checkout' };
+    }
+    let listed;
+    try {
+        listed = await deps.git.run(['worktree', 'list', '--porcelain', '-z'], deps.project.path);
+    }
+    catch {
+        return { ok: false, detail: 'Git worktree registration could not be verified' };
+    }
+    if (listed.code !== 0) {
+        return { ok: false, detail: 'Git worktree registration could not be verified' };
+    }
+    const matches = parseRegisteredGitWorktrees(listed.stdout).filter((registered) => {
+        try {
+            return fs.realpathSync(registered.worktreePath) === realPath;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (matches.length !== 1) {
+        return { ok: false, detail: 'the recorded path is not uniquely registered as a Git worktree of this project' };
+    }
+    const registered = matches[0];
+    if (registered.branch !== `refs/heads/${expectedBranch}`) {
+        return { ok: false, detail: 'the registered Git worktree is not on the recorded delivery branch' };
+    }
+    if (!registered.head || !exports.COMMIT_SHA_RE.test(registered.head)) {
+        return { ok: false, detail: 'the registered Git worktree has no verifiable commit identity' };
+    }
+    if (expectedHead && registered.head.toLowerCase() !== expectedHead.toLowerCase()) {
+        return { ok: false, detail: 'the registered Git worktree changed commits before staging' };
+    }
+    return { ok: true, realPath, head: registered.head };
+}
+async function commitObjectExists(deps, sha) {
+    if (!exports.COMMIT_SHA_RE.test(sha))
+        return false;
+    try {
+        return (await deps.git.run(['cat-file', '-e', `${sha}^{commit}`], deps.project.path)).code === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/** Resolve a legacy mutable ref once into an immutable object. New settlement
+ * rows already carry finalSha and never take this compatibility path. */
+async function captureBranchSha(deps, branch) {
+    try {
+        const result = await deps.git.run(['rev-parse', '--verify', `refs/heads/${branch}`], deps.project.path);
+        const sha = result.code === 0 ? result.stdout.trim() : '';
+        return exports.COMMIT_SHA_RE.test(sha) ? sha : null;
+    }
+    catch {
+        return null;
+    }
+}

package/server/dist/modules/delivery/adapters/decisions/merge-local.js

@@ -0,0 +1,338 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runMergeLocal = runMergeLocal;
+exports.runMergeLocalLocked = runMergeLocalLocked;
+exports.runMergeLocalIntoCheckout = runMergeLocalIntoCheckout;
+const path = __importStar(require("path"));
+const rail_worktree_release_1 = require("../../runtime/rail-worktree-release");
+const rail_pr_store_1 = require("../../runtime/rail-pr-store");
+const ids_1 = require("../../../../ids");
+const repo_lock_1 = require("../../../../repo-lock");
+const integration_branch_1 = require("../../../../integration-branch");
+const metadata_1 = require("./metadata");
+const transitions_1 = require("./transitions");
+const evidence_1 = require("./evidence");
+const ownership_1 = require("./ownership");
+const chains_1 = require("./chains");
+async function runMergeLocal(deps, row) {
+    return (0, repo_lock_1.withRepoLock)(deps.project.path, () => runMergeLocalLocked(deps, row));
+}
+async function runMergeLocalLocked(deps, row) {
+    // A stacked milestone delivery targets the chain integration branch, not
+    // the previous feature branch recorded as its PR base. Freeze that target
+    // for the whole locked operation and every pre/post-advance check.
+    const integrationTarget = (0, metadata_1.mergeLocalTargetBranch)(deps, row);
+    deps.assertAdmission?.();
+    if (!(0, integration_branch_1.isValidBranchName)(integrationTarget) || integrationTarget === 'HEAD' || integrationTarget.startsWith('refs/')) {
+        return {
+            status: 409,
+            body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget,
+                detail: 'Configure a local integration branch before accepting this delivery.' },
+        };
+    }
+    const head = await deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], deps.project.path);
+    if (head.code !== 0 && head.code !== 1) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget } };
+    }
+    if (head.stdout.trim() === `refs/heads/${integrationTarget}`)
+        return runMergeLocalIntoCheckout(deps, row, deps.project.path, integrationTarget);
+    // Claim the designated base in an ordinary linked checkout. Git refuses if
+    // another worktree already holds it; never update-ref a checked-out branch
+    // behind its owner's back or switch/stash the user's current work.
+    const safeId = row.id.replace(/[^A-Za-z0-9-]/g, '').slice(0, 64) || 'delivery';
+    const target = path.join(deps.assemblyRoot ?? (0, metadata_1.batchWorktreeRoot)(deps.project.slug), `local-base-${safeId}-${(0, ids_1.newId)()}`);
+    const added = await deps.git.run(['worktree', 'add', target, integrationTarget], deps.project.path);
+    if (added.code !== 0) {
+        return {
+            status: 409,
+            body: {
+                error: 'merge_local_blocked', reason: 'integration_branch_busy', base: integrationTarget,
+                detail: added.stderr.trim() || added.stdout.trim() || 'The integration branch could not be opened safely.',
+            },
+        };
+    }
+    let result;
+    try {
+        result = await runMergeLocalIntoCheckout(deps, row, target, integrationTarget);
+        return result;
+    }
+    finally {
+        // Even failed assembly must release the temporary base checkout. Non-force
+        // removal preserves files if an external process wrote there during merge.
+        let warning = null;
+        try {
+            const removed = await deps.git.run(['worktree', 'remove', target], deps.project.path);
+            if (removed.code !== 0)
+                warning = `integration worktree ${target}: ${removed.stderr.trim() || removed.stdout.trim() || `exit ${removed.code}`}`;
+        }
+        catch (err) {
+            warning = `integration worktree ${target}: ${err instanceof Error ? err.message : String(err)}`;
+        }
+        if (warning) {
+            (0, transitions_1.safetyArchiveRecorder)(deps, row)(target);
+            const current = (0, rail_pr_store_1.getPrDelivery)(deps.db, row.id);
+            if (current?.operation_token === row.operation_token) {
+                const warnings = [...(0, rail_pr_store_1.toPrDeliverySnapshot)(current).cleanupWarnings, warning];
+                (0, transitions_1.casTransition)(deps, current, current.decision, { cleanupWarnings: warnings, statusCode: 'cleanup_incomplete' });
+                (0, transitions_1.finalizeTransition)(deps, row.id);
+                if (result)
+                    result.body.cleanupWarnings = warnings;
+            }
+        }
+    }
+}
+async function runMergeLocalIntoCheckout(deps, row, targetRepo, integrationTarget) {
+    const snap = (0, rail_pr_store_1.toPrDeliverySnapshot)(row);
+    const cleanupWarnings = [];
+    // Snapshot branch/HEAD before assembly. Local edits are allowed: the final
+    // non-forced fast-forward leaves unrelated work intact and Git atomically
+    // refuses any overwrite, including ignored files.
+    const head = await deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo);
+    const currentBranch = head.code === 0 ? head.stdout.trim().replace(/^refs\/heads\//, '') : '';
+    if (currentBranch !== integrationTarget) {
+        return {
+            status: 409,
+            body: { error: 'merge_local_blocked', reason: 'wrong_branch', current: currentBranch || null, base: integrationTarget },
+        };
+    }
+    const status = await deps.git.run(['status', '--porcelain'], targetRepo);
+    if (status.code !== 0) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'status_unavailable', base: integrationTarget } };
+    }
+    const startingHead = await deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo);
+    const startingSha = startingHead.code === 0 ? startingHead.stdout.trim() : '';
+    if (!/^[0-9a-f]{40,64}$/i.test(startingSha)) {
+        return { status: 409, body: { error: 'merge_local_blocked', reason: 'unresolved_head', base: integrationTarget } };
+    }
+    // What to merge: immutable object ids only. The assembled head carries every
+    // unit already; without one, merge each settled unit's exact final SHA.
+    let toMerge;
+    let deliveryHeadSha = null;
+    if (row.delivery_sha) {
+        if (!evidence_1.COMMIT_SHA_RE.test(row.delivery_sha) || !(await (0, evidence_1.commitObjectExists)(deps, row.delivery_sha))) {
+            return { status: 502, body: { error: 'merge_failed', detail: 'The verified delivery commit is unavailable; no branch fallback was merged.' } };
+        }
+        deliveryHeadSha = row.delivery_sha;
+    }
+    if (deliveryHeadSha) {
+        toMerge = [deliveryHeadSha];
+    }
+    else {
+        toMerge = [];
+        for (const unit of snap.branches.filter((b) => b.succeeded)) {
+            let sourceSha = unit.finalSha && evidence_1.COMMIT_SHA_RE.test(unit.finalSha) ? unit.finalSha : null;
+            if (sourceSha) {
+                if (!(await (0, evidence_1.commitObjectExists)(deps, sourceSha)))
+                    sourceSha = null;
+            }
+            if (!sourceSha) {
+                return {
+                    status: 502,
+                    body: { error: 'merge_failed', detail: `verified commit for '${unit.branch}' (ticket #${unit.ticketId}) is unavailable` },
+                };
+            }
+            toMerge.push(sourceSha);
+        }
+    }
+    if (toMerge.length === 0) {
+        return { status: 502, body: { error: 'merge_failed', detail: 'no succeeded branch to merge' } };
+    }
+    // Assemble every merge away from the user's checkout. A conflict can only
+    // dirty this disposable detached worktree, never the integration branch.
+    const safeId = row.id.replace(/[^A-Za-z0-9-]/g, '').slice(0, 64) || 'delivery';
+    const assemblyPath = path.join(deps.assemblyRoot ?? (0, metadata_1.batchWorktreeRoot)(deps.project.slug), `local-merge-${safeId}-${(0, ids_1.newId)()}`);
+    const added = await deps.git.run(['worktree', 'add', '--detach', assemblyPath, startingSha], deps.project.path);
+    if (added.code !== 0) {
+        const detail = (added.stderr.trim() || added.stdout.trim()).split('\n')[0] || `exit ${added.code}`;
+        return { status: 502, body: { error: 'merge_failed', detail: `creating isolated assembly: ${detail}` } };
+    }
+    let assemblyRemovalAttempted = false;
+    const removeAssembly = async () => {
+        if (assemblyRemovalAttempted)
+            return;
+        assemblyRemovalAttempted = true;
+        try {
+            const removed = await deps.git.run(['worktree', 'remove', assemblyPath], deps.project.path);
+            if (removed.code !== 0) {
+                cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${(removed.stderr.trim() || removed.stdout.trim()).split('\n')[0] || `exit ${removed.code}`}`);
+                (0, transitions_1.safetyArchiveRecorder)(deps, row)(assemblyPath);
+            }
+        }
+        catch (err) {
+            cleanupWarnings.push(`assembly worktree ${assemblyPath}: ${err instanceof Error ? err.message : String(err)}`);
+            (0, transitions_1.safetyArchiveRecorder)(deps, row)(assemblyPath);
+        }
+    };
+    const persistAssemblyFailure = (detail) => {
+        const conflict = (0, transitions_1.casTransition)(deps, row, row.decision, {
+            deliveryOutcome: 'blocked', statusCode: 'delivery_failed', statusDetail: detail, cleanupWarnings,
+        });
+        if (conflict)
+            return conflict;
+        (0, transitions_1.finalizeTransition)(deps, row.id);
+        return null;
+    };
+    try {
+        for (const branch of toMerge) {
+            const r = await deps.git.run(['merge', '--no-ff', '--no-edit', branch], assemblyPath);
+            if (r.code !== 0) {
+                try {
+                    const aborted = await deps.git.run(['merge', '--abort'], assemblyPath);
+                    if (aborted.code !== 0)
+                        cleanupWarnings.push(`assembly abort ${branch}: exit ${aborted.code}`);
+                }
+                catch (err) {
+                    cleanupWarnings.push(`assembly abort ${branch}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+                await removeAssembly();
+                const detail = (r.stderr.trim() || r.stdout.trim()).split('\n')[0] || `exit ${r.code}`;
+                const conflict = persistAssemblyFailure(`merging '${branch}': ${detail}`);
+                if (conflict)
+                    return conflict;
+                return { status: 502, body: { error: 'merge_failed', detail: `merging '${branch}': ${detail}` } };
+            }
+        }
+        const assembled = await deps.git.run(['rev-parse', '--verify', 'HEAD'], assemblyPath);
+        const assembledSha = assembled.code === 0 ? assembled.stdout.trim() : '';
+        if (!/^[0-9a-f]{40,64}$/i.test(assembledSha)) {
+            await removeAssembly();
+            const detail = 'isolated assembly produced no verifiable HEAD';
+            const conflict = persistAssemblyFailure(detail);
+            if (conflict)
+                return conflict;
+            return { status: 502, body: { error: 'merge_failed', detail } };
+        }
+        const [finalBranch, finalStatus, finalHead] = await Promise.all([
+            deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo),
+            deps.git.run(['status', '--porcelain'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo),
+        ]);
+        const changedReason = finalBranch.code !== 0 || finalBranch.stdout.trim() !== `refs/heads/${integrationTarget}`
+            ? 'wrong_branch'
+            : finalStatus.code !== 0
+                ? 'status_unavailable'
+                : finalHead.code !== 0 || finalHead.stdout.trim() !== startingSha
+                    ? 'head_changed'
+                    : null;
+        if (changedReason) {
+            await removeAssembly();
+            if (cleanupWarnings.length > 0) {
+                const conflict = (0, transitions_1.casTransition)(deps, row, row.decision, { cleanupWarnings });
+                if (conflict)
+                    return conflict;
+                (0, transitions_1.finalizeTransition)(deps, row.id);
+            }
+            return { status: 409, body: { error: 'merge_local_blocked', reason: changedReason, base: integrationTarget } };
+        }
+        const advanced = await deps.git.run(['merge', '--ff-only', '--no-overwrite-ignore', assembledSha], targetRepo);
+        if (advanced.code !== 0) {
+            await removeAssembly();
+            if (/would be overwritten|local changes|untracked working tree/i.test(`${advanced.stderr}\n${advanced.stdout}`)) {
+                return {
+                    status: 409,
+                    body: {
+                        error: 'merge_local_blocked', reason: 'dirty', base: integrationTarget,
+                        detail: (advanced.stderr.trim() || advanced.stdout.trim()).slice(0, 1200),
+                    },
+                };
+            }
+            const detail = (advanced.stderr.trim() || advanced.stdout.trim()).split('\n')[0] || `exit ${advanced.code}`;
+            const conflict = persistAssemblyFailure(`advancing '${integrationTarget}': ${detail}`);
+            if (conflict)
+                return conflict;
+            return { status: 502, body: { error: 'merge_failed', detail: `advancing '${integrationTarget}': ${detail}` } };
+        }
+        const [acceptedBranch, acceptedHead, acceptedBase] = await Promise.all([
+            deps.git.run(['symbolic-ref', '--quiet', 'HEAD'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', 'HEAD'], targetRepo),
+            deps.git.run(['rev-parse', '--verify', `refs/heads/${integrationTarget}`], deps.project.path),
+        ]);
+        if (acceptedBranch.code !== 0 || acceptedBranch.stdout.trim() !== `refs/heads/${integrationTarget}` ||
+            acceptedHead.code !== 0 || acceptedHead.stdout.trim().toLowerCase() !== assembledSha.toLowerCase() ||
+            acceptedBase.code !== 0 || acceptedBase.stdout.trim().toLowerCase() !== assembledSha.toLowerCase()) {
+            // An external checkout/ref edit can race the final preflight. A successful
+            // Git exit is insufficient evidence that the authorized base was updated.
+            // Preserve the assembled object and all source worktrees/branches for a
+            // retry; never roll back the external edit or mark tickets done.
+            assemblyRemovalAttempted = true;
+            (0, transitions_1.safetyArchiveRecorder)(deps, row)(assemblyPath);
+            const detail = `The integration checkout changed during the final advance. The assembled result is preserved at ${assemblyPath}.`;
+            cleanupWarnings.push(detail);
+            const conflict = (0, transitions_1.casTransition)(deps, row, row.decision, { cleanupWarnings, statusCode: 'delivery_failed', statusDetail: detail });
+            if (conflict)
+                return conflict;
+            (0, transitions_1.finalizeTransition)(deps, row.id);
+            return { status: 409, body: { error: 'merge_local_blocked', reason: 'head_changed', base: integrationTarget, detail } };
+        }
+        await removeAssembly();
+        // Post-advance sweep: the work now lives on
+        // the integration branch, so the launch's worktrees + branches are spent.
+        cleanupWarnings.push(...await (0, rail_worktree_release_1.releaseRailWorktrees)({
+            db: deps.db,
+            git: deps.git,
+            repoDir: deps.project.path,
+            worktreeIds: (0, ownership_1.releasableWorktreeIds)(deps, snap),
+            state: 'merged',
+            expectedHeadByBranch: (0, rail_worktree_release_1.durableBranchHeads)(snap.branches),
+            overlayEvidenceByBranch: (0, rail_worktree_release_1.durableOverlayCleanupEvidence)(snap.branches),
+            settlementIgnoredByBranch: (0, rail_worktree_release_1.durableSettlementIgnoredPaths)(snap.branches),
+            onSafetyArchive: (0, transitions_1.safetyArchiveRecorder)(deps, row),
+        }));
+        await (0, ownership_1.deleteOwnedBranchesIfUnchanged)(deps, row, snap, cleanupWarnings);
+        const conflict = (0, transitions_1.casTransitionWithTicketEffect)(deps, row, 'merged', {
+            deliveryOutcome: 'delivered',
+            statusCode: cleanupWarnings.length > 0 ? 'cleanup_incomplete' : 'merged',
+            cleanupWarnings,
+        }, {
+            deliveryId: row.id,
+            ticketIds: snap.ticketIds,
+            targetStatus: 'done',
+            jiraAction: 'merged',
+            prUrl: null,
+        });
+        if (conflict)
+            return conflict;
+        (0, transitions_1.applyTerminalTicketEffect)(deps, row, 'merged', cleanupWarnings);
+        (0, transitions_1.finalizeTransition)(deps, row.id);
+        await (0, chains_1.sweepMergedChainAncestors)(deps, row);
+        return { status: 200, body: { ok: true, decision: 'merged', merged: true, local: true } };
+    }
+    finally {
+        // Runner exceptions (spawn failures/timeouts) must release the temporary
+        // assembly as well. A failed non-force removal leaves a recorded archive.
+        await removeAssembly();
+    }
+}

package/server/dist/modules/delivery/adapters/decisions/metadata.js

@@ -0,0 +1,109 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePrNumber = parsePrNumber;
+exports.batchWorktreeRoot = batchWorktreeRoot;
+exports.loadPrTicketData = loadPrTicketData;
+exports.resolveTicketFile = resolveTicketFile;
+exports.mergeLocalTargetBranch = mergeLocalTargetBranch;
+const path = __importStar(require("path"));
+const artifact_registry_1 = require("../../../../artifact-registry");
+const jira_db_1 = require("../../../../jira/jira-db");
+const ticket_store_1 = require("../../../specs/runtime/ticket-store");
+const workspace_resolution_1 = require("../../../../workspace-resolution");
+const milestone_chain_store_1 = require("../../../builder/runtime/milestone-chain-store");
+function parsePrNumber(prUrl) {
+    const m = /\/pull\/(\d+)/.exec(prUrl);
+    return m ? parseInt(m[1], 10) : null;
+}
+function batchWorktreeRoot(slug) {
+    // Mirrors rail-isolated-launch's worktreesRoot — derivable, never stored.
+    return path.join((0, artifact_registry_1.resolveHome)(), '.specrails', 'projects', slug, 'worktrees');
+}
+/**
+ * Load the PR's ticket data (title/labels/description) from the ticket store,
+ * with the Jira key resolved PER TICKET: the authoritative `jira_links` row
+ * prevails over the ticket's `jira_key` field (JIRA ALWAYS PREVAILS), no HTTP.
+ * Tolerant of a missing/corrupt store or link table — degrades to bare local
+ * ids, never throws, never blocks PR creation.
+ */
+function loadPrTicketData(deps, ticketIds) {
+    let tickets = {};
+    try {
+        tickets = (0, ticket_store_1.readStore)(resolveTicketFile(deps)).tickets;
+    }
+    catch {
+        /* tolerated — the PR falls back to bare ticket refs */
+    }
+    return ticketIds.map((id) => {
+        const t = tickets[String(id)];
+        let jiraKey = t?.jira_key ?? null;
+        try {
+            const link = (0, jira_db_1.getLinkByLocalId)(deps.db, id);
+            if (link && !link.tombstoned && link.jiraKey)
+                jiraKey = link.jiraKey;
+        }
+        catch {
+            /* tolerated — fall back to the ticket field */
+        }
+        return {
+            ticketId: id,
+            title: t?.title ?? null,
+            labels: t?.labels ?? null,
+            description: t?.description ?? null,
+            jiraKey,
+        };
+    });
+}
+function resolveTicketFile(deps) {
+    if (deps.ticketFile)
+        return deps.ticketFile;
+    const exec = (0, workspace_resolution_1.resolveProjectExecution)({ slug: deps.project.slug, path: deps.project.path });
+    return exec.relocated ? exec.ticketsPath : (0, ticket_store_1.resolveTicketStoragePath)(deps.project.path);
+}
+/** Local-integration target: a chain-launched (stacked) delivery integrates
+ *  into the chain's integration branch, never into its feature base. */
+function mergeLocalTargetBranch(deps, row) {
+    if (deps.repositoryChildOf)
+        return deps.repositoryIntegrationBranch ?? row.base_branch;
+    try {
+        for (const chain of (0, milestone_chain_store_1.listChainsTouchingDelivery)(deps.db, row.id)) {
+            if (chain.integration_branch)
+                return chain.integration_branch;
+        }
+    }
+    catch { /* fall through */ }
+    return row.base_branch;
+}