specrails-desktop 2.57.0 → 2.58.0

package/server/dist/modules/delivery/runtime/rail-isolated-launch.js

@@ -36,7 +36,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.PrContinuationIsolationError = void 0;
 exports.buildSpecSnapshot = buildSpecSnapshot;
 exports.launchIsolatedRail = launchIsolatedRail;
+exports.reattachIsolatedSettlement = reattachIsolatedSettlement;
 exports.reconcileRailWorktrees = reconcileRailWorktrees;
+const isolated_settlement_reconstruction_1 = require("./isolated-settlement-reconstruction");
+const legacy_launch_telemetry_1 = require("../../loops/runtime/legacy-launch-telemetry");
 /**
  * Isolated (worktree-per-ticket) rail launch — the live wiring that turns the
  * tested building blocks (worktree-manager, merge-manager, rail-merge-orchestrator,
@@ -73,6 +76,9 @@ const pr_naming_1 = require("./pr-naming");
 const jira_db_1 = require("../../../jira/jira-db");
 const db_1 = require("../../../db");
 const delivery_evidence_1 = require("./delivery-evidence");
+const isolated_settlement_store_1 = require("./isolated-settlement-store");
+const loop_runs_store_1 = require("../../loops/runtime/loop-runs-store");
+const loop_definition_recovery_1 = require("../../loops/runtime/loop-definition-recovery");
 const integration_branch_1 = require("../../../integration-branch");
 const repo_lock_1 = require("../../../repo-lock");
 const project_repositories_1 = require("../../../project-repositories");
@@ -359,7 +365,7 @@ async function captureSettlementIgnoredPaths(git, worktreePath, overlayExcludes)
     }
 }
 function branchRecords(results) {
-    return results.flatMap((result) => result.run.ticketIds.map((ticketId) => ({
+    return results.flatMap((result) => (result.run.ticketIds.length ? result.run.ticketIds : [result.run.ticketId]).map((ticketId) => ({
         ticketId,
         branch: result.run.handle.branch,
         // Legacy consumers interpret this as delivery eligibility, not engine truth.
@@ -392,6 +398,209 @@ function getRailName(ctx, railIndex) {
         return null;
     }
 }
+/** Shared by fresh execution and durable reattachment; one owner of Git settlement. */
+function createIsolatedRunSettlement(ports) {
+    const { git, baseRepo, overlaySourceRoot, overlayFallbackRoots, overlayProviderDir, overlayInstructions, isAborted, onFinished, recordRunProvenance, markWorktree, hasRuntimeRequest, commitMessage } = ports;
+    return async (a, enginePromise) => {
+        let actualOutcome = 'failed';
+        let engineFailure;
+        let stallReason;
+        try {
+            const result = await enginePromise;
+            actualOutcome = result.outcome;
+            stallReason = result.stallReason;
+        }
+        catch (err) {
+            engineFailure = errorDetail(err);
+            console.error(`[rail-isolated] loop run ${a.runId} rejected: ${engineFailure}`);
+        }
+        if (ports.ownsRun && !ports.ownsRun(a.runId))
+            throw new Error('Fork owns the original settlement');
+        if (isAborted?.()) {
+            // The coordinator never started. Do not commit incidental edits or
+            // release a mount borrowed from a previous delivery while rolling back.
+            const finalSha = await readHeadSha(git, a.handle.worktreePath);
+            if (a.worktreeOwnership !== 'created')
+                markWorktree(a, 'needs-review');
+            return {
+                run: a, implementationOutcome: 'failed', deliveryOutcome: 'not_started',
+                initialSha: a.initialSha, finalSha, changed: Boolean(finalSha && a.initialSha !== finalSha),
+                safeToRelease: a.worktreeOwnership === 'created' && finalSha !== null && finalSha === a.initialSha,
+            };
+        }
+        const implementationOutcome = actualOutcome === 'success' ? 'succeeded' : 'failed';
+        recordRunProvenance(a);
+        let callbackFailure;
+        try {
+            onFinished(a.runId, actualOutcome, stallReason);
+        }
+        catch (err) {
+            callbackFailure = errorDetail(err);
+            console.error(`[rail-isolated] terminal callback failed for ${a.runId}: ${callbackFailure}`);
+        }
+        // A paused/interrupted programmatic workflow owns unfinished changes and
+        // verification evidence in this exact mount. Keep them available for
+        // explicit Core recovery, including a currently clean worktree.
+        if (implementationOutcome === 'failed' && hasRuntimeRequest(a.runId)) {
+            markWorktree(a, 'needs-review');
+            return {
+                run: a, implementationOutcome, deliveryOutcome: 'blocked',
+                initialSha: a.initialSha, finalSha: await readHeadSha(git, a.handle.worktreePath),
+                failureCode: 'settlement_interrupted',
+                failureDetail: 'Programmatic workflow needs attention. Resume it from Agent Runtime settings in its original worktree.',
+                safeToRelease: false,
+            };
+        }
+        // The engine may have edited a copied overlay file. Re-authenticate only
+        // automatic-cleanup authority. Allocation-time paths remain conservative
+        // NEVER-COMMIT exclusions, while a modified copy is preserved in the
+        // worktree instead of being silently staged or deleted.
+        if (a.overlayCleanupEvidence.length > 0) {
+            a.overlayCleanupEvidence = (0, worktree_overlay_1.revalidateOverlayCleanupEvidence)({
+                worktreePath: a.handle.worktreePath,
+                sourceRoot: overlaySourceRoot,
+                fallbackSourceRoots: overlayFallbackRoots,
+                providerDir: overlayProviderDir,
+                instructionsFilename: overlayInstructions,
+            }, a.overlayCleanupEvidence);
+        }
+        // Warm-dependency links are re-proven against the base repo (their source),
+        // not the framework overlay source. A link the engine replaced with a real
+        // install loses its authorization here and correctly preserves the worktree.
+        if (a.warmLinkEvidence.length > 0) {
+            a.warmLinkEvidence = (0, worktree_node_modules_1.authenticateWarmNodeModulesLinks)(baseRepo, a.handle.worktreePath)
+                .filter((live) => a.warmLinkEvidence.some((prior) => prior.path === live.path && prior.kind === live.kind && prior.digest === live.digest));
+        }
+        let commit;
+        try {
+            commit = await (0, worktree_manager_1.commitWorktreeAndVerify)(git, a.handle.worktreePath, commitMessage(a, implementationOutcome === 'failed'), a.overlayExcludes);
+        }
+        catch (err) {
+            commit = { staged: false, committed: false, clean: false, dirty: [], error: errorDetail(err) };
+        }
+        if (!commit.clean) {
+            const detail = commitFailureSummary(commit);
+            console.error(`[rail-isolated] run ${a.runId} left an unsafe worktree: ${detail}`);
+            markWorktree(a, 'needs-review');
+            return {
+                run: a,
+                implementationOutcome,
+                deliveryOutcome: 'blocked',
+                initialSha: a.initialSha,
+                finalSha: await readHeadSha(git, a.handle.worktreePath),
+                failureCode: 'commit_failed',
+                failureDetail: detail,
+                safeToRelease: false,
+            };
+        }
+        // The worktree is proven clean THIS instant — freeze the ignored-path set
+        // as the settlement snapshot. Everything ignored right now is run residue
+        // by construction (the worktree is app-created and deliverables are
+        // committed); anything ignored that appears LATER preserves the worktree.
+        a.settlementIgnoredPaths = a.automaticRelease === false ? null : await captureSettlementIgnoredPaths(git, a.handle.worktreePath, a.overlayExcludes);
+        let finalSha = null;
+        let verificationFailure;
+        if (a.continuationTarget) {
+            try {
+                finalSha = await verifyContinuationWorktree(git, baseRepo, a.handle, a.continuationTarget);
+            }
+            catch (err) {
+                verificationFailure = errorDetail(err);
+            }
+        }
+        else {
+            finalSha = await readHeadSha(git, a.handle.worktreePath);
+        }
+        const changed = commit.committed || Boolean(a.initialSha && finalSha && a.initialSha !== finalSha);
+        // A successful commit without a provable object is not retryable or safe to
+        // detach. A continuation additionally requires HEAD == refs/heads/<branch>.
+        if (verificationFailure || !finalSha || (!commit.committed && a.branchOwnership === 'created' && !a.initialSha)) {
+            const detail = verificationFailure
+                ?? (!finalSha
+                    ? 'the final HEAD object could not be verified'
+                    : 'the initial HEAD object was not captured, so a no-change result cannot be proven');
+            console.error(`[rail-isolated] run ${a.runId} finished on an unverified ref: ${detail}`);
+            markWorktree(a, 'needs-review');
+            return {
+                run: a,
+                implementationOutcome,
+                deliveryOutcome: 'blocked',
+                initialSha: a.initialSha,
+                finalSha,
+                changed,
+                failureCode: 'branch_verification_failed',
+                failureDetail: detail,
+                safeToRelease: false,
+            };
+        }
+        // Failed clean units remain `building` until aggregate cleanup removes the
+        // mount and atomically terminalizes the ledger as failed. Marking them
+        // terminal first would make idempotent cleanup skip a still-mounted path.
+        const ledgerFailure = implementationOutcome === 'succeeded'
+            ? (markWorktree(a, 'built') ?? undefined)
+            : undefined;
+        const settlementFailure = callbackFailure ?? ledgerFailure;
+        if (settlementFailure) {
+            markWorktree(a, 'needs-review');
+            return {
+                run: a,
+                implementationOutcome,
+                deliveryOutcome: 'blocked',
+                initialSha: a.initialSha,
+                finalSha,
+                changed,
+                failureCode: 'settlement_interrupted',
+                failureDetail: settlementFailure,
+                safeToRelease: false,
+            };
+        }
+        if (implementationOutcome === 'failed') {
+            return {
+                run: a,
+                implementationOutcome,
+                deliveryOutcome: 'not_started',
+                initialSha: a.initialSha,
+                finalSha,
+                changed,
+                ...(engineFailure ? { failureDetail: engineFailure } : {}),
+                safeToRelease: a.automaticRelease !== false,
+            };
+        }
+        // A resumed non-PR branch may already contain reviewable commits from an
+        // earlier attempt, even when this iteration itself did not add one.
+        let resumedBranchDelta = null;
+        if (!changed && a.continuationTarget === null && a.branchOwnership === 'preexisting') {
+            resumedBranchDelta = await branchHasDelta(git, a.handle.worktreePath, a.baseRef);
+            if (resumedBranchDelta === null) {
+                const detail = `cannot prove whether resumed branch ${a.handle.branch} has commits ahead of ${a.baseRef}`;
+                markWorktree(a, 'needs-review');
+                return {
+                    run: a,
+                    implementationOutcome,
+                    deliveryOutcome: 'blocked',
+                    initialSha: a.initialSha,
+                    finalSha,
+                    changed,
+                    failureCode: 'branch_verification_failed',
+                    failureDetail: detail,
+                    safeToRelease: false,
+                };
+            }
+        }
+        const noChanges = !changed && Boolean(a.initialSha && finalSha && a.initialSha === finalSha && (a.continuationTarget !== null ||
+            a.branchOwnership === 'created' ||
+            resumedBranchDelta === false));
+        return {
+            run: a,
+            implementationOutcome,
+            deliveryOutcome: noChanges ? 'no_changes' : 'ready',
+            initialSha: a.initialSha,
+            finalSha,
+            changed,
+            safeToRelease: a.automaticRelease !== false,
+        };
+    };
+}
 async function launchIsolatedRail(input, io = {}) {
     const { ctx, railIndex, ticketIds, loopId, loopName, loopGraph, provider, model, effort, deciderEngine } = input;
     let expectedRepositoryBaseSha = input.repositoryExecution?.expectedBaseSha;
@@ -936,6 +1145,19 @@ async function launchIsolatedRail(input, io = {}) {
                         throw err;
                     }
                 }
+                // Durable admission is part of allocation: if any snapshot cannot commit,
+                // roll back the entire batch before releasing the repository lock or
+                // starting Core. The same ownership-aware cleanup handles that failure.
+                if (prDeliveryId && (0, loop_graph_1.isDefinitionGraph)(loopGraph))
+                    ctx.db.transaction(() => {
+                        for (const run of allocated)
+                            (0, isolated_settlement_store_1.saveIsolatedSettlementSnapshot)(ctx.db, {
+                                version: 1, projectId: ctx.project.id, deliveryId: prDeliveryId, baseRepo,
+                                overlaySourceRoot, overlayFallbackRoots, overlayProviderDir, overlayInstructions,
+                                commitMessage: worktreeCommitMessage(ctx, run.ticketId, run.runId),
+                                partialCommitMessage: worktreeCommitMessage(ctx, run.ticketId, run.runId, true), run,
+                            });
+                    })();
             }
             catch (err) {
                 for (const a of allocated) {
@@ -997,7 +1219,7 @@ async function launchIsolatedRail(input, io = {}) {
             return;
         provenanceRecorded.add(a.runId);
         try {
-            recordProvenance({
+            const record = () => recordProvenance({
                 db: ctx.db,
                 projectId: ctx.project.id,
                 runId: a.runId,
@@ -1007,6 +1229,10 @@ async function launchIsolatedRail(input, io = {}) {
                 snapshot: a.provenanceSnapshot,
                 broadcast: (msg) => ctx.broadcast(msg),
             });
+            if (prDeliveryId && (0, loop_graph_1.isDefinitionGraph)(loopGraph))
+                (0, isolated_settlement_store_1.recordIsolatedProvenanceOnce)(ctx.db, prDeliveryId, a.runId, record);
+            else
+                record();
         }
         catch (err) {
             console.warn(`[rail-isolated] provenance recording failed for ${a.runId}: ${errorDetail(err)}`);
@@ -1022,206 +1248,15 @@ async function launchIsolatedRail(input, io = {}) {
             return errorDetail(err);
         }
     };
-    /** This function resolves for every allocated unit. Engine truth is captured
-     * before any delivery effect and is the only value sent to the deferred
-     * terminal callback. Delivery failures become blocked evidence instead. */
-    const settleAllocatedRun = async (a, enginePromise) => {
-        let actualOutcome = 'failed';
-        let engineFailure;
-        let stallReason;
-        try {
-            const result = await enginePromise;
-            actualOutcome = result.outcome;
-            stallReason = result.stallReason;
-        }
-        catch (err) {
-            engineFailure = errorDetail(err);
-            console.error(`[rail-isolated] loop run ${a.runId} rejected: ${engineFailure}`);
-        }
-        if (input.repositoryExecution?.isAborted?.()) {
-            // The coordinator never started. Do not commit incidental edits or
-            // release a mount borrowed from a previous delivery while rolling back.
-            const finalSha = await readHeadSha(git, a.handle.worktreePath);
-            if (a.worktreeOwnership !== 'created')
-                markWorktree(a, 'needs-review');
-            return {
-                run: a, implementationOutcome: 'failed', deliveryOutcome: 'not_started',
-                initialSha: a.initialSha, finalSha, changed: Boolean(finalSha && a.initialSha !== finalSha),
-                safeToRelease: a.worktreeOwnership === 'created' && finalSha !== null && finalSha === a.initialSha,
-            };
-        }
-        const implementationOutcome = actualOutcome === 'success' ? 'succeeded' : 'failed';
-        recordRunProvenance(a);
-        let callbackFailure;
-        try {
-            ctx.onLoopRunFinished(a.runId, actualOutcome, { ...runFinishedOpts, ...(stallReason ? { stallReason } : {}) });
-        }
-        catch (err) {
-            callbackFailure = errorDetail(err);
-            console.error(`[rail-isolated] terminal callback failed for ${a.runId}: ${callbackFailure}`);
-        }
-        // A paused/interrupted programmatic workflow owns unfinished changes and
-        // verification evidence in this exact mount. Keep them available for
-        // explicit Core recovery, including a currently clean worktree.
-        if (implementationOutcome === 'failed' && (0, agent_runtime_paths_1.hasAgentRuntimeRequest)(input.runtimeStateProject ?? ctx.project, a.runId)) {
-            markWorktree(a, 'needs-review');
-            return {
-                run: a, implementationOutcome, deliveryOutcome: 'blocked',
-                initialSha: a.initialSha, finalSha: await readHeadSha(git, a.handle.worktreePath),
-                failureCode: 'settlement_interrupted',
-                failureDetail: 'Programmatic workflow needs attention. Resume it from Agent Runtime settings in its original worktree.',
-                safeToRelease: false,
-            };
-        }
-        // The engine may have edited a copied overlay file. Re-authenticate only
-        // automatic-cleanup authority. Allocation-time paths remain conservative
-        // NEVER-COMMIT exclusions, while a modified copy is preserved in the
-        // worktree instead of being silently staged or deleted.
-        if (a.overlayCleanupEvidence.length > 0) {
-            a.overlayCleanupEvidence = (0, worktree_overlay_1.revalidateOverlayCleanupEvidence)({
-                worktreePath: a.handle.worktreePath,
-                sourceRoot: overlaySourceRoot,
-                fallbackSourceRoots: overlayFallbackRoots,
-                providerDir: overlayProviderDir,
-                instructionsFilename: overlayInstructions,
-            }, a.overlayCleanupEvidence);
-        }
-        // Warm-dependency links are re-proven against the base repo (their source),
-        // not the framework overlay source. A link the engine replaced with a real
-        // install loses its authorization here and correctly preserves the worktree.
-        if (a.warmLinkEvidence.length > 0) {
-            a.warmLinkEvidence = (0, worktree_node_modules_1.authenticateWarmNodeModulesLinks)(baseRepo, a.handle.worktreePath)
-                .filter((live) => a.warmLinkEvidence.some((prior) => prior.path === live.path && prior.kind === live.kind && prior.digest === live.digest));
-        }
-        let commit;
-        try {
-            commit = await (0, worktree_manager_1.commitWorktreeAndVerify)(git, a.handle.worktreePath, worktreeCommitMessage(ctx, a.ticketId, a.runId, implementationOutcome === 'failed'), a.overlayExcludes);
-        }
-        catch (err) {
-            commit = { staged: false, committed: false, clean: false, dirty: [], error: errorDetail(err) };
-        }
-        if (!commit.clean) {
-            const detail = commitFailureSummary(commit);
-            console.error(`[rail-isolated] run ${a.runId} left an unsafe worktree: ${detail}`);
-            markWorktree(a, 'needs-review');
-            return {
-                run: a,
-                implementationOutcome,
-                deliveryOutcome: 'blocked',
-                initialSha: a.initialSha,
-                finalSha: await readHeadSha(git, a.handle.worktreePath),
-                failureCode: 'commit_failed',
-                failureDetail: detail,
-                safeToRelease: false,
-            };
-        }
-        // The worktree is proven clean THIS instant — freeze the ignored-path set
-        // as the settlement snapshot. Everything ignored right now is run residue
-        // by construction (the worktree is app-created and deliverables are
-        // committed); anything ignored that appears LATER preserves the worktree.
-        a.settlementIgnoredPaths = await captureSettlementIgnoredPaths(git, a.handle.worktreePath, a.overlayExcludes);
-        let finalSha = null;
-        let verificationFailure;
-        if (a.continuationTarget) {
-            try {
-                finalSha = await verifyContinuationWorktree(git, baseRepo, a.handle, a.continuationTarget);
-            }
-            catch (err) {
-                verificationFailure = errorDetail(err);
-            }
-        }
-        else {
-            finalSha = await readHeadSha(git, a.handle.worktreePath);
-        }
-        const changed = commit.committed || Boolean(a.initialSha && finalSha && a.initialSha !== finalSha);
-        // A successful commit without a provable object is not retryable or safe to
-        // detach. A continuation additionally requires HEAD == refs/heads/<branch>.
-        if (verificationFailure || !finalSha || (!commit.committed && a.branchOwnership === 'created' && !a.initialSha)) {
-            const detail = verificationFailure
-                ?? (!finalSha
-                    ? 'the final HEAD object could not be verified'
-                    : 'the initial HEAD object was not captured, so a no-change result cannot be proven');
-            console.error(`[rail-isolated] run ${a.runId} finished on an unverified ref: ${detail}`);
-            markWorktree(a, 'needs-review');
-            return {
-                run: a,
-                implementationOutcome,
-                deliveryOutcome: 'blocked',
-                initialSha: a.initialSha,
-                finalSha,
-                changed,
-                failureCode: 'branch_verification_failed',
-                failureDetail: detail,
-                safeToRelease: false,
-            };
-        }
-        // Failed clean units remain `building` until aggregate cleanup removes the
-        // mount and atomically terminalizes the ledger as failed. Marking them
-        // terminal first would make idempotent cleanup skip a still-mounted path.
-        const ledgerFailure = implementationOutcome === 'succeeded'
-            ? (markWorktree(a, 'built') ?? undefined)
-            : undefined;
-        const settlementFailure = callbackFailure ?? ledgerFailure;
-        if (settlementFailure) {
-            markWorktree(a, 'needs-review');
-            return {
-                run: a,
-                implementationOutcome,
-                deliveryOutcome: 'blocked',
-                initialSha: a.initialSha,
-                finalSha,
-                changed,
-                failureCode: 'settlement_interrupted',
-                failureDetail: settlementFailure,
-                safeToRelease: false,
-            };
-        }
-        if (implementationOutcome === 'failed') {
-            return {
-                run: a,
-                implementationOutcome,
-                deliveryOutcome: 'not_started',
-                initialSha: a.initialSha,
-                finalSha,
-                changed,
-                ...(engineFailure ? { failureDetail: engineFailure } : {}),
-                safeToRelease: true,
-            };
-        }
-        // A resumed non-PR branch may already contain reviewable commits from an
-        // earlier attempt, even when this iteration itself did not add one.
-        let resumedBranchDelta = null;
-        if (!changed && a.continuationTarget === null && a.branchOwnership === 'preexisting') {
-            resumedBranchDelta = await branchHasDelta(git, a.handle.worktreePath, a.baseRef);
-            if (resumedBranchDelta === null) {
-                const detail = `cannot prove whether resumed branch ${a.handle.branch} has commits ahead of ${a.baseRef}`;
-                markWorktree(a, 'needs-review');
-                return {
-                    run: a,
-                    implementationOutcome,
-                    deliveryOutcome: 'blocked',
-                    initialSha: a.initialSha,
-                    finalSha,
-                    changed,
-                    failureCode: 'branch_verification_failed',
-                    failureDetail: detail,
-                    safeToRelease: false,
-                };
-            }
-        }
-        const noChanges = !changed && Boolean(a.initialSha && finalSha && a.initialSha === finalSha && (a.continuationTarget !== null ||
-            a.branchOwnership === 'created' ||
-            resumedBranchDelta === false));
-        return {
-            run: a,
-            implementationOutcome,
-            deliveryOutcome: noChanges ? 'no_changes' : 'ready',
-            initialSha: a.initialSha,
-            finalSha,
-            changed,
-            safeToRelease: true,
-        };
-    };
+    const settleAllocatedRun = createIsolatedRunSettlement({
+        git, baseRepo, overlaySourceRoot, overlayFallbackRoots, overlayProviderDir, overlayInstructions,
+        isAborted: input.repositoryExecution?.isAborted,
+        ownsRun: runId => !(0, loop_runs_store_1.readDefinitionForkTarget)(ctx.db, runId),
+        onFinished: (runId, outcome, stallReason) => ctx.onLoopRunFinished(runId, outcome, { ...runFinishedOpts, ...(stallReason ? { stallReason } : {}) }),
+        recordRunProvenance, markWorktree,
+        hasRuntimeRequest: runId => (0, agent_runtime_paths_1.hasAgentRuntimeRequest)(input.runtimeStateProject ?? ctx.project, runId),
+        commitMessage: (run, partial) => worktreeCommitMessage(ctx, run.ticketId, run.runId, partial),
+    });
     const runPromises = [];
     for (const a of allocated) {
         ctx.railLoopRuns.set(a.runId, {
@@ -1259,7 +1294,14 @@ async function launchIsolatedRail(input, io = {}) {
             ...(input.followUp ? { followUp: { id: input.followUp.id, version: input.followUp.version, hash: input.followUp.hash, openspecChangeName: input.followUp.openspecChangeName ?? null, briefing: (0, pr_follow_up_1.renderFollowUpBriefing)(input.followUp, { prNumber: launchContinuation?.prNumber ?? input.explicitPrTarget?.prNumber ?? null, ticketIds }) } } : {}),
             ...(claimedAddenda.briefing ? { addenda: { ids: claimedAddenda.snapshot.map((e) => e.id), briefing: claimedAddenda.briefing } } : {}),
         });
-        runPromises.push(settleAllocatedRun(a, enginePromise));
+        runPromises.push(settleAllocatedRun(a, enginePromise).then(async (result) => {
+            if (prDeliveryId && (0, loop_graph_1.isDefinitionGraph)(loopGraph))
+                (0, isolated_settlement_store_1.saveIsolatedSettlementResult)(ctx.db, prDeliveryId, result);
+            if (prDeliveryId && (0, loop_graph_1.isDefinitionGraph)(loopGraph) && allocated.some(unit => (0, loop_runs_store_1.readDefinitionForkTarget)(ctx.db, unit.runId))) {
+                await reattachIsolatedSettlement(ctx, prDeliveryId, a.runId).catch(error => console.error('[rail-isolated] fork sibling settlement remains pending:', error));
+            }
+            return result;
+        }));
         try {
             ctx.jiraSyncManager.onRailLaunch(a.ticketIds, a.runId);
         }
@@ -1282,6 +1324,8 @@ async function launchIsolatedRail(input, io = {}) {
     //       the draft PR is only created when the user clicks [Create PR] on the
     //       pr-decision endpoint (ask-first, safe-pr-review-flow).
     const guardedRunPromises = runPromises.map((promise, index) => promise.catch(async (err) => {
+        if ((0, loop_runs_store_1.readDefinitionForkTarget)(ctx.db, allocated[index].runId))
+            return { run: allocated[index], implementationOutcome: 'failed', deliveryOutcome: 'not_started', initialSha: allocated[index].initialSha, finalSha: null, safeToRelease: false };
         const run = allocated[index];
         const detail = errorDetail(err);
         console.error(`[rail-isolated] unexpected settlement rejection for ${run.runId}: ${detail}`);
@@ -1300,6 +1344,8 @@ async function launchIsolatedRail(input, io = {}) {
         };
     }));
     void Promise.all(guardedRunPromises).then(async (settledResults) => {
+        if (allocated.some(unit => (0, loop_runs_store_1.readDefinitionForkTarget)(ctx.db, unit.runId)))
+            return;
         // Cardinality is invariant: one structured result per allocated unit. The
         // guarded promises above synthesize a blocked record for any rejection.
         let results = settledResults;
@@ -1590,9 +1636,12 @@ async function launchIsolatedRail(input, io = {}) {
             const harvest = io.harvestEvidence ?? delivery_evidence_1.harvestDeliveryEvidence;
             let settleEvidence;
             try {
+                const definitionEvidence = await (0, loop_definition_recovery_1.probeDefinitionRuns)({ db: ctx.db, cwd: ctx.project.path, env: process.env }, results.filter(result => (0, loop_runs_store_1.getLoopRun)(ctx.db, result.run.runId)?.engine_version === 2).map(result => result.run.runId), true);
                 settleEvidence = harvest({ readEvents: (runId) => (0, db_1.getJobEvents)(ctx.db, runId) }, results.map((result) => ({
                     ticketId: result.run.ticketId,
                     runId: result.run.runId,
+                    definitionStatus: definitionEvidence.get(result.run.runId),
+                    reviewerStepId: (0, loop_runs_store_1.readDefinitionRun)(ctx.db, result.run.runId)?.request.graph.config.reviewerStepId,
                     worktreePath: result.run.handle.worktreePath,
                     loopId,
                     // Programmatic-runtime evidence (host-run verification, reviewer
@@ -1674,6 +1723,8 @@ async function launchIsolatedRail(input, io = {}) {
             succeeded: result.deliveryOutcome === 'ready',
         })));
         try {
+            if (branches.length)
+                (0, legacy_launch_telemetry_1.recordLegacyLaunch)(ctx.db, { kind: 'merge_back', projectId: ctx.project.id, runId: allocated[0]?.runId });
             const outcomes = await (0, rail_merge_orchestrator_1.runMergeBack)({
                 git, executor: (0, loop_executors_1.createLoopExecutors)(), baseDir: baseRepo,
                 provider, model, effort, ...(deciderEngine ? { deciderEngine } : {}), constants, branches,
@@ -1723,6 +1774,8 @@ async function launchIsolatedRail(input, io = {}) {
             console.error('[rail-isolated] merge-back failed:', err);
         }
     }).catch(async (err) => {
+        if (allocated.some(unit => (0, loop_runs_store_1.readDefinitionForkTarget)(ctx.db, unit.runId)))
+            return;
         const detail = errorDetail(err);
         console.error(`[rail-isolated] aggregate settlement failed: ${detail}`);
         if (!prMode || !prDeliveryId || (0, rail_pr_store_1.getPrDelivery)(ctx.db, prDeliveryId)?.decision !== 'building')
@@ -1750,6 +1803,138 @@ async function launchIsolatedRail(input, io = {}) {
     }).finally(() => { input.repositoryExecution?.onSettled(prDeliveryId); });
     return allocated.map((a) => a.runId);
 }
+/** Git and Node can spell the same Windows directory differently. Compare its
+ * filesystem identity instead of case-folding paths (which could admit another
+ * repository on a case-sensitive volume). */
+function sameRecoveryDirectory(observed, expected) {
+    const left = fs.statSync(observed, { bigint: true });
+    const right = fs.statSync(expected, { bigint: true });
+    if (!left.isDirectory() || !right.isDirectory())
+        return false;
+    if (left.ino !== 0n && right.ino !== 0n)
+        return left.dev === right.dev && left.ino === right.ino;
+    return fs.realpathSync.native(observed) === fs.realpathSync.native(expected);
+}
+/** Reattach the original allocation after Core finishes; no new generation or remote effects. */
+async function reattachIsolatedSettlement(ctx, deliveryId, runId, io = {}) {
+    const frozen = (0, loop_runs_store_1.readDefinitionRun)(ctx.db, runId);
+    if (!frozen || frozen.row.project_id !== ctx.project.id || frozen.row.status !== 'completed')
+        throw new Error('Recovered workflow must finish before delivery settlement');
+    (0, isolated_settlement_reconstruction_1.ensureIsolatedSettlementSnapshot)(ctx.db, ctx.project.id, runId);
+    const ids = ctx.db.prepare('SELECT delivery_id FROM definition_delivery_settlements WHERE project_id=? AND run_id=? ORDER BY delivery_id')
+        .all(ctx.project.id, runId);
+    const rows = ids.map(({ delivery_id }) => (0, rail_pr_store_1.getPrDelivery)(ctx.db, delivery_id));
+    if (!rows.length || rows.some(row => !row) || !rows.some(row => row.id === deliveryId || row.parent_delivery_id === deliveryId))
+        throw new Error('Original isolated settlement is unavailable');
+    const deliveries = rows.filter((row) => !!row);
+    if (deliveries.some(row => ['discarded', 'superseded', 'merged', 'completed'].includes(row.decision)))
+        throw new Error('Delivery ownership has already changed');
+    const parents = [...new Set(deliveries.map(row => row.parent_delivery_id).filter((id) => !!id))];
+    const allRows = [...deliveries, ...parents.map(id => (0, rail_pr_store_1.getPrDelivery)(ctx.db, id)).filter((row) => !!row)];
+    if (allRows.some(row => ['discarded', 'superseded', 'merged', 'completed'].includes(row.decision)))
+        throw new Error('Delivery group ownership has already changed');
+    const pending = deliveries.filter(row => !['on_review', 'no_changes', 'pr_draft', 'pr_ready'].includes(row.decision));
+    if (!pending.length) {
+        ctx.onLoopRunFinished(runId, frozen.row.final_outcome ?? 'failed', { ticketCompletionStatus: 'on_review' });
+        return;
+    }
+    // Terminal admission must not depend on optional, potentially large evidence
+    // outputs. A failed full-status harvest stays visible in the review packet.
+    const probe = await (0, loop_definition_recovery_1.probeDefinitionRun)({ db: ctx.db, cwd: ctx.project.path, env: process.env }, runId);
+    if (probe.status === 'unavailable' || probe.lease?.active || ['paused', 'running'].includes(probe.status))
+        throw new Error('Core has not provided an inactive terminal result');
+    const policy = frozen.metadata.definition?.delivery;
+    const accepted = probe.status === 'succeeded' && probe.completion?.ok === true && (policy?.requiresVerified === false || probe.completion.verified);
+    const outcome = accepted ? 'success' : probe.status === 'cancelled' ? 'stopped' : 'blocked';
+    const token = (0, ids_1.newId)();
+    const execution = (0, loop_runs_store_1.claimDefinitionExecution)(ctx.db, runId, { owner: token, repositoryMounts: (0, loop_runs_store_1.definitionRepositoryMounts)(frozen.request) });
+    if (!execution.ok)
+        throw new Error(`runtime_run_active: ${execution.conflictingRunId}`);
+    const claimed = [];
+    const git = io.git ?? worktree_manager_1.defaultGitRunner;
+    try {
+        ctx.db.transaction(() => {
+            for (const row of allRows) {
+                if (!(0, rail_pr_store_1.claimPrDeliveryOperation)(ctx.db, row.id, row.decision, 'recover-and-retry', token))
+                    throw new Error('Delivery is busy; retry settlement');
+                claimed.push(row);
+            }
+        })();
+        for (const row of pending) {
+            const records = (0, isolated_settlement_store_1.readIsolatedSettlementRecords)(ctx.db, ctx.project.id, row.id);
+            const record = records.find(item => item.snapshot.run.runId === runId);
+            if (!record)
+                throw new Error('Original isolated allocation is missing');
+            const snapshot = record.snapshot, run = snapshot.run;
+            const ledger = (0, rail_worktrees_store_1.getRailWorktree)(ctx.db, run.ledgerId);
+            if (!ledger || ledger.run_id !== runId || ledger.branch !== run.handle.branch || ledger.worktree_path !== run.handle.worktreePath)
+                throw new Error('Worktree ownership changed before recovery');
+            const context = frozen.metadata.context ?? (frozen.metadata.contextPath ? JSON.parse(fs.readFileSync(frozen.metadata.contextPath, 'utf8')) : null);
+            if (!context || context.runId !== runId || !Array.isArray(context.repositories) || !context.repositories.some((repo) => repo.path && fs.realpathSync(repo.path) === fs.realpathSync(run.handle.worktreePath)))
+                throw new Error('Recovered mount is outside the frozen Core context');
+            if (snapshot.reconstructedFrom) {
+                const repository = frozen.request.executionManifest?.repositories.find(item => item.worktreeId === run.ledgerId);
+                const common = await git.run(['rev-parse', '--path-format=absolute', '--git-common-dir'], run.handle.worktreePath);
+                if (!repository || common.code !== 0 || !common.stdout.trim() ||
+                    !sameRecoveryDirectory(common.stdout.trim(), repository.gitCommonDir))
+                    throw new Error('Recovered worktree belongs to another Git repository');
+            }
+            const branch = await git.run(['branch', '--show-current'], run.handle.worktreePath);
+            if (branch.code !== 0 || branch.stdout.trim() !== run.handle.branch)
+                throw new Error('Recovered worktree is on another branch');
+            const settle = createIsolatedRunSettlement({
+                ...snapshot, git,
+                onFinished: () => { },
+                hasRuntimeRequest: () => true,
+                commitMessage: (_run, partial) => partial ? snapshot.partialCommitMessage : snapshot.commitMessage,
+                markWorktree: (unit, state) => (0, rail_worktrees_store_1.updateRailWorktreeState)(ctx.db, unit.ledgerId, state) ? null : 'Worktree ledger disappeared',
+                recordRunProvenance: unit => (0, isolated_settlement_store_1.recordIsolatedProvenanceOnce)(ctx.db, row.id, runId, () => (io.recordProvenance ?? file_story_1.recordLoopRunProvenance)({
+                    db: ctx.db, projectId: ctx.project.id, runId, ticketId: unit.ticketId, repoDir: unit.handle.worktreePath,
+                    repositoryId: row.repository_id ?? undefined, snapshot: unit.provenanceSnapshot, broadcast: message => ctx.broadcast(message),
+                })),
+            });
+            const result = await settle(run, Promise.resolve({ runId, outcome }));
+            (0, isolated_settlement_store_1.saveIsolatedSettlementResult)(ctx.db, row.id, result);
+            const latest = (0, isolated_settlement_store_1.readIsolatedSettlementRecords)(ctx.db, ctx.project.id, row.id);
+            const results = latest.flatMap(item => item.result ? [item.result] : []);
+            const complete = results.length === latest.length;
+            const successes = results.filter(item => item.implementationOutcome === 'succeeded');
+            const ready = results.filter(item => item.deliveryOutcome === 'ready');
+            const noChanges = complete && results.every(item => item.deliveryOutcome === 'no_changes');
+            const partial = complete && ready.length > 0 && results.some(item => item.implementationOutcome !== 'succeeded' || !['ready', 'no_changes'].includes(item.deliveryOutcome));
+            const next = !complete ? 'building' : !successes.length ? 'implementation_failed' : row.pr_url ? 'pr_failed' : ready.length ? 'on_review' : noChanges ? 'no_changes' : 'pr_failed';
+            const definitionEvidence = await (0, loop_definition_recovery_1.probeDefinitionRuns)({ db: ctx.db, cwd: ctx.project.path, env: process.env }, results.map(item => item.run.runId), true);
+            const evidence = (io.harvestEvidence ?? delivery_evidence_1.harvestDeliveryEvidence)({ readEvents: id => (0, db_1.getJobEvents)(ctx.db, id) }, results.map(item => ({
+                ticketId: item.run.ticketId, runId: item.run.runId, worktreePath: item.run.handle.worktreePath,
+                definitionStatus: definitionEvidence.get(item.run.runId),
+                reviewerStepId: (0, loop_runs_store_1.readDefinitionRun)(ctx.db, item.run.runId)?.request.graph.config.reviewerStepId,
+            })));
+            if (!(0, rail_pr_store_1.transitionClaimedDecision)(ctx.db, row.id, row.decision, next, token, {
+                branches: branchRecords(results), runIds: latest.map(item => item.snapshot.run.runId), worktreeIds: latest.map(item => item.snapshot.run.ledgerId),
+                implementationOutcome: !complete ? 'unknown' : successes.length === results.length ? 'succeeded' : successes.length ? 'partially_succeeded' : 'failed',
+                deliveryOutcome: !complete ? 'not_started' : row.pr_url && ready.length ? 'retryable_failure' : ready.length ? (partial ? 'partial' : 'ready') : noChanges ? 'no_changes' : 'blocked',
+                statusCode: !complete ? 'restart_pending' : row.pr_url && ready.length ? 'settlement_interrupted' : ready.length ? (partial ? 'partial_success' : 'ready_for_review') : noChanges ? 'no_changes' : 'implementation_failed',
+                statusDetail: row.pr_url && ready.length ? 'Recovered local work is ready. Retry delivery to update the existing PR.' : null,
+                ...(results.length === 1 ? { deliverySha: results[0].finalSha } : {}), settleEvidence: evidence,
+            }))
+                throw new Error('Delivery changed during recovered settlement');
+        }
+        const { refreshRepositoryDeliveryGroup } = await Promise.resolve().then(() => __importStar(require('./multi-repo-execution')));
+        for (const parent of parents)
+            refreshRepositoryDeliveryGroup(ctx.db, parent);
+        ctx.onLoopRunFinished(runId, outcome, { ticketCompletionStatus: 'on_review' });
+    }
+    finally {
+        for (const row of claimed)
+            (0, rail_pr_store_1.releasePrDeliveryOperation)(ctx.db, row.id, token);
+        execution.release();
+    }
+    for (const row of allRows) {
+        const latest = (0, rail_pr_store_1.getPrDelivery)(ctx.db, row.id);
+        if (latest)
+            ctx.broadcast((0, rail_pr_store_1.toRailPrStateMessage)(ctx.project.id, (0, rail_pr_store_1.toPrDeliverySnapshot)(latest)));
+    }
+}
 function recoveryOverlayExcludes(repoDir, worktreePath) {
     try {
         const parsed = JSON.parse(fs.readFileSync(path.join(worktreePath, worktree_overlay_1.OVERLAY_MANIFEST), 'utf8'));