code-coordinator 0.5.46__py3-none-any.whl

coord/merge_queue.py

@@ -0,0 +1,4681 @@
+"""Merge queue: sequence completed assignments into their target branches.
+
+Two-layer design so the logic is testable without hitting `gh`:
+
+- Data + sequencing live here (pure functions over QueuedMerge).
+- Wire calls (gh pr create / merge / size) are passed in as `gh_ops` so
+  tests can substitute a stub. `coord.cli` wires the real `coord.github_ops`.
+"""
+
+from __future__ import annotations
+
+import json
+import logging
+import time
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Iterable, NamedTuple, Protocol
+
+from coord.audit import record_audit
+from coord.ci_store import (
+    CheckRun,
+    CiCheckSummary,
+    CiStore,
+    JobRun,
+    NoOpCi,
+    checks_are_stale,
+    failed_checks,
+    in_flight_checks,
+    is_verdictless_job,
+    summarize,
+    summarize_counts,
+)
+from coord.db import get_connection
+from coord.models import CLOSES_ISSUE_TYPES, WORK_LIKE_TYPES, Assignment
+from coord.pr_body_lint import downgrade_closing_keywords, find_closing_references
+from coord.state import COORD_DIR, dismiss_drive_escalation
+
+_log = logging.getLogger(__name__)
+
+# Legacy path constant — kept for backward compat with monkeypatch calls in tests.
+QUEUE_FILE = COORD_DIR / "merge_queue.json"
+
+# States
+PENDING = "pending"
+MERGING = "merging"
+MERGED = "merged"
+CONFLICT = "conflict"
+SKIPPED = "skipped"
+# Set on a merge entry whose conflict-fix attempt also failed — the user must
+# resolve the conflict by hand.  See #241.
+HUMAN_REQUIRED = "human_required"
+
+
+# ── Conflict classification ─────────────────────────────────────────────────
+
+# #1467: the specific subset of GitHub wording that means a --rebase merge
+# was refused purely because the branch contains a merge commit — a
+# *linearity* failure, not a content conflict. This distinction matters for
+# reconcile_conflict_entries: GitHub's `mergeable` field (what
+# check_pr_mergeable reads) only reflects content conflicts and happily
+# reports MERGEABLE for a branch that is clean but not rebase-able, so a
+# plain mergeable check is not evidence that a retried --rebase will
+# succeed. See is_rebase_refusal(). Defined once here and folded into
+# _REBASEABLE_SIGNALS below so the two lists can't drift apart.
+_REBASE_REFUSAL_SIGNALS = (
+    "can't be rebased",
+    "cannot be rebased",
+)
+
+_REBASEABLE_SIGNALS = (
+    "could not be rebased",
+    # #1467: GitHub's actual wording when a branch contains a merge commit
+    # — distinct from "could not be rebased" above (which never matched it)
+    # and previously fell through to "unknown", so #241's conflict-fix
+    # worker was never dispatched and the entry parked forever. A local
+    # `git rebase origin/main` linearises the branch, which is exactly what
+    # the dispatched conflict-fix worker attempts.
+    *_REBASE_REFUSAL_SIGNALS,
+    "merge conflict",
+    "not up to date",
+    "non-fast-forward",
+    "behind the base branch",
+    # `gh pr merge` returns this when the PR is behind base and a rebase
+    # would be needed.  Common on PRs that sat open while main moved.
+    "merge commit cannot be cleanly created",
+    "not mergeable",
+)
+
+_HUMAN_SIGNALS = (
+    "required status check",
+    "review required",
+    "permission",
+    "protected branch",
+    "branch protection",
+)
+
+
+def classify_conflict(error: str | None) -> str:
+    """Decide what kind of merge failure ``error`` represents.
+
+    Returns ``"rebaseable"`` (a mechanical rebase conflict an agent can
+    attempt), ``"human"`` (permission / branch protection — surface to the
+    user), or ``"unknown"`` (don't auto-dispatch; let the user inspect).
+
+    Used by ``coord merge`` (#241) to decide whether to spawn a
+    ``type="conflict-fix"`` assignment or surface the failure as-is.
+    """
+    if not error:
+        return "unknown"
+    text = error.lower()
+    if any(sig in text for sig in _HUMAN_SIGNALS):
+        return "human"
+    if any(sig in text for sig in _REBASEABLE_SIGNALS):
+        return "rebaseable"
+    return "unknown"
+
+
+def is_rebase_refusal(error: str | None) -> bool:
+    """True when ``error`` is specifically GitHub's "branch can't be
+    rebased" refusal — a merge commit on the branch, not a content
+    conflict (#1467).
+
+    Narrower than ``classify_conflict(error) == "rebaseable"``, which also
+    matches ordinary content conflicts ("merge conflict", "not mergeable",
+    …) that GitHub's own ``mergeable`` field already reports accurately.
+    This predicate isolates the one failure mode where ``mergeable:
+    MERGEABLE`` is *not* proof a retried ``--rebase`` will succeed, so
+    :func:`reconcile_conflict_entries` and the ``coord merge`` CLI can treat
+    it differently from a plain conflict.
+    """
+    if not error:
+        return False
+    text = error.lower()
+    return any(sig in text for sig in _REBASE_REFUSAL_SIGNALS)
+
+
+# ── Work-chain resolution (#567) ────────────────────────────────────────────
+
+def _chain_work_ids(entry: "QueuedMerge", pool: list) -> set[str]:
+    """Collect every work-assignment id connected to *entry*: by branch
+    equality (pre-#567 behaviour) **or** by the ``review_of_assignment_id``
+    linkage a bounce-fix worker records back to the assignment it fixes.
+
+    #567: a fix worker dispatched under the #557 remote-interactive-rework
+    gap has ``branch=NULL``, so it never matches ``branch == entry.branch``
+    and a verdict recorded on it is invisible to ``has_approved_review`` /
+    ``has_smoke_verdict``. Every ``WORK_LIKE_TYPES`` assignment dispatched as
+    a fix records ``review_of_assignment_id`` pointing at the assignment it
+    fixes (``auto_loop.py`` fix dispatch), so the chain is reconstructable
+    without a branch match. Expansion runs to a fixed point so multi-hop
+    bounce chains (a fix of a fix) are fully covered, not just one hop.
+
+    #1601: the walk used to be forward-only — a known PARENT pulled in its
+    CHILD (the fix round), but not the reverse. An entry keyed to the child
+    (e.g. the fix round's own approved re-review, per #292 Defect 2's
+    re-keying) could not walk *backward* to reach the parent's still-useful
+    fields (its ``test_state``/``smoke_test`` verdict, when the fix round
+    never re-ran one) whenever branch equality alone didn't already bridge
+    the two — the same ``branch=NULL`` gap #567 fixed for the forward
+    direction. The expansion is now symmetric: a known row pulls in both its
+    recorded children AND its own ``review_of_assignment_id`` parent.
+    """
+    work_ids: set[str] = set()
+    if entry.assignment_id:
+        work_ids.add(entry.assignment_id)
+
+    work_assignments = [a for a in pool if getattr(a, "type", None) in WORK_LIKE_TYPES]
+
+    # Branch equality — the original (#292) expansion.
+    for a in work_assignments:
+        aid = getattr(a, "assignment_id", None)
+        branch = getattr(a, "branch", None)
+        if aid and branch and branch == entry.branch:
+            work_ids.add(aid)
+
+    # review_of_assignment_id chain — covers fix workers with branch=NULL,
+    # and multi-iteration bounce chains via a fixed-point expansion. Runs in
+    # BOTH directions (#1601) so the chain is the same set regardless of
+    # which round in it the entry happens to be keyed to.
+    changed = True
+    while changed:
+        changed = False
+        for a in work_assignments:
+            aid = getattr(a, "assignment_id", None)
+            parent = getattr(a, "review_of_assignment_id", None)
+            # Forward: a known parent pulls in its child.
+            if aid and parent in work_ids and aid not in work_ids:
+                work_ids.add(aid)
+                changed = True
+            # Backward (#1601): a known child pulls in its own parent.
+            if aid and aid in work_ids and parent and parent not in work_ids:
+                work_ids.add(parent)
+                changed = True
+
+    return work_ids
+
+
+# ── Branch winner resolution (#1490) ────────────────────────────────────────
+#
+# A fix/bounce cycle dispatches a fresh WORK_LIKE_TYPES assignment for every
+# retry, and every one of them keeps its row in `board.completed` forever —
+# all targeting the same branch. `enqueue_approved_work` (the daemon tick)
+# and `coord merge`'s own auto-enqueue scan both used to process every such
+# row independently and hand each one to `refresh_entry_assignment`, which
+# re-keys the ONE queue row that exists for the branch to whichever
+# assignment_id it was just called with. Processing three rows on one
+# branch in a single pass therefore re-keyed the same entry three times in
+# a row and printed three "auto-enqueued" lines for what is — and always
+# was — a single queue entry; because the gates
+# (`passes_merge_gates`/`has_approved_review`/`has_smoke_verdict`) are
+# resolved over the whole branch chain rather than the specific row passed
+# in, even the row with a *failed* test_state would pass the gate and win a
+# later iteration's re-key, so the "current" key flip-flopped across every
+# row on every single tick, forever (#1490's observed bug).
+#
+# The fix: resolve every branch to a single winner *before* touching the
+# queue at all, and never enqueue (or re-announce) the other rows.
+
+
+def _select_winning_work_assignment(work_assignments: list) -> "Assignment":
+    """Pick the one row in *work_assignments* — all sharing one branch —
+    that should key the branch's merge-queue entry.
+
+    Prefers the most-recently-dispatched row that already carries a fresh
+    terminal smoke verdict (``test_state in ('passed', 'skipped')``) — the
+    "approved + test-passed" row the issue asks the queue entry to track.
+    Falls back to the most-recently-dispatched row overall when none has
+    passed yet (the branch is still mid-cycle; it should still enqueue —
+    blocked on the smoke gate — rather than vanish). Ties on
+    ``dispatched_at`` (including everything being ``None``, e.g. rows from
+    tests or pre-#821 data) resolve to the last one in *work_assignments*
+    (typically ``board.completed`` insertion order, i.e. the most recently
+    seen row), same tie-break convention as :func:`resolve_entry_key`.
+    """
+    def _dispatched_at(a) -> float:
+        return getattr(a, "dispatched_at", None) or 0
+
+    passed = [
+        a for a in work_assignments
+        if getattr(a, "test_state", None) in ("passed", "skipped")
+    ]
+    pool = passed if passed else work_assignments
+    winner = pool[0]
+    for a in pool[1:]:
+        if _dispatched_at(a) >= _dispatched_at(winner):
+            winner = a
+    return winner
+
+
+def group_branch_candidates(completed: Iterable) -> list[tuple["Assignment", list]]:
+    """Group every done :data:`~coord.models.WORK_LIKE_TYPES` assignment in
+    *completed* by ``(repo_name, branch)`` and resolve each group to a
+    single winner (#1490).
+
+    Returns one ``(winner, superseded)`` pair per distinct ``(repo_name,
+    branch)`` group, in first-seen order (stable — output doesn't jitter
+    run to run). ``superseded`` holds the group's other rows (``[]`` when
+    there was only one); callers must log them and never enqueue them —
+    see :func:`_select_winning_work_assignment` for how the winner is
+    chosen.
+
+    Rows missing ``branch``/``assignment_id``, not in ``WORK_LIKE_TYPES``,
+    or not ``status == "done"`` are dropped from consideration entirely —
+    the same ad-hoc filter both call sites (`enqueue_approved_work`, the
+    ``coord merge`` auto-enqueue scan) applied before this was extracted.
+    """
+    order: list[tuple[str, str]] = []
+    groups: dict[tuple[str, str], list] = {}
+    for a in completed:
+        if getattr(a, "type", None) not in WORK_LIKE_TYPES:
+            continue
+        if getattr(a, "status", None) != "done":
+            continue
+        branch = getattr(a, "branch", None)
+        aid = getattr(a, "assignment_id", None)
+        if not branch or not aid:
+            continue
+        key = (getattr(a, "repo_name", None), branch)
+        if key not in groups:
+            groups[key] = []
+            order.append(key)
+        groups[key].append(a)
+
+    result: list[tuple["Assignment", list]] = []
+    for key in order:
+        rows = groups[key]
+        winner = rows[0] if len(rows) == 1 else _select_winning_work_assignment(rows)
+        superseded = [r for r in rows if r is not winner]
+        result.append((winner, superseded))
+    return result
+
+
+def _log_superseded(row) -> None:
+    """One clear line per row a branch-winner scan skipped (#1490) — so
+    "three rows, one queue entry" reads as expected coalescing rather than
+    "two got lost"."""
+    _log.info(
+        "merge-queue: %s#%s assignment %s (branch %s) superseded on this "
+        "branch — not enqueued",
+        getattr(row, "repo_name", None),
+        getattr(row, "issue_number", None),
+        getattr(row, "assignment_id", None),
+        getattr(row, "branch", None),
+    )
+
+
+# ── Review gate (#253) ──────────────────────────────────────────────────────
+
+def requires_review(entry: "QueuedMerge", config) -> bool:
+    """True when *entry* must have an approved review before merging.
+
+    Honours ``config.reviews.enabled`` (the master switch for the
+    adversarial review feature) and the *effective* gate list: ``entry``'s
+    own ``required_gates`` when set, falling back to
+    ``config.pipeline.default_gates`` otherwise (#1213).  ``entry`` is
+    duck-typed — both ``QueuedMerge`` (``required_gates`` snapshotted at
+    :func:`enqueue` time, commit-bound) and ``Assignment`` (``required_gates``
+    resolved from ``config.pipeline.labels`` at dispatch time, see
+    :func:`coord.brain.resolve_required_gates`) carry the attribute, so
+    ``coord.merge_queue.plan`` can pass either.  Untagged work — the entry
+    has no override — behaves exactly as before this change: the default
+    policy applies. Explicit-only overrides (``--skip-review``) remain
+    available as a manual escape hatch on top of this.
+    """
+    if not getattr(config, "reviews", None) or not config.reviews.enabled:
+        return False
+    pipeline = getattr(config, "pipeline", None)
+    if pipeline is None:
+        return True
+    gates = getattr(entry, "required_gates", None) or (pipeline.default_gates or [])
+    return "review" in gates
+
+
+def _backfill_branch_patch_id(entry: "QueuedMerge", gh_ops: "GhOps | None") -> str | None:
+    """Return ``entry.branch_patch_id``, computing and persisting it via
+    *gh_ops* when null, or ``None`` when it can't be determined.
+
+    #1506: ``entry.branch_patch_id`` is normally populated by :func:`process`
+    before the review/smoke gates run, but any entry that reaches
+    :func:`has_approved_review` / :func:`find_scoped_review_candidate`
+    without having gone through that backfill first — most notably every
+    queue row whose approved review predates #1475, which never got a
+    chance to backfill it — has ``branch_patch_id: None`` forever, and a
+    null there previously meant "cannot prove identical", voiding an
+    approval for a diff that had not changed by one byte.
+
+    The base passed is *entry.target_branch* — a branch **name**, resolved
+    by GitHub's three-dot compare API (:func:`coord.github_ops.
+    get_branch_patch_id`) to the true merge-base of the two refs — never the
+    PR's recorded ``baseRefOid``. Using ``baseRefOid`` produces a false
+    mismatch once the base branch has advanced past the PR's original fork
+    point (#1506's investigation hit exactly this).
+
+    ``gh_ops=None`` (no client available) or a missing repo/base/branch on
+    *entry* returns ``None`` without any I/O — callers fail closed exactly as
+    before. A successful computation is written back onto *entry* so the
+    ``gh api compare`` round trip happens at most once per entry; the caller
+    is responsible for persisting the entry (e.g. ``save_queue``) same as
+    the existing ``branch_head_sha``/``branch_patch_id`` backfills in
+    :func:`process`.
+    """
+    if gh_ops is None:
+        return None
+    repo = getattr(entry, "repo_github", None)
+    base = getattr(entry, "target_branch", None)
+    branch = getattr(entry, "branch", None)
+    if not repo or not base or not branch:
+        return None
+    try:
+        computed = gh_ops.get_branch_patch_id(repo, base, branch)
+    except Exception:  # noqa: BLE001 — fail-safe: unknown patch-id is not blocking
+        return None
+    if computed is not None:
+        try:
+            entry.branch_patch_id = computed
+        except Exception:  # noqa: BLE001 — best effort; a read-only entry just recomputes next time
+            pass
+    return computed
+
+
+class ApprovalScan(NamedTuple):
+    """The result of one walk over *board*'s approving reviews for an entry.
+
+    #2085/#2096: two surfaces ask about the same walk and must not answer it
+    with two implementations that merely agree today —
+
+    - ``approved`` — the merge gate's verdict. :func:`has_approved_review`
+      is exactly this field, so every gate caller is unchanged.
+    - ``unknown_head`` — True when an approving review was refused *only*
+      because the entry's branch head SHA was unknown to this caller
+      (``branch_head_sha is None``), rather than because it was confirmed
+      to differ from ``review_head_sha``. The two are indistinguishable in
+      a bool, but they mean opposite things to a read-only display:
+      "confirmed superseded" vs "not yet checked". :func:`display_error`
+      needs that distinction (see its docstring); the gate deliberately
+      does not — both fail closed there.
+    """
+
+    approved: bool
+    unknown_head: bool
+
+
+def has_approved_review(
+    entry: "QueuedMerge", board, gh_ops: "GhOps | None" = None
+) -> bool:
+    """True when a completed review with ``review_verdict='approve'`` exists
+    on *board* for the work assignment behind *entry*.
+
+    Thin wrapper over :func:`scan_approved_reviews` — this is the merge
+    gate's verdict and nothing else. See that function for the walk itself.
+
+    Scans both active and completed assignments — a review whose findings
+    were just posted may still be on ``board.active`` for a tick before
+    reconcile moves it to ``completed``.  We accept either, since the
+    verdict is what matters.
+
+    #292 (Defect 1): after a review bounce the queue entry may be keyed to
+    the *original* work assignment while the approved re-review is linked to
+    the *fix* work assignment.  To handle this we collect **all** work
+    assignment IDs connected to the entry — by shared branch, or (#567) by
+    the ``review_of_assignment_id`` chain, which also catches fix workers
+    dispatched with ``branch=NULL`` — and accept any approved review that
+    points to any of them.
+
+    #1475: a SHA mismatch alone no longer voids the approval outright. When
+    the branch's current content-addressed patch-id (``branch_patch_id``)
+    matches the patch-id captured at review time (``review_patch_id``), the
+    SHA moved but the diff didn't — e.g. a conflict-fix rebase that resolved
+    cleanly — so the approval still covers this content. Missing either
+    patch-id fails closed to the pre-#1475 behaviour (stale, re-review) —
+    UNLESS *gh_ops* is supplied, in which case a null ``branch_patch_id`` is
+    computed on demand (#1506) rather than treated as an unrecoverable
+    mismatch; see :func:`_backfill_branch_patch_id`.
+    """
+    return scan_approved_reviews(entry, board, gh_ops).approved
+
+
+def scan_approved_reviews(
+    entry: "QueuedMerge", board, gh_ops: "GhOps | None" = None
+) -> ApprovalScan:
+    """Walk *board* for an approving review covering *entry*'s work chain.
+
+    The single implementation behind both :func:`has_approved_review` (the
+    merge gate) and :func:`display_error`'s read-only recompute — see
+    :class:`ApprovalScan` for why the second one needs more than the bool.
+    """
+    pool = list(getattr(board, "completed", []) or []) + list(getattr(board, "active", []) or [])
+
+    branch_work_ids = _chain_work_ids(entry, pool)
+
+    if not branch_work_ids:
+        return ApprovalScan(approved=False, unknown_head=False)
+
+    # #821: commit-bound check.  If the entry has a branch_head_sha (set at
+    # process() time from the live branch tip) and the review has a
+    # review_head_sha (set when the review assignment ran), an approval only
+    # counts when the two SHAs match — i.e. no new commits were pushed after
+    # the review completed.  When the review has no review_head_sha at all
+    # (pre-#821 rows, SHA tracking never available for that verdict) the
+    # check is skipped — nothing to compare against, unchanged from before
+    # #821 existed.
+    #
+    # #2085: a review WITH a review_head_sha but a caller that cannot supply
+    # entry.branch_head_sha (a raw work Assignment — no such attribute; a
+    # QueuedMerge whose branch was deleted — attribute present but None) is
+    # the opposite case and must fail CLOSED, not skip the check. Before
+    # #2085 `current_sha is None` fell through to the same "return True" as
+    # "review predates SHA tracking", so any caller that didn't populate
+    # branch_head_sha (the board's stage projection, `enqueue_approved_work`,
+    # a queue row whose branch had just been deleted) silently accepted a
+    # superseded approval — see #2085 for the observed #1966 chain and the
+    # deleted-branch READY flip this produced.
+    current_sha = getattr(entry, "branch_head_sha", None)
+    current_patch_id = getattr(entry, "branch_patch_id", None)
+    patch_id_attempted = current_patch_id is not None
+    # #2085: set when an approval is refused *purely* because `current_sha`
+    # is unknown here — see `ApprovalScan.unknown_head`.
+    unknown_head = False
+
+    for a in pool:
+        if getattr(a, "type", None) != "review":
+            continue
+        if getattr(a, "review_of_assignment_id", None) not in branch_work_ids:
+            continue
+        if getattr(a, "review_verdict", None) != "approve":
+            continue
+        review_sha = getattr(a, "review_head_sha", None)
+        # #2085: `current_sha is None` (branch head unknown to this caller)
+        # is folded into the same "not confirmed fresh" branch as an actual
+        # mismatch — previously it skipped straight to `return True` below,
+        # which is exactly the fail-open gap #2085 documents. A review with
+        # no `review_head_sha` at all (the `review_sha is not None` guard)
+        # still takes the legacy no-SHA-to-compare path unchanged.
+        if review_sha is not None and (current_sha is None or review_sha != current_sha):
+            # #1475: the SHA moved (or is unknown) — before declaring the
+            # approval stale/unconfirmed, check whether the underlying
+            # content is identical via patch-id. A pure rebase (no conflict)
+            # replays the identical diff against a new base and produces the
+            # same patch-id even though the commit SHA changed; a conflict
+            # resolution or a genuine content change produces a different
+            # one. Fail closed when either patch-id is unavailable — which
+            # it always is when *entry* has no way to supply one (e.g. a raw
+            # work Assignment with no `branch_patch_id` attribute and
+            # *gh_ops* is ``None``), so a caller with no live SHA/patch-id
+            # access correctly can never confirm freshness and falls to
+            # `continue` → ``False``.
+            review_patch_id = getattr(a, "review_patch_id", None)
+            if review_patch_id is not None:
+                if current_patch_id is None and not patch_id_attempted:
+                    # #1506: compute-once, not fail-closed-forever.
+                    current_patch_id = _backfill_branch_patch_id(entry, gh_ops)
+                    patch_id_attempted = True
+                if current_patch_id is not None and review_patch_id == current_patch_id:
+                    # content-identical rebase — approval still covers it
+                    return ApprovalScan(approved=True, unknown_head=False)
+            if current_sha is None:
+                # Refused because we don't KNOW the head, not because we
+                # checked and it moved. Same (closed) gate verdict, but a
+                # display surface must not call this "not approved".
+                unknown_head = True
+            continue  # stale/unconfirmed: cannot prove this approval covers the current head
+        return ApprovalScan(approved=True, unknown_head=False)
+    return ApprovalScan(approved=False, unknown_head=unknown_head)
+
+
+def find_scoped_review_candidate(
+    entry: "QueuedMerge", board, gh_ops: "GhOps | None" = None
+) -> Assignment | None:
+    """Return the previously-approved review whose approval was voided
+    ONLY by a content-changing rebase (#1476), or ``None``.
+
+    Mirrors :func:`has_approved_review`'s SHA/patch-id staleness walk but
+    returns the review :class:`~coord.models.Assignment` itself (not a
+    bool) — a scoped re-review needs the prior review's ``review_head_sha``
+    (the base to diff the resolution from) and ``briefing``/findings as
+    established context, not just a yes/no.
+
+    Returns ``None`` — meaning "not this path, fall back to a full review"
+    — when:
+
+    - No approved review exists for *entry*'s work chain at all.
+    - The branch's current SHA isn't known (can't confirm anything changed),
+      or the current patch-id isn't known and can't be computed (#1506: when
+      *gh_ops* is supplied, a null ``branch_patch_id`` is backfilled on
+      demand via :func:`_backfill_branch_patch_id` instead of failing
+      immediately).
+    - The most-recently-matched approved review's SHA still matches the
+      current one (nothing changed — not stale at all).
+    - Its patch-id still matches the current one (content-identical
+      rebase — :func:`has_approved_review` already carries this forward,
+      there is no delta to scope a review around).
+    - Either patch-id is missing (fail closed, same posture as
+      ``has_approved_review``: an unconfirmable diff gets a full review,
+      never a guessed-at scoped one).
+    """
+    pool = list(getattr(board, "completed", []) or []) + list(getattr(board, "active", []) or [])
+    branch_work_ids = _chain_work_ids(entry, pool)
+    if not branch_work_ids:
+        return None
+
+    current_sha = getattr(entry, "branch_head_sha", None)
+    current_patch_id = getattr(entry, "branch_patch_id", None)
+    if current_patch_id is None:
+        current_patch_id = _backfill_branch_patch_id(entry, gh_ops)
+    if current_sha is None or current_patch_id is None:
+        return None
+
+    # Walk most-recently-dispatched first so a branch that's been through
+    # more than one review-then-rebase cycle picks its latest approval as
+    # the diff base, not an older one — a stale pick still produces a safe
+    # (over-inclusive, never under-inclusive) delta, but a needlessly large
+    # one. ``pool`` is otherwise unordered (completed + active concatenated).
+    ordered = sorted(pool, key=lambda a: getattr(a, "dispatched_at", None) or 0, reverse=True)
+
+    for a in ordered:
+        if getattr(a, "type", None) != "review":
+            continue
+        if getattr(a, "review_of_assignment_id", None) not in branch_work_ids:
+            continue
+        if getattr(a, "review_verdict", None) != "approve":
+            continue
+        review_sha = getattr(a, "review_head_sha", None)
+        if review_sha is None or review_sha == current_sha:
+            continue  # not stale, or SHA tracking unavailable — not this path
+        review_patch_id = getattr(a, "review_patch_id", None)
+        if review_patch_id is None:
+            continue  # fail closed — cannot confirm scope, full review
+        if review_patch_id == current_patch_id:
+            continue  # content-identical — has_approved_review already covers it
+        return a  # approval voided ONLY by a content-changing rebase
+    return None
+
+
+def intervening_work_since_review(
+    entry: "QueuedMerge", board, review: Assignment
+) -> list[Assignment]:
+    """Return the :data:`~coord.models.WORK_LIKE_TYPES` assignments in
+    *entry*'s branch chain that were **dispatched after** *review* was — i.e.
+    genuine new commits (a bounce/fix round, a fresh work dispatch), not a
+    mechanical rebase.
+
+    Extracted from :func:`only_conflict_fix_since_review` so callers that need
+    to distinguish its two distinct "False" reasons can do so: a non-empty
+    list means "another commit landed after the approval" (never reaffirmable
+    without a re-review), whereas an empty list plus a ``False`` from
+    ``only_conflict_fix_since_review`` merely means "no coord-tracked
+    conflict-fix explains the delta" (e.g. the operator rebased by hand) —
+    unattributable, but not evidence of new logic. ``#1488``'s
+    ``coord review-reaffirm`` hard-refuses the former and warns loudly on the
+    latter; the automated dispatcher (``#1476``) declines both.
+
+    Dispatch order, not completion order, is compared — see
+    :func:`only_conflict_fix_since_review` for why.
+    """
+    pool = list(getattr(board, "completed", []) or []) + list(getattr(board, "active", []) or [])
+    branch_work_ids = _chain_work_ids(entry, pool)
+    review_dispatched_at = getattr(review, "dispatched_at", None)
+    if review_dispatched_at is None:
+        return []
+
+    out: list[Assignment] = []
+    for a in pool:
+        if getattr(a, "type", None) not in WORK_LIKE_TYPES:
+            continue
+        if getattr(a, "assignment_id", None) not in branch_work_ids:
+            continue
+        a_dispatched_at = getattr(a, "dispatched_at", None)
+        if a_dispatched_at is not None and a_dispatched_at > review_dispatched_at:
+            out.append(a)
+    return out
+
+
+def only_conflict_fix_since_review(entry: "QueuedMerge", board, review: Assignment) -> bool:
+    """True when the sole thing that changed *entry*'s branch since *review*
+    approved it was one or more successful conflict-fix rebases (#1476's
+    scoping guardrail) — i.e. a scoped review is safe to dispatch.
+
+    False (⇒ the caller must fall back to a full review) when:
+
+    - No successful (``status="done"``) conflict-fix for this merge entry is
+      found at all — there is nothing to attribute the content change to,
+      and guessing would be unsound.
+    - Any other :data:`~coord.models.WORK_LIKE_TYPES` assignment in the
+      branch's work chain (a fix/bounce round, a fresh work dispatch — i.e.
+      a genuine new commit, not a rebase) was dispatched after *review* ran.
+
+    Dispatch order, not completion order, is what's compared against
+    *review*'s own dispatch time — a fix round that was *in flight* when the
+    review was dispatched (and so is exactly what the review covered) must
+    not itself disqualify the scoped path; only a fix/work round that
+    started **after** the approval counts as "another commit".
+    """
+    if intervening_work_since_review(entry, board, review):
+        return False  # a new work/fix round happened — not conflict-fix-only
+
+    pool = list(getattr(board, "completed", []) or []) + list(getattr(board, "active", []) or [])
+    review_dispatched_at = getattr(review, "dispatched_at", None)
+
+    for a in pool:
+        if getattr(a, "type", None) != "conflict-fix":
+            continue
+        if getattr(a, "review_of_assignment_id", None) != entry.assignment_id:
+            continue
+        if getattr(a, "status", None) != "done":
+            continue
+        a_dispatched_at = getattr(a, "dispatched_at", None)
+        if (
+            review_dispatched_at is not None
+            and a_dispatched_at is not None
+            and a_dispatched_at < review_dispatched_at
+        ):
+            continue  # a conflict-fix from BEFORE this review isn't relevant
+        return True
+    return False
+
+
+# ── Smoke gate (#465) ──────────────────────────────────────────────────────
+
+def requires_smoke(entry: "QueuedMerge", config) -> bool:
+    """True when *entry* must have an interactive smoke verdict before merging.
+
+    Honours the *effective* gate list — ``entry``'s own ``required_gates``
+    when set, falling back to ``config.pipeline.default_gates`` otherwise
+    (#1213; see :func:`requires_review` for the duck-typing/fallback
+    contract shared by both gates).  When ``"test"`` is in the resolved
+    gate list the user must record ``coord test --passed`` (or ``--skip``)
+    before ``coord merge`` proceeds.  ``"test"`` absent → gate disabled.
+    """
+    pipeline = getattr(config, "pipeline", None)
+    if pipeline is None:
+        return False
+    gates = getattr(entry, "required_gates", None) or (pipeline.default_gates or [])
+    return "test" in gates
+
+
+# ── Gate-bypass auditing (#1213) ────────────────────────────────────────────
+
+def _bypassed_gates(entry: "QueuedMerge", config) -> list[str]:
+    """Which of the default pipeline's gates *entry*'s resolved gate list
+    drops.
+
+    Returns ``[]`` when ``entry`` carries no override (``required_gates``
+    empty/absent — falls back to ``config.pipeline.default_gates``, nothing
+    to bypass) or when its resolved gates already match the default list.
+    Only ``"review"`` and ``"test"`` are reported — ``"merge"`` is the
+    terminal action being gated, not a checkpoint that can be "bypassed".
+
+    ``"review"`` is reported only when ``config.reviews.enabled`` is truthy
+    — mirroring the guard :func:`requires_review` applies first. When review
+    is globally disabled, dropping ``"review"`` from a label's resolved gate
+    list changes nothing (the gate was already off), so it isn't a real
+    bypass and reporting it would produce a misleading audit row / CLI note
+    (#1213 review finding 1).
+    """
+    gates = getattr(entry, "required_gates", None)
+    if not gates:
+        return []
+    pipeline = getattr(config, "pipeline", None) if config is not None else None
+    default_gates = list(getattr(pipeline, "default_gates", None) or []) if pipeline else []
+    reviews_enabled = bool(getattr(config, "reviews", None)) and bool(
+        getattr(config.reviews, "enabled", True)
+    )
+    candidates = [g for g in ("review", "test") if g in default_gates and g not in gates]
+    if not reviews_enabled:
+        candidates = [g for g in candidates if g != "review"]
+    return candidates
+
+
+def _bypass_label(entry: "QueuedMerge", config) -> str | None:
+    """Best-effort reverse lookup of the ``pipeline.labels`` key that
+    produced *entry*'s resolved ``required_gates``, for a readable audit
+    row / CLI message.
+
+    Returns ``None`` when no exact match is found (the label was renamed or
+    removed from config after enqueue time, or ``pipeline.labels`` is
+    empty) — the audit event and CLI note still fire without a name in that
+    case, since the gate list itself is the durable evidence.  Ambiguous
+    when two labels resolve to the same gate list — the first match (dict
+    iteration order) wins; this is display-only and never affects gate
+    enforcement.
+    """
+    pipeline = getattr(config, "pipeline", None) if config is not None else None
+    labels = getattr(pipeline, "labels", None) if pipeline else None
+    gates = getattr(entry, "required_gates", None)
+    if not labels or not gates:
+        return None
+    for label, label_gates in labels.items():
+        if list(label_gates) == list(gates):
+            return label
+    return None
+
+
+def _bypass_note(entry: "QueuedMerge", config) -> str:
+    """Human-readable suffix naming any bypassed gate, or ``""`` when none.
+
+    Appended to the ``coord merge`` "merged" event message (real and
+    dry-run) so a bypass is never silent (#1213).  Side-effect free — the
+    audit row itself is written separately, only on a real (non-dry-run)
+    merge, by the caller in :func:`process`.
+    """
+    bypassed = _bypassed_gates(entry, config)
+    if not bypassed:
+        return ""
+    label = _bypass_label(entry, config)
+    label_desc = f"label {label!r}" if label else "an issue-label override"
+    return f" [gate bypass via {label_desc}: {', '.join(bypassed)} skipped]"
+
+
+def _record_gate_bypass_audit(entry: "QueuedMerge", config) -> list[str]:
+    """Emit one ``gate_bypassed`` business-tier audit row per bypassed gate
+    set, and return the bypassed gate names (``[]`` if none).
+
+    Called once per real merge success in :func:`process` — never in
+    dry-run, so previews never write phantom audit rows.  ``record_audit``
+    is itself best-effort (never raises), matching every other write
+    choke point in :mod:`coord.state`.
+    """
+    bypassed = _bypassed_gates(entry, config)
+    if not bypassed:
+        return []
+    label = _bypass_label(entry, config)
+    label_desc = f"label {label!r}" if label else "an issue-label override"
+    record_audit(
+        tier="business",
+        category="gate",
+        event_type="gate_bypassed",
+        actor="user",
+        summary=(
+            f"Gate bypass via {label_desc}: {', '.join(bypassed)} skipped "
+            f"for {entry.repo_name}#{entry.issue_number}"
+        ),
+        repo=entry.repo_name,
+        issue=entry.issue_number,
+        assignment_id=entry.assignment_id,
+        details={
+            "label": label,
+            "resolved_gates": list(getattr(entry, "required_gates", None) or []),
+            "bypassed_gates": bypassed,
+        },
+    )
+    return bypassed
+
+
+@dataclass(frozen=True)
+class MergeGateFailure:
+    """One un-satisfied merge gate for a work row / queue entry (#1695).
+
+    :func:`passes_merge_gates` collapses this to a bool, which is all the
+    gate *decision* ever needed. What it never carried was *why* — so the
+    ``coord merge`` auto-enqueue scan's ``if not passes_merge_gates(...):
+    continue`` printed nothing at all, and an operator staring at a branch
+    in ``--dry-run`` that ``--only`` could not address had no statement of
+    the cause anywhere (#1695's 40-minute diagnosis).
+
+    ``waiver_flag`` is the ``coord merge`` flag that waives this gate **at
+    merge time** — the whole point of #1695 being that the gate and its
+    override must live at the same stage. It is a display string; nothing
+    here waives anything.
+    """
+
+    gate: str          # "review" | "smoke"
+    reason: str        # short human-readable cause
+    waiver_flag: str   # "--skip-review" | "--skip-smoke"
+
+    def __str__(self) -> str:
+        return f"{self.gate} gate — {self.reason} (waive with {self.waiver_flag})"
+
+
+def merge_gate_failures(
+    a,
+    config,
+    board,
+    gh_ops: "GhOps | None" = None,
+    stop_early: bool = False,
+) -> list[MergeGateFailure]:
+    """Every merge gate *a* has NOT satisfied, in :func:`process` order.
+
+    The reason-carrying form of :func:`passes_merge_gates` — that function is
+    now literally ``not merge_gate_failures(..., stop_early=True)``, so the
+    two can never disagree about whether a row is gated (the #946 drift this
+    predicate exists to prevent).
+
+    Returns ``[]`` when every configured gate is satisfied (or none is
+    configured — each gate no-ops when ``requires_*`` is False).
+
+    *stop_early* returns as soon as the first failure is found, preserving
+    :func:`passes_merge_gates`'s original short-circuit so the boolean path
+    never pays for a second gate evaluation (and, with *gh_ops* supplied,
+    never makes a second round trip) just to answer yes/no.
+    """
+    failures: list[MergeGateFailure] = []
+    if requires_review(a, config) and not has_approved_review(a, board, gh_ops):
+        failures.append(MergeGateFailure(
+            gate="review",
+            reason="review required but not approved",
+            waiver_flag="--skip-review",
+        ))
+        if stop_early:
+            return failures
+    if requires_smoke(a, config):
+        smoke = evaluate_smoke_verdict(a, board, gh_ops)
+        if not smoke.ok:
+            failures.append(MergeGateFailure(
+                gate="smoke",
+                reason=smoke.short_reason or "test verdict missing",
+                waiver_flag="--skip-smoke",
+            ))
+            if stop_early:
+                return failures
+    return failures
+
+
+def describe_merge_gate_failures(failures: "list[MergeGateFailure]") -> str:
+    """Render *failures* as one operator-readable clause.
+
+    ``""`` when *failures* is empty, so call sites can interpolate it
+    unconditionally.
+    """
+    return "; ".join(str(f) for f in failures)
+
+
+def passes_merge_gates(a, config, board, gh_ops: "GhOps | None" = None) -> bool:
+    """True when *a* (a work ``Assignment`` or ``QueuedMerge`` entry) has
+    satisfied every gate required before it may merge.
+
+    Shared predicate (#946) so untested/unreviewed work can never *merge*
+    through any path — previously each of the enqueue/merge call sites
+    (the daemon's :func:`enqueue_approved_work`, the ``coord merge``
+    auto-enqueue loop, the raw :func:`enqueue` helper, :func:`process`)
+    re-derived this logic and drifted: only the daemon path actually gated,
+    so untested/unreviewed work could sneak into the queue via
+    ``coord merge``.
+
+    #1695 narrows *where* a False answer is allowed to act. It still refuses
+    the merge (:func:`process` and :func:`_entry_gate_status` are unchanged —
+    a row that fails here can never be merged by any automatic path), but the
+    ``coord merge`` auto-enqueue scan no longer treats it as "drop this row
+    on the floor": the row is enqueued in a visibly BLOCKED state so it is
+    addressable by ``--only``, where ``--skip-review``/``--skip-smoke`` can
+    waive the gate. Enqueueing changes an entry's *visibility*, never its
+    *eligibility*.
+
+    Duck-typed on ``entry.assignment_id`` / ``entry.branch`` (both
+    ``Assignment`` and ``QueuedMerge`` have them), matching
+    :func:`requires_review` / :func:`has_approved_review` / :func:`requires_smoke`
+    / :func:`has_smoke_verdict`, which this composes.
+
+    *gh_ops* (optional, #1601) is forwarded to both gates so a live SHA/
+    patch-id lookup can back a fresh ``QueuedMerge`` entry that hasn't been
+    through :func:`process` yet — see :func:`has_smoke_verdict`'s docstring.
+    """
+    return not merge_gate_failures(a, config, board, gh_ops, stop_early=True)
+
+
+# ── Smoke-verdict outcome kinds (#1640) ─────────────────────────────────────
+# The gate has always been a bool; #1640 splits the *failure* into the two
+# cases an operator has to act on differently:
+#
+#   SMOKE_MISSING — nothing terminal was ever recorded. Run the Test stage.
+#   SMOKE_STALE   — a passing verdict EXISTS but was recorded against a
+#                   branch/base combination that no longer exists (#1479).
+#                   Re-verify against the current base, then re-record.
+#                   (#1732: a ``skipped`` verdict is never SMOKE_STALE — it's
+#                   a structural claim about the diff, not a measurement at
+#                   a SHA, so it can't go stale when the base moves.)
+#
+# Before #1640 both collapsed to "smoke test required but no verdict
+# recorded", which is a false statement in the stale case and is exactly what
+# made #1640 get filed as a lost DB write.
+SMOKE_OK = "ok"
+SMOKE_MISSING = "missing"
+SMOKE_STALE = "stale"
+
+
+def _short_sha(sha: str | None) -> str:
+    """7-char display form of *sha*, or ``"unknown"`` when it isn't known."""
+    if not sha:
+        return "unknown"
+    return sha[:7]
+
+
+@dataclass(frozen=True)
+class SmokeVerdictStatus:
+    """Structured outcome of the smoke gate for one entry (#1640).
+
+    ``ok`` is what :func:`has_smoke_verdict` returns; the remaining fields
+    exist so every surface that renders the refusal (``coord merge``, ``coord
+    merge --plan``, the ``/board`` staging section, the TUI) can say *which*
+    failure it is and against what, instead of all of them printing the
+    "no verdict recorded" wording that only fits :data:`SMOKE_MISSING`.
+
+    ``anchor`` is ``"base"`` when the merge base moved out from under the
+    verdict (the #1479-specific condition — the common one on a sequential
+    drain, since every merge moves the base for the next entry) and
+    ``"branch"`` when the branch's own content changed since the test ran.
+
+    #1819 adds a third anchor, ``"run"``: no terminal verdict exists, but the
+    row is pinned at the transient ``test_state="running"`` marker (#1395)
+    with no Test worker left alive to resolve it. That is an *abandoned*
+    verdict, not an absent one — see :data:`RUNNING_MARKER_STALE_AFTER`.
+
+    ``spared_reason`` is the mirror image, set only on a passing (``ok``)
+    verdict when the merge base *did* move but one of the #1479 escape
+    hatches proved the move couldn't have invalidated the verdict — #1738
+    (base move inert), #1778 (branch inert), or #1847 (base move and branch
+    touch disjoint files). ``None`` whenever the base didn't move at all, so
+    the common unremarkable-fresh case stays silent. See
+    :func:`_base_move_spared` for the three wordings.
+    """
+
+    ok: bool
+    kind: str  # SMOKE_OK | SMOKE_MISSING | SMOKE_STALE
+    assignment_id: str | None = None
+    anchor: str | None = None  # "base" | "branch" | "run" (SMOKE_STALE only)
+    recorded_sha: str | None = None
+    current_sha: str | None = None
+    spared_reason: str | None = None  # set only on `ok=True` after a base move (#1847)
+
+    @property
+    def short_reason(self) -> str | None:
+        """Compact wording for plan / staging rows (``PlannedMerge.reason``).
+
+        ``None`` when the gate passes.
+        """
+        if self.ok:
+            return None
+        if self.kind == SMOKE_STALE:
+            if self.anchor == "run":
+                return (
+                    "test verdict stale (Test stage stuck at 'running' with no "
+                    "live worker)"
+                )
+            noun = "base" if self.anchor == "base" else "branch"
+            return (
+                f"test verdict stale (recorded against {noun} "
+                f"{_short_sha(self.recorded_sha)}, {noun} now "
+                f"{_short_sha(self.current_sha)})"
+            )
+        return "test verdict missing"
+
+    @property
+    def message(self) -> str | None:
+        """Full wording for a merge attempt (``QueuedMerge.error`` / the
+        ``smoke_required`` event message). ``None`` when the gate passes."""
+        if self.ok:
+            return None
+        if self.kind == SMOKE_STALE:
+            aid = self.assignment_id or "<assignment>"
+            if self.anchor == "run":
+                return (
+                    "smoke test verdict is stale: the Test stage has been "
+                    "marked 'running' since before the last Test worker for "
+                    "this branch stopped, so no verdict is coming — re-verify "
+                    f"against the current base, then `coord test {aid} "
+                    "--passed`"
+                )
+            noun = "base" if self.anchor == "base" else "branch"
+            return (
+                f"smoke test verdict is stale: recorded against {noun} "
+                f"{_short_sha(self.recorded_sha)}, {noun} is now "
+                f"{_short_sha(self.current_sha)} — re-verify against the "
+                f"current base, then `coord test {aid} --passed`"
+            )
+        return "smoke test required but no verdict recorded"
+
+
+# ── Stale-vs-missing: the ONE implementation (#1769) ────────────────────────
+#
+# Both wordings a stale (as opposed to never-recorded) smoke verdict can be
+# reported under are produced *by this module*: `SmokeVerdictStatus.message`
+# ("smoke test verdict is stale: …", what `process()` stores on `entry.error`
+# and what lands on the board as `merge_reason`) and
+# `SmokeVerdictStatus.short_reason` ("test verdict stale (…)", what `plan()` /
+# the staging rows render). So the predicate that recognises them belongs
+# here, next to the code that emits them, and NOT copied into every consumer.
+#
+# #1738 put a private copy in `coord/drive.py` to give `coord drive` its
+# re-test arm. #1769 adds the second consumer — `coord merge --revalidate` —
+# and a *third* string-matching copy in a third module is exactly how #1141
+# went stale, so the copy was lifted here instead: `coord.drive` and
+# `coord.revalidate` both import THIS function, and `tests/test_merge_queue.py`
+# asserts they are the same object.
+#
+# Deliberately a strict subset of `coord.drive._SMOKE_GATE_MARKERS`, which
+# also matches "no verdict at all" ("smoke test required" / "test verdict
+# missing"). Only the stale case has a safe, bounded, automatable fix:
+# re-verify against the CURRENT base and let a fresh verdict land. A
+# missing-verdict block is the #1640 lost-write shape instead — the driver and
+# the gate disagree about whether a verdict exists at all — which a re-test
+# cannot safely paper over, so it still escalates to a human.
+STALE_SMOKE_MARKERS = ("smoke test verdict is stale", "test verdict stale")
+
+
+def is_stale_smoke_reason(reason: str | None) -> bool:
+    """True when *reason* names a STALE (not missing) smoke verdict.
+
+    The single implementation of the stale-vs-missing distinction over merge
+    *prose* (#1738/#1769). The structured form of the same question is
+    ``evaluate_smoke_verdict(...).kind == SMOKE_STALE``; this string-matching
+    variant exists only for the consumers whose input is a persisted
+    ``merge_reason``/``entry.error`` rather than a live gate evaluation.
+    """
+    r = (reason or "").lower()
+    return any(marker in r for marker in STALE_SMOKE_MARKERS)
+
+
+# #1738: paths whose content cannot affect a pytest/cargo test result — the
+# allowlist a base-SHA move is checked against before staling an otherwise-
+# fresh verdict. Deliberately small and additive (start conservative, widen
+# later if a real false-stale shows up outside it). Two shapes:
+#   - a directory prefix ("docs/", "scripts/", ...) — everything under it,
+#     recursively, is inert;
+#   - a bare top-level filename pattern ("*.md") — matches ONLY files with no
+#     directory component. This is why `tests/acceptance/foo.md` is NOT
+#     inert despite the `.md` extension: extension alone never qualifies, only
+#     a top-level `*.md` (README.md, CONTRIBUTING.md, ...) does. Any other
+#     path — including any `coord/**`, `tests/**`, `tui/**`, `pyproject.toml`,
+#     or `.github/workflows/**` — stales the verdict exactly as before.
+_INERT_BASE_DIR_PREFIXES = ("docs/", "scripts/", ".github/ISSUE_TEMPLATE/")
+
+# #1778: explicit deny-list that takes precedence over
+# `_INERT_BASE_DIR_PREFIXES` — the executable test surface the Test stage
+# actually runs. `scripts/` is otherwise allowlisted wholesale, which made
+# `scripts/coord-test-runner.sh` inert by omission: a base move touching
+# only the runner didn't stale (wrong — the runner IS what the suite runs),
+# and worse, a *branch* that edits the runner could point at this same
+# allowlist to declare itself untestable and skip its own gate
+# (self-certification). An explicit deny beats trimming the allowlist
+# because the next executable script added under `scripts/` inherits the
+# safe (non-inert) default instead of silently inheriting the hole.
+_INERT_DENY_PATHS = frozenset({
+    "scripts/coord-test-runner.sh",
+})
+
+
+def _path_is_inert(path: str) -> bool:
+    """True when *path* matches the #1738 inert-base allowlist.
+
+    Checked on both the base-move side (:func:`_base_move_is_inert`) and the
+    branch side (:func:`_branch_is_inert`) — the deny-list in
+    `_INERT_DENY_PATHS` is consulted first so it wins over the directory
+    allowlist on either side (#1778).
+    """
+    if path in _INERT_DENY_PATHS:
+        return False
+    if any(path.startswith(prefix) for prefix in _INERT_BASE_DIR_PREFIXES):
+        return True
+    return "/" not in path and path.endswith(".md")
+
+
+def _fetch_compare_files(
+    gh_ops: "GhOps | None",
+    repo_github: str | None,
+    base_sha: str | None,
+    head_sha: str | None,
+) -> list[str] | None:
+    """Fetch the file list for one ``get_compare_files(base_sha, head_sha)``
+    compare, failing closed to ``None`` (never raising) whenever the answer
+    can't be established: no *gh_ops*/*repo_github* to ask, a missing SHA on
+    either side, the call raising, or it returning ``None`` (unreadable)
+    itself.
+
+    The single I/O seam behind :func:`_base_move_is_inert`,
+    :func:`_branch_is_inert`, and (#1847) :func:`_base_move_disjoint_from_branch`
+    — all three ultimately ask "what files does this compare touch" of one of
+    the same two compares (``test_base_sha..current_base_sha`` or
+    ``test_base_sha..test_head_sha``), so :func:`_base_move_spared` fetches
+    each side through here at most once and shares the result across every
+    predicate that consults it, rather than each predicate fetching its own
+    copy.
+
+    Note: :class:`coord.gate_snapshot.GateSnapshot` (the ``/board`` display
+    path's ``gh_ops`` stand-in) does not yet cache ``get_compare_files``, so a
+    plain ``AttributeError`` lands here and this fails closed exactly as it
+    does for a genuine lookup failure — the display can show STALE for a
+    base move that a live ``coord merge``/``coord drive`` (real
+    ``coord.github_ops``) correctly treats as fresh. That's the safe
+    direction of disagreement (pessimistic display, correct live gate) —
+    the opposite of the #1640 incident — but wiring this cache through
+    :class:`~coord.gate_snapshot.GateSnapshotRefresher` would close it too.
+    """
+    if gh_ops is None or not repo_github or not base_sha or not head_sha:
+        return None
+    try:
+        return gh_ops.get_compare_files(repo_github, base_sha, head_sha)
+    except Exception:  # noqa: BLE001 — fail-safe: unknown diff is not "inert"/disjoint
+        return None
+
+
+def _files_are_inert(files: list[str] | None) -> bool:
+    """True when *files* — an already-fetched compare file list — is
+    non-``None`` and every entry passes :func:`_path_is_inert`.
+
+    ``None`` (an unreadable compare) fails closed to ``False``. Factored out
+    of :func:`_base_move_is_inert`/:func:`_branch_is_inert` (#1847) so the
+    same predicate can run against a list :func:`_base_move_spared` fetched
+    once, instead of each of the three #1479 escape hatches fetching (and
+    re-checking) its own copy.
+    """
+    if files is None:
+        return False
+    return all(_path_is_inert(f) for f in files)
+
+
+def _base_move_is_inert(
+    gh_ops: "GhOps | None", repo_github: str | None, old_sha: str, new_sha: str
+) -> bool:
+    """True when every file the base moved through (*old_sha*..*new_sha*) is
+    provably inert (#1738) — content that cannot alter a test result, so a
+    fresh verdict recorded against *old_sha* still covers *new_sha*.
+
+    Fails closed (returns ``False``, i.e. "not proven inert, stale as
+    before") whenever inertness can't be established: no *gh_ops*/*repo_github*
+    to ask, the compare call raises, or it comes back ``None`` (unreadable) or
+    empty-but-unconfirmed. The bar set by #1738 is "bias hard toward staling":
+    a false "fresh" merges untested code; a false "stale" only costs a re-run.
+
+    Thin composition of :func:`_fetch_compare_files` + :func:`_files_are_inert`
+    — kept as its own function (rather than inlined at the one call site) so
+    it stays independently testable and so :func:`_base_move_spared`'s
+    single-fetch orchestration reads as "the same predicates, sharing one
+    fetch" rather than a parallel implementation.
+    """
+    return _files_are_inert(_fetch_compare_files(gh_ops, repo_github, old_sha, new_sha))
+
+
+def _branch_is_inert(
+    gh_ops: "GhOps | None",
+    repo_github: str | None,
+    base_sha: str | None,
+    branch_sha: str | None,
+) -> bool:
+    """True when a branch's entire diff against its merge-base is provably
+    inert (#1778) — content the suite cannot see, so
+    ``suite(base + branch) ≡ suite(base)`` and re-running the suite over a
+    moved base tells you nothing about *this branch* that wasn't already
+    known.
+
+    This is the mirror of :func:`_base_move_is_inert`: that function asks
+    "did the base move through anything that matters"; this one asks "does
+    the branch touch anything that matters", independent of whether the base
+    moved at all. The three are consulted together at the base-move staling
+    check (#1479/#1847) by :func:`_base_move_spared` — any one being true is
+    enough to skip staling on a base move alone. None of the three replace
+    the separate branch-*content*-changed check (patch-id comparison) that
+    follows: a branch that is inert today and later gains a `coord/**`
+    commit is caught by that check, not this one.
+
+    Fails closed exactly like :func:`_base_move_is_inert` — returns
+    ``False`` ("not proven inert, stale as before") whenever inertness can't
+    be established: no *gh_ops*/*repo_github*, a raising compare call, or a
+    ``None`` (unreadable) result. A false "fresh" would let an untested
+    branch merge; a false "stale" only costs a redundant re-run.
+
+    Reuses :func:`_path_is_inert` for the allowlist, which is why the
+    `_INERT_DENY_PATHS` exclusion of `scripts/coord-test-runner.sh` matters
+    here specifically: without it, a branch that edits the composed test
+    runner could point at the `scripts/` allowlist and declare its own diff
+    untestable, skipping the gate it is trying to evade.
+    """
+    return _files_are_inert(
+        _fetch_compare_files(gh_ops, repo_github, base_sha, branch_sha)
+    )
+
+
+def _base_move_disjoint_from_branch(
+    base_files: list[str] | None, branch_files: list[str] | None
+) -> bool:
+    """True when the files the base moved through and the files the branch
+    touches share no path (#1847) — the third #1479 base-move escape hatch,
+    alongside :func:`_base_move_is_inert` and :func:`_branch_is_inert`.
+
+    Those two are allowlist-based: each asks "is this one diff inert on its
+    own". This asks a different, cheaper-to-satisfy question — "do these two
+    diffs have anything to do with each other" — which is the shape that
+    actually costs a human intervention on a queue drain: a substantive base
+    move and a substantive branch that simply never touch the same file.
+
+    Fails closed to ``False`` when either list is ``None`` (an unreadable
+    compare on either side), matching the fail-closed posture of the other
+    two checks: a false "disjoint" would let an untested base/branch
+    combination merge; a false "overlapping" only costs a redundant re-run.
+
+    File-level disjointness is *not* semantic independence — a base change
+    to one module can still break a branch that never names it (there is no
+    compiler to catch a moved signature at this granularity, and a shared
+    `conftest.py` fixture makes it worse). Two things bound that risk enough
+    to accept it here rather than requiring semantic analysis:
+
+    * CI already tests the *composite*. `.github/workflows/test.yml` runs
+      pytest and `.github/workflows/cargo-test.yml` runs cargo test on every
+      `pull_request` push, built against branch-merged-into-base, and
+      `coord merge` gates on those checks independently via
+      `coord.ci_store.CiStore` — the local Test verdict this function spares
+      is substantially re-deriving what CI already proves.
+    * GitHub does not re-run PR workflows when only the *base* moves (only
+      on head `synchronize`), which is a real gap — but it is the SAME gap
+      `_base_move_is_inert`/`_branch_is_inert` already accept for their own
+      allowlisted content, not a new one this check introduces. Closing it
+      (re-running CI on a base move) is out of scope here.
+    """
+    if base_files is None or branch_files is None:
+        return False
+    return set(base_files).isdisjoint(branch_files)
+
+
+def _base_move_spared(
+    gh_ops: "GhOps | None",
+    repo_github: str | None,
+    test_base_sha: str,
+    current_base_sha: str,
+    test_head_sha: str | None,
+) -> tuple[bool, str | None]:
+    """Whether a moved base still spares a `passed` verdict recorded against
+    *test_base_sha*, and — when it does — why.
+
+    Tries the three #1479 escape hatches in order, stopping at the first
+    that fires: #1738 (:func:`_base_move_is_inert`), #1778
+    (:func:`_branch_is_inert`), #1847 (:func:`_base_move_disjoint_from_branch`).
+    Ordered cheapest-first and fetch-sharing on purpose: the base-move file
+    list is fetched once and checked for #1738 before the branch file list is
+    fetched at all; the branch file list, once fetched for #1778, is reused
+    for #1847 rather than re-fetched. At most two `get_compare_files` calls
+    total per invocation, regardless of which disjunct fires or whether none
+    do — same worst case as the pre-#1847 `_base_move_is_inert(...) or
+    _branch_is_inert(...)` this replaces at the call site.
+    """
+    base_files = _fetch_compare_files(
+        gh_ops, repo_github, test_base_sha, current_base_sha
+    )
+    if _files_are_inert(base_files):
+        return True, "base move touches only inert paths (#1738)"
+    branch_files = _fetch_compare_files(
+        gh_ops, repo_github, test_base_sha, test_head_sha
+    )
+    if _files_are_inert(branch_files):
+        return True, "branch touches only inert paths (#1778)"
+    if _base_move_disjoint_from_branch(base_files, branch_files):
+        return True, "base move and branch touch disjoint files (#1847)"
+    return False, None
+
+
+# #1851: the reason string prefix `_entry_gate_status` returns for a CI-stale
+# entry. Both the wording and the eligibility check in
+# :func:`ci_revalidation_candidates` key off this constant so the two can
+# never drift apart the way #1141 warns about (see `STALE_SMOKE_MARKERS`'s
+# comment above for the same lesson learned the hard way for the smoke gate).
+CI_STALE_PREFIX = "CI stale:"
+
+
+# #1891: the reason string prefix `_entry_gate_status` (board-render time)
+# and `process()`'s live `checks_pending` event (real merge-attempt time)
+# BOTH use for "checks exist on GitHub but have not reported a conclusion
+# yet" — as opposed to `checks_failed` (a check that DID report, and
+# reported red). This is the one piece of vocabulary #1891's incident was
+# missing: a CI verdict that has not arrived was indistinguishable from one
+# that arrived and said no, so a drive spent its bounded merge-attempt
+# budget (and then a drive-queue launch attempt) retrying a merge that only
+# more real time — never another retry — could resolve.
+#
+# `IssueState.merge_reason` (`drive_state._merge_entry`) already falls back
+# from the live plan's freshly-recomputed `reason` to the raw queue row's
+# *persisted* `error` whenever the plan's own re-evaluation comes back
+# empty — which is exactly what happens when `_gate_refresher`'s
+# periodically-refreshed snapshot (`coord/gate_snapshot.py`) lags or gaps a
+# live `coord merge` attempt's own fresher read. That makes `merge_reason`
+# — not `merge_status`, which has no such fallback — the robust signal to
+# key off. `coord.drive._decide_merge` and `coord.drive_queue`'s `parked`
+# outcome both import :func:`is_ci_pending_reason` below so the two can
+# never drift apart the way #1141 warns about.
+CI_PENDING_PREFIX = "CI running:"
+
+
+def is_ci_pending_reason(reason: str | None) -> bool:
+    """True when *reason* names checks that exist but have not reported a
+    conclusion yet (#1891) — as opposed to a check that ran and failed.
+
+    The single implementation of the pending-vs-failed distinction over merge
+    prose, the same posture :func:`is_stale_smoke_reason` takes for the smoke
+    gate: callers whose input is a persisted ``merge_reason``/``entry.error``
+    string (not a live ``CheckRun`` list) use this instead of re-deriving it.
+    """
+    return (reason or "").startswith(CI_PENDING_PREFIX)
+
+
+# #1904: every CI gate predicate — `failed_checks`, `in_flight_checks`,
+# `_ci_checks_are_stale` — is a filter *over* `checks`, so `checks == []`
+# satisfies all three vacuously and the pre-#1904 gate fell all the way
+# through to "merge". `checks == []` is genuinely ambiguous (see
+# `CiStore.expects_checks`'s docstring): "no CI configured for this repo"
+# (correct to merge) and "CI exists but never triggered for this PR" (a
+# throttled webhook, a wedged run, a path-filtered-out workflow — wrong to
+# merge) both produce it. `CI_ABSENT_PREFIX` names the second reading,
+# distinctly from `CI_PENDING_PREFIX` ("checks exist, still running") and
+# `CI_STALE_PREFIX` ("checks exist, green, but predate the base") — an
+# operator (and `coord drive`) needs to know nothing was ever triggered, not
+# that something is still in flight.
+#
+# #1877: `checks == []` has a THIRD reading — the PR conflicts with its
+# base, so GitHub never built a merge ref to run a `pull_request`-triggered
+# workflow against at all. Unlike the "never triggered" reading above, this
+# one is self-healing: routing it to the #241 conflict-fix path (rather
+# than blocking here) is the cure. `process()` and `_entry_gate_status`
+# both consult `GhOps.check_pr_mergeable` before committing to the
+# `CI_ABSENT_PREFIX` block, specifically to give this reading a chance to
+# fall through first — see the `#1877` comments at each call site.
+CI_ABSENT_PREFIX = "CI never ran:"
+
+
+def is_ci_absent_reason(reason: str | None) -> bool:
+    """True when *reason* names a PR whose CI was expected to run but never
+    reported a single check (#1904) — as opposed to one that ran and failed
+    (``checks_failed``), is still running (:func:`is_ci_pending_reason`), or
+    ran stale (``CI_STALE_PREFIX``)."""
+    return (reason or "").startswith(CI_ABSENT_PREFIX)
+
+
+# #1892: the reason string prefix for a `checks_failed` entry whose failing
+# checks carry NO VERDICT ABOUT THE CODE — every one of them either never got
+# a runner (cancelled at the queue timeout, zero steps) or died at "Set up
+# job" (before checkout, so no repo code ran). Distinctly named from the
+# plain "checks failed: ..." wording a genuine red suite produces, so
+# `coord.drive`'s retry accounting and `coord.drive_queue`'s `parked` state
+# (both already keying off :data:`CI_PENDING_PREFIX`/`is_ci_pending_reason`
+# for the #1891 "still running" case) can extend the identical treatment to
+# this one: don't spend a merge attempt / launch attempt on a failure that
+# says nothing about whether the branch is any good — see
+# :func:`_ci_infra_reason` for the classification and `MAX_CI_INFRA_RERUNS`
+# for the auto-rerun this reason also triggers.
+#
+# Deliberately NOT surfaced by `_entry_gate_status` (board-render time,
+# consumed by `plan()`/`/board`): classifying this needs one extra
+# `gh api .../actions/runs/{id}/jobs` call per distinct failing run
+# (`CiStore.list_jobs_for_run`), and `coord.gate_snapshot`'s module
+# docstring states Invariant 1 — the board *read* path performs no
+# third-party I/O. Only the LIVE merge path (`process()`, which already
+# pays for fresh truth — see that module's docstring) computes this and
+# persists it onto `QueuedMerge.error`; `coord.drive_state._merge_entry`
+# prefers that raw, more-specific reading over the plan's own generic
+# re-derivation when the two diverge (mirrors the NEEDS_ATTENTION recovery
+# a few lines into that function).
+CI_INFRA_PREFIX = "CI infra:"
+
+
+def is_ci_infra_reason(reason: str | None) -> bool:
+    """True when *reason* names a `checks_failed` block whose failures were
+    all classified verdictless (#1892) — see :data:`CI_INFRA_PREFIX`."""
+    return (reason or "").startswith(CI_INFRA_PREFIX)
+
+
+# #1892: auto-reruns `process()` will trigger for a single entry's verdictless
+# CI failure (via `CiStore.rerun_for_pr`) before giving up and parking it for
+# a human instead of the queue's own #1891 machinery. A workflow genuinely
+# broken at the "Set up job" level — a bad `uses:` ref, a deleted action —
+# would otherwise loop this forever; two tries is enough to ride out a queue-
+# timeout blip or a transient "Service Unavailable" without masking a
+# standing breakage.
+MAX_CI_INFRA_RERUNS = 2
+
+
+def _ci_infra_reason(
+    ci: "CiStore", repo: str, number: int, failed: "list[CheckRun]"
+) -> str | None:
+    """The :data:`CI_INFRA_PREFIX` reason when EVERY check in *failed* is
+    verdictless (#1892), else ``None``.
+
+    Issues at most one :meth:`CiStore.list_jobs_for_run` call per distinct
+    ``run_id`` among *failed* — never when *failed* is empty (the all-green
+    or still-pending path), matching the "only on the failure path" scoping
+    this feature was built to. ``getattr(ci, "list_jobs_for_run", None)``
+    mirrors the same fail-closed-toward-"no answer" pattern
+    ``_ci_checks_are_stale``/``_ci_expects_checks`` already use for a
+    ``CiStore`` stand-in that predates a capability (a duck-typed test stub,
+    or :class:`coord.gate_snapshot.GateSnapshot` — which deliberately does
+    NOT implement this, per Invariant 1 above) — such a store just never
+    produces this classification, falling back to the plain "checks failed"
+    wording exactly like #1892 didn't exist for it.
+    """
+    if not failed:
+        return None
+    list_jobs = getattr(ci, "list_jobs_for_run", None)
+    if list_jobs is None:
+        return None
+    run_ids = sorted({c.run_id for c in failed if c.run_id})
+    jobs_by_run: dict[str, dict[str, JobRun]] = {}
+    for run_id in run_ids:
+        try:
+            jobs = list_jobs(repo, run_id)
+        except Exception:  # noqa: BLE001 — classification-only, never raises upward
+            jobs = []
+        jobs_by_run[run_id] = {j.name: j for j in (jobs or [])}
+    all_verdictless = all(
+        is_verdictless_job(c, jobs_by_run.get(c.run_id, {}).get(c.name))
+        for c in failed
+    )
+    if not all_verdictless:
+        return None
+    summary = ", ".join(f"{c.name} ({c.conclusion})" for c in failed)
+    return (
+        f"{CI_INFRA_PREFIX} {summary} — no verdict about the code (never "
+        "assigned a runner, or died before checkout)"
+    )
+
+
+def _ci_expects_checks(
+    ci_store: "CiStore", repo_github: str | None, pr_number: int | None
+) -> bool:
+    """True when *ci_store* believes *repo_github*#*pr_number* should have
+    reported at least one check (#1904) — i.e. an empty
+    ``list_checks_for_pr`` result is suspicious, not a legitimate "no CI
+    here" reading. Callers only consult this once ``list_checks_for_pr`` has
+    already come back empty.
+
+    ``getattr(..., None)`` mirrors `_ci_checks_are_stale`'s own fail-closed
+    posture toward a ``CiStore``/``GhOps`` stand-in that predates a
+    capability (see that function's ``get_branch_commit_timestamp`` probe):
+    a store that hasn't been taught to answer this question yet reads as
+    "checks were expected" rather than silently reopening the #1904 hole for
+    any backend or test double this code doesn't already know about.
+    :class:`coord.ci_store.NoOpCi` and :class:`coord.ci_github.GitHubCi`
+    both implement this explicitly; so does
+    :class:`coord.gate_snapshot.GateSnapshot`.
+    """
+    probe = getattr(ci_store, "expects_checks", None)
+    if probe is None:
+        return True
+    try:
+        return bool(probe(repo_github, pr_number))
+    except Exception:  # noqa: BLE001 — fail closed: an erroring probe still means "assume expected"
+        return True
+
+
+def _ci_checks_are_stale(
+    checks: "list[CheckRun]",
+    gh_ops: "GhOps | None",
+    repo_github: str | None,
+    target_branch: str | None,
+    smoke: "SmokeVerdictStatus | None",
+) -> bool:
+    """True when *checks* — already confirmed by the caller to have no
+    failed/in-flight entries — are stale relative to *target_branch*'s
+    current base (#1851).
+
+    GitHub does not re-run ``pull_request`` workflows on a base-only move
+    (only on head ``synchronize``), so a green check can silently outlive the
+    base commit it actually validated. See ``coord/ci_store.py``'s module
+    docstring and :func:`coord.ci_store.checks_are_stale` for the full
+    rationale; this function supplies the two pieces that predicate needs and
+    can't fetch for itself — the base's current commit timestamp, and (#1847
+    reuse) whether the base move can be dismissed without even reading one.
+
+    *smoke*, when given, is the :class:`SmokeVerdictStatus` this same gate
+    pass already computed for the entry's local Test verdict (evaluated only
+    when the smoke gate applies). Its ``spared_reason`` is set exactly when a
+    moved base was proven inert (#1738), the branch's own diff was proven
+    inert (#1778), or the two diffs are file-disjoint (#1847) — any one of
+    which spares the local verdict for the *same* base move, and the same
+    reasoning spares the CI result: "the two checks answer the same question
+    about different evidence" (#1851). When *smoke* is ``None`` or carries no
+    ``spared_reason`` (smoke gate not required/evaluated for this entry, or
+    the base move wasn't spared), this falls back to a pure timestamp
+    comparison — the only evidence available without an anchor.
+
+    Fails closed (returns ``True``) whenever the timestamp comparison itself
+    can't be made: no *gh_ops*, no *target_branch*, a *gh_ops* stand-in with
+    no ``get_branch_commit_timestamp`` (e.g. :class:`coord.gate_snapshot.
+    GateSnapshot`, which doesn't cache it — same documented pessimistic-
+    display tradeoff as :func:`_fetch_compare_files`), or a live lookup that
+    raises or returns ``None``.
+    """
+    if smoke is not None and smoke.spared_reason is not None:
+        return False
+    if gh_ops is None or not repo_github or not target_branch:
+        return True
+    getter = getattr(gh_ops, "get_branch_commit_timestamp", None)
+    if getter is None:
+        return True
+    try:
+        base_commit_time = getter(repo_github, target_branch)
+    except Exception:  # noqa: BLE001 — fail-safe: unknown timestamp is stale, not blocking here
+        base_commit_time = None
+    return checks_are_stale(checks, base_commit_time)
+
+
+def has_smoke_verdict(
+    entry: "QueuedMerge", board, gh_ops: "GhOps | None" = None
+) -> bool:
+    """True when the smoke requirement for *entry* is satisfied.
+
+    Thin ``.ok`` projection of :func:`evaluate_smoke_verdict` — kept as the
+    boolean seam every existing gate call site already uses. Callers that
+    need to *render* a refusal should call :func:`evaluate_smoke_verdict`
+    directly so they can distinguish stale from missing (#1640).
+    """
+    return evaluate_smoke_verdict(entry, board, gh_ops).ok
+
+
+#: #1819: how long a transient ``test_state="running"`` marker (#1395) may
+#: outlive the last Test worker on its branch before the gate calls it STALE
+#: rather than MISSING. The marker is written at dispatch and cleared when a
+#: terminal verdict lands; if the worker died, was reaped, or its verdict write
+#: was lost, nothing ever clears it and every gate reads "no verdict" forever
+#: (#1797). ``--revalidate`` — the one tool built for exactly this cascade —
+#: only ever touches STALE entries, so without this classification the
+#: operator's escape hatch is unreachable from the state that most needs it
+#: (the #1640 shape, in its load-bearing form).
+#:
+#: Generous on purpose: a real suite run is minutes, so an hour of slack still
+#: never races a live worker, and the check ALSO requires that no live Test
+#: worker for the branch remains on the board.
+RUNNING_MARKER_STALE_AFTER = 60 * 60.0
+
+
+def _abandoned_running_marker(
+    branch_work: list,
+    board,
+    now: float | None = None,
+) -> "Assignment | None":
+    """The work row wedged at ``test_state="running"`` with no live Test worker.
+
+    #1819. Returns the row whose Test stage can never resolve itself, or
+    ``None`` when the marker is absent or a run is plausibly still going.
+
+    Deliberately conservative in two ways:
+
+    * it only fires when coord itself dispatched a Test-stage assignment for
+      the branch. A ``running`` marker with **no** smoke assignment anywhere is
+      the #1395 local-driver shape (``scripts/drive-issue.sh`` sets the marker
+      and runs the suite in-process), and there is no worker row whose age
+      could tell a live run from a dead one — so that case keeps the old
+      MISSING classification rather than risk resetting a driver mid-run;
+    * the window is measured from the newest Test worker's ``dispatched_at``
+      and applies uniformly, whether that worker is still in ``board.active``
+      or already reaped. A live-and-young smoke is obviously a run in
+      progress; a *just*-reaped one still buys the notify path time to land
+      the verdict it produced, so a lost write is never confused with a slow
+      one.
+    """
+    running = [
+        a for a in branch_work if getattr(a, "test_state", None) == "running"
+    ]
+    if not running:
+        return None
+
+    now = time.time() if now is None else now
+    pool = list(getattr(board, "completed", []) or []) + list(
+        getattr(board, "active", []) or []
+    )
+    active_ids = {
+        getattr(a, "assignment_id", None)
+        for a in (getattr(board, "active", []) or [])
+    } - {None}
+    work_ids = {
+        getattr(a, "assignment_id", None) for a in branch_work
+    } - {None}
+
+    smokes = [
+        a for a in pool
+        if getattr(a, "type", None) == "smoke"
+        and getattr(a, "review_of_assignment_id", None) in work_ids
+    ]
+    if not smokes:
+        return None
+    for s in smokes:
+        if getattr(s, "assignment_id", None) not in active_ids:
+            continue  # already reaped — cannot still be running
+        if getattr(s, "status", None) in ("done", "failed", "cancelled"):
+            continue
+        if now - (getattr(s, "dispatched_at", None) or 0.0) < RUNNING_MARKER_STALE_AFTER:
+            return None  # a Test worker is plausibly still going
+    newest = max(smokes, key=lambda s: getattr(s, "dispatched_at", None) or 0.0)
+    if now - (getattr(newest, "dispatched_at", None) or 0.0) < RUNNING_MARKER_STALE_AFTER:
+        return None
+    return running[0]
+
+
+def evaluate_smoke_verdict(
+    entry: "QueuedMerge", board, gh_ops: "GhOps | None" = None
+) -> SmokeVerdictStatus:
+    """Evaluate the smoke requirement for *entry*, with the reason it failed.
+
+    The gate **fails open**: if no work assignment can be found on the board
+    for the entry's branch (e.g. board was cleared, manual queue entry, or
+    the assignment pre-dates board persistence), this returns ``ok=True`` so
+    that the merge is not silently blocked without evidence.
+
+    The gate **fails closed** (``ok=False``) only when we can positively
+    identify the work assignment(s) on the branch and none of them carries a
+    *fresh* ``test_state in ('passed', 'skipped')`` verdict.
+
+    Collects all work assignment IDs connected to the entry — by shared
+    branch, or (#567) by the ``review_of_assignment_id`` chain, which also
+    catches fix workers dispatched with ``branch=NULL`` (the #557 remote-
+    interactive-rework gap) — to handle bounce/fix-work chains.
+
+    #1479: unlike the pre-existing behaviour, a terminal ``passed`` verdict is
+    not trusted unconditionally — it is checked against the branch/base state
+    it was recorded against (``test_head_sha``/``test_patch_id``/
+    ``test_base_sha``, stamped by ``coord.state._record_test_verdict_local``)
+    the same way ``has_approved_review`` checks ``review_head_sha``/
+    ``review_patch_id``, **plus** one condition the review gate deliberately
+    doesn't have: the *merge base itself* moving. A rebase onto a moved base
+    can break tests without the branch's own diff changing at all (a
+    semantic conflict — upstream renamed something the branch calls), so
+    that combination no longer having been tested must re-block the gate
+    even when ``branch_patch_id`` is unchanged. Content changing (new
+    commits on the branch) also re-blocks, mirroring the review gate. Either
+    anchor missing on either side skips that half of the check (fail open —
+    #821/#1475's existing convention), so rows/entries predating this
+    feature behave exactly as before.
+
+    #1732: ``skipped`` is deliberately excluded from all of the above. It is
+    not a measurement of code at a SHA the way ``passed`` is — it is a
+    structural claim about the diff itself ("contract/fixture-only, nothing
+    to smoke-test", #1076/#1152) that cannot be falsified by the base or
+    branch moving. Treating it like ``passed`` meant a Gate-A slice approved
+    and merge-ready would get refused as "STALE" with an unperformable
+    remedy: there is no suite to re-run, and recording ``passed`` would be a
+    lie about a suite that does not apply. A ``skipped`` verdict short-
+    circuits straight to :data:`SMOKE_OK` before any SHA comparison runs.
+
+    #1601: *gh_ops* (optional, mirroring :func:`has_approved_review`) fetches
+    the branch's/base's *live* SHA (and, via :func:`_backfill_branch_patch_id`,
+    the live patch-id) on demand when *entry* doesn't already carry them.
+    Without it, an entry that has never been through a live :func:`process`
+    pass has ``branch_head_sha``/``target_branch_head_sha``/``branch_patch_id``
+    all ``None``, which makes every staleness check above a no-op — so
+    ``coord merge --plan`` (which calls this via :func:`_entry_gate_status`
+    on a freshly-enqueued entry) could show READY for a verdict that
+    ``coord merge --only`` (whose :func:`process` DOES backfill these before
+    checking) then correctly refuses as stale. Passing *gh_ops* through
+    closes that "plan says ready, only refuses" disagreement — the #1566
+    incident's reader 3 vs. reader 4 split.
+
+    #1640: a *gh_ops* that cannot answer ``get_branch_sha`` /
+    ``get_branch_patch_id`` (the daemon's :class:`coord.gate_snapshot.
+    GateSnapshot` used to be exactly that) reopens the same disagreement
+    through a different door — the ``except Exception`` fallbacks below
+    swallow the ``AttributeError`` and every staleness check silently
+    degrades to a no-op, so ``/board``'s plan shows READY while a live
+    ``coord merge --only`` refuses. ``GateSnapshot`` now serves both lookups
+    from its tick-refreshed data; keep that in lockstep if a new gh_ops
+    stand-in is ever introduced.
+
+    Returns a :class:`SmokeVerdictStatus`: ``ok`` plus, when it fails,
+    whether the verdict is :data:`SMOKE_MISSING` (never recorded) or
+    :data:`SMOKE_STALE` (recorded, but against a branch/base combination
+    that no longer exists) and the SHAs that disagree.
+    """
+    pool = list(getattr(board, "completed", []) or []) + list(
+        getattr(board, "active", []) or []
+    )
+
+    branch_work_ids = _chain_work_ids(entry, pool)
+
+    # Collect work assignments that are explicitly present on the board.
+    branch_work = [
+        a for a in pool
+        if getattr(a, "assignment_id", None) in branch_work_ids
+        and getattr(a, "type", None) in WORK_LIKE_TYPES
+    ]
+    # Fail open: no work assignment found → can't block without evidence.
+    if not branch_work:
+        return SmokeVerdictStatus(ok=True, kind=SMOKE_OK)
+
+    current_base_sha = getattr(entry, "target_branch_head_sha", None)
+    current_branch_sha = getattr(entry, "branch_head_sha", None)
+    current_patch_id = getattr(entry, "branch_patch_id", None)
+    repo_github = getattr(entry, "repo_github", None)
+    entry_branch = getattr(entry, "branch", None)
+    target_branch = getattr(entry, "target_branch", None)
+    base_sha_attempted = current_base_sha is not None
+    branch_sha_attempted = current_branch_sha is not None
+    patch_id_attempted = current_patch_id is not None
+
+    # #1640: the first row rejected purely for staleness, so a refusal can
+    # name the case ("recorded at X, base now Y") instead of claiming no
+    # verdict exists. Only set when a terminal verdict was actually found —
+    # a board with no terminal verdict at all stays SMOKE_MISSING.
+    stale: SmokeVerdictStatus | None = None
+
+    # Work found — check whether any carries a fresh terminal smoke verdict.
+    for a in branch_work:
+        test_state = getattr(a, "test_state", None)
+        if test_state not in ("passed", "skipped"):
+            continue
+
+        # #1732: `skipped` is a structural claim about the *shape of the
+        # diff* ("contract/fixture-only, nothing to smoke-test" — #1076/
+        # #1152), not a claim about code behaving correctly at a particular
+        # SHA. Unlike `passed`, it does not decay when the base or branch
+        # moves — a rename upstream, or new commits on the branch, can't
+        # turn "there is nothing here a smoke test could exercise" into
+        # false. Only `passed` verdicts go through the #1479 base/branch
+        # staleness check below; `skipped` is accepted unconditionally.
+        if test_state == "skipped":
+            return SmokeVerdictStatus(
+                ok=True, kind=SMOKE_OK, assignment_id=getattr(a, "assignment_id", None)
+            )
+
+        # Merge base moved: the tested combination (this branch + that base)
+        # no longer exists, even if the branch's own diff is unchanged.
+        test_base_sha = getattr(a, "test_base_sha", None)
+        if (
+            test_base_sha is not None
+            and current_base_sha is None
+            and not base_sha_attempted
+            and gh_ops is not None
+            and repo_github
+            and target_branch
+        ):
+            try:
+                current_base_sha = gh_ops.get_branch_sha(repo_github, target_branch)
+            except Exception:  # noqa: BLE001 — fail-safe: unknown SHA is not blocking
+                current_base_sha = None
+            base_sha_attempted = True
+
+        # #1738/#1778/#1847: the base moved, but a moved SHA doesn't
+        # necessarily mean a content change that could affect a test result.
+        # `_base_move_spared` tries, in order: is the base move itself
+        # provably inert content (docs/scripts/issue-template only, #1738);
+        # failing that, is *this branch*'s entire diff (as actually tested,
+        # test_base_sha..test_head_sha) provably inert (#1778); failing that,
+        # do the two diffs simply touch disjoint files (#1847) — a
+        # substantive base move and a substantive branch that have nothing to
+        # do with each other. Any one being true means the tested combination
+        # is still covered — fall through to the branch-content check below
+        # instead of staling here. If the branch has since gained real
+        # content, that check still catches it independently via the
+        # patch-id compare (#1847 doesn't short-circuit it).
+        base_move_spare_reason: str | None = None
+        if (
+            test_base_sha is not None
+            and current_base_sha is not None
+            and test_base_sha != current_base_sha
+        ):
+            spared, base_move_spare_reason = _base_move_spared(
+                gh_ops,
+                repo_github,
+                test_base_sha,
+                current_base_sha,
+                getattr(a, "test_head_sha", None),
+            )
+            if not spared:
+                # stale: re-verify against the new base
+                if stale is None:
+                    stale = SmokeVerdictStatus(
+                        ok=False,
+                        kind=SMOKE_STALE,
+                        assignment_id=getattr(a, "assignment_id", None),
+                        anchor="base",
+                        recorded_sha=test_base_sha,
+                        current_sha=current_base_sha,
+                    )
+                continue
+
+        # Branch content changed since the test ran. Same SHA-then-patch-id
+        # fallback as has_approved_review: a content-identical rebase (SHA
+        # moved, patch-id didn't) does not invalidate the verdict.
+        test_head_sha = getattr(a, "test_head_sha", None)
+        if (
+            test_head_sha is not None
+            and current_branch_sha is None
+            and not branch_sha_attempted
+            and gh_ops is not None
+            and repo_github
+            and entry_branch
+        ):
+            try:
+                current_branch_sha = gh_ops.get_branch_sha(repo_github, entry_branch)
+            except Exception:  # noqa: BLE001 — fail-safe: unknown SHA is not blocking
+                current_branch_sha = None
+            branch_sha_attempted = True
+        if (
+            test_head_sha is not None
+            and current_branch_sha is not None
+            and test_head_sha != current_branch_sha
+        ):
+            test_patch_id = getattr(a, "test_patch_id", None)
+            if (
+                test_patch_id is not None
+                and current_patch_id is None
+                and not patch_id_attempted
+                and gh_ops is not None
+            ):
+                current_patch_id = _backfill_branch_patch_id(entry, gh_ops)
+                patch_id_attempted = True
+            if not (
+                test_patch_id is not None
+                and current_patch_id is not None
+                and test_patch_id == current_patch_id
+            ):
+                # stale: branch content changed since the test ran
+                if stale is None:
+                    stale = SmokeVerdictStatus(
+                        ok=False,
+                        kind=SMOKE_STALE,
+                        assignment_id=getattr(a, "assignment_id", None),
+                        anchor="branch",
+                        recorded_sha=test_head_sha,
+                        current_sha=current_branch_sha,
+                    )
+                continue
+
+        return SmokeVerdictStatus(
+            ok=True,
+            kind=SMOKE_OK,
+            assignment_id=getattr(a, "assignment_id", None),
+            spared_reason=base_move_spare_reason,
+        )
+
+    if stale is not None:
+        return stale
+
+    # #1819: no terminal verdict — but is it MISSING, or abandoned? A row
+    # pinned at the transient `running` marker whose Test worker is gone has a
+    # verdict that will never arrive, which is a staleness problem with a
+    # bounded automatic fix (re-run and re-record), not the #1640 "was a write
+    # lost?" question `--revalidate` deliberately refuses to paper over.
+    abandoned = _abandoned_running_marker(branch_work, board)
+    if abandoned is not None:
+        return SmokeVerdictStatus(
+            ok=False,
+            kind=SMOKE_STALE,
+            assignment_id=getattr(abandoned, "assignment_id", None),
+            anchor="run",
+        )
+
+    return SmokeVerdictStatus(
+        ok=False,
+        kind=SMOKE_MISSING,
+        assignment_id=getattr(branch_work[0], "assignment_id", None),
+    )
+
+
+@dataclass(frozen=True)
+class RevalidationCandidate:
+    """One queue entry that ``coord merge --revalidate`` may re-test (#1769).
+
+    Built only for entries blocked **solely** on a stale-but-``passed`` smoke
+    verdict — see :func:`revalidation_candidates`, which is the whole of the
+    eligibility policy. ``work_assignment_id`` is the row whose verdict has to
+    be re-recorded for the entry to clear its gate (the one
+    :func:`evaluate_smoke_verdict` named as carrying the stale verdict).
+    """
+
+    entry: "QueuedMerge"
+    work_assignment_id: str | None
+    smoke: SmokeVerdictStatus
+
+
+def revalidation_candidates(
+    items: Iterable["QueuedMerge"],
+    board,
+    config,
+    gh_ops: "GhOps | None" = None,
+) -> list[RevalidationCandidate]:
+    """The subset of *items* ``--revalidate`` is allowed to re-test (#1769).
+
+    An entry qualifies **only** when every one of these holds:
+
+    * it is ``PENDING`` (a ``CONFLICT``/``HUMAN_REQUIRED``/``MERGED`` entry is
+      never re-tested — a conflict is not a staleness problem);
+    * the smoke gate applies to it (:func:`requires_smoke`) and
+      :func:`evaluate_smoke_verdict` reports :data:`SMOKE_STALE` — i.e. a
+      terminal ``passed`` verdict exists but was recorded against a branch/base
+      combination that no longer exists. :data:`SMOKE_MISSING` is deliberately
+      excluded: a re-test cannot safely paper over the #1640 "was a verdict
+      ever written?" disagreement, and #1769's acceptance criteria name a
+      genuinely-missing verdict as out of scope;
+    * **no other gate is failing.** Concretely, the smoke failure is the only
+      entry in :func:`merge_gate_failures`, so an entry that also needs a
+      review is left alone. CI is not evaluated here (it needs a PR number and
+      a live ``gh`` round trip); :func:`process` still enforces it afterwards,
+      so a red-CI entry that was revalidated simply stays blocked on CI —
+      it is never merged.
+
+    This is the *eligibility* half of ``--revalidate``. The re-test itself and
+    the verdict write live in :mod:`coord.revalidate`; nothing here mutates
+    anything, so it is safe to call from ``--dry-run``.
+    """
+    out: list[RevalidationCandidate] = []
+    for entry in items:
+        if getattr(entry, "state", None) != PENDING:
+            continue
+        if config is None or board is None:
+            continue
+        if not requires_smoke(entry, config):
+            continue
+        failures = merge_gate_failures(entry, config, board, gh_ops)
+        # Blocked *solely* on smoke — a review/other block means a human (or
+        # another stage) still owes this entry something a re-test can't give.
+        if len(failures) != 1 or failures[0].gate != "smoke":
+            continue
+        smoke = evaluate_smoke_verdict(entry, board, gh_ops)
+        if smoke.ok or smoke.kind != SMOKE_STALE:
+            continue
+        out.append(RevalidationCandidate(
+            entry=entry,
+            work_assignment_id=smoke.assignment_id,
+            smoke=smoke,
+        ))
+    return out
+
+
+def ci_revalidation_candidates(
+    items: Iterable["QueuedMerge"],
+    board,
+    config,
+    ci_store: "CiStore | None",
+    gh_ops: "GhOps | None" = None,
+) -> list["QueuedMerge"]:
+    """The subset of *items* ``--revalidate`` may trigger a CI re-run for
+    (#1851) — the CI analogue of :func:`revalidation_candidates`.
+
+    An entry qualifies only when it is ``PENDING`` and
+    :func:`_entry_gate_status` blocks it for CI staleness specifically (a
+    reason starting with :data:`CI_STALE_PREFIX`) — which only happens after
+    every gate ahead of CI in that function's evaluation order (review,
+    smoke) has already passed, and the CI checks themselves are neither
+    failed nor still running, only stale. This mirrors
+    :func:`revalidation_candidates`'s "blocked *solely* on..." policy: an
+    entry that also needs a review or a fresh local Test verdict is left
+    alone here exactly as it already is there — a re-run is never offered as
+    a distraction from a block it can't resolve.
+
+    Returns the raw :class:`QueuedMerge` entries (unlike
+    :class:`RevalidationCandidate`, there is no local verdict to re-record —
+    the remedy is :meth:`coord.ci_store.CiStore.rerun_for_pr`, keyed off
+    ``entry.repo_github``/``entry.pr_number`` alone).
+    """
+    if ci_store is None or not ci_store.is_available:
+        return []
+    out: list["QueuedMerge"] = []
+    for entry in items:
+        if getattr(entry, "state", None) != PENDING:
+            continue
+        if not getattr(entry, "pr_number", None):
+            continue
+        status, reason = _entry_gate_status(entry, board, config, ci_store, gh_ops)
+        if status == PLAN_BLOCKED and (reason or "").startswith(CI_STALE_PREFIX):
+            out.append(entry)
+    return out
+
+
+# Stored error strings that only reflect the gate state *at the moment a
+# merge attempt ran* (`process()`) — nothing clears them when the approval or
+# verdict they're waiting on lands outside of a merge attempt (a normal
+# interactive review, no `coord merge`/auto-loop tick in between). See #420.
+_STALE_GATE_ERRORS = frozenset({
+    "review required but not approved",
+    "review required but board unavailable to confirm approval",
+    "smoke test required but no verdict recorded",
+    "smoke test required but board unavailable to confirm verdict",
+})
+
+# #1640: the stale-verdict wording carries live SHAs, so it can't be matched
+# by equality against a fixed set. It goes stale for exactly the same reason
+# the strings above do (recording a fresh verdict clears the condition
+# without any merge attempt running), so it gets the same recomputation.
+_STALE_GATE_ERROR_PREFIXES = ("smoke test verdict is stale:",)
+
+# #2085: the honest third answer for the review gate on a read-only surface —
+# neither "not approved" (unconfirmed failure) nor cleared (unconfirmed
+# success). See `display_error`.
+REVIEW_UNCONFIRMED_ERROR = (
+    "review approved but not yet confirmed against the branch head"
+)
+
+
+def _is_recomputable_gate_error(err: str | None) -> bool:
+    """True when *err* is a gate refusal :func:`display_error` may recompute."""
+    if not err:
+        return False
+    return err in _STALE_GATE_ERRORS or err.startswith(_STALE_GATE_ERROR_PREFIXES)
+
+
+def display_error(entry: "QueuedMerge", board, config) -> str | None:
+    """Return the error to show for *entry* in a read-only display (``coord
+    status``, dashboards) — recomputing the review/smoke gates live instead
+    of trusting the stored ``entry.error`` string verbatim.
+
+    #420: ``entry.error`` is only refreshed by :func:`process` (a real merge
+    attempt) or ``refresh_entry_assignment``. When a review approves — or a
+    smoke verdict is recorded — through the normal path (no ``coord merge``
+    run, no auto-loop tick in between), nothing clears the stored string, so
+    a mergeable entry can keep showing e.g. "review required but not
+    approved" indefinitely. Left unchecked this invites operators to bounce
+    already-approved work back for another round (the #410 real-world case).
+
+    Only the two gate messages known to go stale this way are recomputed
+    here, and recomputation is pure board/config lookups — no I/O. Every
+    other stored error (merge conflicts, CI check results) reflects the
+    outcome of the *last actual attempt* and is left untouched; re-checking
+    CI on every ``coord status`` would mean a live ``gh`` call per queue
+    entry just to render a status line.
+    """
+    if not _is_recomputable_gate_error(entry.error):
+        return entry.error
+    if board is None or config is None:
+        # Can't recompute without both — fall back to the stored string.
+        return entry.error
+    if entry.error.startswith("review"):
+        if not requires_review(entry, config):
+            return None
+        scan = scan_approved_reviews(entry, board)
+        if scan.approved:
+            return None
+        if scan.unknown_head:
+            # #2085 review follow-up: an approval exists and carries a
+            # `review_head_sha`, but this entry's `branch_head_sha` is still
+            # None — it's only populated once a live `process()`/`plan()`
+            # tick has touched the row, so a freshly-approved entry hasn't
+            # got one yet. This recompute is deliberately I/O-free (see
+            # above), so it cannot resolve the freshness question; the
+            # stored "review required but not approved" would be an
+            # unconfirmed *failure* verdict, and clearing it outright would
+            # be an unconfirmed *success* one (the #1640 trap in the smoke
+            # branch below). Say what is actually known instead — this
+            # self-heals to a definite answer on the next live tick.
+            return REVIEW_UNCONFIRMED_ERROR
+        return entry.error
+    if entry.error.startswith("smoke"):
+        if not requires_smoke(entry, config):
+            return None
+        smoke = evaluate_smoke_verdict(entry, board)
+        if not smoke.ok:
+            # Prefer the freshly-computed wording — it names stale-vs-missing
+            # (#1640) even when the stored string predates that distinction.
+            return smoke.message
+        # #1640: this recomputation is deliberately I/O-free (no gh_ops), so
+        # the #1479 freshness anchors are only populated on an entry that a
+        # live `process()` pass already backfilled. Without them "ok" means
+        # "found a terminal verdict", NOT "found a fresh one" — so a stored
+        # staleness refusal must not be cleared on that evidence, or this
+        # read-only surface starts showing green for exactly the entry
+        # `coord merge` refuses. The plain "no verdict recorded" string keeps
+        # its original #420 clear-on-recompute behaviour.
+        if entry.error.startswith(_STALE_GATE_ERROR_PREFIXES):
+            return entry.error
+        return None
+    return entry.error  # pragma: no cover — unreachable, kept for safety
+
+
+@dataclass
+class QueuedMerge:
+    assignment_id: str
+    repo_name: str
+    repo_github: str
+    branch: str
+    target_branch: str
+    issue_number: int
+    issue_title: str
+    state: str = PENDING
+    pr_number: int | None = None
+    pr_url: str | None = None
+    size: int | None = None
+    last_attempt: float | None = None
+    error: str | None = None
+    enqueued_at: float | None = None
+    # #821: current branch HEAD SHA, populated at process() time from GitHub.
+    # When set, `has_approved_review` checks it against the review assignment's
+    # `review_head_sha` to detect stale approvals (commits pushed after review).
+    # None means SHA tracking is not available for this entry.
+    branch_head_sha: str | None = None
+    # #1475: current content-addressed patch-id for the branch's diff against
+    # `target_branch`, populated at process() time alongside branch_head_sha.
+    # `has_approved_review` falls back to comparing this against the review's
+    # `review_patch_id` when the SHAs differ (e.g. a conflict-fix rebase) —
+    # identical patch-id means the rebase changed no content, so the approval
+    # still covers it. None means patch-id tracking is not available (fails
+    # closed to the pre-#1475 SHA-only staleness check).
+    branch_patch_id: str | None = None
+    # #1479: current HEAD SHA of `target_branch` itself, populated at
+    # process() time alongside branch_head_sha/branch_patch_id.
+    # `has_smoke_verdict` compares this against the test verdict's recorded
+    # `test_base_sha` to detect a merge base that moved since the test ran —
+    # a condition `branch_patch_id` (the branch's own content fingerprint)
+    # cannot see, since a rebase replays the identical diff onto a new base
+    # without changing it. None means base-SHA tracking is not available for
+    # this entry (transient, like branch_head_sha/branch_patch_id — never
+    # persisted to the queue DB).
+    target_branch_head_sha: str | None = None
+    # #1077: the originating assignment's `type` (e.g. "work", "mock-author"),
+    # captured at enqueue time. Drives both the PR-body "Closes #N" vs
+    # "Refs #N" keyword (`_briefing_body`) and whether `process()` closes
+    # `issue_number` deterministically after merge — see
+    # `coord.models.CLOSES_ISSUE_TYPES`. Defaults to "work" for entries
+    # created before this field existed (preserves prior close-on-merge
+    # behavior for old rows).
+    assignment_type: str = "work"
+    # #1213: snapshot of the originating assignment's resolved
+    # required_gates (from config.pipeline.labels via a matching GitHub
+    # issue label, or [] for "no override"), captured at enqueue() time.
+    # requires_review/requires_smoke read this — falling back to
+    # config.pipeline.default_gates when empty — instead of re-resolving
+    # from the live board at merge time, so the effective gate policy for
+    # an entry is commit-bound to when it was enqueued. [] (the default)
+    # means "no override" for both fresh entries and rows predating this
+    # column (NULL decodes to []) — both fall back identically.
+    required_gates: list[str] = field(default_factory=list)
+    # #1892: count of automatic `CiStore.rerun_for_pr` calls `process()` has
+    # issued for this entry's CURRENT run of verdictless CI failures —
+    # capped at `MAX_CI_INFRA_RERUNS`. Persists across ticks (unlike the
+    # transient `branch_head_sha`/`branch_patch_id` fields above) because the
+    # whole point is a durable ceiling: a workflow broken at "Set up job"
+    # must stop auto-rerunning and park for a human, not retry every tick
+    # forever. 0 for every entry that has never hit a verdictless failure,
+    # and for rows predating this column.
+    ci_infra_reruns: int = 0
+
+
+class GhOps(Protocol):
+    """Minimal interface the queue needs from github_ops. Tests pass a stub."""
+
+    def create_pr(
+        self, repo: str, *, base: str, head: str, title: str, body: str
+    ) -> dict: ...
+
+    def get_pr_size(self, repo: str, number: int) -> int: ...
+
+    def merge_pr(self, repo: str, number: int, method: str = "rebase") -> tuple[bool, str]: ...
+
+    def close_issue(self, repo: str, issue_number: int) -> None: ...
+
+    def get_pr_body(self, repo: str, number: int) -> str:
+        """Return PR *number*'s current body text (#1196, PR-body lint)."""
+        ...
+
+    def edit_pr_body(self, repo: str, number: int, body: str) -> None:
+        """Overwrite PR *number*'s body text (#1196, PR-body lint)."""
+        ...
+
+    def has_open_children(self, repo: str, issue_number: int) -> bool:
+        """True when *issue_number* has an open child (#1196)."""
+        ...
+
+    def is_epic_issue(self, repo: str, issue_number: int) -> bool:
+        """True when *issue_number* carries the tracking/epic label (#1318)."""
+        ...
+
+    def get_pr_commit_messages(self, repo: str, number: int) -> list[str]:
+        """Return every commit message on PR *number* (#1318, epic guard)."""
+        ...
+
+    def get_branch_sha(self, repo: str, branch: str) -> str | None:
+        """Return the current HEAD SHA for *branch*, or None on failure.
+
+        Used to populate ``QueuedMerge.branch_head_sha`` at process() time so
+        ``has_approved_review`` can reject stale approvals (#821).  Returning
+        ``None`` (on any network/auth failure) is safe — the staleness check
+        is skipped for rows without a SHA, preserving backward compatibility.
+        """
+        ...
+
+    def get_branch_patch_id(self, repo: str, base: str, branch: str) -> str | None:
+        """Return the content-addressed patch-id for *branch*'s diff against
+        *base*, or None on failure.
+
+        Used to populate ``QueuedMerge.branch_patch_id`` at process() time so
+        ``has_approved_review`` can carry an approval forward across a pure
+        rebase (#1475) even though the branch's HEAD SHA changed. Returning
+        ``None`` is safe — the gate falls back to the pre-#1475 SHA-only
+        staleness check.
+        """
+        ...
+
+    def get_compare_files(self, repo: str, base: str, head: str) -> list[str] | None:
+        """Return the file paths changed in the three-dot *base*...*head*
+        compare, or None on failure.
+
+        #1738: used by :func:`_base_move_is_inert` to tell a content-
+        irrelevant base move (docs/scripts/issue-template only) from one that
+        could actually affect a test result, before staling an otherwise-
+        fresh smoke verdict just because the merge base's SHA moved.
+
+        #1778: also used by :func:`_branch_is_inert`, the mirror check — is
+        the *branch's* own diff (not the base move) entirely inert, so a
+        base move (however substantive) doesn't need to re-verify it either.
+
+        #1847: both file lists (fetched once each, via
+        :func:`_fetch_compare_files`) also feed
+        :func:`_base_move_disjoint_from_branch` — the third #1479 escape
+        hatch, sparing a verdict when the two diffs simply touch no files in
+        common, independent of either being inert on its own.
+        """
+        ...
+
+    def check_pr_mergeable(self, repo: str, number: int) -> bool | None:
+        """Return GitHub's current mergeability verdict for PR *number*.
+
+        ``True`` when cleanly mergeable, ``False`` when conflicting, ``None``
+        when unknown (still computing, or the check itself failed). Used by
+        :func:`reconcile_conflict_entries` (#1477) to re-test a parked
+        ``CONFLICT`` entry rather than trusting the cached verdict from
+        whenever the queue last attempted it.
+        """
+        ...
+
+    def branch_has_merge_commit(self, repo: str, number: int) -> bool | None:
+        """True when any commit on PR *number* has more than one parent.
+
+        ``True``/``False`` when determined, ``None`` when it can't be (any
+        ``gh`` error, or a malformed response) — an inconclusive read, same
+        fail-closed contract as :meth:`check_pr_mergeable`. Used by
+        :func:`process` (#1467) to fall back from ``--rebase`` to
+        ``--squash`` before attempting a merge GitHub would otherwise refuse
+        with "This branch can't be rebased", and by
+        :func:`reconcile_conflict_entries` to avoid unparking an entry whose
+        rebase-refusal will deterministically recur.
+
+        Optional on stub ``GhOps`` implementations: callers detect support
+        via ``getattr(gh_ops, "branch_has_merge_commit", None)`` and treat a
+        missing method the same as an inconclusive (``None``) result, so
+        existing test stubs that predate #1467 keep working unmodified.
+        """
+        ...
+
+    def find_pr_for_branch(self, repo: str, branch: str) -> dict | None:
+        """Return the open PR whose head ref is *branch*, or ``None``.
+
+        Used by :func:`process` (#1624) to resolve an entry's real PR in the
+        ``dry_run`` path — mirroring what ``create_pr`` already does
+        internally on the real path — so a branch with an already-open PR is
+        reported as ``PR #N (existed)`` instead of ``would open PR``, and so
+        the CI gate below has a real PR number to evaluate against instead of
+        silently skipping.
+
+        Optional on stub ``GhOps`` implementations, same contract as
+        :meth:`branch_has_merge_commit`: callers detect support via
+        ``getattr(gh_ops, "find_pr_for_branch", None)`` and treat a missing
+        method (or a lookup failure) the same as "no PR found" — fail closed,
+        never assume a PR exists that couldn't be confirmed.
+        """
+        ...
+
+
+def live_gate_entry(
+    a: Assignment,
+    repo_github: str,
+    target_branch: str,
+    gh_ops: "GhOps | None",
+) -> QueuedMerge:
+    """Build a synthetic, never-persisted :class:`QueuedMerge` from a raw
+    work :class:`~coord.models.Assignment` *a*, with the #821/#1475/#1479
+    freshness anchors (``branch_head_sha``, ``branch_patch_id``,
+    ``target_branch_head_sha``) populated LIVE via *gh_ops* when supplied.
+
+    #2085: :func:`has_approved_review` / :func:`evaluate_smoke_verdict` read
+    those anchors straight off whatever *entry* they're handed — a real
+    ``QueuedMerge`` only carries them once :func:`process` has run at least
+    once. Any caller that needs to gate-check a raw work ``Assignment``
+    *before* it has gone through ``process()`` — the daemon's passive-tick
+    :func:`enqueue_approved_work`, ``coord.notify``'s stalled-dispatch
+    recovery, ``coord.diagnose``'s stage-work recovery, and ``coord.commands.
+    merge``'s auto-enqueue scan — used to hand ``has_approved_review`` the
+    bare ``Assignment`` directly. It has no ``branch_head_sha`` attribute at
+    all, so ``getattr(entry, "branch_head_sha", None)`` always read ``None``;
+    since #2085 made an unconfirmed SHA fail CLOSED (previously it fell
+    open), that made a review carrying a real ``review_head_sha`` —
+    virtually every modern approval — permanently unconfirmable from any of
+    those call sites, not just the superseded-approval case #2085 was filed
+    about. Routing through this helper first — mirroring the construction
+    :func:`coord.gates.build_gate_report` already used inline for the same
+    reason — gives those callers the same live SHA a real ``coord merge``
+    run would see, so a genuinely fresh approval can still confirm.
+
+    This is now the ONE place that construction happens — ``build_gate_report``
+    was refactored to call this too (#2096: two surfaces answering "is this
+    entry's approval still fresh" must call one function, not reimplement it
+    twice and risk drifting apart).
+
+    *gh_ops* ``None`` skips every live lookup (fails open on the freshness
+    anchors themselves, exactly as ``build_gate_report`` does with no live
+    client) — the resulting entry still lets a review with no
+    ``review_head_sha`` at all take the legacy no-SHA-to-compare path, but
+    correctly fails closed for one that has a SHA and can't be confirmed.
+    """
+    entry = QueuedMerge(
+        assignment_id=a.assignment_id or "",
+        repo_name=a.repo_name,
+        repo_github=repo_github,
+        branch=a.branch or "",
+        target_branch=target_branch,
+        issue_number=getattr(a, "issue_number", 0) or 0,
+        issue_title=getattr(a, "issue_title", None) or "",
+        assignment_type=getattr(a, "type", None) or "work",
+        required_gates=list(getattr(a, "required_gates", None) or []),
+    )
+    if gh_ops is not None and entry.branch:
+        try:
+            entry.branch_head_sha = gh_ops.get_branch_sha(entry.repo_github, entry.branch)
+        # #2085: NOT "fail-open, unknown SHA isn't blocking" — an unknown
+        # branch_head_sha now fails has_approved_review CLOSED (not open)
+        # for any review that carries a review_head_sha to compare against.
+        # A transient gh error here degrades to the same conservative
+        # refusal as gh_ops=None, never a silent pass.
+        except Exception:  # noqa: BLE001
+            entry.branch_head_sha = None
+        try:
+            entry.target_branch_head_sha = gh_ops.get_branch_sha(
+                entry.repo_github, entry.target_branch
+            )
+        except Exception:  # noqa: BLE001
+            entry.target_branch_head_sha = None
+        try:
+            entry.branch_patch_id = gh_ops.get_branch_patch_id(
+                entry.repo_github, entry.target_branch, entry.branch
+            )
+        except Exception:  # noqa: BLE001
+            entry.branch_patch_id = None
+    return entry
+
+
+# ── Persistence ──────────────────────────────────────────────────────────
+
+def load_queue() -> list[QueuedMerge]:
+    """Load all merge queue entries from the database."""
+    conn = get_connection()
+    rows = conn.execute(
+        "SELECT * FROM merge_queue ORDER BY id"
+    ).fetchall()
+    return [
+        QueuedMerge(
+            assignment_id=row["assignment_id"],
+            repo_name=row["repo_name"],
+            repo_github=row["repo_github"],
+            branch=row["branch"],
+            target_branch=row["target_branch"],
+            issue_number=row["issue_number"],
+            issue_title=row["issue_title"],
+            state=row["state"],
+            pr_number=row["pr_number"],
+            pr_url=row["pr_url"],
+            size=row["size"],
+            last_attempt=row["last_attempt"],
+            error=row["error"],
+            enqueued_at=row["enqueued_at"],
+            # #1077: column added via migration; rows written before it
+            # existed read back as NULL, so fall back to "work" (the
+            # pre-existing close-on-merge behavior for those entries).
+            assignment_type=row["assignment_type"] or "work",
+            # #1213: column added via migration; NULL (pre-migration rows)
+            # and '[]' (explicit "no override") both decode to [] — the
+            # gate falls back to config.pipeline.default_gates for either.
+            required_gates=json.loads(row["required_gates"]) if row["required_gates"] else [],
+            # #1892: column added via migration; NULL (pre-migration rows)
+            # decodes to 0 — no auto-reruns spent yet, same as a fresh entry.
+            ci_infra_reruns=row["ci_infra_reruns"] or 0,
+        )
+        for row in rows
+    ]
+
+
+def save_queue(items: list[QueuedMerge]) -> None:
+    """Replace the entire merge queue in the database."""
+    conn = get_connection()
+    with conn:
+        conn.execute("DELETE FROM merge_queue")
+        for item in items:
+            conn.execute(
+                """INSERT INTO merge_queue (
+                    assignment_id, repo_name, repo_github, branch,
+                    target_branch, issue_number, issue_title, state,
+                    pr_number, pr_url, size, last_attempt, error, enqueued_at,
+                    assignment_type, required_gates, ci_infra_reruns
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)""",
+                (
+                    item.assignment_id, item.repo_name, item.repo_github,
+                    item.branch, item.target_branch, item.issue_number,
+                    item.issue_title, item.state, item.pr_number, item.pr_url,
+                    item.size, item.last_attempt, item.error, item.enqueued_at,
+                    item.assignment_type, json.dumps(list(item.required_gates or [])),
+                    item.ci_infra_reruns,
+                ),
+            )
+
+
+# ── Enqueue ──────────────────────────────────────────────────────────────
+
+def enqueue(
+    assignment: Assignment,
+    repo_github: str,
+    target_branch: str,
+    config=None,
+    board=None,
+    gh_ops: "GhOps | None" = None,
+) -> QueuedMerge | None:
+    """Add a completed assignment to the queue if it isn't already there.
+
+    Returns the new entry, or None if it was already queued, has no branch,
+    or (#946) *config* was supplied and ``passes_merge_gates`` rejects it —
+    i.e. review/smoke are required but not yet satisfied.  ``config`` (and
+    ``board``) are optional and default to ``None`` for backward
+    compatibility with existing callers (notably tests that seed the queue
+    directly); passing ``None`` skips the gate check entirely rather than
+    failing closed, since without a config there's no way to know which
+    gates apply.
+
+    #2085: when *config* IS supplied, the gate check runs against
+    :func:`live_gate_entry` — never against the raw *assignment*. An
+    ``Assignment`` has no ``branch_head_sha``/``branch_patch_id`` attribute
+    at all, so handing it straight to :func:`passes_merge_gates` made
+    :func:`has_approved_review`'s #821 freshness check permanently
+    *unconfirmable*: every review carrying a real ``review_head_sha`` (i.e.
+    virtually every modern approval) failed closed, turning this gate into
+    one that can never pass. ``repo_github`` and ``target_branch`` are
+    already parameters here, so the confirmation data is built rather than
+    demanded — a caller cannot reintroduce that regression by forgetting to
+    thread *gh_ops* through, which is exactly how the dashboard's enqueue
+    path was missed when the other four raw-``Assignment`` gate call sites
+    were fixed.
+
+    *gh_ops* defaults to the live :mod:`coord.github_ops` module (only
+    consulted when *config* is set, so a gate-less enqueue stays as
+    I/O-light as before, and only alongside the ``get_branch_diff_size``
+    call this function already makes). Pass an explicit stub to inject a
+    fake; a lookup failure degrades to the conservative "unconfirmed"
+    refusal, never a silent pass.
+
+    Dedup is by ``(repo_github, branch)`` — the queue's natural key is the
+    branch we'd merge, not the assignment_id.  Multiple work assignments
+    routinely target the same branch (original + fix-1 in the auto-loop,
+    original + PR-creator from ``coord pr``); they should not produce
+    duplicate rows. (#274)
+    """
+    if not assignment.branch:
+        return None
+    if config is not None:
+        if gh_ops is None:
+            from coord import github_ops as _live_gh  # noqa: PLC0415
+
+            gh_ops = _live_gh
+        gate_entry = live_gate_entry(assignment, repo_github, target_branch, gh_ops)
+        if not passes_merge_gates(gate_entry, config, board, gh_ops=gh_ops):
+            return None
+    items = load_queue()
+    if any(
+        x.assignment_id == assignment.assignment_id
+        or (x.repo_github == repo_github and x.branch == assignment.branch)
+        for x in items
+    ):
+        return None
+    # #776: populate size eagerly at enqueue time via the compare API so the
+    # displayed order matches the merge order without waiting for a PR to be
+    # opened.  Fail-open: size=None keeps the entry at the back of the queue.
+    from coord import github_ops as _gho  # noqa: PLC0415
+    try:
+        diff_size: int | None = _gho.get_branch_diff_size(
+            repo_github, target_branch, assignment.branch
+        ) or None
+    except Exception:  # noqa: BLE001
+        diff_size = None
+
+    entry = QueuedMerge(
+        assignment_id=assignment.assignment_id or "",
+        repo_name=assignment.repo_name,
+        repo_github=repo_github,
+        branch=assignment.branch,
+        target_branch=target_branch,
+        issue_number=assignment.issue_number,
+        issue_title=assignment.issue_title,
+        size=diff_size,
+        enqueued_at=time.time(),
+        assignment_type=assignment.type,
+        # #1213: snapshot the resolved gate list at enqueue time (commit-
+        # bound) rather than leaving requires_review/requires_smoke to
+        # re-resolve it from the live board later.
+        required_gates=list(assignment.required_gates or []),
+    )
+    items.append(entry)
+    save_queue(items)
+    return entry
+
+
+def enqueue_approved_work(config, board=None) -> list[str]:
+    """Enqueue / re-key merge-queue entries for all approved + tested done work.
+
+    Scans ``board.completed`` for done assignments whose ``type`` is in
+    :data:`coord.models.WORK_LIKE_TYPES` (``"work"`` or ``"mock-author"``,
+    #930) and, for each that satisfies ALL three conditions:
+
+    1. Review gate OK — ``requires_review(a, config)`` is False, **or** an
+       approved review exists on the board (``has_approved_review``) that
+       still covers the branch's LIVE current head (#2085: confirmed via
+       :func:`live_gate_entry`, not the raw ``Assignment``, which has no SHA
+       to compare against).
+    2. Smoke gate OK — ``requires_smoke(a, config)`` is False, **or** the
+       work assignment carries a ``test_state in ('passed', 'skipped')``
+       verdict (``has_smoke_verdict``).
+    3. Not terminal on GitHub — ``work_is_terminal`` returns False (issue still
+       open, or the PR that merged is not this branch's *current* commit —
+       #1150: a historical merge on a reused branch, e.g. from ``--fix-of``
+       continuing on the same branch, must not block enqueue of new commits
+       pushed on top of it). This is checked directly against GitHub per
+       assignment rather than via a queue-derived "already merged" shortcut,
+       since a MERGED entry for the same ``(repo, issue)`` pair may belong to
+       an entirely different branch/commit than the one being considered here.
+
+    …calls :func:`refresh_entry_assignment` so the entry is **created** (when
+    the work was never enqueued) or **re-keyed** to the latest fix assignment
+    (the #292 bounce fix).  :func:`enqueue` is *not* used because it cannot
+    update an existing entry's ``assignment_id``; ``refresh_entry_assignment``
+    handles both cases.
+
+    Idempotent: a second call with the same board produces no further changes
+    (``refresh_entry_assignment`` is a no-op when the entry already exists and
+    is keyed correctly).
+
+    #1490: a fix/bounce cycle piles up more than one ``WORK_LIKE_TYPES`` row
+    on the *same* branch (the original dispatch plus every retry), and each
+    stays in ``board.completed`` forever. Processing every such row
+    independently — the pre-#1490 behaviour — re-keyed the branch's one
+    queue entry once per row, every single tick, because the review/smoke
+    gates are resolved over the whole branch chain (so even a *failed*-test
+    row passes them) and there was nothing to stop each row's turn from
+    winning the re-key. :func:`group_branch_candidates` now resolves every
+    branch to a single winner up front (the most-recently-dispatched row
+    with a passed/skipped verdict — falling back to the most recent row
+    overall when none has passed yet); every other row on that branch is
+    logged (:func:`_log_superseded`) and never touches the queue.
+
+    Returns a list of assignment IDs for which an entry was created or updated.
+    Call sites use this list for diagnostic logging; callers that don't need it
+    can discard the return value.
+
+    Called from the daemon passive tick (:func:`coord.serve_app._passive_tick`)
+    on every interval so approved work enters the queue without requiring a
+    manual ``coord merge`` run (#736 / #217 invisible limbo).
+    """
+    from coord import github_ops as _gho  # noqa: PLC0415
+
+    if board is None:
+        from coord.state import build_board as _build_board  # noqa: PLC0415
+        board = _build_board()
+
+    changed: list[str] = []
+    terminal_cache: dict = {}
+    milestone_cache: dict = {}
+
+    completed = list(getattr(board, "completed", []) or [])
+    existing_queue = load_queue()
+
+    for a, superseded in group_branch_candidates(completed):
+        for row in superseded:
+            _log_superseded(row)
+
+        branch = a.branch
+        aid = a.assignment_id
+        repo_name = a.repo_name
+        repo_cfg = config.repo(repo_name)
+        if repo_cfg is None:
+            continue
+
+        # Skip if the assignment is already in the queue under its own ID.
+        # refresh_entry_assignment would create a second entry when no entry
+        # exists with a matching branch, even if one exists with the same
+        # assignment_id (e.g. seeded with a different branch in the queue).
+        # This guard prevents double-entries; re-keying is still handled
+        # because for fix-work the new aid is NOT yet in the queue.
+        if any(x.assignment_id == aid for x in existing_queue):
+            continue
+
+        # #934: target the milestone's `feature/ms-NN` branch, not
+        # `default_branch`, when this issue belongs to a milestone and the
+        # repo opted into the develop + feature-branch-per-milestone git
+        # model. The milestone lookup itself is skipped entirely (no `gh`
+        # call) when the repo hasn't opted in — fails open to
+        # `default_branch`, today's behavior, unchanged.
+        # #2085: resolved BEFORE the gate check now (it used to run after) —
+        # `live_gate_entry` below needs a target_branch to populate the
+        # #821/#1479 freshness anchors live.
+        from coord.branch_model import resolve_base_branch_for_issue_number  # noqa: PLC0415
+
+        target_branch = resolve_base_branch_for_issue_number(
+            repo_cfg,
+            repo_cfg.github,
+            getattr(a, "issue_number", 0),
+            cache=milestone_cache,
+        )
+
+        # Gates 1+2: review + smoke, via the shared predicate (#946) so this
+        # path stays in lockstep with the `coord merge` auto-enqueue loop and
+        # the raw `enqueue()` helper.  Only blocks when a gate is configured
+        # AND not satisfied — passes_merge_gates itself no-ops a disabled gate.
+        #
+        # #2085: `a` is a raw work Assignment — it has no `branch_head_sha`/
+        # `branch_patch_id`/`repo_github`/`target_branch` attribute at all,
+        # so handing it straight to `passes_merge_gates` made
+        # `has_approved_review`'s #821 SHA-freshness check permanently
+        # unconfirmable (fails closed on every review that carries a real
+        # `review_head_sha` — i.e. virtually every modern approval, not just
+        # the superseded-approval case this gate exists to catch).
+        # `live_gate_entry` builds the same live-anchored synthetic entry
+        # `coord.gates.build_gate_report` uses, so a genuinely fresh approval
+        # can still be confirmed via `_gho` (already available in this
+        # function for the terminal-state check below).
+        gate_entry = live_gate_entry(a, repo_cfg.github, target_branch, _gho)
+        if not passes_merge_gates(gate_entry, config, board, gh_ops=_gho):
+            continue
+
+        # Gate 3: not already terminal on GitHub (merged / closed).  Fail OPEN
+        # on transient gh errors so a network blip never blocks a real enqueue.
+        if _gho.work_is_terminal(
+            repo_cfg.github,
+            getattr(a, "issue_number", 0),
+            branch,
+            cache=terminal_cache,
+        ):
+            continue
+
+        if refresh_entry_assignment(
+            a,
+            repo_github=repo_cfg.github,
+            target_branch=target_branch,
+        ):
+            changed.append(aid)
+
+    return changed
+
+
+def refresh_entry_assignment(
+    assignment: Assignment,
+    repo_github: str,
+    target_branch: str,
+) -> bool:
+    """Ensure a PENDING queue entry exists for *assignment*'s branch and
+    is keyed to *assignment*.
+
+    #292 (Defect 2): after a review bounce the entry was created during an
+    earlier ``coord merge`` run and is keyed to the *original* work
+    assignment.  When the fix work gets approved, the entry's
+    ``assignment_id`` must be updated so ``has_approved_review`` (and the
+    matching TUI check) can find the approval.
+
+    - If no entry exists for the branch, one is created (same as
+      ``enqueue``).
+    - If an entry already exists keyed to a different assignment on the
+      same branch and its state is ``PENDING``, its ``assignment_id`` is
+      updated and any stale ``"review required"`` error is cleared.
+    - If the entry is in a terminal state (MERGED, CONFLICT, etc.) it is
+      left untouched.
+
+    Returns ``True`` when a change was made (entry created or updated).
+    """
+    from coord import github_ops as _gho  # noqa: PLC0415
+
+    if not assignment.branch or not assignment.assignment_id:
+        return False
+    items = load_queue()
+    # Match by (repo_github, branch) first; also accept a match by
+    # assignment_id alone so that a queue entry with a different branch but
+    # the same assignment_id (e.g. a test-seeded entry or a manually-created
+    # entry) is treated as "already present" rather than spawning a second row.
+    existing = next(
+        (
+            x for x in items
+            if (x.repo_github == repo_github and x.branch == assignment.branch)
+            or x.assignment_id == assignment.assignment_id
+        ),
+        None,
+    )
+    if existing is None:
+        # #776: populate size eagerly (same as enqueue()) and record enqueued_at.
+        try:
+            diff_size: int | None = _gho.get_branch_diff_size(
+                repo_github, target_branch, assignment.branch
+            ) or None
+        except Exception:  # noqa: BLE001
+            diff_size = None
+
+        entry = QueuedMerge(
+            assignment_id=assignment.assignment_id,
+            repo_name=assignment.repo_name,
+            repo_github=repo_github,
+            branch=assignment.branch,
+            target_branch=target_branch,
+            issue_number=assignment.issue_number,
+            issue_title=assignment.issue_title,
+            size=diff_size,
+            enqueued_at=time.time(),
+            assignment_type=assignment.type,
+            # #1213: snapshot the resolved gate list, same as enqueue().
+            required_gates=list(assignment.required_gates or []),
+        )
+        items.append(entry)
+        save_queue(items)
+        return True
+    if existing.assignment_id == assignment.assignment_id:
+        return False  # already correct
+    if existing.state != PENDING:
+        return False  # don't touch terminal entries (MERGED, CONFLICT, etc.)
+    existing.assignment_id = assignment.assignment_id
+    # #1077 (review round 1): do NOT overwrite existing.assignment_type here.
+    # assignment_type is a structural property of the branch/issue pairing,
+    # fixed once at enqueue() time -- not something to refresh from whatever
+    # assignment last touched the branch. A review-bounce fix worker is
+    # unconditionally dispatched with type="work" (auto_loop.py's
+    # _dispatch_fix_for_review), regardless of the original assignment's
+    # type, so re-keying assignment_type here would clobber a "mock-author"
+    # entry back to "work" on every ordinary request-changes round trip --
+    # silently re-enabling the close-on-merge behavior this issue fixed.
+    # assignment_id legitimately needs to track the latest fix (for
+    # approval-lookup purposes via has_approved_review), but assignment_type
+    # does not -- a bounce/fix iteration is conceptually still "fixing the
+    # same PR", so the type set at enqueue() stays authoritative.
+    # Clear a stale "review required" error now that a fresh approval arrived.
+    if existing.error == "review required but not approved":
+        existing.error = None
+    save_queue(items)
+    return True
+
+
+# ── Stale-conflict reconciliation (#1477) ───────────────────────────────────
+
+def reconcile_conflict_entries(gh_ops: "GhOps") -> list["MergeEvent"]:
+    """Re-test every ``CONFLICT`` entry's mergeability and clear stale verdicts.
+
+    A ``CONFLICT`` entry caches the ``gh pr merge`` failure message from
+    whenever the queue last attempted it, and ``process()`` never looks at it
+    again — it only ever iterates ``PENDING`` entries. When a conflict-fix
+    worker (#241) lands a rebase, or a human pushes a fix by hand, the branch
+    becomes clean but the entry sits parked on the old verdict forever,
+    requiring the three-step manual incantation described in #1477
+    (``--drop`` → a bare re-enqueue → ``--only``) to notice.
+
+    This re-tests GitHub's own mergeability computation for every
+    ``CONFLICT`` entry that has an open PR and, when it now reports clean,
+    returns the entry to ``PENDING`` and clears the stored error so it
+    re-enters the ordinary merge flow on this tick — no manual archaeology.
+
+    Fail-closed by design: an entry with no PR yet, or whose mergeability
+    can't be determined (``gh`` error, or GitHub still computing it — both
+    surface as ``None`` from :meth:`GhOps.check_pr_mergeable`), is left
+    untouched. Only an explicit ``True`` unparks it — never speculative.
+
+    #1467: a ``MERGEABLE`` verdict only reflects *content* conflicts — it
+    says nothing about whether a ``--rebase`` merge specifically will
+    succeed, because GitHub reports a branch carrying a merge commit as
+    ``MERGEABLE`` even though it flatly refuses to rebase-merge it. An
+    entry parked on that particular refusal (:func:`is_rebase_refusal`)
+    would otherwise unpark here, hit the exact same wall in :func:`process`,
+    and re-park — an infinite loop once auto-drain is on (#1491). For those
+    entries specifically, this also confirms via
+    :meth:`GhOps.branch_has_merge_commit` that the branch has actually gone
+    linear before unparking; an inconclusive read (``None``, or a ``gh_ops``
+    that doesn't support the probe) leaves the entry parked rather than
+    guessing — the same fail-closed posture as the mergeability check above.
+    A plain content conflict (no rebase-refusal wording) is unaffected and
+    keeps the original mergeable-only behaviour.
+
+    Loads and saves the queue directly (same shape as
+    :func:`enqueue_approved_work`), so this is safe to call unconditionally,
+    even under ``--dry-run``: it corrects previously-cached state rather than
+    taking a merge action, mirroring the auto-enqueue scan that already runs
+    regardless of ``--dry-run`` in ``coord merge``.
+
+    Returns the list of :class:`MergeEvent` for entries that were cleared, so
+    callers can echo them the same way they echo ``process()`` events.
+    """
+    items = load_queue()
+    events: list[MergeEvent] = []
+    changed = False
+    for entry in items:
+        if entry.state != CONFLICT or not entry.pr_number:
+            continue
+        try:
+            mergeable = gh_ops.check_pr_mergeable(entry.repo_github, entry.pr_number)
+        except Exception:  # noqa: BLE001 — never let a gh hiccup wedge the tick
+            mergeable = None
+        if mergeable is not True:
+            continue
+        if is_rebase_refusal(entry.error):
+            probe = getattr(gh_ops, "branch_has_merge_commit", None)
+            if probe is None:
+                continue  # can't confirm linearity — stay parked (#1467)
+            try:
+                has_merge_commit = probe(entry.repo_github, entry.pr_number)
+            except Exception:  # noqa: BLE001
+                has_merge_commit = None
+            if has_merge_commit is not False:
+                # Still has a merge commit, or the probe was inconclusive —
+                # unparking now would just reproduce the same refusal.
+                continue
+        entry.state = PENDING
+        entry.error = None
+        changed = True
+        events.append(MergeEvent(
+            entry, "reopened",
+            f"conflict cleared — PR #{entry.pr_number} ({entry.branch}) is "
+            "mergeable again, returned to pending",
+        ))
+    if changed:
+        save_queue(items)
+    return events
+
+
+def resolve_entry_key(items: list["QueuedMerge"], key: str) -> "QueuedMerge | None":
+    """Resolve *key* to a queue entry by whatever identifier the read path
+    printed — ``assignment_id``, the durable ``repo#issue`` form, a bare
+    issue number, or the branch name (#1477, #1490).
+
+    ``assignment_id`` is volatile across a drop + re-enqueue cycle: a fresh
+    row mints whatever assignment id the board currently shows for that
+    issue, which is not guaranteed to match the id an operator last saw in
+    ``coord status`` (#1477). #1490 sharpens this further: even *without* a
+    drop, a queue entry can legitimately be re-keyed between the moment the
+    board is read and the moment ``--only`` is invoked (a concurrent
+    auto-enqueue tick re-keying the branch's one entry to a newer fix
+    assignment) — so an id that was 100% correct when printed can already
+    be stale by the time it's passed here. Every fallback below resolves by
+    something that does *not* change out from under the operator for the
+    life of the entry.
+
+    Resolution order (first match wins):
+
+    1. Exact ``assignment_id`` — unchanged, most specific.
+    2. ``repo#issue`` (or ``repo_github#issue``) — only tried when *key*
+       contains ``#`` (plain ids/branches never do, so this can never
+       accidentally shadow one). A parse failure after ``#`` is a hard
+       miss — no fallthrough to the forms below.
+    3. A bare issue number — *key* parses as an ``int`` with no ``#``.
+       Matches ``entry.issue_number`` across every repo in *items*;
+       ambiguous only when the same issue number is queued for more than
+       one repo, in which case (like form 2) the most recently added match
+       wins.
+    4. The entry's own ``branch`` name (#1490) — the most stable identifier
+       there is: it's set once at enqueue time and never changes for the
+       life of the entry, unlike ``assignment_id`` which re-keys on every
+       fix/bounce round. This is the fallback the issue calls out
+       explicitly: "if an ID is genuinely re-keyed between passes, resolve
+       by branch".
+
+    When more than one entry matches forms 2-4, :func:`_pick_ambiguous_match`
+    breaks the tie: an entry still in play (not ``MERGED``/``SKIPPED``) is
+    preferred over one already at rest, and only among equally-actionable
+    (or equally-terminal) candidates does "most recently added" apply
+    (``load_queue()`` returns rows in insertion order) — the #1477 tie-break.
+    #2080: two sealed slices of the same milestone share one *tracking*
+    issue number, so a bare-issue or ``repo#issue`` key is routinely
+    ambiguous between them even though each is a distinct, independently
+    mergeable entry. Plain "most recent wins" used to resolve that ambiguity
+    to whichever slice merged *first* — because merging is what makes an
+    entry's ``load_queue()`` position look "most recent" to a re-read of the
+    file — permanently orphaning the other slice's ``--only <issue>`` runs
+    behind an already-``MERGED`` sibling. Preferring the still-pending entry
+    fixes that without changing behaviour for the (still ambiguous, still a
+    caller error to rely on) case where two matches are equally actionable —
+    use the branch name there.
+
+    Returns ``None`` when nothing matches any form — callers must treat
+    that as an explicit error, never a silent no-op (#1477).
+    """
+    for entry in items:
+        if entry.assignment_id == key:
+            return entry
+    if "#" in key:
+        repo_part, _, issue_part = key.rpartition("#")
+        try:
+            issue_number = int(issue_part)
+        except ValueError:
+            return None
+        matches = [
+            e for e in items
+            if e.issue_number == issue_number and repo_part in (e.repo_name, e.repo_github)
+        ]
+        if matches:
+            return _pick_ambiguous_match(matches)
+        return None
+    try:
+        bare_issue_number = int(key)
+    except ValueError:
+        bare_issue_number = None
+    if bare_issue_number is not None:
+        matches = [e for e in items if e.issue_number == bare_issue_number]
+        if matches:
+            return _pick_ambiguous_match(matches)
+    branch_matches = [e for e in items if e.branch == key]
+    if branch_matches:
+        return branch_matches[-1]
+    return None
+
+
+# States a queue entry never leaves once reached — resolving a shared key
+# (durable repo#issue, or bare issue number) against a mix of these and
+# still-actionable states should never silently prefer the entry that's
+# already done (#2080).
+_RESOLVE_TERMINAL_STATES = (MERGED, SKIPPED)
+
+
+def _pick_ambiguous_match(matches: list["QueuedMerge"]) -> "QueuedMerge":
+    """Break a tie between several :func:`resolve_entry_key` *matches* that
+    share one durable key (#2080).
+
+    Two sealed slices of the same milestone share the milestone's tracking
+    issue number, so ``repo#issue`` and bare-issue-number resolution
+    routinely finds more than one queue entry. Prefer an entry that is still
+    actionable (state not in :data:`_RESOLVE_TERMINAL_STATES`) over one
+    already at rest — a merged sibling is never the row an operator meant by
+    the shared key once anything else with that key is still pending. Among
+    equally-actionable (or equally-terminal) candidates, fall back to
+    "most recently added" (*matches* is in ``load_queue()`` insertion
+    order) — the pre-existing #1477 tie-break, applied only where it can no
+    longer pick a done entry over a live one.
+    """
+    actionable = [e for e in matches if e.state not in _RESOLVE_TERMINAL_STATES]
+    pool = actionable if actionable else matches
+    return pool[-1]
+
+
+def resolve_board_work_key(board, key: str) -> "list":
+    """Every done work-like board row that *key* addresses (#1695).
+
+    The board-side twin of :func:`resolve_entry_key`, matching the **same
+    four key forms** (``assignment_id``, ``repo#issue``, bare issue number,
+    branch name) against ``board.completed`` instead of the persisted queue.
+
+    Exists purely so ``coord merge --only`` can tell the two failure modes
+    apart when the queue lookup misses:
+
+    * *no board row either* → the identifier genuinely did not resolve, which
+      is what the pre-#1695 message ("tried assignment_id, repo#issue, issue
+      number, and branch name") always claimed and was usually wrong about;
+    * *a board row exists* → the identifier is fine, and the reason there is
+      no entry is a gate — which the caller can then name via
+      :func:`merge_gate_failures`.
+
+    Returns **all** matches (not just the most recent, unlike
+    :func:`resolve_entry_key`'s tie-break) because the caller is producing a
+    diagnostic, not choosing a row to act on: it is more useful to report
+    every candidate and its gate state than to silently pick one. Ordered as
+    they appear in ``board.completed``; ``[]`` when nothing matches or
+    *board* is None.
+    """
+    rows = [
+        a for a in (getattr(board, "completed", None) or [])
+        if getattr(a, "type", None) in WORK_LIKE_TYPES
+    ]
+    exact = [a for a in rows if a.assignment_id == key]
+    if exact:
+        return exact
+    if "#" in key:
+        repo_part, _, issue_part = key.rpartition("#")
+        try:
+            issue_number = int(issue_part)
+        except ValueError:
+            return []
+        return [
+            a for a in rows
+            if a.issue_number == issue_number and a.repo_name == repo_part
+        ]
+    try:
+        bare_issue_number: int | None = int(key)
+    except ValueError:
+        bare_issue_number = None
+    if bare_issue_number is not None:
+        matches = [a for a in rows if a.issue_number == bare_issue_number]
+        if matches:
+            return matches
+    return [a for a in rows if a.branch == key]
+
+
+# ── Plan-status constants (#776) ─────────────────────────────────────────────
+
+# Computed status values for PlannedMerge.status — not stored in the DB.
+PLAN_READY = "READY"
+PLAN_BLOCKED = "BLOCKED"
+PLAN_MERGING = "MERGING"
+PLAN_MERGED = "MERGED"
+PLAN_NEEDS_ATTENTION = "NEEDS_ATTENTION"
+
+
+# ── Gate evaluation (#776) ──────────────────────────────────────────────────
+
+def _entry_gate_status(
+    entry: "QueuedMerge",
+    board,
+    config,
+    ci_store: "CiStore | None" = None,
+    gh_ops: "GhOps | None" = None,
+) -> tuple[str, str | None]:
+    """Return *(status, reason)* for a single PENDING merge-queue entry.
+
+    Evaluates gates in the same order as :func:`process` — review → smoke →
+    CI → epic-closing-keyword-in-commit — so the plan shown to the operator
+    is byte-for-byte what merge would do. Both :func:`plan` and :func:`process`
+    delegate to this helper so they can never diverge.
+
+    Returns ``(PLAN_READY, None)`` when all gates pass.
+    Returns ``(PLAN_BLOCKED, reason)`` when any gate blocks.
+
+    The *ci_store* gate is only evaluated when both *ci_store* is provided
+    **and** the entry has a ``pr_number`` (CI is checked per-PR, not per-branch).
+    This mirrors the live-merge behaviour: a ``PENDING`` entry with no PR yet
+    opened is not blocked on CI — the PR hasn't been created yet.
+
+    The *gh_ops* epic-closing-keyword-in-commit gate (#1318) is likewise only
+    evaluated when both *gh_ops* is provided **and** the entry has a
+    ``pr_number`` — mirroring the CI gate's guard, since commit messages can
+    only be read once a PR exists. This gate is never bypassable via
+    ``force_merge`` here (unlike :func:`process`'s live override) — the plan
+    view has no such flag; an operator who wants to see the override outcome
+    reads the ``coord merge --force-merge`` output itself.
+
+    #1851: a CI gate that reads all-green additionally checks *staleness* —
+    whether every passing check predates the target branch's current HEAD
+    commit, which GitHub's own re-run-on-``synchronize``-only behaviour never
+    catches. Reported with the :data:`CI_STALE_PREFIX` wording, distinct from
+    "CI failed"/"CI running" so an operator (and :func:`ci_revalidation_candidates`,
+    which keys off the same prefix) can tell the three apart.
+    """
+    smoke: "SmokeVerdictStatus | None" = None
+    if config is not None and board is not None:
+        # #1506: pass gh_ops through so a null branch_patch_id (e.g. an entry
+        # whose approved review predates #1475) is computed on demand rather
+        # than displaying a stale "review not approved" the plan can't fix.
+        if requires_review(entry, config) and not has_approved_review(entry, board, gh_ops):
+            return PLAN_BLOCKED, "review not approved"
+        if requires_smoke(entry, config):
+            # #1640: render the specific failure. A stale verdict used to be
+            # reported with the same "test verdict missing" wording as one
+            # that was never recorded, which sent operators hunting a lost
+            # write instead of re-verifying against the moved base.
+            smoke = evaluate_smoke_verdict(entry, board, gh_ops)
+            if not smoke.ok:
+                return PLAN_BLOCKED, smoke.short_reason
+    if ci_store is not None and ci_store.is_available and entry.pr_number:
+        checks = ci_store.list_checks_for_pr(entry.repo_github, entry.pr_number)
+        # #1904: an empty check list satisfies every gate below vacuously —
+        # must be handled explicitly, before those gates, or a PR whose CI
+        # never ran at all reads as clear to merge.
+        if not checks and _ci_expects_checks(
+            ci_store, entry.repo_github, entry.pr_number
+        ):
+            # #1877: an empty check list is ALSO what GitHub reports for a
+            # PR that conflicts with its base — it can never build a merge
+            # ref, so no `pull_request`-triggered workflow ever runs. That
+            # is a different fact from "CI never ran on a mergeable PR" and
+            # needs the opposite response: don't block here, mirror what
+            # `process()` does — fall through so `coord merge` attempts the
+            # merge, discovers the real conflict, and routes to the #241
+            # conflict-fix path via the `conflict` event, instead of
+            # pre-empting it with a "CI never ran" block only a human can
+            # clear. `check_pr_mergeable` is duck-typed/optional here
+            # (unlike in `process()`, where `gh_ops` is always a live
+            # client): this function also runs against a `GateSnapshot`
+            # (the `/board` read path, #1336 Invariant 1 — no third-party
+            # I/O), which doesn't implement it — a missing probe reads as
+            # inconclusive, same as a `None`/confirmed-mergeable verdict,
+            # and today's block is left untouched.
+            _mergeable_probe = getattr(gh_ops, "check_pr_mergeable", None)
+            conflicted = False
+            if _mergeable_probe is not None:
+                try:
+                    conflicted = (
+                        _mergeable_probe(entry.repo_github, entry.pr_number)
+                        is False
+                    )
+                except Exception:  # noqa: BLE001 — inconclusive, not a block override
+                    conflicted = False
+            if not conflicted:
+                return (
+                    PLAN_BLOCKED,
+                    f"{CI_ABSENT_PREFIX} no checks reported for PR #{entry.pr_number} "
+                    "though this repo declares CI — merging would run untested code",
+                )
+        failed = failed_checks(checks)
+        if failed:
+            summary = ", ".join(f"{c.name} ({c.conclusion})" for c in failed)
+            return PLAN_BLOCKED, f"CI failed: {summary}"
+        pending = in_flight_checks(checks)
+        if pending:
+            summary = ", ".join(c.name for c in pending)
+            return PLAN_BLOCKED, f"{CI_PENDING_PREFIX} {summary}"
+        if checks and _ci_checks_are_stale(
+            checks, gh_ops, entry.repo_github, entry.target_branch, smoke
+        ):
+            return (
+                PLAN_BLOCKED,
+                f"{CI_STALE_PREFIX} checks predate the current base — "
+                "re-run CI (`coord merge --revalidate`) before merging",
+            )
+    if gh_ops is not None and entry.pr_number:
+        try:
+            commit_messages = gh_ops.get_pr_commit_messages(
+                entry.repo_github, entry.pr_number
+            )
+        except Exception:  # noqa: BLE001
+            commit_messages = []
+        commit_referenced: set[int] = set()
+        for message in commit_messages:
+            commit_referenced.update(find_closing_references(message))
+        commit_epic_hits: list[int] = []
+        for n in sorted(commit_referenced):
+            try:
+                if gh_ops.is_epic_issue(entry.repo_github, n):
+                    commit_epic_hits.append(n)
+            except Exception:  # noqa: BLE001
+                pass
+        if commit_epic_hits:
+            numbers_str = ", ".join(f"#{n}" for n in commit_epic_hits)
+            return (
+                PLAN_BLOCKED,
+                f"commit message contains closing keyword for epic {numbers_str} (#1318)",
+            )
+    return PLAN_READY, None
+
+
+# ── Merge plan (#776) ────────────────────────────────────────────────────────
+
+@dataclass
+class PlannedMerge:
+    """One entry in the server-side merge plan.
+
+    The plan is the single source of truth for ordering and gate-status — it
+    is what the TUI panel, the CLI ``--plan`` flag, and auto-drain all consume.
+    Unlike ``QueuedMerge``, which is the raw DB row, ``PlannedMerge`` carries
+    computed fields (``rank``, ``status``, ``reason``, ``milestone``) that are
+    always fresh and never stale.
+    """
+
+    assignment_id: str
+    repo_name: str
+    repo_github: str
+    branch: str
+    target_branch: str
+    issue_number: int
+    issue_title: str
+    rank: int                    # 1-based, ordered by true merge sequence
+    size: int | None             # diff lines (populated at enqueue; None = unknown)
+    status: str                  # READY | BLOCKED | MERGING | MERGED | NEEDS_ATTENTION
+    reason: str | None           # why it is blocked (None when READY / terminal)
+    enqueued_at: float | None    # unix timestamp when the entry was created
+    last_attempt: float | None   # unix timestamp of the last merge attempt
+    milestone: str | None        # issue milestone title, or None
+    # #1344: structured CI rollup so the TUI can render "2✓ 1✗" badges straight
+    # from `/board` instead of shelling out to `gh pr checks` itself. `None`
+    # when no PR is open yet, or `ci_store` has no checks for this PR.
+    pr_number: int | None = None
+    ci_summary: "CiCheckSummary | None" = None
+
+
+def _load_milestones_for_queue(
+    items: "list[QueuedMerge]",
+) -> "dict[tuple[str, int], str | None]":
+    """Load milestone titles for each (repo_name, issue_number) in *items*.
+
+    Queries the ``issues`` table in bulk and returns a dict keyed by
+    ``(repo_name, issue_number)``.  Missing rows (issue not yet synced) map
+    to ``None``.  Any DB error returns an empty dict so the plan degrades
+    gracefully.
+    """
+    if not items:
+        return {}
+    try:
+        conn = get_connection()
+        rows = conn.execute(
+            "SELECT repo_name, number, milestone_title FROM issues"
+        ).fetchall()
+        return {
+            (r["repo_name"], r["number"]): r["milestone_title"]
+            for r in rows
+        }
+    except Exception:  # noqa: BLE001
+        return {}
+
+
+def _state_to_plan_status(state: str) -> str:
+    """Map a ``QueuedMerge.state`` to a ``PlannedMerge.status`` constant."""
+    if state == PENDING:
+        return PLAN_READY      # will be overridden by gate check if blocked
+    if state == MERGING:
+        return PLAN_MERGING
+    if state == MERGED:
+        return PLAN_MERGED
+    # CONFLICT, HUMAN_REQUIRED, SKIPPED → surface for operator attention.
+    return PLAN_NEEDS_ATTENTION
+
+
+def plan(
+    board,
+    config,
+    ci_store: "CiStore | None" = None,
+    gh_ops: "GhOps | None" = None,
+) -> "list[PlannedMerge]":
+    """Return the **ordered merge plan** — one :class:`PlannedMerge` per queue entry.
+
+    This is the single source of truth for ordering and gate-status consumed by
+    the TUI panel (#B), the CLI ``--plan`` flag (#D), and auto-drain (#E).
+
+    Algorithm
+    ---------
+    1. Load the queue from the DB.
+    2. Group entries by ``(repo_github, target_branch)``.
+    3. Within each group, order PENDING entries by ``sequence()`` (size-ascending
+       with unknown-size last), then append non-PENDING entries in original DB
+       order.
+    4. Assign a 1-based ``rank`` globally across all groups (i.e. the first
+       PENDING entry across all repos is rank=1 regardless of repo).
+    5. For each entry:
+       - Derive ``status`` from the raw ``state`` value.
+       - For PENDING entries, override with :func:`_entry_gate_status` which
+         evaluates review / smoke / CI / epic-closing-keyword-in-commit gates
+         live against *board* + *config* + *ci_store* + *gh_ops*.
+       - Look up the issue's milestone from the ``issues`` table.
+
+    The function is intentionally **read-only** — no side effects, no DB writes.
+    Pass ``board=None`` and/or ``config=None`` to skip the review/smoke gates,
+    ``ci_store=None`` to skip the CI gate, and ``gh_ops=None`` to skip the
+    epic-closing-keyword-in-commit gate (useful in test scenarios that only
+    care about ordering).
+    """
+    items = load_queue()
+    milestones = _load_milestones_for_queue(items)
+
+    # ── Group by (repo_github, target_branch) ──────────────────────────────
+    group_order: list[tuple[str, str]] = []
+    groups: dict[tuple[str, str], list[QueuedMerge]] = {}
+    for entry in items:
+        key = (entry.repo_github, entry.target_branch)
+        if key not in groups:
+            group_order.append(key)
+            groups[key] = []
+        groups[key].append(entry)
+
+    # ── Build the ranked plan ───────────────────────────────────────────────
+    result: list[PlannedMerge] = []
+    rank = 0
+
+    for key in group_order:
+        group = groups[key]
+        # PENDING entries sorted by sequence(); all others in DB insertion order.
+        pending = [e for e in group if e.state == PENDING]
+        non_pending = [e for e in group if e.state != PENDING]
+        ordered = sequence(pending) + non_pending
+
+        for entry in ordered:
+            rank += 1
+            base_status = _state_to_plan_status(entry.state)
+            reason: str | None = None
+
+            ci_summary = None
+            if entry.state == PENDING:
+                base_status, reason = _entry_gate_status(
+                    entry, board, config, ci_store, gh_ops
+                )
+
+                # #1344: structured CI rollup for the TUI's badges. Deliberately
+                # scoped to PENDING entries only — the same scope as the gate
+                # check above — because `ci_store` is not always the cheap,
+                # tick-refreshed `GateSnapshot` (a dict lookup). Two other
+                # callers pass a freshly-built *live* `CiStore`
+                # (`ci_github.GitHubCi`) instead: `_auto_drain_tick`
+                # (serve_app.py, every ~30s when `merge.auto_drain` is on) and
+                # `coord merge --plan` (commands/merge.py). `merge_queue`
+                # never prunes MERGED entries (see
+                # `prune_stale_queue_entries`), so on a long-lived project the
+                # queue table accumulates unbounded merged history — widening
+                # this to "any entry with a pr_number" would fire one live
+                # `gh pr checks` subprocess per historical merged PR on every
+                # auto-drain tick, reintroducing the exact unbounded-`gh`-
+                # polling failure class #1344 removed from the TUI, just
+                # relocated to the daemon. It also wouldn't gain anything on
+                # the safe /board path: `GateSnapshotRefresher.refresh` itself
+                # only ever populates checks for entries that are PENDING at
+                # refresh time, so a MERGING/MERGED row never had real
+                # snapshot data to render in the first place.
+                if ci_store is not None and ci_store.is_available and entry.pr_number:
+                    checks = ci_store.list_checks_for_pr(entry.repo_github, entry.pr_number)
+                    if checks:
+                        ci_summary = summarize_counts(checks)
+
+            result.append(PlannedMerge(
+                assignment_id=entry.assignment_id,
+                repo_name=entry.repo_name,
+                repo_github=entry.repo_github,
+                branch=entry.branch,
+                target_branch=entry.target_branch,
+                issue_number=entry.issue_number,
+                issue_title=entry.issue_title,
+                rank=rank,
+                size=entry.size,
+                status=base_status,
+                reason=reason,
+                pr_number=entry.pr_number,
+                ci_summary=ci_summary,
+                enqueued_at=entry.enqueued_at,
+                last_attempt=entry.last_attempt,
+                milestone=milestones.get((entry.repo_name, entry.issue_number)),
+            ))
+
+    return result
+
+
+# ── Sequencing ───────────────────────────────────────────────────────────
+
+def sequence(items: Iterable[QueuedMerge]) -> list[QueuedMerge]:
+    """Order pending entries. Smaller diffs first; unknown sizes go last."""
+    pending = [x for x in items if x.state == PENDING]
+    return sorted(
+        pending,
+        key=lambda x: (x.size if x.size is not None else 10**9, x.assignment_id),
+    )
+
+
+def reorder(items: list[QueuedMerge], order: list[str]) -> list[QueuedMerge]:
+    """Return `items` reordered so that assignment_ids in `order` come first
+    in the given sequence. Unknown IDs are dropped from the override."""
+    by_id = {x.assignment_id: x for x in items}
+    head = [by_id[aid] for aid in order if aid in by_id]
+    tail = [x for x in items if x.assignment_id not in set(order)]
+    return head + tail
+
+
+# ── Sibling overlap warnings (#920) ─────────────────────────────────────────
+#
+# The 2026-07-02 mess (docs referenced in #915) was triggered by late
+# merging of overlapping sibling branches: #769/#645/#770 (+#768) were a
+# milestone chain all editing the same new files, approved but left sitting
+# while main moved, so every rebase collided with its siblings' additions.
+# Nothing warned that these would conflict if merged out of order or late.
+#
+# `find_sibling_overlaps` is a pure, read-only heuristic over the merge
+# queue: it groups PENDING (i.e. approved — see `enqueue_approved_work`'s
+# review+smoke gate) entries by `(repo_github, target_branch)`, clusters
+# same-group entries whose originating assignment's `files_allowed`
+# (the brain's inferred "files likely touched" — the same signal
+# `compute_do_not_touch` uses pre-dispatch, see `coord.dispatch`) overlap,
+# and reports a warning once the oldest member of a ≥2-entry cluster has
+# been sitting in the queue at least `config.merge.sibling_overlap_aging_hours`.
+
+
+@dataclass(frozen=True)
+class SiblingOverlapWarning:
+    """≥2 approved, aging queue entries whose branches touch the same files.
+
+    `issue_numbers` is already in the suggested merge order — oldest
+    ``enqueued_at`` first, since that entry has drifted furthest from a
+    moving main and merging it first shrinks the others' eventual rebase.
+    """
+
+    repo_name: str
+    target_branch: str
+    issue_numbers: tuple[int, ...] = field(default_factory=tuple)
+    overlapping_files: tuple[str, ...] = field(default_factory=tuple)
+    oldest_age_hours: float = 0.0
+
+
+def find_sibling_overlaps(
+    board,
+    config,
+    *,
+    now: float | None = None,
+) -> list[SiblingOverlapWarning]:
+    """Detect approved, aging, file-overlapping sibling branches in the queue.
+
+    Pure/read-only: loads the queue via :func:`load_queue`, reads
+    ``files_allowed`` off the matching assignments on *board*
+    (``board.completed`` + ``board.active``), does no GitHub/subprocess
+    calls. ``config.merge.sibling_overlap_aging_hours`` (default 24h) gates
+    how long the oldest entry in an overlapping cluster must have waited
+    before it's worth surfacing — a value of ``0`` (or a missing
+    ``merge`` config) disables the warning entirely.
+
+    Only ``PENDING`` entries are considered: by the time an assignment has a
+    queue entry, :func:`enqueue`/:func:`enqueue_approved_work` have already
+    applied the review+smoke gate, so a PENDING entry is "approved" in the
+    sense #920 means. Entries without a recorded ``enqueued_at`` (pre-#274
+    rows) are skipped — there's no age to measure.
+    """
+    aging_hours = getattr(getattr(config, "merge", None), "sibling_overlap_aging_hours", 24.0)
+    if not aging_hours or aging_hours <= 0:
+        return []
+    if now is None:
+        now = time.time()
+
+    entries = [e for e in load_queue() if e.state == PENDING and e.enqueued_at is not None]
+    if len(entries) < 2:
+        return []
+
+    pool = (
+        list(getattr(board, "completed", []) or [])
+        + list(getattr(board, "active", []) or [])
+    )
+    files_by_aid: dict[str, set[str]] = {}
+    for a in pool:
+        aid = getattr(a, "assignment_id", None)
+        if aid:
+            files_by_aid[aid] = set(getattr(a, "files_allowed", None) or [])
+
+    groups: dict[tuple[str, str], list[QueuedMerge]] = {}
+    for e in entries:
+        groups.setdefault((e.repo_github, e.target_branch), []).append(e)
+
+    warnings: list[SiblingOverlapWarning] = []
+    for (repo_github, target_branch), group in groups.items():
+        if len(group) < 2:
+            continue
+
+        # Union-find: cluster entries transitively sharing >=1 file.
+        parent = {e.assignment_id: e.assignment_id for e in group}
+
+        def find(x: str) -> str:
+            while parent[x] != x:
+                parent[x] = parent[parent[x]]
+                x = parent[x]
+            return x
+
+        def union(a: str, b: str) -> None:
+            ra, rb = find(a), find(b)
+            if ra != rb:
+                parent[ra] = rb
+
+        for i in range(len(group)):
+            files_i = files_by_aid.get(group[i].assignment_id, set())
+            if not files_i:
+                continue
+            for j in range(i + 1, len(group)):
+                files_j = files_by_aid.get(group[j].assignment_id, set())
+                if files_i & files_j:
+                    union(group[i].assignment_id, group[j].assignment_id)
+
+        clusters: dict[str, list[QueuedMerge]] = {}
+        for e in group:
+            clusters.setdefault(find(e.assignment_id), []).append(e)
+
+        for members in clusters.values():
+            if len(members) < 2:
+                continue
+            oldest_enqueued = min(m.enqueued_at for m in members)
+            age_hours = (now - oldest_enqueued) / 3600.0
+            if age_hours < aging_hours:
+                continue
+
+            ordered = sorted(members, key=lambda m: (m.enqueued_at, m.assignment_id))
+            overlap_files: set[str] = set()
+            for i in range(len(ordered)):
+                files_i = files_by_aid.get(ordered[i].assignment_id, set())
+                for j in range(i + 1, len(ordered)):
+                    files_j = files_by_aid.get(ordered[j].assignment_id, set())
+                    overlap_files |= files_i & files_j
+
+            warnings.append(SiblingOverlapWarning(
+                repo_name=members[0].repo_name,
+                target_branch=target_branch,
+                issue_numbers=tuple(m.issue_number for m in ordered),
+                overlapping_files=tuple(sorted(overlap_files)),
+                oldest_age_hours=round(age_hours, 1),
+            ))
+
+    warnings.sort(key=lambda w: (-w.oldest_age_hours, w.repo_name, w.target_branch))
+    return warnings
+
+
+# ── Staging section (#778) ────────────────────────────────────────────────────
+
+# Status values for StagingItem.status — never stored in the DB.
+STAGING_READY = "ready"      # all gates pass; will be enqueued on the next tick
+STAGING_BLOCKED = "blocked"  # at least one non-review gate is failing
+
+
+@dataclass
+class StagingItem:
+    """One entry in the 'approved but not yet queued' staging section.
+
+    Populated by :func:`staging_items` which scans the board for completed
+    work assignments that have an approved review (or don't need one) but
+    have not yet been admitted to the merge queue.  Exposed on ``/board`` so
+    thin clients (TUI, phone webapp) can answer "did my PR make it in?" without
+    a manual ``coord merge --dry-run``.
+    """
+
+    assignment_id: str
+    repo_name: str
+    issue_number: int
+    issue_title: str
+    branch: str
+    status: str          # STAGING_READY | STAGING_BLOCKED
+    reason: str | None   # None when ready; human-readable gate failure when blocked
+
+
+# #2085: `_work_has_approved_review_a` (a hand-rolled "any approve on any
+# connected work id" scan, no SHA/patch-id binding at all) used to live here
+# as a second implementation of the same question `has_approved_review`
+# answers — "two surfaces that happen to agree" is exactly the shape #2096
+# warns about, and this one agreed by being *more* permissive than the real
+# gate rather than less: a staging item could read READY off a review that
+# `coord merge` would refuse as stale. `has_approved_review` is already
+# duck-typed on `.assignment_id`/`.branch` (both present on a raw
+# `Assignment`) via `_chain_work_ids`, and getattr-defaults every SHA/
+# patch-id field a raw Assignment doesn't carry to `None` — which, since
+# #2085, means it fails CLOSED on any review whose approval can't be
+# confirmed fresh rather than skipping the check. staging_items now calls
+# `has_approved_review(a, board, gh_ops)` directly below.
+
+
+def _staging_smoke_entry(a, config):
+    """Build the minimal duck-typed entry :func:`evaluate_smoke_verdict` needs
+    for a staging candidate (#1640).
+
+    A staging item is by definition *not* in the merge queue, so there is no
+    :class:`QueuedMerge` row carrying ``branch_head_sha`` /
+    ``target_branch_head_sha`` / ``branch_patch_id``. The shim supplies the
+    identity fields (``assignment_id``/``branch``/``repo_github``/
+    ``target_branch``) the evaluator needs to *look those up* through a
+    ``gh_ops``, and leaves the SHA fields ``None`` so a ``gh_ops=None`` call
+    stays I/O-free.
+
+    ``target_branch`` is the repo's ``default_branch``, not the #934
+    milestone feature branch: resolving the latter costs a ``gh`` call, and
+    this function is on the ``/board`` read path. A staging candidate on a
+    milestone repo therefore compares against the wrong base and simply fails
+    the freshness check open — the same "anchor missing → skip that half"
+    convention the evaluator already uses, never a false *block*.
+    """
+    repo_cfg = None
+    if config is not None:
+        try:
+            repo_cfg = config.repo(getattr(a, "repo_name", None) or "")
+        except Exception:  # noqa: BLE001 — unknown repo: no live lookup possible
+            repo_cfg = None
+    return QueuedMerge(
+        assignment_id=getattr(a, "assignment_id", None) or "",
+        repo_name=getattr(a, "repo_name", None) or "",
+        repo_github=getattr(repo_cfg, "github", None) or "",
+        branch=getattr(a, "branch", None) or "",
+        target_branch=getattr(repo_cfg, "default_branch", None) or "",
+        issue_number=int(getattr(a, "issue_number", 0) or 0),
+        issue_title=getattr(a, "issue_title", None) or "",
+    )
+
+
+def staging_items(board, config, gh_ops: "GhOps | None" = None) -> list[StagingItem]:
+    """Return work assignments that are done+approved but not yet in the queue.
+
+    Scans ``board.completed`` for ``status=done`` assignments whose ``type``
+    is in :data:`coord.models.WORK_LIKE_TYPES` (``"work"`` or
+    ``"mock-author"``, #930) and returns one :class:`StagingItem` per
+    candidate that has an approved review
+    (or doesn't need one) but hasn't yet been admitted to the merge queue.
+    Each item is classified:
+
+    * ``STAGING_READY``   — all gates pass; will be enqueued on the next daemon
+      tick (typically within 30 s of approval).
+    * ``STAGING_BLOCKED`` — the smoke / test gate is failing; the item cannot
+      enter the queue until the operator records a verdict (``coord test
+      --passed`` / ``--skipped``).
+
+    Items that have NOT received an approved review are silently excluded so
+    that the staging section only shows work the pipeline has already green-lit.
+
+    The function is intentionally **read-only**: no DB writes.  Pass
+    ``board=None`` or ``config=None`` to skip gate evaluation (useful in
+    tests that only care about filtering logic).
+
+    #1640: the smoke gate here used to read the raw ``test_state`` column
+    with no freshness check at all, so it printed READY (and ``/board``'s
+    staging section showed green) for an assignment whose verdict
+    :func:`has_smoke_verdict` — the reader ``coord merge`` actually uses —
+    rejects as stale under the #1479 binding. It now routes through the same
+    :func:`evaluate_smoke_verdict` helper as every other smoke reader, so the
+    two can no longer disagree, and reports *which* failure it is.
+
+    *gh_ops* is optional and, when ``None`` (the default), no GitHub call is
+    made: the freshness anchors simply aren't available, and the evaluation
+    degrades to the terminal-verdict check it has always performed. Callers
+    that can supply a client — or the daemon's tick-refreshed
+    :class:`coord.gate_snapshot.GateSnapshot`, which serves the same two
+    lookups without live I/O — get the full freshness binding.
+    """
+    existing_queue = load_queue()
+
+    # Fast-lookup: assignment IDs already in the queue (any state).
+    queued_aids: set[str] = {x.assignment_id for x in existing_queue}
+
+    # Fast-lookup: branches already in the queue (any state).  A fix worker
+    # dispatched after the original work was enqueued will have a different
+    # assignment_id but share the same branch — so dedup by branch too.
+    queued_branches: set[str] = {x.branch for x in existing_queue if x.branch}
+
+    # Fast-lookup: (repo_name, issue_number) pairs already MERGED so we skip
+    # issues whose prior attempt was already shipped.
+    already_merged: set[tuple[str, int]] = {
+        (x.repo_name, x.issue_number)
+        for x in existing_queue
+        if x.state == MERGED
+    }
+
+    result: list[StagingItem] = []
+    completed = list(getattr(board, "completed", []) or [])
+
+    for a in completed:
+        if getattr(a, "type", None) not in WORK_LIKE_TYPES:
+            continue
+        if getattr(a, "status", None) != "done":
+            continue
+
+        aid = getattr(a, "assignment_id", None)
+        branch = getattr(a, "branch", None)
+        if not aid or not branch:
+            continue
+
+        repo_name = getattr(a, "repo_name", None) or ""
+        issue_number = int(getattr(a, "issue_number", 0) or 0)
+        issue_title = getattr(a, "issue_title", None) or ""
+
+        # Skip items already tracked in the queue (by assignment_id or branch).
+        # Branch-level dedup catches fix workers that share a branch with an
+        # already-queued original work assignment (#778).
+        if aid in queued_aids or branch in queued_branches:
+            continue
+
+        # Skip if the issue has already been merged via a prior work attempt.
+        if (repo_name, issue_number) in already_merged:
+            continue
+
+        # Gate: review.  Skip entirely when review is required but NOT yet
+        # approved — the item isn't "approved" yet and should not appear in the
+        # staging section (it belongs to the pipeline, not the merge staging).
+        if config is not None and board is not None:
+            if requires_review(a, config) and not has_approved_review(a, board, gh_ops):
+                continue
+
+        # Gate: smoke.  When the test gate is enabled and no *fresh* verdict
+        # exists, the item appears as BLOCKED rather than being silently
+        # excluded.  #1640: shared reader — see the docstring.
+        status = STAGING_READY
+        reason: str | None = None
+        if config is not None and board is not None and requires_smoke(a, config):
+            smoke = evaluate_smoke_verdict(
+                _staging_smoke_entry(a, config), board, gh_ops
+            )
+            if not smoke.ok:
+                status = STAGING_BLOCKED
+                reason = smoke.short_reason
+
+        result.append(StagingItem(
+            assignment_id=aid,
+            repo_name=repo_name,
+            issue_number=issue_number,
+            issue_title=issue_title,
+            branch=branch,
+            status=status,
+            reason=reason,
+        ))
+
+    return result
+
+
+# ── Processing ───────────────────────────────────────────────────────────
+
+@dataclass
+class MergeEvent:
+    entry: QueuedMerge
+    kind: str  # "opened" | "sized" | "merged" | "conflict" | "skipped" | "error" | "reopened"
+    message: str = ""
+
+
+def _briefing_body(entry: QueuedMerge) -> str:
+    # `Closes #N` makes GitHub auto-close the linked issue when the PR
+    # merges — without it the issue stays stranded open and the TUI's
+    # lifecycle ledger shows the row as In-flight forever (the brain
+    # keeps re-synching it as state=open).  Quadraui #239/#240/#242 hit
+    # this in 2026-05; closing the issues was a manual cleanup.
+    #
+    # #1077: only emit the closing keyword when this entry's issue_number is
+    # actually resolved by the PR (`CLOSES_ISSUE_TYPES`). A "mock-author"
+    # entry's issue_number is the milestone's tracking issue — closing it on
+    # merge is wrong (the epic reads "done" while its sub-issues are still
+    # open), so it gets the non-closing `Refs #N` instead.
+    keyword = "Closes" if entry.assignment_type in CLOSES_ISSUE_TYPES else "Refs"
+    return (
+        f"{keyword} #{entry.issue_number}\n\n"
+        f"Automated merge from the coordinator for assignment "
+        f"{entry.assignment_id} on issue #{entry.issue_number}.\n\n"
+        f"Worker branch: `{entry.branch}` → `{entry.target_branch}`."
+    )
+
+
+def process(
+    items: list[QueuedMerge],
+    gh_ops: GhOps,
+    *,
+    method: str = "rebase",
+    dry_run: bool = False,
+    presorted: bool = False,
+    ci_store: CiStore | None = None,
+    force_merge: bool = False,
+    config=None,
+    board=None,
+    skip_review: bool = False,
+    skip_smoke: bool = False,
+) -> list[MergeEvent]:
+    """Open PRs, size them, then merge each pending item.
+
+    Items are grouped by (repo_github, target_branch); a **merge conflict**
+    parks the conflicting entry (``CONFLICT`` state; the caller in
+    ``cli.py`` promotes it to ``HUMAN_REQUIRED``) and **continues** with
+    the remaining siblings in that group — each entry's ``gh pr merge`` is
+    independent, so a failed merge does not dirty the target branch for
+    siblings (#735).  Within a group, items are merged in input order —
+    call `sequence(group)` first if you want size-based ordering.
+    Set `presorted=True` to make that explicit at call sites.
+
+    When ``ci_store`` is provided and available, each PR is checked against
+    its CI status before merge.  A failed check produces a ``checks_failed``
+    event; a still-running check produces ``checks_pending``; a PR whose CI
+    was expected to run but reported zero checks at all — a distinct case
+    from either, see #1904 — produces ``checks_absent``.  In all three cases
+    the entry is **skipped** (``continue``) rather than halting the group, so
+    a ready sibling can still merge.  ``force_merge=True`` skips this gate.
+
+    #253/#821: When *config* says review is required (``reviews.enabled`` and
+    ``"review"`` in ``pipeline.default_gates``) the gate **fails closed**: if
+    *board* is ``None`` the approval cannot be confirmed so the entry is
+    blocked (``review_required`` event, skip — never merge).  When *config*
+    is ``None`` the gate is not applicable (no review policy → no block).
+    ``skip_review=True`` bypasses the gate for explicit local-only overrides.
+    The daemon ``/merge`` endpoint always passes ``skip_review=False`` and
+    ignores any ``skip_review`` flag from the client (#821).
+
+    #465/#821: Same fail-closed semantics for the smoke gate: when *config*
+    says ``"test"`` is in ``pipeline.default_gates`` but *board* is ``None``,
+    the verdict cannot be confirmed → block (``smoke_required`` event).
+    ``skip_smoke=True`` bypasses the gate.
+
+    Dry-run applies the review and smoke gates, and — #1624 — resolves each
+    entry's real PR via ``find_pr_for_branch`` (the same lookup ``create_pr``
+    does internally) and applies the CI gate against it too, so output
+    reflects what a real run would do. CI genuinely cannot be checked for an
+    entry with no PR yet (nothing exists to query); that case is reported as
+    an explicit ``gate: unknown (no PR yet)`` note rather than silently
+    treated as passing.
+
+    #1318: before each merge, both the PR body (#1196) and every commit
+    message on the branch are scanned for a GitHub closing keyword
+    (``Closes``/``Fixes``/``Resolves #N``) targeting an epic-labelled issue
+    — free-text prose in a commit message (even a quote explaining the bug)
+    is enough for GitHub's own scanner to auto-close it once the commit
+    lands on the base branch, and no PR-body edit can undo that. A body hit
+    is downgraded to ``Refs #N`` in place, same as #1196. A commit-message
+    hit can't be rewritten here (no local git checkout in this ``gh``-only
+    wire layer) so it **blocks** the merge (``epic_closing_keyword_in_commit``
+    event) unless ``force_merge=True``, in which case the merge proceeds but
+    an ``epic_closing_keyword_in_commit_forced`` warning event is still
+    emitted — the override is never silent.
+
+    Mutates `items` in place; the caller saves the queue after.
+    """
+    events: list[MergeEvent] = []
+    ci: CiStore = ci_store if ci_store is not None else NoOpCi()
+
+    groups: dict[tuple[str, str], list[QueuedMerge]] = {}
+    for entry in items:
+        if entry.state != PENDING:
+            continue
+        groups.setdefault((entry.repo_github, entry.target_branch), []).append(entry)
+
+    _unset = object()
+
+    for group in groups.values():
+        # #1479-review: every entry in a group shares the same target_branch
+        # (that's the grouping key), so target_branch_head_sha is the same
+        # value for all of them — fetch it once per group instead of once
+        # per entry to avoid N redundant `gh api` calls for an N-entry group.
+        _group_target_branch_head_sha: str | None | object = _unset
+
+        if dry_run:
+            # #1624: resolve each entry's real PR the same way the non-dry
+            # path does (`create_pr` internally calls `find_pr_for_branch`
+            # before ever calling `gh pr create`) instead of unconditionally
+            # announcing "would open PR". A branch can already have an open
+            # PR — from an earlier real attempt that opened one and then
+            # stalled on a gate, or created out-of-band — and the CI gate
+            # below needs a real PR number to evaluate against; without this,
+            # the gate was silently skipped and the entry reported mergeable
+            # even with failing checks (#1624). `find_pr_for_branch` is
+            # optional on GhOps (older test stubs predate #1624): a missing
+            # probe or a lookup failure leaves the PR unresolved, same
+            # fail-closed contract as `branch_has_merge_commit` (#1467).
+            _find_pr = getattr(gh_ops, "find_pr_for_branch", None)
+            for entry in group:
+                if entry.pr_number is not None:
+                    events.append(MergeEvent(
+                        entry, "opened",
+                        f"PR #{entry.pr_number} (existed) for {entry.branch}",
+                    ))
+                    continue
+                existing = None
+                if _find_pr is not None:
+                    try:
+                        existing = _find_pr(entry.repo_github, entry.branch)
+                    except Exception:  # noqa: BLE001
+                        existing = None
+                if existing is not None:
+                    entry.pr_number = existing.get("number")
+                    entry.pr_url = existing.get("url")
+                    events.append(MergeEvent(
+                        entry, "opened",
+                        f"PR #{entry.pr_number} (existed) for {entry.branch}",
+                    ))
+                else:
+                    events.append(MergeEvent(
+                        entry, "opened",
+                        f"(dry run) would open PR for {entry.branch}",
+                    ))
+            ordered = group if presorted else sequence(group)
+            for entry in ordered:
+                # #821: populate branch_head_sha for the commit-bound approval
+                # staleness check in has_approved_review.  Only when the board
+                # is live (board=None blocks unconditionally; no SHA needed).
+                if board is not None and entry.branch_head_sha is None:
+                    entry.branch_head_sha = gh_ops.get_branch_sha(
+                        entry.repo_github, entry.branch
+                    )
+                # #1475/#1479: populate branch_patch_id alongside
+                # branch_head_sha so has_approved_review / has_smoke_verdict
+                # can carry a verdict forward across a content-identical
+                # rebase instead of re-blocking on SHA alone. Only fetch it
+                # when review or smoke is actually required for this entry —
+                # neither gate consults branch_patch_id otherwise, so
+                # skipping here saves a `gh api compare` round trip per entry
+                # per process() tick for the common gate-disabled case.
+                if (
+                    board is not None
+                    and entry.branch_patch_id is None
+                    and config is not None
+                    and (
+                        (not skip_review and requires_review(entry, config))
+                        or (not skip_smoke and requires_smoke(entry, config))
+                    )
+                ):
+                    entry.branch_patch_id = gh_ops.get_branch_patch_id(
+                        entry.repo_github, entry.target_branch, entry.branch
+                    )
+                # #1479: populate target_branch_head_sha so has_smoke_verdict
+                # can detect a merge base that moved since the test verdict
+                # was recorded — a condition branch_patch_id can't see, since
+                # a rebase replays the identical diff onto a new base without
+                # changing it. Only fetched when smoke is actually required,
+                # same cost-avoidance as branch_patch_id above.
+                if (
+                    board is not None
+                    and entry.target_branch_head_sha is None
+                    and not skip_smoke
+                    and config is not None
+                    and requires_smoke(entry, config)
+                ):
+                    if _group_target_branch_head_sha is _unset:
+                        _group_target_branch_head_sha = gh_ops.get_branch_sha(
+                            entry.repo_github, entry.target_branch
+                        )
+                    entry.target_branch_head_sha = _group_target_branch_head_sha
+                # #292 (Defect 4): apply the review gate in dry-run so output
+                # reflects real behaviour.  CI cannot be checked in dry-run
+                # (no PR exists yet), so review and smoke gates are evaluated.
+                # #821: fail closed — if review is required but board is None
+                # (approval cannot be confirmed) block the entry.
+                if (
+                    not skip_review
+                    and config is not None
+                    and requires_review(entry, config)
+                    and (board is None or not has_approved_review(entry, board, gh_ops))
+                ):
+                    _why = (
+                        "board unavailable to confirm review approval"
+                        if board is None
+                        else "review required but not approved"
+                    )
+                    events.append(MergeEvent(
+                        entry, "review_required",
+                        f"(dry run) would be blocked: {_why} for {entry.branch}",
+                    ))
+                    continue
+                # #465/#821: smoke gate in dry-run — same fail-closed logic.
+                # #1640: when a verdict exists but failed the #1479 freshness
+                # binding, say so (and against which SHA) rather than
+                # reporting it as never recorded.
+                _smoke = None  # read below for the "merged" preview note (#1847)
+                if (
+                    not skip_smoke
+                    and config is not None
+                    and requires_smoke(entry, config)
+                ):
+                    _smoke = (
+                        None
+                        if board is None
+                        else evaluate_smoke_verdict(entry, board, gh_ops)
+                    )
+                    if _smoke is None or not _smoke.ok:
+                        _why = (
+                            "board unavailable to confirm smoke verdict"
+                            if _smoke is None
+                            else _smoke.message
+                        )
+                        events.append(MergeEvent(
+                            entry, "smoke_required",
+                            f"(dry run) would be blocked: {_why} for {entry.branch}",
+                        ))
+                        continue
+                # CI gate (#240) preview, added by #1624: same check the real
+                # path runs, evaluated here so a dry run can't claim
+                # "would merge" for a PR whose checks are already failing.
+                # Only evaluable when a real PR number is known — either
+                # persisted from an earlier attempt or just resolved above
+                # via `find_pr_for_branch` — since CI is checked per-PR, not
+                # per-branch. A brand-new entry with no PR yet genuinely
+                # cannot be checked; say so explicitly in the "merged"
+                # preview below rather than silently treating "not
+                # evaluated" as "would merge" (#1624). `force_merge` skips
+                # the gate here exactly as it does in the real path.
+                _ci_note = ""
+                if not force_merge and ci.is_available:
+                    if entry.pr_number is not None:
+                        checks = ci.list_checks_for_pr(entry.repo_github, entry.pr_number)
+                        # #1904: same explicit "empty checks" handling the
+                        # real path applies below — every gate that follows
+                        # is a filter over `checks` and passes vacuously on
+                        # `[]`, so a PR whose CI never ran must be caught
+                        # here, not silently reported as "would merge".
+                        if not checks and _ci_expects_checks(
+                            ci, entry.repo_github, entry.pr_number
+                        ):
+                            # #1877: mirror the real path's fall-through —
+                            # an empty check list also means "PR conflicts
+                            # with its base, GitHub never built a merge ref
+                            # to test" and a real run routes that to the
+                            # #241 conflict-fix path rather than blocking
+                            # on CI. Preview that accurately instead of
+                            # either the misleading "CI never ran" (nothing
+                            # here is a CI problem) or letting it fall
+                            # through to the "would merge" message below
+                            # (the merge attempt itself would fail).
+                            conflicted = gh_ops.check_pr_mergeable(
+                                entry.repo_github, entry.pr_number
+                            ) is False
+                            if conflicted:
+                                events.append(MergeEvent(
+                                    entry, "conflict",
+                                    f"(dry run) {entry.branch} conflicts "
+                                    f"with {entry.target_branch} and "
+                                    "reports no checks — a real run would "
+                                    "route to the #241 conflict-fix path "
+                                    "rather than block on CI (#1877)",
+                                ))
+                                continue
+                            events.append(MergeEvent(
+                                entry, "checks_absent",
+                                f"(dry run) would be blocked: {CI_ABSENT_PREFIX} "
+                                f"no checks reported for {entry.branch} though "
+                                "this repo declares CI",
+                            ))
+                            continue
+                        failed = failed_checks(checks)
+                        if failed:
+                            # #1892: preview-only — never mutates, never
+                            # reruns; just shows the same classification a
+                            # live attempt would compute so `--dry-run`
+                            # doesn't undersell what's actually blocking.
+                            infra_reason = _ci_infra_reason(
+                                ci, entry.repo_github, entry.pr_number, failed
+                            )
+                            summary = ", ".join(
+                                f"{c.name} ({c.conclusion})" for c in failed
+                            )
+                            msg = infra_reason or f"checks failed: {summary}"
+                            events.append(MergeEvent(
+                                entry, "checks_failed",
+                                f"(dry run) would be blocked: {msg}",
+                            ))
+                            continue
+                        pending = in_flight_checks(checks)
+                        if pending:
+                            summary = ", ".join(c.name for c in pending)
+                            events.append(MergeEvent(
+                                entry, "checks_pending",
+                                f"(dry run) would be blocked: checks still running: {summary}",
+                            ))
+                            continue
+                        # #1851: a green CI result can itself be stale —
+                        # GitHub re-runs `pull_request` checks on head
+                        # `synchronize`, never on base movement, so a check
+                        # that started before the base's newest commit
+                        # landed never saw it. Named distinctly from
+                        # checks_failed/checks_pending above.
+                        if checks and _ci_checks_are_stale(
+                            checks, gh_ops, entry.repo_github,
+                            entry.target_branch, _smoke,
+                        ):
+                            events.append(MergeEvent(
+                                entry, "checks_stale",
+                                "(dry run) would be blocked: CI checks "
+                                "predate the current base — re-run CI "
+                                f"(`coord merge --revalidate`) for {entry.branch}",
+                            ))
+                            continue
+                    else:
+                        _ci_note = " [gate: unknown (no PR yet) — CI cannot be evaluated]"
+                # #1467-review: preview the rebase→squash fallback in
+                # dry-run too. Only reachable when this entry already has a
+                # pr_number — from an earlier (non-dry-run) attempt, or just
+                # resolved above via `find_pr_for_branch` (#1624) — since the
+                # probe needs one to query. A first-time dry-run preview of a
+                # brand-new entry still can't foresee the fallback. Same
+                # fail-closed contract as the real merge path: an
+                # inconclusive probe leaves the previewed method unchanged.
+                _preview_method = method
+                if method == "rebase" and entry.pr_number is not None:
+                    _probe = getattr(gh_ops, "branch_has_merge_commit", None)
+                    if _probe is not None:
+                        try:
+                            _has_merge_commit = _probe(
+                                entry.repo_github, entry.pr_number
+                            )
+                        except Exception:  # noqa: BLE001
+                            _has_merge_commit = None
+                        if _has_merge_commit is True:
+                            _preview_method = "squash"
+                            events.append(MergeEvent(
+                                entry, "method_fallback",
+                                f"(dry run) PR #{entry.pr_number} ({entry.branch}) "
+                                "contains a merge commit and cannot be "
+                                "rebase-merged — would fall back to --squash "
+                                "(#1467)",
+                            ))
+                # #1847: name *why* a base move didn't stale the smoke
+                # verdict, distinctly for each of the three #1479 escape
+                # hatches, so `--dry-run`/the TUI don't just say "fresh" —
+                # they say fresh *because the base move was inert*, *because
+                # the branch was inert*, or *because the two diffs are
+                # disjoint*. Absent whenever the base never moved at all
+                # (the common, unremarkable case stays quiet).
+                _smoke_note = (
+                    f" [test verdict fresh: {_smoke.spared_reason}]"
+                    if _smoke is not None and _smoke.ok and _smoke.spared_reason
+                    else ""
+                )
+                events.append(MergeEvent(
+                    entry, "merged",
+                    f"(dry run) would merge {entry.branch} → {entry.target_branch} "
+                    f"via --{_preview_method}"
+                    f"{_bypass_note(entry, config)}"
+                    f"{_ci_note}"
+                    f"{_smoke_note}",
+                ))
+            continue
+
+        # Open PRs first so every entry has a pr_number when we sort & merge.
+        for entry in group:
+            if entry.pr_number is None:
+                try:
+                    pr = gh_ops.create_pr(
+                        entry.repo_github,
+                        base=entry.target_branch,
+                        head=entry.branch,
+                        title=f"#{entry.issue_number}: {entry.issue_title}",
+                        body=_briefing_body(entry),
+                    )
+                except Exception as e:  # noqa: BLE001 — surface gh failure as event
+                    events.append(MergeEvent(entry, "error", f"create_pr failed: {e}"))
+                    continue
+                entry.pr_number = pr.get("number")
+                entry.pr_url = pr.get("url")
+                events.append(MergeEvent(
+                    entry, "opened",
+                    f"PR #{entry.pr_number} ({'existed' if pr.get('existed') else 'created'}) for {entry.branch}",
+                ))
+            if entry.pr_number and entry.size is None:
+                entry.size = gh_ops.get_pr_size(entry.repo_github, entry.pr_number)
+                events.append(MergeEvent(entry, "sized", f"size={entry.size}"))
+
+        ordered = group if presorted else sequence(group)
+        for entry in ordered:
+            if entry.pr_number is None:
+                continue
+            # #821: populate branch_head_sha for the commit-bound approval
+            # staleness check in has_approved_review.  Only when the board
+            # is live (board=None blocks unconditionally; no SHA needed).
+            if board is not None and entry.branch_head_sha is None:
+                entry.branch_head_sha = gh_ops.get_branch_sha(
+                    entry.repo_github, entry.branch
+                )
+            # #1475/#1479: populate branch_patch_id alongside branch_head_sha
+            # so has_approved_review / has_smoke_verdict can carry a verdict
+            # forward across a content-identical rebase instead of
+            # re-blocking on SHA alone. Only fetch it when review or smoke is
+            # actually required for this entry — neither gate consults
+            # branch_patch_id otherwise, so skipping here saves a `gh api
+            # compare` round trip per entry per process() tick for the
+            # common gate-disabled case.
+            if (
+                board is not None
+                and entry.branch_patch_id is None
+                and config is not None
+                and (
+                    (not skip_review and requires_review(entry, config))
+                    or (not skip_smoke and requires_smoke(entry, config))
+                )
+            ):
+                entry.branch_patch_id = gh_ops.get_branch_patch_id(
+                    entry.repo_github, entry.target_branch, entry.branch
+                )
+            # #1479: populate target_branch_head_sha so has_smoke_verdict can
+            # detect a merge base that moved since the test verdict was
+            # recorded — a condition branch_patch_id can't see, since a
+            # rebase replays the identical diff onto a new base without
+            # changing it. Only fetched when smoke is actually required,
+            # same cost-avoidance as branch_patch_id above.
+            if (
+                board is not None
+                and entry.target_branch_head_sha is None
+                and not skip_smoke
+                and config is not None
+                and requires_smoke(entry, config)
+            ):
+                if _group_target_branch_head_sha is _unset:
+                    _group_target_branch_head_sha = gh_ops.get_branch_sha(
+                        entry.repo_github, entry.target_branch
+                    )
+                entry.target_branch_head_sha = _group_target_branch_head_sha
+            # Review gate (#253/#821): refuse to merge when a review is required
+            # by the pipeline policy but no approved review is on the board.
+            # --skip-review bypasses for trivial/docs-only merges where the
+            # user has consciously decided review isn't needed.
+            # #292 (Defect 3): skip this entry and try the next one in the
+            # group rather than halting the whole group.  An un-reviewed entry
+            # should not prevent a fully-approved sibling from merging.
+            # #821: fail closed — when review is required but board is None
+            # the approval cannot be confirmed; block rather than silently merge.
+            if (
+                not skip_review
+                and config is not None
+                and requires_review(entry, config)
+                and (board is None or not has_approved_review(entry, board, gh_ops))
+            ):
+                msg = (
+                    "review required but board unavailable to confirm approval"
+                    if board is None
+                    else "review required but not approved"
+                )
+                entry.error = msg
+                events.append(MergeEvent(entry, "review_required", msg))
+                continue  # #292: skip this entry; try the next in the group
+            # Smoke gate (#465/#821): refuse to merge when the interactive smoke
+            # is required by the pipeline policy but no passing/skipped verdict
+            # is recorded on the work assignment.  Same skip-not-halt semantics
+            # as the review gate above.
+            # #821: fail closed — when smoke is required but board is None
+            # the verdict cannot be confirmed; block rather than silently merge.
+            # #1640: distinguish "never recorded" from "recorded but stale
+            # against the current base" — both used to print the former.
+            # #1851: also read below by the CI-staleness check, which reuses
+            # `smoke.spared_reason` when the smoke gate evaluated this same
+            # base move — `None` when smoke wasn't required for this entry.
+            smoke: "SmokeVerdictStatus | None" = None
+            if (
+                not skip_smoke
+                and config is not None
+                and requires_smoke(entry, config)
+            ):
+                smoke = (
+                    None if board is None else evaluate_smoke_verdict(entry, board, gh_ops)
+                )
+                if smoke is None or not smoke.ok:
+                    msg = (
+                        "smoke test required but board unavailable to confirm verdict"
+                        if smoke is None
+                        else smoke.message
+                    )
+                    entry.error = msg
+                    events.append(MergeEvent(entry, "smoke_required", msg))
+                    continue  # skip this entry; try the next in the group
+            # CI gate (#240): refuse to merge when checks are failed or
+            # still running.  --force-merge overrides for the case where the
+            # user has seen the failures and wants to merge anyway.
+            # #292 (Defect 3): skip-and-proceed for CI gates too, same logic
+            # as the review gate — a pending/failing CI entry should not
+            # block an approved sibling in the same (repo, target) group.
+            if not force_merge and ci.is_available:
+                checks = ci.list_checks_for_pr(entry.repo_github, entry.pr_number)
+                # #1904: `failed_checks`/`in_flight_checks`/`_ci_checks_are_stale`
+                # below are all filters over `checks` — an empty list
+                # satisfies every one of them vacuously, which is exactly
+                # the mechanism that let a PR whose CI never ran (a
+                # throttled webhook, a wedged run, a path-filtered-out
+                # workflow) merge as if it were green. Handled explicitly,
+                # ahead of those gates, and only when `expects_checks` says
+                # this repo actually declares CI — a repo with none
+                # configured (`NoOpCi`, or `GitHubCi` against a repo with no
+                # workflows) must not deadlock on this.
+                if not checks and _ci_expects_checks(
+                    ci, entry.repo_github, entry.pr_number
+                ):
+                    # #1877: an empty check list is ALSO what GitHub reports
+                    # for a PR that conflicts with its base — GitHub can
+                    # never build a merge ref for a conflicted PR, so no
+                    # `pull_request`-triggered workflow ever runs. That is a
+                    # different fact from "CI never ran on a mergeable PR"
+                    # and needs the opposite response: fall through to the
+                    # merge attempt below, which discovers the real conflict
+                    # and (via the `conflict` event / `_dispatch_conflict_
+                    # fixes`) dispatches #241's conflict-fix rebase, instead
+                    # of pre-empting it here with a "CI never ran" block
+                    # that only a human can clear. A confirmed-mergeable or
+                    # inconclusive (`None` — still computing, or the `gh`
+                    # call itself failed) read leaves today's block
+                    # untouched; this is not a license to skip the CI gate
+                    # for a merely-slow or unreadable mergeability check.
+                    conflicted = gh_ops.check_pr_mergeable(
+                        entry.repo_github, entry.pr_number
+                    ) is False
+                    if not conflicted:
+                        msg = (
+                            f"{CI_ABSENT_PREFIX} no checks reported for PR "
+                            f"#{entry.pr_number} though this repo declares CI "
+                            "— merging would run untested code"
+                        )
+                        entry.error = msg
+                        events.append(MergeEvent(entry, "checks_absent", msg))
+                        continue  # #292: skip, don't halt the group
+                failed = failed_checks(checks)
+                if failed:
+                    summary = ", ".join(
+                        f"{c.name} ({c.conclusion})" for c in failed
+                    )
+                    # #1892: classify BEFORE deciding the message/event — a
+                    # verdictless failure (every failing check says nothing
+                    # about the code: never assigned a runner, or died at
+                    # "Set up job") gets auto-rerun instead of the plain
+                    # "checks failed" block, up to MAX_CI_INFRA_RERUNS times
+                    # per entry. This is the one extra `gh api .../jobs` call
+                    # per distinct failing run — never issued above on the
+                    # absent/pending paths, only here once something has
+                    # actually failed.
+                    infra_reason = _ci_infra_reason(
+                        ci, entry.repo_github, entry.pr_number, failed
+                    )
+                    if (
+                        infra_reason is not None
+                        and entry.ci_infra_reruns < MAX_CI_INFRA_RERUNS
+                    ):
+                        entry.ci_infra_reruns += 1
+                        reran = ci.rerun_for_pr(entry.repo_github, entry.pr_number)
+                        _log.info(
+                            "#1892 auto-rerun %d/%d for %s#%d (PR #%s): %s "
+                            "(rerun_for_pr %s)",
+                            entry.ci_infra_reruns, MAX_CI_INFRA_RERUNS,
+                            entry.repo_name, entry.issue_number,
+                            entry.pr_number, summary,
+                            "triggered" if reran else "FAILED",
+                        )
+                        msg = (
+                            f"{infra_reason} — auto-rerun "
+                            f"{entry.ci_infra_reruns}/{MAX_CI_INFRA_RERUNS} "
+                            f"{'triggered' if reran else 'failed to trigger'}"
+                        )
+                        entry.error = msg
+                        events.append(MergeEvent(entry, "ci_infra_rerun", msg))
+                        continue  # #292: skip, don't halt the group
+                    if infra_reason is not None:
+                        # #1892: budget exhausted — a workflow broken at
+                        # "Set up job" itself (a bad `uses:` ref, a deleted
+                        # action) must stop auto-rerunning and surface to a
+                        # human instead of looping forever. Deliberately
+                        # WITHOUT the CI_INFRA_PREFIX from here on: this is
+                        # no longer something more real time alone resolves,
+                        # so it falls back to being treated exactly like a
+                        # genuine `checks_failed` block (drive attempts are
+                        # spent on it again, same as today).
+                        _log.info(
+                            "#1892 auto-rerun budget exhausted for %s#%d "
+                            "(PR #%s) after %d/%d tries: %s",
+                            entry.repo_name, entry.issue_number,
+                            entry.pr_number, entry.ci_infra_reruns,
+                            MAX_CI_INFRA_RERUNS, summary,
+                        )
+                        msg = (
+                            f"checks failed: {summary} — auto-rerun budget "
+                            f"exhausted ({entry.ci_infra_reruns}/"
+                            f"{MAX_CI_INFRA_RERUNS}); needs a human"
+                        )
+                        entry.error = msg
+                        events.append(MergeEvent(entry, "checks_failed", msg))
+                        continue  # #292: skip, don't halt the group
+                    msg = f"checks failed: {summary}"
+                    entry.error = msg
+                    events.append(MergeEvent(entry, "checks_failed", msg))
+                    continue  # #292: skip, don't halt the group
+                pending = in_flight_checks(checks)
+                if pending:
+                    summary = ", ".join(c.name for c in pending)
+                    # #1891: same `CI_PENDING_PREFIX` wording `_entry_gate_status`
+                    # returns for the board render — this is what lets
+                    # `IssueState.merge_reason`'s raw-row fallback (see that
+                    # constant's docstring) carry the SAME, recognisable marker
+                    # even when it falls back to this persisted `entry.error`
+                    # instead of a fresh live re-evaluation.
+                    msg = f"{CI_PENDING_PREFIX} {summary}"
+                    entry.error = msg
+                    events.append(MergeEvent(entry, "checks_pending", msg))
+                    continue  # #292: skip, don't halt the group
+                # #1892: this line is only reached once BOTH `if failed:`
+                # and `if pending:` above did not fire — a genuine
+                # resolution (checks non-empty*, nothing failed, nothing
+                # pending), not merely "not currently failed". Resetting on
+                # "not failed" alone was a bug: the tick right after this
+                # same code triggers an auto-rerun almost always observes
+                # the rerun as still pending (a real Actions run takes real
+                # wall-clock minutes), which would zero the budget before
+                # the rerun itself ever resolves — so a workflow genuinely
+                # broken at "Set up job" would fail, rerun, get reset to 0
+                # while pending, fail again, rerun again... forever, never
+                # reaching MAX_CI_INFRA_RERUNS and never parking for a
+                # human. Whatever verdictless run the budget was tracking
+                # has now actually resolved one way or another, so a LATER
+                # failure (a fresh push, a flaky green-then-red) starts its
+                # own budget from zero rather than inheriting an unrelated
+                # exhausted count.
+                # * `checks` can still be `[]` here for a repo that doesn't
+                # declare CI at all (`_ci_expects_checks` false, so the
+                # `checks_absent` branch above didn't fire) — resetting in
+                # that case is harmless since such an entry can never have
+                # accrued a nonzero `ci_infra_reruns` to begin with.
+                entry.ci_infra_reruns = 0
+                # #1851: a green CI result can itself be stale relative to the
+                # base — see `_ci_checks_are_stale`'s docstring. Named
+                # distinctly (`checks_stale`) from checks_failed/
+                # checks_pending above so an operator (and `coord merge
+                # --revalidate`, the remedy) can tell the three apart.
+                if checks and _ci_checks_are_stale(
+                    checks, gh_ops, entry.repo_github, entry.target_branch, smoke,
+                ):
+                    msg = (
+                        f"{CI_STALE_PREFIX} checks predate the current base "
+                        "— re-run CI (`coord merge --revalidate`) before merging"
+                    )
+                    entry.error = msg
+                    events.append(MergeEvent(entry, "checks_stale", msg))
+                    continue  # #292: skip, don't halt the group
+            # #1318: cache is_epic_issue lookups for this entry — the same
+            # referenced number can show up in both the PR body and one or
+            # more commit messages below, and each lookup is a `gh` round
+            # trip. Best-effort like every check in this block: a lookup
+            # failure just means "not known to be an epic", never a block.
+            _epic_cache: dict[int, bool] = {}
+
+            def _is_epic(n: int) -> bool:
+                if n not in _epic_cache:
+                    try:
+                        _epic_cache[n] = gh_ops.is_epic_issue(entry.repo_github, n)
+                    except Exception:  # noqa: BLE001
+                        _epic_cache[n] = False
+                return _epic_cache[n]
+
+            # #1196 hole 2 / #1318: GitHub's own closing-keyword magic reads
+            # the PR body directly at merge time and never calls
+            # `github_ops.close_issue` — that chokepoint's open-children
+            # guard can't stop it. Scan the body for `Closes #N`/`Fixes
+            # #N`/`Resolves #N` and downgrade to `Refs #N` for any N that
+            # either currently has open children (#1196) or carries the
+            # epic/tracking label (#1318 — an epic can have zero open
+            # children today and still be the wrong thing to auto-close),
+            # before the merge lands. Best effort throughout: a lint
+            # failure must never block a merge.
+            try:
+                pr_body = gh_ops.get_pr_body(entry.repo_github, entry.pr_number)
+            except Exception:  # noqa: BLE001
+                pr_body = ""
+            if pr_body:
+                referenced = find_closing_references(pr_body)
+                blocking: set[int] = set()
+                for n in referenced:
+                    try:
+                        if gh_ops.has_open_children(entry.repo_github, n):
+                            blocking.add(n)
+                    except Exception:  # noqa: BLE001
+                        pass
+                    if _is_epic(n):
+                        blocking.add(n)
+                if blocking:
+                    new_body, downgraded = downgrade_closing_keywords(pr_body, blocking)
+                    if downgraded:
+                        try:
+                            gh_ops.edit_pr_body(entry.repo_github, entry.pr_number, new_body)
+                            events.append(MergeEvent(
+                                entry, "pr_body_downgraded",
+                                "downgraded closing keyword to Refs for "
+                                + ", ".join(f"#{n}" for n in downgraded)
+                                + " (open children / epic — #1196/#1318)",
+                            ))
+                        except Exception as e:  # noqa: BLE001
+                            events.append(MergeEvent(
+                                entry, "pr_body_downgrade_failed",
+                                f"could not downgrade PR #{entry.pr_number} body "
+                                f"for {', '.join(f'#{n}' for n in downgraded)}: {e}",
+                            ))
+
+            # #1318: the PR-body scan above can't help with commit messages
+            # — GitHub's closing-keyword scanner reads those too once they
+            # land on the base branch (every original commit, unchanged, for
+            # `--rebase`/`--merge`; and depending on repo settings, squash's
+            # default commit body can pull the same text). There's no local
+            # git checkout in this `gh`-only wire layer to amend and
+            # force-push a rewritten message, so a hit here **blocks** the
+            # merge rather than silently rewriting history. `force_merge`
+            # overrides (same flag `--force-merge` already uses to skip the
+            # CI gate) but the override is never silent — a warning event
+            # still fires so it shows up in `coord merge` output and the
+            # audit trail.
+            try:
+                commit_messages = gh_ops.get_pr_commit_messages(
+                    entry.repo_github, entry.pr_number
+                )
+            except Exception:  # noqa: BLE001
+                commit_messages = []
+            commit_referenced: set[int] = set()
+            for message in commit_messages:
+                commit_referenced.update(find_closing_references(message))
+            commit_epic_hits = sorted(n for n in commit_referenced if _is_epic(n))
+            if commit_epic_hits:
+                numbers_str = ", ".join(f"#{n}" for n in commit_epic_hits)
+                msg = (
+                    f"a commit message on this branch contains a closing keyword "
+                    f"(Closes/Fixes/Resolves) for {numbers_str}, which carries the "
+                    f"'epic' label — GitHub auto-closes it on merge regardless of "
+                    f"the PR body (#1318). Reword the commit message(s) to "
+                    f"'refs #N' / 'epic #N' and push, or pass --force-merge to "
+                    f"merge anyway (the epic WILL still auto-close)."
+                )
+                if force_merge:
+                    events.append(MergeEvent(
+                        entry, "epic_closing_keyword_in_commit_forced", msg,
+                    ))
+                else:
+                    entry.error = msg
+                    events.append(MergeEvent(
+                        entry, "epic_closing_keyword_in_commit", msg,
+                    ))
+                    continue  # #1318: refuse — never merge a branch that will
+                    # auto-close an epic via a commit message we can't rewrite.
+
+            # #1467: pre-flight linearity check. GitHub refuses to
+            # rebase-merge any branch containing a merge commit ("This
+            # branch can't be rebased") — a distinct failure from a content
+            # conflict, and one GitHub's own `mergeable` field can't predict
+            # (a branch with a merge commit still reads MERGEABLE). Detect
+            # it via the PR's commit list — no local checkout is guaranteed
+            # on the daemon host, so `git rev-list --merges` is the wrong
+            # instrument here — and fall back to squash, which is always
+            # valid and keeps the target branch linear.
+            #
+            # Fail-closed: `branch_has_merge_commit` is optional on `gh_ops`
+            # (older stubs in tests predate #1467) and returns `None` on any
+            # `gh` error or ambiguous response; either case leaves `method`
+            # unchanged rather than guessing.
+            merge_method = method
+            if method == "rebase":
+                _probe = getattr(gh_ops, "branch_has_merge_commit", None)
+                if _probe is not None:
+                    try:
+                        _has_merge_commit = _probe(entry.repo_github, entry.pr_number)
+                    except Exception:  # noqa: BLE001
+                        _has_merge_commit = None
+                    if _has_merge_commit is True:
+                        merge_method = "squash"
+                        events.append(MergeEvent(
+                            entry, "method_fallback",
+                            f"PR #{entry.pr_number} ({entry.branch}) contains a "
+                            "merge commit and cannot be rebase-merged — "
+                            "falling back to --squash (#1467)",
+                        ))
+
+            entry.last_attempt = time.time()
+            entry.state = MERGING
+            ok, msg = gh_ops.merge_pr(entry.repo_github, entry.pr_number, method=merge_method)
+            if ok:
+                entry.state = MERGED
+                entry.error = None
+                # #1767: the condition that produced a drive escalation for
+                # this issue (if any) just resolved through the normal
+                # pipeline — clear it so `coord escalate list` doesn't
+                # accumulate phantoms for merged work. Idempotent and a
+                # no-op when there's nothing on file; routes through
+                # `coord.state` so it works (via the daemon) from a thin
+                # client rather than writing the local DB directly.
+                try:
+                    dismiss_drive_escalation(entry.repo_name, entry.issue_number)
+                except Exception:  # noqa: BLE001 — never fail a merge on this
+                    pass
+                # #1213: audit any gate bypassed by a per-issue label override
+                # BEFORE announcing the merge, so the "merged" event message
+                # already carries the bypass note — a bypass is never silent.
+                # Only fires on a real merge (never dry-run, handled above via
+                # the side-effect-free _bypass_note) so previews can't write
+                # phantom audit rows.
+                _record_gate_bypass_audit(entry, config)
+                bypass_note = _bypass_note(entry, config)
+                # Deterministically close the linked issue.  GitHub's `Closes #N`
+                # auto-close only fires when the PR *body* carries the keyword
+                # AND it merges into the default branch; the worker-created-PR
+                # path only asks the LLM for it and `fix(#N):` subjects aren't
+                # closing keywords, so issues got stranded open (#806).
+                # Best-effort — a close failure must not undo a successful merge.
+                # Closing on GitHub keeps the daemon the sole DB writer: the next
+                # reconcile/sync flips the cached row to closed (state.py).
+                #
+                # #1077: only for entries whose issue_number is actually
+                # resolved by this PR (CLOSES_ISSUE_TYPES). A "mock-author"
+                # entry's issue_number is the milestone's tracking issue —
+                # closing it here would be the exact #1077 bug regardless of
+                # what the PR body says.
+                if entry.assignment_type in CLOSES_ISSUE_TYPES:
+                    try:
+                        gh_ops.close_issue(entry.repo_github, entry.issue_number)
+                        events.append(MergeEvent(
+                            entry, "merged",
+                            f"merged PR #{entry.pr_number}; closed issue #{entry.issue_number}"
+                            f"{bypass_note}",
+                        ))
+                    except Exception as e:  # noqa: BLE001 — never fail a merge on close
+                        events.append(MergeEvent(
+                            entry, "merged",
+                            f"merged PR #{entry.pr_number} (warning: could not "
+                            f"close issue #{entry.issue_number}: {e}){bypass_note}",
+                        ))
+                else:
+                    events.append(MergeEvent(
+                        entry, "merged",
+                        f"merged PR #{entry.pr_number}; issue #{entry.issue_number} "
+                        f"left open (assignment type {entry.assignment_type!r} "
+                        f"does not close its tracking issue, #1077){bypass_note}",
+                    ))
+                continue
+            entry.state = CONFLICT
+            entry.error = msg
+            events.append(MergeEvent(entry, "conflict", msg))
+            continue  # #735: park this entry; siblings in same group still merge
+
+    return events
+
+
+# ── Drop / prune (#732) ──────────────────────────────────────────────────
+
+def drop_entry(assignment_id: str) -> bool:
+    """Remove exactly the merge_queue row keyed to *assignment_id*.
+
+    Returns ``True`` when a row was deleted, ``False`` when no matching row
+    was found.  This is the surgical mutation that ``coord merge --drop`` and
+    the TUI "drop" action use; it never touches other rows.
+
+    Because the queue lives on the daemon host, callers on thin clients must
+    route through the daemon (``/merge`` endpoint with ``"drop": aid`` in the
+    body) rather than calling this directly — the daemon guard pattern is the
+    same as ``coord merge`` (#584).
+
+    #1477: *assignment_id* is resolved via :func:`resolve_entry_key`, so the
+    durable ``repo#issue`` form works here too — not just a raw assignment
+    id, which can go stale across a drop + re-enqueue cycle.
+    """
+    conn = get_connection()
+    entry = resolve_entry_key(load_queue(), assignment_id)
+    if entry is None:
+        return False
+    with conn:
+        cursor = conn.execute(
+            "DELETE FROM merge_queue WHERE assignment_id = ?", (entry.assignment_id,)
+        )
+    return cursor.rowcount > 0
+
+
+def prune_stale_queue_entries(dry_run: bool = False) -> list["QueuedMerge"]:
+    """Remove merge_queue entries whose issue is closed or PR is already merged.
+
+    Returns the list of pruned entries so callers can surface them in output.
+
+    Only non-``MERGED`` entries are inspected — entries already recorded as
+    ``MERGED`` are correct history and are left untouched.
+
+    Uses :func:`coord.github_ops.issue_is_closed` and
+    :func:`coord.github_ops.pr_is_merged`, both of which **fail-open**
+    (return ``False`` on any ``gh`` error) so a transient GitHub/CLI failure
+    never silently prunes a live entry.
+    """
+    from coord import github_ops  # noqa: PLC0415
+
+    entries = load_queue()
+    stale: list[QueuedMerge] = []
+    surviving: list[QueuedMerge] = []
+
+    for entry in entries:
+        if entry.state == MERGED:
+            surviving.append(entry)
+            continue
+
+        is_stale = False
+        if github_ops.issue_is_closed(entry.repo_github, entry.issue_number):
+            is_stale = True
+        elif entry.branch and github_ops.pr_is_merged(entry.repo_github, entry.branch):
+            is_stale = True
+
+        if is_stale:
+            stale.append(entry)
+        else:
+            surviving.append(entry)
+
+    if not dry_run and stale:
+        save_queue(surviving)
+
+    return stale
+
+
+# ── Convenience ──────────────────────────────────────────────────────────
+
+def pending_summary(items: list[QueuedMerge]) -> dict[str, list[QueuedMerge]]:
+    """Group items for display in `coord status`. Returns {repo_name: [entries]}."""
+    out: dict[str, list[QueuedMerge]] = {}
+    for entry in items:
+        if entry.state in (MERGED, SKIPPED):
+            continue
+        out.setdefault(entry.repo_name, []).append(entry)
+    return out