github2gerrit 0.1.10__py3-none-any.whl → 0.1.11__py3-none-any.whl

github2gerrit/core.py

@@ -26,6 +26,7 @@
 
 from __future__ import annotations
 
+import json
 import logging
 import os
 import re
@@ -59,9 +60,13 @@ from .gitutils import git_config
 from .gitutils import git_last_commit_trailers
 from .gitutils import git_show
 from .gitutils import run_cmd
+from .mapping_comment import ChangeIdMapping
+from .mapping_comment import serialize_mapping_comment
 from .models import GitHubContext
 from .models import Inputs
 from .pr_content_filter import filter_pr_body
+from .reconcile_matcher import LocalCommit
+from .reconcile_matcher import create_local_commit
 from .ssh_common import merge_known_hosts_content
 from .utils import env_bool
 from .utils import log_exception_conditionally
@@ -114,14 +119,15 @@ _MSG_PYGERRIT2_AUTH_MISSING = "pygerrit2 auth missing"
 
 def _insert_issue_id_into_commit_message(message: str, issue_id: str) -> str:
     """
-    Insert Issue ID into commit message after the first line.
+    Insert Issue ID into commit message footer above Change-Id.
 
     Format:
     Title line
 
-    Issue-ID: CIMAN-33
+    Body content...
 
-    Rest of body...
+    Issue-ID: CIMAN-33
+    Change-Id: I1234567890123456789012345678901234567890
     """
     if not issue_id.strip():
         return message
@@ -132,30 +138,70 @@ def _insert_issue_id_into_commit_message(message: str, issue_id: str) -> str:
         raise ValueError(_MSG_ISSUE_ID_MULTILINE)
 
     # Format as proper Issue-ID trailer
-    issue_line = cleaned_issue_id if cleaned_issue_id.startswith("Issue-ID:") else f"Issue-ID: {cleaned_issue_id}"
+    issue_line = (
+        cleaned_issue_id
+        if cleaned_issue_id.startswith("Issue-ID:")
+        else f"Issue-ID: {cleaned_issue_id}"
+    )
 
+    # Parse the message to find trailers
     lines = message.splitlines()
     if not lines:
         return message
 
-    # Take the first line as title
-    title = lines[0]
+    # Find the start of trailers (lines like "Key: value" at the end)
+    trailer_start = len(lines)
+    for i in range(len(lines) - 1, -1, -1):
+        line = lines[i].strip()
+        if not line:
+            continue
+        # Common trailer patterns
+        if any(
+            line.startswith(prefix)
+            for prefix in [
+                "Change-Id:",
+                "Signed-off-by:",
+                "Co-authored-by:",
+                "GitHub-",
+            ]
+        ):
+            trailer_start = i
+        else:
+            break
+
+    # Insert Issue-ID at the beginning of trailers
+    if trailer_start < len(lines):
+        # There are existing trailers
+        lines.insert(trailer_start, issue_line)
+    else:
+        # No existing trailers, add at the end
+        if lines and lines[-1].strip():
+            lines.append("")  # Empty line before trailer
+        lines.append(issue_line)
+
+    return "\n".join(lines)
+
+
+def _clean_ellipses_from_message(message: str) -> str:
+    """Clean ellipses from commit message content."""
+    if not message:
+        return message
 
-    # Build new message with Issue ID on third line
-    new_lines = [title, "", issue_line]
+    lines = message.splitlines()
+    cleaned_lines = []
 
-    # Add rest of the body if it exists
-    if len(lines) > 1:
-        # Skip empty lines immediately after title to avoid double spacing
-        body_start = 1
-        while body_start < len(lines) and not lines[body_start].strip():
-            body_start += 1
+    for line in lines:
+        # Skip lines that are just "..." or whitespace + "..."
+        stripped = line.strip()
+        if stripped == "..." or stripped == "…":
+            continue
 
-        if body_start < len(lines):
-            new_lines.append("")  # Empty line before body
-            new_lines.extend(lines[body_start:])
+        # Remove trailing ellipses from lines
+        cleaned_line = re.sub(r"\s*\.{3,}\s*$", "", line)
+        cleaned_line = re.sub(r"\s*…\s*$", "", cleaned_line)
+        cleaned_lines.append(cleaned_line)
 
-    return "\n".join(new_lines)
+    return "\n".join(cleaned_lines)
 
 
 # ---------------------
@@ -186,7 +232,9 @@ def _is_valid_change_id(value: str) -> bool:
     return (
         value.startswith("I")
         and 10 <= len(value) <= 40
-        and not re.fullmatch(r"I[0-9a-fA-F]+", value)  # Exclude hex-like patterns
+        and not re.fullmatch(
+            r"I[0-9a-fA-F]+", value
+        )  # Exclude hex-like patterns
         and bool(re.fullmatch(r"I[A-Za-z0-9._-]+", value))
     )
 
@@ -213,6 +261,12 @@ class PreparedChange:
     # The commit shas created/pushed to Gerrit. May be empty until queried.
     commit_shas: list[str]
 
+    def all_change_ids(self) -> list[str]:
+        """
+        Return all Change-Ids (copy) for post-push comment emission.
+        """
+        return list(self.change_ids)
+
 
 @dataclass(frozen=True)
 class SubmissionResult:
@@ -240,6 +294,409 @@ class Orchestrator:
     - Comment on the PR and optionally close it.
     """
 
+    # Phase 1 helper: build deterministic PR metadata trailers
+    # Phase 3 introduces reconciliation helpers below for reusing prior
+    # Change-Ids
+    def _build_pr_metadata_trailers(self, gh: GitHubContext) -> list[str]:
+        """
+        Build GitHub PR metadata trailers (GitHub-PR, GitHub-Hash).
+
+        Always deterministic:
+        - GitHub-PR: full PR URL
+        - GitHub-Hash: stable hash derived from server/repo/pr_number
+
+        Returns:
+            List of trailer lines (without preceding newlines).
+        """
+        trailers: list[str] = []
+        try:
+            pr_num = gh.pr_number
+        except Exception:
+            pr_num = None
+        if not pr_num:
+            return trailers
+        pr_url = f"{gh.server_url}/{gh.repository}/pull/{pr_num}"
+        trailers.append(f"GitHub-PR: {pr_url}")
+        try:
+            from .duplicate_detection import DuplicateDetector
+
+            gh_hash = DuplicateDetector._generate_github_change_hash(gh)
+            trailers.append(f"GitHub-Hash: {gh_hash}")
+        except Exception as exc:
+            log.debug("Failed to compute GitHub-Hash trailer: %s", exc)
+        return trailers
+
+    def _emit_change_id_map_comment(
+        self,
+        *,
+        gh_context: GitHubContext | None,
+        change_ids: list[str],
+        multi: bool,
+        topic: str,
+        replace_existing: bool = True,
+    ) -> None:
+        """
+        Emit or update a machine-parseable PR comment enumerating Change-Ids.
+
+        Args:
+            gh_context: GitHub context information
+            change_ids: Ordered list of Change-IDs to emit
+            multi: True for multi-commit mode, False for squash
+            topic: Gerrit topic name
+            replace_existing: If True, replace existing mapping comment
+        """
+        if not gh_context or not gh_context.pr_number:
+            return
+
+        # Sanitize and dedupe while preserving order
+        seen: set[str] = set()
+        ordered: list[str] = []
+        for cid in change_ids:
+            if cid and cid not in seen:
+                ordered.append(cid)
+                seen.add(cid)
+        if not ordered:
+            return
+
+        try:
+            from .github_api import build_client
+            from .github_api import create_pr_comment
+            from .github_api import get_pull
+            from .github_api import get_repo_from_env
+        except Exception as exc:
+            log.debug("GitHub API imports failed for comment emission: %s", exc)
+            return
+
+        try:
+            client = build_client()
+            repo = get_repo_from_env(client)
+            pr_obj = get_pull(repo, int(gh_context.pr_number))
+
+            # Build metadata
+            mode_str = "multi-commit" if multi else "squash"
+            meta = self._build_pr_metadata_trailers(gh_context)
+            gh_hash = ""
+            for trailer in meta:
+                if trailer.startswith("GitHub-Hash:"):
+                    gh_hash = trailer.split(":", 1)[1].strip()
+                    break
+
+            pr_url = (
+                f"{gh_context.server_url}/{gh_context.repository}/pull/"
+                f"{gh_context.pr_number}"
+            )
+
+            # Create mapping comment using utility
+            # Include reconciliation digest if available
+            digest = ""
+            plan_snapshot = getattr(self, "_reconciliation_plan", None)
+            if isinstance(plan_snapshot, dict):
+                digest = plan_snapshot.get("digest", "") or ""
+            comment_body = serialize_mapping_comment(
+                pr_url=pr_url,
+                mode=mode_str,
+                topic=topic,
+                change_ids=ordered,
+                github_hash=gh_hash,
+                digest=digest or None,
+            )
+
+            if replace_existing:
+                # Try to find and update existing mapping comment
+                issue = pr_obj.as_issue()
+                comments = list(issue.get_comments())
+
+                from .mapping_comment import find_mapping_comments
+                from .mapping_comment import update_mapping_comment_body
+
+                comment_indices = find_mapping_comments(
+                    [c.body or "" for c in comments]
+                )
+                if comment_indices:
+                    # Update the latest mapping comment
+                    latest_idx = comment_indices[-1]
+                    latest_comment = comments[latest_idx]
+
+                    # Create new mapping for update
+                    new_mapping = ChangeIdMapping(
+                        pr_url=pr_url,
+                        mode=mode_str,
+                        topic=topic,
+                        change_ids=ordered,
+                        github_hash=gh_hash,
+                        digest=digest,
+                    )
+
+                    body = latest_comment.body or ""
+                    updated_body = update_mapping_comment_body(
+                        body, new_mapping
+                    )
+                    latest_comment.edit(updated_body)  # type: ignore[attr-defined]
+                    log.debug(
+                        "Updated existing mapping comment for PR #%s",
+                        gh_context.pr_number,
+                    )
+                    return
+
+            # Create new comment if no existing one or replace_existing is False
+            create_pr_comment(pr_obj, comment_body)
+            log.debug(
+                "Emitted Change-Id map comment for PR #%s with %d id(s)",
+                gh_context.pr_number,
+                len(ordered),
+            )
+
+        except Exception as exc:
+            log.debug(
+                "Failed to emit Change-Id mapping comment for PR #%s: %s",
+                getattr(gh_context, "pr_number", "?"),
+                exc,
+            )
+
+    def _perform_robust_reconciliation(
+        self,
+        inputs: Inputs,
+        gh: GitHubContext,
+        gerrit: GerritInfo,
+        local_commits: list[LocalCommit],
+    ) -> list[str]:
+        """
+        Delegate to extracted reconciliation module.
+        Captures reconciliation plan for later verification (digest check).
+        """
+        if not local_commits:
+            self._reconciliation_plan = None
+            return []
+        # Lazy import to avoid cycles
+        from .orchestrator import perform_reconciliation
+        from .orchestrator.reconciliation import (
+            _compute_plan_digest as _plan_digest,
+        )
+
+        meta_trailers = self._build_pr_metadata_trailers(gh)
+        expected_pr_url = f"{gh.server_url}/{gh.repository}/pull/{gh.pr_number}"
+        expected_github_hash = ""
+        for trailer in meta_trailers:
+            if trailer.startswith("GitHub-Hash:"):
+                expected_github_hash = trailer.split(":", 1)[1].strip()
+                break
+        change_ids = perform_reconciliation(
+            inputs=inputs,
+            gh=gh,
+            gerrit=gerrit,
+            local_commits=local_commits,
+            expected_pr_url=expected_pr_url,
+            expected_github_hash=expected_github_hash or None,
+        )
+        # Store lightweight plan snapshot (only fields needed for verify)
+        try:
+            self._reconciliation_plan = {
+                "change_ids": change_ids,
+                "digest": _plan_digest(change_ids),
+            }
+        except Exception:
+            # Non-fatal; verification will gracefully degrade
+            self._reconciliation_plan = None
+        return change_ids
+
+    def _verify_reconciliation_digest(
+        self,
+        gh: GitHubContext,
+        gerrit: GerritInfo,
+    ) -> None:
+        """
+        Verification phase: re-query Gerrit by topic and compare digest.
+
+        - Rebuild observed Change-Id ordering aligned to original plan order
+        - Compute observed digest
+        - Emit VERIFICATION_SUMMARY log line
+        - If mismatch and VERIFY_DIGEST_STRICT=true raise OrchestratorError
+
+        Assumes self._reconciliation_plan set by reconciliation step:
+          {
+            "change_ids": [...],
+            "digest": "<sha12>"
+          }
+        """
+        plan = getattr(self, "_reconciliation_plan", None)
+        if not plan:
+            log.debug("No reconciliation plan present; skipping verification")
+            return
+        planned_ids = plan.get("change_ids") or []
+        planned_digest = plan.get("digest") or ""
+        if not planned_ids or not planned_digest:
+            log.debug("Incomplete plan data; skipping verification")
+            return
+
+        topic = (
+            f"GH-{gh.repository_owner}-{gh.repository.split('/')[-1]}-"
+            f"{gh.pr_number}"
+        )
+        try:
+            from .gerrit_query import query_changes_by_topic
+            from .gerrit_rest import GerritRestClient
+
+            client = GerritRestClient(
+                base_url=f"https://{gerrit.host}:{gerrit.port}",
+                auth=None,
+            )
+            # Re-query only NEW changes; merged ones are stable but keep for
+            # compatibility with earlier reuse logic if needed.
+            changes = query_changes_by_topic(
+                client,
+                topic,
+                statuses=["NEW", "MERGED"],
+            )
+            # Map change_id -> change for quick lookup
+            id_set = {c.change_id for c in changes}
+            # Preserve original ordering: filter plan list by those still
+            # present, then append any newly discovered (unexpected) ones.
+            observed_ordered: list[str] = [
+                cid for cid in planned_ids if cid in id_set
+            ]
+            extras = [cid for cid in id_set if cid not in observed_ordered]
+            if extras:
+                observed_ordered.extend(sorted(extras))
+            # Compute digest identical to reconciliation module logic
+            from .orchestrator.reconciliation import (
+                _compute_plan_digest as _plan_digest,
+            )
+
+            observed_digest = _plan_digest(observed_ordered)
+            match = observed_digest == planned_digest
+            summary = {
+                "planned_digest": planned_digest,
+                "observed_digest": observed_digest,
+                "match": match,
+                "planned_count": len(planned_ids),
+                "observed_count": len(observed_ordered),
+                "extras": extras,
+            }
+            log.info(
+                "VERIFICATION_SUMMARY json=%s",
+                json.dumps(summary, separators=(",", ":")),
+            )
+            if not match:
+                msg = (
+                    "Reconciliation digest mismatch (planned != observed). "
+                    "Enable stricter diagnostics or inspect Gerrit topic drift."
+                )
+                if os.getenv("VERIFY_DIGEST_STRICT", "true").lower() in (
+                    "1",
+                    "true",
+                    "yes",
+                ):
+                    self._raise_verification_error(msg)
+                log.warning(msg)
+        except OrchestratorError:
+            # Re-raise verification errors unchanged
+            raise
+        except Exception as exc:
+            log.debug("Verification phase failed (non-fatal): %s", exc)
+
+    def _raise_verification_error(self, msg: str) -> None:
+        """Helper to raise verification errors (extracted for TRY301
+        compliance)."""
+        raise OrchestratorError(msg)
+
+    def _extract_local_commits_for_reconciliation(
+        self,
+        inputs: Inputs,
+        gh: GitHubContext,
+    ) -> list[LocalCommit]:
+        """
+        Extract local commits as LocalCommit objects for reconciliation.
+
+        Args:
+            inputs: Configuration inputs
+            gh: GitHub context
+
+        Returns:
+            List of LocalCommit objects representing local commits to be
+            submitted
+        """
+        branch = self._resolve_target_branch()
+        base_ref = f"origin/{branch}"
+
+        # Get commit range: commits in HEAD not in base branch
+        try:
+            run_cmd(
+                ["git", "fetch", "origin", branch],
+                cwd=self.workspace,
+                env=self._ssh_env(),
+            )
+
+            revs = run_cmd(
+                ["git", "rev-list", "--reverse", f"{base_ref}..HEAD"],
+                cwd=self.workspace,
+            ).stdout
+
+            commit_list = [c.strip() for c in revs.splitlines() if c.strip()]
+
+        except (CommandError, GitError) as exc:
+            log.warning("Failed to extract commit range: %s", exc)
+            return []
+
+        if not commit_list:
+            log.debug("No commits found in range %s..HEAD", base_ref)
+            return []
+
+        local_commits = []
+
+        for index, commit_sha in enumerate(commit_list):
+            try:
+                # Get commit subject
+                subject = run_cmd(
+                    ["git", "show", "-s", "--pretty=format:%s", commit_sha],
+                    cwd=self.workspace,
+                ).stdout.strip()
+
+                # Get full commit message
+                commit_message = run_cmd(
+                    ["git", "show", "-s", "--pretty=format:%B", commit_sha],
+                    cwd=self.workspace,
+                ).stdout
+
+                # Get modified files
+                files_output = run_cmd(
+                    [
+                        "git",
+                        "show",
+                        "--name-only",
+                        "--pretty=format:",
+                        commit_sha,
+                    ],
+                    cwd=self.workspace,
+                ).stdout
+
+                files = [
+                    f.strip() for f in files_output.splitlines() if f.strip()
+                ]
+
+                # Create LocalCommit object
+                local_commit = create_local_commit(
+                    index=index,
+                    sha=commit_sha,
+                    subject=subject,
+                    files=files,
+                    commit_message=commit_message,
+                )
+
+                local_commits.append(local_commit)
+
+            except (CommandError, GitError) as exc:
+                log.warning(
+                    "Failed to extract commit info for %s: %s",
+                    commit_sha[:8],
+                    exc,
+                )
+                continue
+
+        log.info(
+            "Extracted %d local commits for reconciliation", len(local_commits)
+        )
+        return local_commits
+
     def __init__(
         self,
         *,
@@ -251,6 +708,8 @@ class Orchestrator:
         self._ssh_known_hosts_path: Path | None = None
         self._ssh_agent_manager: SSHAgentManager | None = None
         self._use_ssh_agent: bool = False
+        # Store inputs for access by helper methods
+        self._inputs: Inputs | None = None
 
     # ---------------
     # Public API
@@ -271,7 +730,8 @@ class Orchestrator:
         GitHub output writes), but does perform internal environment mutations
         (e.g., G2G_TMP_BRANCH) for subprocess coordination within the workflow.
         """
-        log.info("Starting PR -> Gerrit pipeline")
+        log.debug("Starting PR -> Gerrit pipeline")
+        self._inputs = inputs  # Store for access by helper methods
         self._guard_pull_request_context(gh)
 
         # Initialize git repository in workspace if it doesn't exist
@@ -280,16 +740,26 @@ class Orchestrator:
 
         gitreview = self._read_gitreview(self.workspace / ".gitreview", gh)
         repo_names = self._derive_repo_names(gitreview, gh)
-        log.debug("execute: inputs.dry_run=%s, inputs.ci_testing=%s", inputs.dry_run, inputs.ci_testing)
+        log.debug(
+            "execute: inputs.dry_run=%s, inputs.ci_testing=%s",
+            inputs.dry_run,
+            inputs.ci_testing,
+        )
         gerrit = self._resolve_gerrit_info(gitreview, inputs, repo_names)
 
         log.debug("execute: resolved gerrit info: %s", gerrit)
         if inputs.dry_run:
-            log.debug("execute: entering dry-run mode due to inputs.dry_run=True")
+            log.debug(
+                "execute: entering dry-run mode due to inputs.dry_run=True"
+            )
             # Perform preflight validations and exit without making changes
-            self._dry_run_preflight(gerrit=gerrit, inputs=inputs, gh=gh, repo=repo_names)
-            log.info("Dry run complete; skipping write operations to Gerrit")
-            return SubmissionResult(change_urls=[], change_numbers=[], commit_shas=[])
+            self._dry_run_preflight(
+                gerrit=gerrit, inputs=inputs, gh=gh, repo=repo_names
+            )
+            log.debug("Dry run complete; skipping write operations to Gerrit")
+            return SubmissionResult(
+                change_urls=[], change_numbers=[], commit_shas=[]
+            )
         self._setup_ssh(inputs, gerrit)
         # Establish baseline non-interactive SSH/Git environment
         # for all child processes
@@ -322,14 +792,61 @@ class Orchestrator:
             prep = self._prepare_squashed_commit(inputs, gh, gerrit)
 
         self._configure_git(gerrit, inputs)
+
+        # Phase 3: Robust reconciliation with multi-pass matching
+        if inputs.submit_single_commits:
+            # Extract local commits for multi-commit reconciliation
+            local_commits = self._extract_local_commits_for_reconciliation(
+                inputs, gh
+            )
+            reuse_ids = self._perform_robust_reconciliation(
+                inputs, gh, gerrit, local_commits
+            )
+
+            if reuse_ids:
+                try:
+                    prep = self._prepare_single_commits(
+                        inputs, gh, gerrit, reuse_change_ids=reuse_ids
+                    )
+                except Exception as exc:
+                    log.debug(
+                        "Re-preparation with reuse Change-Ids failed "
+                        "(continuing without reuse): %s",
+                        exc,
+                    )
+        else:
+            # For squash mode, use modern reconciliation with single commit
+            local_commits = self._extract_local_commits_for_reconciliation(
+                inputs, gh
+            )
+            # Limit to first commit for squash mode
+            single_commit = local_commits[:1] if local_commits else []
+            reuse_ids = self._perform_robust_reconciliation(
+                inputs, gh, gerrit, single_commit
+            )
+            if reuse_ids:
+                try:
+                    prep = self._prepare_squashed_commit(
+                        inputs, gh, gerrit, reuse_change_ids=reuse_ids[:1]
+                    )
+                except Exception as exc:
+                    log.debug(
+                        "Re-preparation with reuse Change-Ids failed "
+                        "(continuing without reuse): %s",
+                        exc,
+                    )
+
         self._apply_pr_title_body_if_requested(inputs, gh)
 
+        # Store context for downstream push/comment emission (Phase 2)
+        self._gh_context_for_push = gh
         self._push_to_gerrit(
             gerrit=gerrit,
             repo=repo_names,
             branch=self._resolve_target_branch(),
             reviewers=self._resolve_reviewers(inputs),
             single_commits=inputs.submit_single_commits,
+            prepared=prep,
         )
 
         result = self._query_gerrit_for_results(
@@ -350,7 +867,7 @@ class Orchestrator:
 
         self._close_pull_request_if_required(gh)
 
-        log.info("Pipeline complete: %s", result)
+        log.debug("Pipeline complete: %s", result)
         self._cleanup_ssh()
         return result
 
@@ -398,8 +915,14 @@ class Orchestrator:
                 repo_obj: Any = get_repo_from_env(client)
                 # Prefer a specific ref when available; otherwise default branch
                 ref = os.getenv("GITHUB_HEAD_REF") or os.getenv("GITHUB_SHA")
-                content = repo_obj.get_contents(".gitreview", ref=ref) if ref else repo_obj.get_contents(".gitreview")
-                text_remote = (getattr(content, "decoded_content", b"") or b"").decode("utf-8")
+                content = (
+                    repo_obj.get_contents(".gitreview", ref=ref)
+                    if ref
+                    else repo_obj.get_contents(".gitreview")
+                )
+                text_remote = (
+                    getattr(content, "decoded_content", b"") or b""
+                ).decode("utf-8")
                 info_remote = self._parse_gitreview_text(text_remote)
                 if info_remote:
                     log.debug("Parsed remote .gitreview: %s", info_remote)
@@ -409,7 +932,14 @@ class Orchestrator:
                 log.debug("Remote .gitreview not available: %s", exc)
             # Attempt raw.githubusercontent.com as a fallback
             try:
-                repo_full = ((gh.repository if gh else os.getenv("GITHUB_REPOSITORY", "")) or "").strip()
+                repo_full = (
+                    (
+                        gh.repository
+                        if gh
+                        else os.getenv("GITHUB_REPOSITORY", "")
+                    )
+                    or ""
+                ).strip()
                 branches: list[str] = []
                 # Prefer PR head/base refs via GitHub API when running
                 # from a direct URL when a token is available
@@ -423,8 +953,18 @@ class Orchestrator:
                         client = build_client()
                         repo_obj = get_repo_from_env(client)
                         pr_obj = get_pull(repo_obj, int(gh.pr_number))
-                        api_head = str(getattr(getattr(pr_obj, "head", object()), "ref", "") or "")
-                        api_base = str(getattr(getattr(pr_obj, "base", object()), "ref", "") or "")
+                        api_head = str(
+                            getattr(
+                                getattr(pr_obj, "head", object()), "ref", ""
+                            )
+                            or ""
+                        )
+                        api_base = str(
+                            getattr(
+                                getattr(pr_obj, "base", object()), "ref", ""
+                            )
+                            or ""
+                        )
                         if api_head:
                             branches.append(api_head)
                         if api_base:
@@ -446,7 +986,10 @@ class Orchestrator:
                     tried.add(br)
                     url = f"https://raw.githubusercontent.com/{repo_full}/refs/heads/{br}/.gitreview"
                     parsed = urllib.parse.urlparse(url)
-                    if parsed.scheme != "https" or parsed.netloc != "raw.githubusercontent.com":
+                    if (
+                        parsed.scheme != "https"
+                        or parsed.netloc != "raw.githubusercontent.com"
+                    ):
                         continue
                     log.info("Fetching .gitreview via raw URL: %s", url)
                     with urllib.request.urlopen(url, timeout=5) as resp:  # noqa: S310
@@ -498,7 +1041,7 @@ class Orchestrator:
         repo_full = gh.repository
         if not repo_full or "/" not in repo_full:
             raise OrchestratorError(_MSG_BAD_REPOSITORY_CONTEXT)
-        owner, name = repo_full.split("/", 1)
+        _owner, name = repo_full.split("/", 1)
         # Fallback: map all '-' to '/' for Gerrit path (e.g., 'my/repo/name')
         gerrit_name = name.replace("-", "/")
         names = RepoNames(project_gerrit=gerrit_name, project_github=name)
@@ -512,7 +1055,9 @@ class Orchestrator:
         repo: RepoNames,
     ) -> GerritInfo:
         """Resolve Gerrit connection info from .gitreview or inputs."""
-        log.debug("_resolve_gerrit_info: inputs.ci_testing=%s", inputs.ci_testing)
+        log.debug(
+            "_resolve_gerrit_info: inputs.ci_testing=%s", inputs.ci_testing
+        )
         log.debug("_resolve_gerrit_info: gitreview=%s", gitreview)
 
         # If CI testing flag is set, ignore .gitreview and use environment
@@ -527,7 +1072,7 @@ class Orchestrator:
         host = inputs.gerrit_server.strip()
         if not host:
             raise OrchestratorError(_MSG_MISSING_GERRIT_SERVER)
-        port_s = inputs.gerrit_server_port.strip() or "29418"
+        port_s = str(inputs.gerrit_server_port).strip() or "29418"
         try:
             port = int(port_s)
         except ValueError as exc:
@@ -570,12 +1115,16 @@ class Orchestrator:
             log.debug("SSH private key not provided, skipping SSH setup")
             return
 
-        # Auto-discover or augment host keys (merge missing types/[host]:port entries)
+        # Auto-discover or augment host keys (merge missing
+        # types/[host]:port entries)
         effective_known_hosts = inputs.gerrit_known_hosts
         if auto_discover_gerrit_host_keys is not None:
             try:
                 if not effective_known_hosts:
-                    log.info("GERRIT_KNOWN_HOSTS not provided, attempting auto-discovery...")
+                    log.info(
+                        "GERRIT_KNOWN_HOSTS not provided, attempting "
+                        "auto-discovery..."
+                    )
                     discovered_keys = auto_discover_gerrit_host_keys(
                         gerrit_hostname=gerrit.host,
                         gerrit_port=gerrit.port,
@@ -585,14 +1134,19 @@ class Orchestrator:
                     if discovered_keys:
                         effective_known_hosts = discovered_keys
                         log.info(
-                            "Successfully auto-discovered SSH host keys for %s:%d",
+                            "Successfully auto-discovered SSH host keys for "
+                            "%s:%d",
                             gerrit.host,
                             gerrit.port,
                         )
                     else:
-                        log.warning("Auto-discovery failed, SSH host key verification may fail")
+                        log.warning(
+                            "Auto-discovery failed, SSH host key verification "
+                            "may fail"
+                        )
                 else:
-                    # Provided known_hosts exists; ensure it contains [host]:port entries and modern key types
+                    # Provided known_hosts exists; ensure it contains
+                    # [host]:port entries and modern key types
                     lower = effective_known_hosts.lower()
                     bracket_host = f"[{gerrit.host}]:{gerrit.port}"
                     bracket_lower = bracket_host.lower()
@@ -600,7 +1154,8 @@ class Orchestrator:
                     if bracket_lower not in lower:
                         needs_discovery = True
                     else:
-                        # Confirm at least one known key type exists for the bracketed host
+                        # Confirm at least one known key type exists for the
+                        # bracketed host
                         if (
                             f"{bracket_lower} ssh-ed25519" not in lower
                             and f"{bracket_lower} ecdsa-sha2" not in lower
@@ -609,7 +1164,8 @@ class Orchestrator:
                             needs_discovery = True
                     if needs_discovery:
                         log.info(
-                            "Augmenting provided GERRIT_KNOWN_HOSTS with discovered entries for %s:%d",
+                            "Augmenting provided GERRIT_KNOWN_HOSTS with "
+                            "discovered entries for %s:%d",
                             gerrit.host,
                             gerrit.port,
                         )
@@ -621,26 +1177,38 @@ class Orchestrator:
                         )
                         if discovered_keys:
                             # Use centralized merging logic
-                            effective_known_hosts = merge_known_hosts_content(effective_known_hosts, discovered_keys)
+                            effective_known_hosts = merge_known_hosts_content(
+                                effective_known_hosts, discovered_keys
+                            )
                             log.info(
-                                "Known hosts augmented with discovered entries for %s:%d",
+                                "Known hosts augmented with discovered entries "
+                                "for %s:%d",
                                 gerrit.host,
                                 gerrit.port,
                             )
                         else:
-                            log.warning("Auto-discovery returned no keys; known_hosts not augmented")
+                            log.warning(
+                                "Auto-discovery returned no keys; known_hosts "
+                                "not augmented"
+                            )
             except Exception as exc:
-                log.warning("SSH host key auto-discovery/augmentation failed: %s", exc)
+                log.warning(
+                    "SSH host key auto-discovery/augmentation failed: %s", exc
+                )
 
         if not effective_known_hosts:
-            log.debug("No SSH host keys available (manual or auto-discovered), skipping SSH setup")
+            log.debug(
+                "No SSH host keys available (manual or auto-discovered), "
+                "skipping SSH setup"
+            )
             return
 
         # Check if SSH agent authentication is preferred
         use_ssh_agent = env_bool("G2G_USE_SSH_AGENT", default=True)
 
         if use_ssh_agent and setup_ssh_agent_auth is not None:
-            # Try SSH agent first as it's more secure and avoids file permission issues
+            # Try SSH agent first as it's more secure and avoids file
+            # permission issues
             if self._try_ssh_agent_setup(inputs, effective_known_hosts):
                 return
 
@@ -649,7 +1217,9 @@ class Orchestrator:
 
         self._setup_file_based_ssh(inputs, effective_known_hosts)
 
-    def _try_ssh_agent_setup(self, inputs: Inputs, effective_known_hosts: str) -> bool:
+    def _try_ssh_agent_setup(
+        self, inputs: Inputs, effective_known_hosts: str
+    ) -> bool:
         """Try to setup SSH agent-based authentication.
 
         Args:
@@ -660,21 +1230,23 @@ class Orchestrator:
             True if SSH agent setup succeeded, False otherwise
         """
         if setup_ssh_agent_auth is None:
-            log.debug("SSH agent module not available, falling back to file-based SSH")  # type: ignore[unreachable]
-            return False
+            return False  # type: ignore[unreachable]
 
         try:
-            log.info("Setting up SSH agent-based authentication (more secure)")
+            log.debug("Setting up SSH agent-based authentication (more secure)")
             self._ssh_agent_manager = setup_ssh_agent_auth(
                 workspace=self.workspace,
                 private_key_content=inputs.gerrit_ssh_privkey_g2g,
                 known_hosts_content=effective_known_hosts,
             )
             self._use_ssh_agent = True
-            log.info("SSH agent authentication configured successfully")
+            log.debug("SSH agent authentication configured successfully")
 
         except Exception as exc:
-            log.warning("SSH agent setup failed, falling back to file-based SSH: %s", exc)
+            log.warning(
+                "SSH agent setup failed, falling back to file-based SSH: %s",
+                exc,
+            )
             if self._ssh_agent_manager:
                 self._ssh_agent_manager.cleanup()
                 self._ssh_agent_manager = None
@@ -682,7 +1254,9 @@ class Orchestrator:
         else:
             return True
 
-    def _setup_file_based_ssh(self, inputs: Inputs, effective_known_hosts: str) -> None:
+    def _setup_file_based_ssh(
+        self, inputs: Inputs, effective_known_hosts: str
+    ) -> None:
         """Setup file-based SSH authentication as fallback.
 
         Args:
@@ -697,10 +1271,12 @@ class Orchestrator:
         tool_ssh_dir = self.workspace / ".ssh-g2g"
         tool_ssh_dir.mkdir(mode=0o700, exist_ok=True)
 
-        # Write SSH private key to tool-specific location with secure permissions
+        # Write SSH private key to tool-specific location with secure
+        # permissions
         key_path = tool_ssh_dir / "gerrit_key"
 
-        # Use a more robust approach for creating the file with secure permissions
+        # Use a more robust approach for creating the file with secure
+        # permissions
         key_content = inputs.gerrit_ssh_privkey_g2g.strip() + "\n"
 
         # Multiple strategies to create secure key file
@@ -714,7 +1290,8 @@ class Orchestrator:
             msg = (
                 "Failed to create SSH key file with secure permissions. "
                 "This may be due to CI environment restrictions. "
-                "Consider using G2G_USE_SSH_AGENT=true (default) for SSH agent authentication."
+                "Consider using G2G_USE_SSH_AGENT=true (default) for SSH "
+                "agent authentication."
             )
             raise RuntimeError(msg)
 
@@ -762,10 +1339,17 @@ class Orchestrator:
                 # Verify permissions
                 actual_perms = oct(key_path.stat().st_mode)[-3:]
                 if actual_perms == "600":
-                    log.debug("SSH key created successfully with strategy: %s", strategy_name)
+                    log.debug(
+                        "SSH key created successfully with strategy: %s",
+                        strategy_name,
+                    )
                     return True
                 else:
-                    log.debug("Strategy %s resulted in permissions %s", strategy_name, actual_perms)
+                    log.debug(
+                        "Strategy %s resulted in permissions %s",
+                        strategy_name,
+                        actual_perms,
+                    )
 
             except Exception as exc:
                 log.debug("Strategy %s failed: %s", strategy_name, exc)
@@ -811,7 +1395,9 @@ class Orchestrator:
         finally:
             os.umask(original_umask)
 
-    def _strategy_stat_constants(self, key_path: Path, key_content: str) -> None:
+    def _strategy_stat_constants(
+        self, key_path: Path, key_content: str
+    ) -> None:
         """Strategy: use stat constants for permission setting."""
         import os
         import stat
@@ -824,7 +1410,9 @@ class Orchestrator:
         os.chmod(str(key_path), mode)
         key_path.chmod(mode)
 
-    def _create_key_in_memory_fs(self, key_path: Path, key_content: str) -> bool:
+    def _create_key_in_memory_fs(
+        self, key_path: Path, key_content: str
+    ) -> bool:
         """Fallback: try to create key in memory filesystem."""
         import shutil
         import tempfile
@@ -851,7 +1439,11 @@ class Orchestrator:
                 tmp_path = None
                 try:
                     with tempfile.NamedTemporaryFile(
-                        mode="w", dir=memory_dir, prefix="g2g_key_", suffix=".tmp", delete=False
+                        mode="w",
+                        dir=memory_dir,
+                        prefix="g2g_key_",
+                        suffix=".tmp",
+                        delete=False,
                     ) as tmp_file:
                         tmp_file.write(key_content)
                         tmp_path = Path(tmp_file.name)
@@ -863,18 +1455,29 @@ class Orchestrator:
                     if actual_perms == "600":
                         # Move to final location
                         shutil.move(str(tmp_path), str(key_path))
-                        log.debug("Successfully created SSH key using memory filesystem: %s", memory_dir)
+                        log.debug(
+                            "Successfully created SSH key using memory "
+                            "filesystem: %s",
+                            memory_dir,
+                        )
                         return True
                     else:
                         tmp_path.unlink()
 
                 except Exception as exc:
-                    log.debug("Memory filesystem strategy failed for %s: %s", memory_dir, exc)
+                    log.debug(
+                        "Memory filesystem strategy failed for %s: %s",
+                        memory_dir,
+                        exc,
+                    )
                     try:
                         if tmp_path is not None and tmp_path.exists():
                             tmp_path.unlink()
                     except Exception as cleanup_exc:
-                        log.debug("Failed to cleanup temporary key file: %s", cleanup_exc)
+                        log.debug(
+                            "Failed to cleanup temporary key file: %s",
+                            cleanup_exc,
+                        )
 
         except Exception as exc:
             log.debug("Memory filesystem fallback failed: %s", exc)
@@ -946,7 +1549,9 @@ class Orchestrator:
                 import shutil
 
                 shutil.rmtree(tool_ssh_dir)
-                log.debug("Cleaned up temporary SSH directory: %s", tool_ssh_dir)
+                log.debug(
+                    "Cleaned up temporary SSH directory: %s", tool_ssh_dir
+                )
         except Exception as exc:
             log.warning("Failed to clean up temporary SSH files: %s", exc)
 
@@ -956,7 +1561,7 @@ class Orchestrator:
         inputs: Inputs,
     ) -> None:
         """Set git global config and initialize git-review if needed."""
-        log.info("Configuring git and git-review for %s", gerrit.host)
+        log.debug("Configuring git and git-review for %s", gerrit.host)
         # Prefer repo-local config; fallback to global if needed
         try:
             git_config(
@@ -966,7 +1571,9 @@ class Orchestrator:
                 cwd=self.workspace,
             )
         except GitError:
-            git_config("gitreview.username", inputs.gerrit_ssh_user_g2g, global_=True)
+            git_config(
+                "gitreview.username", inputs.gerrit_ssh_user_g2g, global_=True
+            )
         try:
             git_config(
                 "user.name",
@@ -984,7 +1591,9 @@ class Orchestrator:
                 cwd=self.workspace,
             )
         except GitError:
-            git_config("user.email", inputs.gerrit_ssh_user_g2g_email, global_=True)
+            git_config(
+                "user.email", inputs.gerrit_ssh_user_g2g_email, global_=True
+            )
         # Disable GPG signing to avoid interactive prompts for signing keys
         try:
             git_config(
@@ -1039,8 +1648,10 @@ class Orchestrator:
             )
         except CommandError:
             ssh_user = inputs.gerrit_ssh_user_g2g.strip()
-            remote_url = f"ssh://{ssh_user}@{gerrit.host}:{gerrit.port}/{gerrit.project}"
-            log.info("Adding 'gerrit' remote: %s", remote_url)
+            remote_url = (
+                f"ssh://{ssh_user}@{gerrit.host}:{gerrit.port}/{gerrit.project}"
+            )
+            log.debug("Adding 'gerrit' remote: %s", remote_url)
             # Use our specific SSH configuration for adding remote
             env = self._ssh_env()
             run_cmd(
@@ -1051,7 +1662,9 @@ class Orchestrator:
             )
 
         # Workaround for submodules commit-msg hook
-        hooks_path = run_cmd(["git", "rev-parse", "--show-toplevel"], cwd=self.workspace).stdout.strip()
+        hooks_path = run_cmd(
+            ["git", "rev-parse", "--show-toplevel"], cwd=self.workspace
+        ).stdout.strip()
         try:
             git_config(
                 "core.hooksPath",
@@ -1078,6 +1691,7 @@ class Orchestrator:
         inputs: Inputs,
         gh: GitHubContext,
         gerrit: GerritInfo,
+        reuse_change_ids: list[str] | None = None,
     ) -> PreparedChange:
         """Cherry-pick commits one-by-one and ensure Change-Id is present."""
         log.info("Preparing single-commit submission for PR #%s", gh.pr_number)
@@ -1100,12 +1714,16 @@ class Orchestrator:
             log.info("No commits to submit; returning empty PreparedChange")
             return PreparedChange(change_ids=[], commit_shas=[])
         # Create temp branch from base sha; export for downstream
-        base_sha = run_cmd(["git", "rev-parse", base_ref], cwd=self.workspace).stdout.strip()
+        base_sha = run_cmd(
+            ["git", "rev-parse", base_ref], cwd=self.workspace
+        ).stdout.strip()
         tmp_branch = f"g2g_tmp_{gh.pr_number or 'pr'!s}_{os.getpid()}"
         os.environ["G2G_TMP_BRANCH"] = tmp_branch
-        run_cmd(["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace)
+        run_cmd(
+            ["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace
+        )
         change_ids: list[str] = []
-        for csha in commit_list:
+        for idx, csha in enumerate(commit_list):
             run_cmd(["git", "checkout", tmp_branch], cwd=self.workspace)
             git_cherry_pick(csha, cwd=self.workspace)
             # Preserve author of the original commit
@@ -1113,9 +1731,61 @@ class Orchestrator:
                 ["git", "show", "-s", "--pretty=format:%an <%ae>", csha],
                 cwd=self.workspace,
             ).stdout.strip()
-            git_commit_amend(author=author, no_edit=True, signoff=True, cwd=self.workspace)
+            git_commit_amend(
+                author=author, no_edit=True, signoff=True, cwd=self.workspace
+            )
+            # Phase 3: Reuse Change-Id if provided
+            if reuse_change_ids and idx < len(reuse_change_ids):
+                desired = reuse_change_ids[idx]
+                if desired:
+                    cur_msg = run_cmd(
+                        ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+                        cwd=self.workspace,
+                    ).stdout
+                    # Clean ellipses from commit message
+                    cur_msg = _clean_ellipses_from_message(cur_msg)
+                    if f"Change-Id: {desired}" not in cur_msg:
+                        amended = (
+                            cur_msg.rstrip() + f"\n\nChange-Id: {desired}\n"
+                        )
+                        git_commit_amend(
+                            author=author,
+                            no_edit=False,
+                            signoff=False,
+                            message=amended,
+                            cwd=self.workspace,
+                        )
+            # Phase 1: ensure PR metadata trailers (idempotent)
+            try:
+                meta = self._build_pr_metadata_trailers(gh)
+                if meta:
+                    cur_msg = run_cmd(
+                        ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+                        cwd=self.workspace,
+                    ).stdout
+                    # Clean ellipses from commit message
+                    cur_msg = _clean_ellipses_from_message(cur_msg)
+                    needed = [m for m in meta if m not in cur_msg]
+                    if needed:
+                        new_msg = (
+                            cur_msg.rstrip() + "\n" + "\n".join(needed) + "\n"
+                        )
+                        git_commit_amend(
+                            message=new_msg,
+                            no_edit=False,
+                            signoff=False,
+                            cwd=self.workspace,
+                        )
+            except Exception as meta_exc:
+                log.debug(
+                    "Skipping metadata trailer injection for commit %s: %s",
+                    csha,
+                    meta_exc,
+                )
             # Extract newly added Change-Id from last commit trailers
-            trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
+            trailers = git_last_commit_trailers(
+                keys=["Change-Id"], cwd=self.workspace
+            )
             for cid in trailers.get("Change-Id", []):
                 if cid:
                     change_ids.append(cid)
@@ -1138,7 +1808,8 @@ class Orchestrator:
             )
         else:
             log.debug(
-                "No Change-IDs collected during preparation for PR #%s (will be ensured via commit-msg hook)",
+                "No Change-IDs collected during preparation for PR #%s "
+                "(will be ensured via commit-msg hook)",
                 gh.pr_number,
             )
         return PreparedChange(change_ids=uniq_ids, commit_shas=[])
@@ -1148,9 +1819,10 @@ class Orchestrator:
         inputs: Inputs,
         gh: GitHubContext,
         gerrit: GerritInfo,
+        reuse_change_ids: list[str] | None = None,
     ) -> PreparedChange:
         """Squash PR commits into a single commit and handle Change-Id."""
-        log.info("Preparing squashed commit for PR #%s", gh.pr_number)
+        log.debug("Preparing squashed commit for PR #%s", gh.pr_number)
         branch = self._resolve_target_branch()
 
         run_cmd(
@@ -1159,13 +1831,19 @@ class Orchestrator:
             env=self._ssh_env(),
         )
         base_ref = f"origin/{branch}"
-        base_sha = run_cmd(["git", "rev-parse", base_ref], cwd=self.workspace).stdout.strip()
-        head_sha = run_cmd(["git", "rev-parse", "HEAD"], cwd=self.workspace).stdout.strip()
+        base_sha = run_cmd(
+            ["git", "rev-parse", base_ref], cwd=self.workspace
+        ).stdout.strip()
+        head_sha = run_cmd(
+            ["git", "rev-parse", "HEAD"], cwd=self.workspace
+        ).stdout.strip()
 
         # Create temp branch from base and merge-squash PR head
         tmp_branch = f"g2g_tmp_{gh.pr_number or 'pr'!s}_{os.getpid()}"
         os.environ["G2G_TMP_BRANCH"] = tmp_branch
-        run_cmd(["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace)
+        run_cmd(
+            ["git", "checkout", "-b", tmp_branch, base_sha], cwd=self.workspace
+        )
         run_cmd(["git", "merge", "--squash", head_sha], cwd=self.workspace)
 
         def _collect_log_lines() -> list[str]:
@@ -1193,17 +1871,24 @@ class Orchestrator:
             message_lines: list[str] = []
             in_metadata_section = False
             for ln in lines:
-                if ln.strip() in ("---", "```") or ln.startswith("updated-dependencies:"):
+                if ln.strip() in ("---", "```") or ln.startswith(
+                    "updated-dependencies:"
+                ):
                     in_metadata_section = True
                     continue
                 if in_metadata_section:
                     if ln.startswith(("- dependency-", "  dependency-")):
                         continue
-                    if not ln.startswith(("  ", "-", "dependency-")) and ln.strip():
+                    if (
+                        not ln.startswith(("  ", "-", "dependency-"))
+                        and ln.strip()
+                    ):
                         in_metadata_section = False
                 # Skip Change-Id lines from body - they should only be in footer
                 if ln.startswith("Change-Id:"):
-                    log.debug("Skipping Change-Id from commit body: %s", ln.strip())
+                    log.debug(
+                        "Skipping Change-Id from commit body: %s", ln.strip()
+                    )
                     continue
                 if ln.startswith("Signed-off-by:"):
                     signed_off.append(ln)
@@ -1229,11 +1914,17 @@ class Orchestrator:
                 break_points = [". ", "! ", "? ", " - ", ": "]
                 for bp in break_points:
                     if bp in title_line[:100]:
-                        title_line = title_line[: title_line.index(bp) + len(bp.strip())]
+                        title_line = title_line[
+                            : title_line.index(bp) + len(bp.strip())
+                        ]
                         break
                 else:
                     words = title_line[:100].split()
-                    title_line = " ".join(words[:-1]) if len(words) > 1 else title_line[:100].rstrip()
+                    title_line = (
+                        " ".join(words[:-1])
+                        if len(words) > 1
+                        else title_line[:100].rstrip()
+                    )
 
             # Apply conventional commit normalization if enabled
             if inputs.normalise_commit and gh.pr_number:
@@ -1243,10 +1934,18 @@ class Orchestrator:
                     repo = get_repo_from_env(client)
                     pr_obj = get_pull(repo, int(gh.pr_number))
                     author = getattr(pr_obj, "user", {})
-                    author_login = getattr(author, "login", "") if author else ""
-                    title_line = normalize_commit_title(title_line, author_login, self.workspace)
+                    author_login = (
+                        getattr(author, "login", "") if author else ""
+                    )
+                    title_line = normalize_commit_title(
+                        title_line, author_login, self.workspace
+                    )
                 except Exception as e:
-                    log.debug("Failed to apply commit normalization in squash mode: %s", e)
+                    log.debug(
+                        "Failed to apply commit normalization in squash "
+                        "mode: %s",
+                        e,
+                    )
 
             return title_line
 
@@ -1257,16 +1956,27 @@ class Orchestrator:
             out: list[str] = [title_line]
             if len(message_lines) > 1:
                 body_start = 1
-                while body_start < len(message_lines) and not message_lines[body_start].strip():
+                while (
+                    body_start < len(message_lines)
+                    and not message_lines[body_start].strip()
+                ):
                     body_start += 1
                 if body_start < len(message_lines):
                     out.append("")
-                    out.extend(message_lines[body_start:])
+                    # Clean up ellipses from body lines
+                    body_content = "\n".join(message_lines[body_start:])
+                    cleaned_body_content = _clean_ellipses_from_message(
+                        body_content
+                    )
+                    if cleaned_body_content.strip():
+                        out.extend(cleaned_body_content.splitlines())
             return out
 
         def _maybe_reuse_change_id(pr_str: str) -> str:
             reuse = ""
-            sync_all_prs = os.getenv("SYNC_ALL_OPEN_PRS", "false").lower() == "true"
+            sync_all_prs = (
+                os.getenv("SYNC_ALL_OPEN_PRS", "false").lower() == "true"
+            )
             if (
                 not sync_all_prs
                 and gh.event_name == "pull_request_target"
@@ -1276,7 +1986,9 @@ class Orchestrator:
                     client = build_client()
                     repo = get_repo_from_env(client)
                     pr_obj = get_pull(repo, int(pr_str))
-                    cand = get_recent_change_ids_from_comments(pr_obj, max_comments=50)
+                    cand = get_recent_change_ids_from_comments(
+                        pr_obj, max_comments=50
+                    )
                     if cand:
                         reuse = cand[-1]
                         log.debug(
@@ -1299,10 +2011,17 @@ class Orchestrator:
             reuse_cid: str,
         ) -> str:
             msg = "\n".join(lines_in).strip()
-            msg = _insert_issue_id_into_commit_message(msg, inputs.issue_id)
 
-            # Build footer with proper trailer ordering
+            # Build footer with proper trailer ordering (Issue-ID first,
+            # then others)
             footer_parts = []
+            if inputs.issue_id.strip():
+                issue_line = (
+                    inputs.issue_id.strip()
+                    if inputs.issue_id.strip().startswith("Issue-ID:")
+                    else f"Issue-ID: {inputs.issue_id.strip()}"
+                )
+                footer_parts.append(issue_line)
             if signed_off:
                 footer_parts.extend(signed_off)
             if reuse_cid:
@@ -1314,10 +2033,18 @@ class Orchestrator:
 
         # Build message parts
         raw_lines = _collect_log_lines()
-        message_lines, signed_off, _existing_cids = _parse_message_parts(raw_lines)
+        message_lines, signed_off, _existing_cids = _parse_message_parts(
+            raw_lines
+        )
         clean_lines = _build_clean_message_lines(message_lines)
         pr_str = str(gh.pr_number or "").strip()
         reuse_cid = _maybe_reuse_change_id(pr_str)
+        # Phase 3: if external reuse list provided, override with first
+        # Change-Id
+        if reuse_change_ids:
+            cand = reuse_change_ids[0]
+            if cand:
+                reuse_cid = cand
         commit_msg = _compose_commit_message(clean_lines, signed_off, reuse_cid)
 
         # Preserve primary author from the PR head commit
@@ -1325,9 +2052,23 @@ class Orchestrator:
             ["git", "show", "-s", "--pretty=format:%an <%ae>", head_sha],
             cwd=self.workspace,
         ).stdout.strip()
-        git_commit_new(
-            message=commit_msg,
-            author=author,
+        # Phase 1: ensure metadata trailers before creating commit
+        # (idempotent merge)
+        try:
+            meta = self._build_pr_metadata_trailers(gh)
+            if meta:
+                needed = [m for m in meta if m not in commit_msg]
+                if needed:
+                    commit_msg = commit_msg.rstrip() + "\n" + "\n".join(needed)
+        except Exception as meta_exc:
+            log.debug(
+                "Skipping metadata trailer injection (squash path): %s",
+                meta_exc,
+            )
+
+        git_commit_new(
+            message=commit_msg,
+            author=author,
             signoff=True,
             cwd=self.workspace,
         )
@@ -1349,11 +2090,19 @@ class Orchestrator:
             )
         else:
             # Fallback detection: re-scan commit message for Change-Id trailers
-            msg_after = run_cmd(["git", "show", "-s", "--pretty=format:%B", "HEAD"], cwd=self.workspace).stdout
+            msg_after = run_cmd(
+                ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+                cwd=self.workspace,
+            ).stdout
 
-            found = [m.strip() for m in re.findall(r"(?mi)^Change-Id:\s*([A-Za-z0-9._-]+)\s*$", msg_after)]
+            found = [
+                m.strip()
+                for m in re.findall(
+                    r"(?mi)^Change-Id:\s*([A-Za-z0-9._-]+)\s*$", msg_after
+                )
+            ]
             if found:
-                log.info(
+                log.debug(
                     "Detected Change-ID(s) after amend for PR #%s: %s",
                     gh.pr_number,
                     ", ".join(found),
@@ -1407,26 +2156,35 @@ class Orchestrator:
 
             # Apply conventional commit normalization if enabled
             if inputs.normalise_commit:
-                title = normalize_commit_title(title, author_login, self.workspace)
+                title = normalize_commit_title(
+                    title, author_login, self.workspace
+                )
 
         # Compose message; preserve existing trailers at footer
         # (Signed-off-by, Change-Id)
         current_body = git_show("HEAD", fmt="%B", cwd=self.workspace)
         # Extract existing trailers from current commit body
         lines_cur = current_body.splitlines()
-        signed_lines = [ln for ln in lines_cur if ln.startswith("Signed-off-by:")]
-        change_id_lines = [ln for ln in lines_cur if ln.startswith("Change-Id:")]
-        github_hash_lines = [ln for ln in lines_cur if ln.startswith("GitHub-Hash:")]
-        github_pr_lines = [ln for ln in lines_cur if ln.startswith("GitHub-PR:")]
+        signed_lines = [
+            ln for ln in lines_cur if ln.startswith("Signed-off-by:")
+        ]
+        change_id_lines = [
+            ln for ln in lines_cur if ln.startswith("Change-Id:")
+        ]
+        github_hash_lines = [
+            ln for ln in lines_cur if ln.startswith("GitHub-Hash:")
+        ]
+        github_pr_lines = [
+            ln for ln in lines_cur if ln.startswith("GitHub-PR:")
+        ]
 
         msg_parts = [title, "", body] if title or body else [current_body]
         commit_message = "\n".join(msg_parts).strip()
 
-        # Add Issue-ID if provided
-        commit_message = _insert_issue_id_into_commit_message(commit_message, inputs.issue_id)
+        # Issue-ID will be added in the footer section later
+        # (removed from here to avoid duplication)
 
-        # Ensure GitHub-Hash is part of the body (not trailers)
-        # to keep a blank line before Signed-off-by/Change-Id trailers.
+        # Prepare GitHub-Hash (will be placed after GitHub-PR at footer)
         if github_hash_lines:
             gh_hash_line = github_hash_lines[-1]
         else:
@@ -1435,9 +2193,7 @@ class Orchestrator:
             gh_val = DuplicateDetector._generate_github_change_hash(gh)
             gh_hash_line = f"GitHub-Hash: {gh_val}"
 
-        commit_message += "\n\n" + gh_hash_line
-
-        # Build trailers: Signed-off-by first, Change-Id last.
+        # Build trailers: Signed-off-by first, Change-Id next.
         trailers_out: list[str] = []
         if signed_lines:
             seen_so: set[str] = set()
@@ -1448,18 +2204,26 @@ class Orchestrator:
         if change_id_lines:
             trailers_out.append(change_id_lines[-1])
 
-        # GitHub-PR trailer (must appear after Change-Id)
+        # GitHub-PR (after Change-Id)
         if github_pr_lines:
             pr_line = github_pr_lines[-1]
         else:
-            pr_line = f"GitHub-PR: {gh.server_url}/{gh.repository}/pull/{gh.pr_number}" if gh.pr_number else ""
+            pr_line = (
+                f"GitHub-PR: {gh.server_url}/{gh.repository}/pull/"
+                f"{gh.pr_number}"
+                if gh.pr_number
+                else ""
+            )
+
+        # Assemble footer in desired order:
+        footer_lines: list[str] = []
+        footer_lines.extend(trailers_out)
+        if pr_line:
+            footer_lines.append(pr_line)
+        footer_lines.append(gh_hash_line)
 
-        if trailers_out:
-            commit_message += "\n\n" + "\n".join(trailers_out)
-            if pr_line:
-                commit_message += "\n" + pr_line
-        elif pr_line:
-            commit_message += "\n\n" + pr_line
+        if footer_lines:
+            commit_message += "\n\n" + "\n".join(footer_lines)
 
         author = run_cmd(
             ["git", "show", "-s", "--pretty=format:%an <%ae>", "HEAD"],
@@ -1473,6 +2237,41 @@ class Orchestrator:
             author=author,
             message=commit_message,
         )
+        # Phase 2: collect Change-Id trailers for later comment emission
+        try:
+            trailers_after = git_last_commit_trailers(
+                keys=["Change-Id"], cwd=self.workspace
+            )
+            self._latest_apply_pr_change_ids = trailers_after.get(
+                "Change-Id", []
+            )
+        except Exception as exc:
+            log.debug(
+                "Failed to collect Change-Ids after apply_pr_title: %s", exc
+            )
+        # Phase 1: ensure trailers present even if earlier logic skipped
+        # (idempotent)
+        try:
+            meta = self._build_pr_metadata_trailers(gh)
+            if meta:
+                cur_msg = run_cmd(
+                    ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
+                    cwd=self.workspace,
+                ).stdout
+                needed = [m for m in meta if m not in cur_msg]
+                if needed:
+                    new_msg = cur_msg.rstrip() + "\n" + "\n".join(needed) + "\n"
+                    git_commit_amend(
+                        cwd=self.workspace,
+                        no_edit=False,
+                        signoff=False,
+                        author=author,
+                        message=new_msg,
+                    )
+        except Exception as meta_exc:
+            log.debug(
+                "Skipping post-apply metadata trailer ensure: %s", meta_exc
+            )
 
     def _push_to_gerrit(
         self,
@@ -1482,9 +2281,10 @@ class Orchestrator:
         branch: str,
         reviewers: str,
         single_commits: bool,
+        prepared: PreparedChange | None = None,
     ) -> None:
         """Push prepared commit(s) to Gerrit using git-review."""
-        log.info(
+        log.debug(
             "Pushing changes to Gerrit %s:%s project=%s branch=%s",
             gerrit.host,
             gerrit.port,
@@ -1497,7 +2297,11 @@ class Orchestrator:
             run_cmd(["git", "checkout", tmp_branch], cwd=self.workspace)
         prefix = os.getenv("G2G_TOPIC_PREFIX", "GH").strip() or "GH"
         pr_num = os.getenv("PR_NUMBER", "").strip()
-        topic = f"{prefix}-{repo.project_github}-{pr_num}" if pr_num else f"{prefix}-{repo.project_github}"
+        topic = (
+            f"{prefix}-{repo.project_github}-{pr_num}"
+            if pr_num
+            else f"{prefix}-{repo.project_github}"
+        )
 
         # Use our specific SSH configuration
         env = self._ssh_env()
@@ -1511,32 +2315,164 @@ class Orchestrator:
                 "-t",
                 topic,
             ]
-            revs = [r.strip() for r in (reviewers or "").split(",") if r.strip() and "@" in r and r.strip() != branch]
+            collected_change_ids: list[str] = []
+            if prepared:
+                collected_change_ids.extend(prepared.all_change_ids())
+            # Add any Change-Ids captured from apply_pr path (squash amend)
+            extra_ids = getattr(self, "_latest_apply_pr_change_ids", [])
+            for cid in extra_ids:
+                if cid and cid not in collected_change_ids:
+                    collected_change_ids.append(cid)
+            revs = [
+                r.strip()
+                for r in (reviewers or "").split(",")
+                if r.strip() and "@" in r and r.strip() != branch
+            ]
             for r in revs:
                 args.extend(["--reviewer", r])
             # Branch as positional argument (not a flag)
             args.append(branch)
 
             if env_bool("CI_TESTING", False):
-                log.info("CI_TESTING enabled: using synthetic orphan commit push path")
-                self._create_orphan_commit_and_push(gerrit, repo, branch, reviewers, topic, env)
+                log.debug(
+                    "CI_TESTING enabled: using synthetic orphan commit "
+                    "push path"
+                )
+                self._create_orphan_commit_and_push(
+                    gerrit, repo, branch, reviewers, topic, env
+                )
                 return
             log.debug("Executing git review command: %s", " ".join(args))
             run_cmd(args, cwd=self.workspace, env=env)
-            log.info("Successfully pushed changes to Gerrit")
+            log.debug("Successfully pushed changes to Gerrit")
         except CommandError as exc:
             # Check if this is a "no common ancestry" error in CI_TESTING mode
             if self._should_handle_unrelated_history(exc):
-                log.info("Detected unrelated repository history. Creating orphan commit for CI testing...")
-                self._create_orphan_commit_and_push(gerrit, repo, branch, reviewers, topic, env)
+                log.debug(
+                    "Detected unrelated repository history. Creating orphan "
+                    "commit for CI testing..."
+                )
+                self._create_orphan_commit_and_push(
+                    gerrit, repo, branch, reviewers, topic, env
+                )
                 return
 
+            # Check for account not found error and try with case-normalized
+            # emails
+            account_not_found_emails = self._extract_account_not_found_emails(
+                exc
+            )
+            if account_not_found_emails:
+                normalized_reviewers = self._normalize_reviewer_emails(
+                    reviewers, account_not_found_emails
+                )
+                if normalized_reviewers != reviewers:
+                    log.debug(
+                        "Retrying with case-normalized email addresses..."
+                    )
+                    try:
+                        # Rebuild args with normalized reviewers
+                        retry_args = args[:-1]  # Remove branch (last arg)
+                        # Clear previous reviewer args and add normalized ones
+                        retry_args = [
+                            arg for arg in retry_args if arg != "--reviewer"
+                        ]
+                        retry_args = [
+                            retry_args[i]
+                            for i in range(len(retry_args))
+                            if i == 0 or retry_args[i - 1] != "--reviewer"
+                        ]
+
+                        norm_revs = [
+                            r.strip()
+                            for r in (normalized_reviewers or "").split(",")
+                            if r.strip() and "@" in r and r.strip() != branch
+                        ]
+                        for r in norm_revs:
+                            retry_args.extend(["--reviewer", r])
+                        retry_args.append(branch)
+
+                        log.debug(
+                            "Retrying git review command with normalized "
+                            "emails: %s",
+                            " ".join(retry_args),
+                        )
+                        run_cmd(retry_args, cwd=self.workspace, env=env)
+                        log.debug(
+                            "Successfully pushed changes to Gerrit with "
+                            "normalized email addresses"
+                        )
+
+                        # Update configuration file with normalized email
+                        # addresses
+                        self._update_config_with_normalized_emails(
+                            account_not_found_emails
+                        )
+                    except CommandError as retry_exc:
+                        log.warning(
+                            "Retry with normalized emails also failed: %s",
+                            self._analyze_gerrit_push_failure(retry_exc),
+                        )
+                        # Continue with original error handling
+                    else:
+                        # On success, emit mapping comment before return
+                        try:
+                            gh_context = getattr(
+                                self, "_gh_context_for_push", None
+                            )
+                            replace_existing = getattr(
+                                self, "_inputs", None
+                            ) and getattr(
+                                self._inputs,
+                                "persist_single_mapping_comment",
+                                True,
+                            )
+                            self._emit_change_id_map_comment(
+                                gh_context=gh_context,
+                                change_ids=collected_change_ids,
+                                multi=single_commits,
+                                topic=topic,
+                                replace_existing=bool(replace_existing),
+                            )
+                        except Exception as cexc:
+                            log.debug(
+                                "Failed to emit Change-Id map comment "
+                                "(retry path): %s",
+                                cexc,
+                            )
+                        return
+
             # Analyze the specific failure reason from git review output
             error_details = self._analyze_gerrit_push_failure(exc)
-            log_exception_conditionally(log, "Gerrit push failed: %s", error_details)
-            msg = f"Failed to push changes to Gerrit with git-review: {error_details}"
+            log_exception_conditionally(
+                log, "Gerrit push failed: %s", error_details
+            )
+            msg = (
+                f"Failed to push changes to Gerrit with git-review: "
+                f"{error_details}"
+            )
             raise OrchestratorError(msg) from exc
         # Cleanup temporary branch used during preparation
+        else:
+            # Successful push: emit mapping comment (Phase 2)
+            try:
+                gh_context = getattr(self, "_gh_context_for_push", None)
+                replace_existing = getattr(self, "_inputs", None) and getattr(
+                    self._inputs, "persist_single_mapping_comment", True
+                )
+                self._emit_change_id_map_comment(
+                    gh_context=gh_context,
+                    change_ids=collected_change_ids,
+                    multi=single_commits,
+                    topic=topic,
+                    replace_existing=bool(replace_existing),
+                )
+            except Exception as exc_emit:
+                log.debug(
+                    "Failed to emit Change-Id map comment (success path): %s",
+                    exc_emit,
+                )
+        # Cleanup temporary branch used during preparation
         tmp_branch = (os.getenv("G2G_TMP_BRANCH", "") or "").strip()
         if tmp_branch:
             # Switch back to the target branch, then delete the temp branch
@@ -1553,8 +2489,144 @@ class Orchestrator:
                 env=env,
             )
 
+    def _extract_account_not_found_emails(self, exc: CommandError) -> list[str]:
+        """Extract email addresses from 'Account not found' errors.
+
+        Args:
+            exc: The CommandError from git review failure
+
+        Returns:
+            List of email addresses that were not found in Gerrit
+        """
+        combined_output = f"{exc.stdout}\n{exc.stderr}"
+        import re
+
+        # Pattern to match: Account 'email@domain.com' not found
+        pattern = r"Account\s+'([^']+)'\s+not\s+found"
+        matches = re.findall(pattern, combined_output, re.IGNORECASE)
+
+        # Filter to only include valid email addresses
+        email_pattern = r"^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$"
+        valid_emails = [
+            email for email in matches if re.match(email_pattern, email)
+        ]
+
+        if valid_emails:
+            log.debug("Found 'Account not found' emails: %s", valid_emails)
+
+        return valid_emails
+
+    def _normalize_reviewer_emails(
+        self, reviewers: str, failed_emails: list[str]
+    ) -> str:
+        """Normalize reviewer email addresses to lowercase.
+
+        Args:
+            reviewers: Comma-separated string of reviewer emails
+            failed_emails: List of emails that failed account lookup
+
+        Returns:
+            Comma-separated string with failed emails converted to lowercase
+        """
+        if not reviewers or not failed_emails:
+            return reviewers
+
+        reviewer_list = [r.strip() for r in reviewers.split(",") if r.strip()]
+        normalized_list = []
+
+        for reviewer in reviewer_list:
+            if reviewer in failed_emails:
+                normalized = reviewer.lower()
+                if normalized != reviewer:
+                    log.info(
+                        "Normalizing email case: %s -> %s", reviewer, normalized
+                    )
+                normalized_list.append(normalized)
+            else:
+                normalized_list.append(reviewer)
+
+        return ",".join(normalized_list)
+
+    def _update_config_with_normalized_emails(
+        self, original_emails: list[str]
+    ) -> None:
+        """Update configuration file with normalized email addresses.
+
+        Args:
+            original_emails: List of original emails that were normalized
+        """
+        try:
+            # Get current organization for config lookup
+            org = os.getenv("ORGANIZATION") or os.getenv(
+                "GITHUB_REPOSITORY_OWNER"
+            )
+            if not org:
+                log.debug("No organization found, skipping config file update")
+                return
+
+            config_path = os.getenv("G2G_CONFIG_PATH", "").strip()
+            if not config_path:
+                config_path = "~/.config/github2gerrit/configuration.txt"
+
+            config_path_obj = Path(config_path).expanduser()
+            if not config_path_obj.exists():
+                log.debug(
+                    "Config file does not exist, skipping update: %s",
+                    config_path_obj,
+                )
+                return
+
+            # Read current config content
+            content = config_path_obj.read_text(encoding="utf-8")
+            original_content = content
+
+            # Look for email addresses in the content and normalize them
+            for original_email in original_emails:
+                normalized_email = original_email.lower()
+                if normalized_email != original_email:
+                    # Replace the original email with normalized version
+                    # This handles both quoted and unquoted email addresses
+                    patterns = [
+                        f'"{original_email}"',  # Quoted
+                        f"'{original_email}'",  # Single quoted
+                        original_email,  # Unquoted
+                    ]
+
+                    for pattern in patterns:
+                        if pattern in content:
+                            replacement = pattern.replace(
+                                original_email, normalized_email
+                            )
+                            content = content.replace(pattern, replacement)
+                            log.info(
+                                "Updated config file: %s -> %s",
+                                pattern,
+                                replacement,
+                            )
+
+            # Write back if changes were made
+            if content != original_content:
+                config_path_obj.write_text(content, encoding="utf-8")
+                log.info(
+                    "Configuration file updated with normalized email "
+                    "addresses: %s",
+                    config_path_obj,
+                )
+            else:
+                log.debug(
+                    "No email addresses found in config file to normalize"
+                )
+
+        except Exception as exc:
+            log.warning(
+                "Failed to update configuration file with normalized "
+                "emails: %s",
+                exc,
+            )
+
     def _should_handle_unrelated_history(self, exc: CommandError) -> bool:
-        """Check if we should handle unrelated repository history in CI testing mode."""
+        """Check if we should handle unrelated repository history in CI
+        testing mode."""
         if not env_bool("CI_TESTING", False):
             return False
 
@@ -1577,25 +2649,61 @@ class Orchestrator:
         return any(p in combined_lower for p in phrases)
 
     def _create_orphan_commit_and_push(
-        self, gerrit: GerritInfo, repo: RepoNames, branch: str, reviewers: str, topic: str, env: dict[str, str]
+        self,
+        gerrit: GerritInfo,
+        repo: RepoNames,
+        branch: str,
+        reviewers: str,
+        topic: str,
+        env: dict[str, str],
     ) -> None:
-        """Create a synthetic commit on top of the remote base with the PR tree (CI testing mode)."""
-        log.info("CI_TESTING: Creating synthetic commit on top of remote base for unrelated repository")
+        """Create a synthetic commit on top of the remote base with the PR
+        tree (CI testing mode)."""
+        log.debug(
+            "CI_TESTING: Creating synthetic commit on top of remote base "
+            "for unrelated repository"
+        )
 
         try:
             # Capture the current PR commit message and tree
-            commit_msg = run_cmd(["git", "log", "--format=%B", "-n", "1", "HEAD"], cwd=self.workspace).stdout.strip()
-            pr_tree = run_cmd(["git", "show", "--quiet", "--format=%T", "HEAD"], cwd=self.workspace).stdout.strip()
+            commit_msg = run_cmd(
+                ["git", "log", "--format=%B", "-n", "1", "HEAD"],
+                cwd=self.workspace,
+            ).stdout.strip()
+            pr_tree = run_cmd(
+                ["git", "show", "--quiet", "--format=%T", "HEAD"],
+                cwd=self.workspace,
+            ).stdout.strip()
 
             # Create/update a synthetic branch based on the remote base branch
             synth_branch = f"synth-{topic}"
             # Ensure remote ref exists locally (best-effort)
-            run_cmd(["git", "fetch", "gerrit", branch], cwd=self.workspace, env=env, check=False)
-            run_cmd(["git", "checkout", "-B", synth_branch, f"remotes/gerrit/{branch}"], cwd=self.workspace, env=env)
+            run_cmd(
+                ["git", "fetch", "gerrit", branch],
+                cwd=self.workspace,
+                env=env,
+                check=False,
+            )
+            run_cmd(
+                [
+                    "git",
+                    "checkout",
+                    "-B",
+                    synth_branch,
+                    f"remotes/gerrit/{branch}",
+                ],
+                cwd=self.workspace,
+                env=env,
+            )
 
             # Replace working tree contents with the PR tree
             # 1) Remove current tracked files (ignore errors if none)
-            run_cmd(["git", "rm", "-r", "--quiet", "."], cwd=self.workspace, env=env, check=False)
+            run_cmd(
+                ["git", "rm", "-r", "--quiet", "."],
+                cwd=self.workspace,
+                env=env,
+                check=False,
+            )
             # 2) Clean untracked files/dirs (preserve our SSH known_hosts dir)
             run_cmd(
                 ["git", "clean", "-fdx", "-e", ".ssh-g2g", "-e", ".ssh-g2g/**"],
@@ -1604,15 +2712,23 @@ class Orchestrator:
                 check=False,
             )
             # 3) Checkout the PR tree into working directory
-            run_cmd(["git", "checkout", pr_tree, "--", "."], cwd=self.workspace, env=env)
+            run_cmd(
+                ["git", "checkout", pr_tree, "--", "."],
+                cwd=self.workspace,
+                env=env,
+            )
             run_cmd(["git", "add", "-A"], cwd=self.workspace, env=env)
 
-            # Commit synthetic change with the same message (should already include Change-Id)
+            # Commit synthetic change with the same message (should already
+            # include Change-Id)
             import tempfile as _tempfile
             from pathlib import Path as _Path
 
-            with _tempfile.NamedTemporaryFile("w", delete=False, encoding="utf-8") as _tf:
-                # Ensure Signed-off-by for current committer (uploader) is present in the footer
+            with _tempfile.NamedTemporaryFile(
+                "w", delete=False, encoding="utf-8"
+            ) as _tf:
+                # Ensure Signed-off-by for current committer (uploader) is
+                # present in the footer
                 try:
                     committer_name = run_cmd(
                         ["git", "config", "--get", "user.name"],
@@ -1629,7 +2745,9 @@ class Orchestrator:
                     committer_email = ""
                 msg_to_write = commit_msg
                 if committer_name and committer_email:
-                    sob_line = f"Signed-off-by: {committer_name} <{committer_email}>"
+                    sob_line = (
+                        f"Signed-off-by: {committer_name} <{committer_email}>"
+                    )
                     if sob_line not in msg_to_write:
                         if not msg_to_write.endswith("\n"):
                             msg_to_write += "\n"
@@ -1640,20 +2758,39 @@ class Orchestrator:
                 _tf.flush()
                 _tmp_msg_path = _Path(_tf.name)
             try:
-                run_cmd(["git", "commit", "-F", str(_tmp_msg_path)], cwd=self.workspace, env=env)
+                run_cmd(
+                    ["git", "commit", "-F", str(_tmp_msg_path)],
+                    cwd=self.workspace,
+                    env=env,
+                )
             finally:
                 from contextlib import suppress
 
                 with suppress(Exception):
                     _tmp_msg_path.unlink(missing_ok=True)
 
-            # Push directly to refs/for/<branch> with topic and reviewers to avoid rebase behavior
+            # Push directly to refs/for/<branch> with topic and reviewers to
+            # avoid rebase behavior
             push_ref = f"refs/for/{branch}%topic={topic}"
-            revs = [r.strip() for r in (reviewers or "").split(",") if r.strip() and "@" in r and r.strip() != branch]
+            revs = [
+                r.strip()
+                for r in (reviewers or "").split(",")
+                if r.strip() and "@" in r and r.strip() != branch
+            ]
             for r in revs:
                 push_ref += f",r={r}"
-            run_cmd(["git", "push", "--no-follow-tags", "gerrit", f"HEAD:{push_ref}"], cwd=self.workspace, env=env)
-            log.info("Successfully pushed synthetic commit to Gerrit")
+            run_cmd(
+                [
+                    "git",
+                    "push",
+                    "--no-follow-tags",
+                    "gerrit",
+                    f"HEAD:{push_ref}",
+                ],
+                cwd=self.workspace,
+                env=env,
+            )
+            log.debug("Successfully pushed synthetic commit to Gerrit")
 
         except CommandError as orphan_exc:
             error_details = self._analyze_gerrit_push_failure(orphan_exc)
@@ -1667,6 +2804,10 @@ class Orchestrator:
         combined_output = f"{stdout}\n{stderr}"
         combined_lower = combined_output.lower()
 
+        # Remove extra whitespace and normalize line breaks for better pattern
+        # matching
+        normalized_output = " ".join(combined_lower.split())
+
         # Check for SSH host key verification failures first
         if (
             "host key verification failed" in combined_lower
@@ -1683,7 +2824,10 @@ class Orchestrator:
                 "'ssh-keyscan -p 29418 <gerrit-host>' "
                 "to get the current host keys."
             )
-        elif "authenticity of host" in combined_lower and "can't be established" in combined_lower:
+        elif (
+            "authenticity of host" in combined_lower
+            and "can't be established" in combined_lower
+        ):
             return (
                 "SSH host key unknown. The GERRIT_KNOWN_HOSTS value does not "
                 "contain the host key for the Gerrit server. "
@@ -1693,18 +2837,37 @@ class Orchestrator:
                 "'ssh-keyscan -p 29418 <gerrit-host>' to get the host keys."
             )
         # Check for specific SSH key issues before general permission denied
-        elif "key_load_public" in combined_lower and "invalid format" in combined_lower:
-            return "SSH key format is invalid. Check that the SSH private key is properly formatted."
-        elif "no matching host key type found" in combined_lower:
-            return "SSH key type not supported by server. The server may not accept this SSH key algorithm."
+        elif (
+            "key_load_public" in combined_lower
+            and "invalid format" in combined_lower
+        ):
+            return (
+                "SSH key format is invalid. Check that the SSH private key "
+                "is properly formatted."
+            )
+        elif "no matching host key type found" in normalized_output:
+            return (
+                "SSH key type not supported by server. The server may not "
+                "accept this SSH key algorithm."
+            )
         elif "authentication failed" in combined_lower:
-            return "SSH authentication failed - check SSH key, username, and server configuration"
+            return (
+                "SSH authentication failed - check SSH key, username, and "
+                "server configuration"
+            )
         # Check for connection timeout/refused before "could not read" check
-        elif "connection timed out" in combined_lower or "connection refused" in combined_lower:
-            return "Connection failed - check network connectivity and Gerrit server availability"
+        elif (
+            "connection timed out" in combined_lower
+            or "connection refused" in combined_lower
+        ):
+            return (
+                "Connection failed - check network connectivity and Gerrit "
+                "server availability"
+            )
         # Check for specific SSH publickey-only authentication failures
         elif "permission denied (publickey)" in combined_lower and not any(
-            auth_method in combined_lower for auth_method in ["gssapi", "password", "keyboard"]
+            auth_method in combined_lower
+            for auth_method in ["gssapi", "password", "keyboard"]
         ):
             return (
                 "SSH public key authentication failed. The SSH key may be "
@@ -1714,14 +2877,33 @@ class Orchestrator:
         elif "permission denied" in combined_lower:
             return "SSH permission denied - check SSH key and user permissions"
         elif "could not read from remote repository" in combined_lower:
-            return "Could not read from remote repository - check SSH authentication and repository access permissions"
+            return (
+                "Could not read from remote repository - check SSH "
+                "authentication and repository access permissions"
+            )
         # Check for Gerrit-specific issues
         elif "missing issue-id" in combined_lower:
             return "Missing Issue-ID in commit message."
         elif "commit not associated to any issue" in combined_lower:
             return "Commit not associated to any issue."
-        elif "remote rejected" in combined_lower and "refs/for/" in combined_lower:
+        elif (
+            "remote rejected" in combined_lower
+            and "refs/for/" in combined_lower
+        ):
             # Extract specific rejection reason from output
+            # Handle multiline rejection messages by looking in normalized
+            # output
+            import re
+
+            # Look for the rejection pattern in the normalized output
+            rejection_match = re.search(
+                r"!\s*\[remote rejected\].*?\((.*?)\)", normalized_output
+            )
+            if rejection_match:
+                reason = rejection_match.group(1).strip()
+                return f"Gerrit rejected the push: {reason}"
+
+            # Fallback: look line by line
             lines = combined_output.split("\n")
             for line in lines:
                 if "! [remote rejected]" in line:
@@ -1742,35 +2924,22 @@ class Orchestrator:
         change_ids: Sequence[str],
     ) -> SubmissionResult:
         """Query Gerrit for change URL/number and patchset sha via REST."""
-        log.info("Querying Gerrit for submitted change(s) via REST")
+        log.debug("Querying Gerrit for submitted change(s) via REST")
 
-        # pygerrit2 netrc filter is already applied in execute() unless verbose mode
+        # pygerrit2 netrc filter is already applied in execute() unless
+        # verbose mode
 
         # Create centralized URL builder (auto-discovers base path)
         url_builder = create_gerrit_url_builder(gerrit.host)
 
         # Get authentication credentials
-        http_user = os.getenv("GERRIT_HTTP_USER", "").strip() or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
+        http_user = (
+            os.getenv("GERRIT_HTTP_USER", "").strip()
+            or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
+        )
         http_pass = os.getenv("GERRIT_HTTP_PASSWORD", "").strip()
 
-        # Build Gerrit REST client (prefer HTTP basic auth if provided)
-        if GerritRestAPI is None:
-            raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
-
-        def _create_rest_client(base_url: str) -> Any:
-            """Helper to create REST client with optional auth."""
-            if http_user and http_pass:
-                if HTTPBasicAuth is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_AUTH)
-                if GerritRestAPI is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
-                return GerritRestAPI(url=base_url, auth=HTTPBasicAuth(http_user, http_pass))
-            else:
-                if GerritRestAPI is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_REQUIRED_REST)
-                return GerritRestAPI(url=base_url)
-
-        # Try API URLs in order of preference (client creation happens in retry loop)
+        # Query changes using centralized REST client
         urls: list[str] = []
         nums: list[str] = []
         shas: list[str] = []
@@ -1797,7 +2966,9 @@ class Orchestrator:
                 log.debug("Gerrit API base URL (discovered): %s", api_base_url)
                 changes = client.get(path)
             except Exception as exc:
-                log.warning("Failed to query change via REST for %s: %s", cid, exc)
+                log.warning(
+                    "Failed to query change via REST for %s: %s", cid, exc
+                )
                 continue
             if not changes:
                 continue
@@ -1811,13 +2982,17 @@ class Orchestrator:
                 continue
             # Construct a stable web URL for the change
             if num:
-                change_url = url_builder.change_url(repo.project_gerrit, int(num))
+                change_url = url_builder.change_url(
+                    repo.project_gerrit, int(num)
+                )
                 urls.append(change_url)
                 nums.append(num)
             if current_rev:
                 shas.append(current_rev)
 
-        return SubmissionResult(change_urls=urls, change_numbers=nums, commit_shas=shas)
+        return SubmissionResult(
+            change_urls=urls, change_numbers=nums, commit_shas=shas
+        )
 
     def _setup_git_workspace(self, inputs: Inputs, gh: GitHubContext) -> None:
         """Initialize and set up git workspace for PR processing."""
@@ -1825,7 +3000,9 @@ class Orchestrator:
 
         # Try modern git init with explicit branch first
         try:
-            run_cmd(["git", "init", "--initial-branch=master"], cwd=self.workspace)
+            run_cmd(
+                ["git", "init", "--initial-branch=master"], cwd=self.workspace
+            )
         except Exception:
             # Fallback for older git versions (hint filtered at logging level)
             run_cmd(["git", "init"], cwd=self.workspace)
@@ -1842,7 +3019,10 @@ class Orchestrator:
 
         # Fetch PR head
         if gh.pr_number:
-            pr_ref = f"refs/pull/{gh.pr_number}/head:refs/remotes/origin/pr/{gh.pr_number}/head"
+            pr_ref = (
+                f"refs/pull/{gh.pr_number}/head:refs/remotes/origin/pr/"
+                f"{gh.pr_number}/head"
+            )
             run_cmd(
                 [
                     "git",
@@ -1878,10 +3058,14 @@ class Orchestrator:
             def _raise_orch(msg: str) -> None:
                 raise OrchestratorError(msg)  # noqa: TRY301
 
-            _MSG_HOOK_SIZE_BOUNDS = "commit-msg hook size outside expected bounds"
+            _MSG_HOOK_SIZE_BOUNDS = (
+                "commit-msg hook size outside expected bounds"
+            )
             _MSG_HOOK_READ_FAILED = "failed reading commit-msg hook"
             _MSG_HOOK_NO_SHEBANG = "commit-msg hook missing shebang"
-            _MSG_HOOK_BAD_CONTENT = "commit-msg hook content lacks expected markers"
+            _MSG_HOOK_BAD_CONTENT = (
+                "commit-msg hook content lacks expected markers"
+            )
 
             # Use centralized curl download with retry/logging/metrics
             return_code, status_code = curl_download(
@@ -1894,7 +3078,8 @@ class Orchestrator:
 
             size = hook_path.stat().st_size
             log.debug(
-                "curl fetch of commit-msg: url=%s http_status=%s size=%dB rc=%s",
+                "curl fetch of commit-msg: url=%s http_status=%s size=%dB "
+                "rc=%s",
                 hook_url,
                 status_code,
                 size,
@@ -1916,33 +3101,50 @@ class Orchestrator:
             if not text_head.startswith("#!"):
                 _raise_orch(_MSG_HOOK_NO_SHEBANG)
             # Look for recognizable strings
-            if not any(m in text_head for m in ("Change-Id", "Gerrit Code Review", "add_change_id")):
+            if not any(
+                m in text_head
+                for m in ("Change-Id", "Gerrit Code Review", "add_change_id")
+            ):
                 _raise_orch(_MSG_HOOK_BAD_CONTENT)
 
             # Make hook executable (single chmod)
             hook_path.chmod(hook_path.stat().st_mode | stat.S_IEXEC)
-            log.debug("Successfully installed commit-msg hook from %s", hook_url)
+            log.debug(
+                "Successfully installed commit-msg hook from %s", hook_url
+            )
 
         except Exception as exc:
-            log.warning("Failed to install commit-msg hook via centralized curl: %s", exc)
+            log.warning(
+                "Failed to install commit-msg hook via centralized curl: %s",
+                exc,
+            )
             msg = f"Could not install commit-msg hook: {exc}"
             raise OrchestratorError(msg) from exc
 
-    def _ensure_change_id_present(self, gerrit: GerritInfo, author: str) -> list[str]:
+    def _ensure_change_id_present(
+        self, gerrit: GerritInfo, author: str
+    ) -> list[str]:
         """Ensure the last commit has a Change-Id.
 
         Installs the commit-msg hook and amends the commit if needed.
         """
-        trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
+        trailers = git_last_commit_trailers(
+            keys=["Change-Id"], cwd=self.workspace
+        )
         existing_change_ids = trailers.get("Change-Id", [])
 
         if existing_change_ids:
-            log.debug("Found existing Change-Id(s) in footer: %s", existing_change_ids)
+            log.debug(
+                "Found existing Change-Id(s) in footer: %s", existing_change_ids
+            )
             # Clean up any duplicate Change-IDs in the message body
             self._clean_change_ids_from_body(author)
             return [c for c in existing_change_ids if c]
 
-        log.debug("No Change-Id found; attempting to install commit-msg hook and amend commit")
+        log.debug(
+            "No Change-Id found; attempting to install commit-msg hook and "
+            "amend commit"
+        )
         try:
             self._install_commit_msg_hook(gerrit)
             git_commit_amend(
@@ -1953,7 +3155,8 @@ class Orchestrator:
             )
         except Exception as exc:
             log.warning(
-                "Commit-msg hook installation failed, falling back to direct Change-Id injection: %s",
+                "Commit-msg hook installation failed, falling back to direct "
+                "Change-Id injection: %s",
                 exc,
             )
             # Fallback: generate a Change-Id and append to the commit
@@ -1967,11 +3170,15 @@ class Orchestrator:
             seed = f"{current_msg}\n{time.time()}"
             import hashlib as _hashlib  # local alias to satisfy linters
 
-            change_id = "I" + _hashlib.sha256(seed.encode("utf-8")).hexdigest()[:40]
+            change_id = (
+                "I" + _hashlib.sha256(seed.encode("utf-8")).hexdigest()[:40]
+            )
 
             # Clean message and ensure proper footer placement
             cleaned_msg = self._clean_commit_message_for_change_id(current_msg)
-            new_msg = cleaned_msg.rstrip() + "\n\n" + f"Change-Id: {change_id}\n"
+            new_msg = (
+                cleaned_msg.rstrip() + "\n\n" + f"Change-Id: {change_id}\n"
+            )
             git_commit_amend(
                 no_edit=False,
                 signoff=True,
@@ -1985,11 +3192,14 @@ class Orchestrator:
             cwd=self.workspace,
         ).stdout.strip()
         log.debug("Commit message after amend:\n%s", actual_msg)
-        trailers = git_last_commit_trailers(keys=["Change-Id"], cwd=self.workspace)
+        trailers = git_last_commit_trailers(
+            keys=["Change-Id"], cwd=self.workspace
+        )
         return [c for c in trailers.get("Change-Id", []) if c]
 
     def _clean_change_ids_from_body(self, author: str) -> None:
-        """Remove any Change-Id lines from the commit message body, keeping only footer trailers."""
+        """Remove any Change-Id lines from the commit message body, keeping
+        only footer trailers."""
         current_msg = run_cmd(
             ["git", "show", "-s", "--pretty=format:%B", "HEAD"],
             cwd=self.workspace,
@@ -2008,16 +3218,22 @@ class Orchestrator:
             )
 
     def _clean_commit_message_for_change_id(self, message: str) -> str:
-        """Remove Change-Id lines from message body while preserving footer trailers."""
+        """Remove Change-Id lines from message body while preserving footer
+        trailers."""
         lines = message.splitlines()
 
         # Parse proper trailers using the fixed trailer parser
         trailers = _parse_trailers(message)
         change_id_trailers = trailers.get("Change-Id", [])
         signed_off_trailers = trailers.get("Signed-off-by", [])
-        other_trailers = {k: v for k, v in trailers.items() if k not in ["Change-Id", "Signed-off-by"]}
-
-        # Find trailer section by working backwards to find continuous trailer block
+        other_trailers = {
+            k: v
+            for k, v in trailers.items()
+            if k not in ["Change-Id", "Signed-off-by"]
+        }
+
+        # Find trailer section by working backwards to find continuous
+        # trailer block
         trailer_start = len(lines)
 
         # Work backwards to find where trailers start
@@ -2036,12 +3252,15 @@ class Orchestrator:
                 key, val = line.split(":", 1)
                 k = key.strip()
                 v = val.strip()
-                if not (k and v and not k.startswith(" ") and not k.startswith("\t")):
+                if not (
+                    k and v and not k.startswith(" ") and not k.startswith("\t")
+                ):
                     # Invalid trailer format - trailers start after this
                     trailer_start = i + 1
                     break
 
-        # Process body lines (before trailers) and remove any Change-Id references
+        # Process body lines (before trailers) and remove any Change-Id
+        # references
         body_lines = []
         for i in range(trailer_start):
             line = lines[i]
@@ -2049,19 +3268,28 @@ class Orchestrator:
             if "Change-Id:" in line:
                 # If line starts with Change-Id:, skip it entirely
                 if line.strip().startswith("Change-Id:"):
-                    log.debug("Removing Change-Id line from body: %s", line.strip())
+                    log.debug(
+                        "Removing Change-Id line from body: %s", line.strip()
+                    )
                     continue
                 else:
-                    # If Change-Id is mentioned within the line, remove that part
+                    # If Change-Id is mentioned within the line, remove that
+                    # part
                     original_line = line
                     # Remove Change-Id: followed by the ID value
 
-                    # Pattern to match "Change-Id: <value>" where value can contain word chars, hyphens, etc.
+                    # Pattern to match "Change-Id: <value>" where value can
+                    # contain word chars, hyphens, etc.
                     line = re.sub(r"Change-Id:\s*[A-Za-z0-9._-]+\b", "", line)
                     # Clean up extra whitespace
                     line = re.sub(r"\s+", " ", line).strip()
                     if line != original_line:
-                        log.debug("Cleaned Change-Id reference from body line: %s -> %s", original_line.strip(), line)
+                        log.debug(
+                            "Cleaned Change-Id reference from body line: "
+                            "%s -> %s",
+                            original_line.strip(),
+                            line,
+                        )
             body_lines.append(line)
 
         # Remove trailing empty lines from body
@@ -2111,17 +3339,66 @@ class Orchestrator:
             "1",
             "yes",
         ):
-            log.info("Skipping back-reference comments (G2G_SKIP_GERRIT_COMMENTS=true)")
+            log.info(
+                "Skipping back-reference comments "
+                "(G2G_SKIP_GERRIT_COMMENTS=true)"
+            )
             return
 
-        log.info("Adding back-reference comment in Gerrit")
+        log.debug("Adding back-reference comment in Gerrit")
         user = os.getenv("GERRIT_SSH_USER_G2G", "")
         server = gerrit.host
         pr_url = f"{gh.server_url}/{gh.repository}/pull/{gh.pr_number}"
-        run_url = f"{gh.server_url}/{gh.repository}/actions/runs/{gh.run_id}" if gh.run_id else "N/A"
+        run_url = (
+            f"{gh.server_url}/{gh.repository}/actions/runs/{gh.run_id}"
+            if gh.run_id
+            else "N/A"
+        )
         message = f"GHPR: {pr_url} | Action-Run: {run_url}"
-        log.info("Adding back-reference comment: %s", message)
+        log.debug("Adding back-reference comment: %s", message)
+        # Idempotence override: allow forcing duplicate comments (debug/testing)
+        force_dup = os.getenv("G2G_FORCE_BACKREF_DUPLICATE", "").lower() in (
+            "1",
+            "true",
+            "yes",
+        )
+
+        def _has_existing_backref(commit_sha: str) -> bool:
+            if force_dup:
+                return False
+            try:
+                from .gerrit_rest import build_client_for_host
+
+                client = build_client_for_host(
+                    gerrit.host, timeout=8.0, max_attempts=3
+                )
+                # Query change messages for this commit
+                path = f"/changes/?q=commit:{commit_sha}&o=MESSAGES"
+                data = client.get(path)
+                if not isinstance(data, list):
+                    return False
+                for entry in data:
+                    msgs = entry.get("messages") or []
+                    for msg in msgs:
+                        txt = (msg.get("message") or "").strip()
+                        if "GHPR:" in txt and pr_url in txt:
+                            log.debug(
+                                "Skipping back-reference for %s "
+                                "(already present)",
+                                commit_sha,
+                            )
+                            return True
+            except Exception as exc:
+                log.debug(
+                    "Backref idempotence check failed for %s: %s",
+                    commit_sha,
+                    exc,
+                )
+            return False
+
         for csha in commit_shas:
+            if _has_existing_backref(csha):
+                continue
             if not csha:
                 continue
             try:
@@ -2163,7 +3440,11 @@ class Orchestrator:
                             f"{shlex.quote(csha)}"
                         ),
                     ]
-                elif self._use_ssh_agent and self._ssh_agent_manager and self._ssh_agent_manager.known_hosts_path:
+                elif (
+                    self._use_ssh_agent
+                    and self._ssh_agent_manager
+                    and self._ssh_agent_manager.known_hosts_path
+                ):
                     # SSH agent authentication with known_hosts
                     ssh_cmd = [
                         "ssh",
@@ -2238,14 +3519,15 @@ class Orchestrator:
                     cwd=self.workspace,
                     env=self._ssh_env(),
                 )
-                log.info(
+                log.debug(
                     "Successfully added back-reference comment for %s: %s",
                     csha,
                     message,
                 )
             except CommandError as exc:
                 log.warning(
-                    "Failed to add back-reference comment for %s (non-fatal): %s",
+                    "Failed to add back-reference comment for %s "
+                    "(non-fatal): %s",
                     csha,
                     exc,
                 )
@@ -2261,11 +3543,14 @@ class Orchestrator:
                 # Continue processing - this is not a fatal error
             except Exception as exc:
                 log.warning(
-                    "Failed to add back-reference comment for %s (non-fatal): %s",
+                    "Failed to add back-reference comment for %s "
+                    "(non-fatal): %s",
                     csha,
                     exc,
                 )
-                log.debug("Back-reference comment failure details:", exc_info=True)
+                log.debug(
+                    "Back-reference comment failure details:", exc_info=True
+                )
                 # Continue processing - this is not a fatal error
 
     def _comment_on_pull_request(
@@ -2277,9 +3562,12 @@ class Orchestrator:
         """Post a comment on the PR with the Gerrit change URL(s)."""
         # Respect CI_TESTING: do not attempt to update the source/origin PR
         if os.getenv("CI_TESTING", "").strip().lower() in ("1", "true", "yes"):
-            log.debug("Source/origin pull request will NOT be updated with Gerrit change when CI_TESTING set true")
+            log.debug(
+                "Source/origin pull request will NOT be updated with Gerrit "
+                "change when CI_TESTING set true"
+            )
             return
-        log.info("Adding reference comment on PR #%s", gh.pr_number)
+        log.debug("Adding reference comment on PR #%s", gh.pr_number)
         if not gh.pr_number:
             return
         urls = result.change_urls or []
@@ -2287,7 +3575,10 @@ class Orchestrator:
         # Create centralized URL builder for organization link
         url_builder = create_gerrit_url_builder(gerrit.host)
         org_url = url_builder.web_url()
-        text = f"The pull-request PR-{gh.pr_number} is submitted to Gerrit [{org}]({org_url})!\n\n"
+        text = (
+            f"The pull-request PR-{gh.pr_number} is submitted to Gerrit "
+            f"[{org}]({org_url})!\n\n"
+        )
         if urls:
             text += "To follow up on the change visit:\n\n" + "\n".join(urls)
         try:
@@ -2357,24 +3648,29 @@ class Orchestrator:
         """
         import socket
 
-        log.info("Dry-run: starting preflight checks")
+        log.debug("Dry-run: starting preflight checks")
         if os.getenv("G2G_DRYRUN_DISABLE_NETWORK", "").strip().lower() in (
             "1",
             "true",
             "yes",
             "on",
         ):
-            log.info("Dry-run: network checks disabled (G2G_DRYRUN_DISABLE_NETWORK)")
-            log.info(
-                "Dry-run targets: Gerrit project=%s branch=%s topic_prefix=GH-%s",
+            log.debug(
+                "Dry-run: network checks disabled (G2G_DRYRUN_DISABLE_NETWORK)"
+            )
+            log.debug(
+                "Dry-run targets: Gerrit project=%s branch=%s "
+                "topic_prefix=GH-%s",
                 repo.project_gerrit,
                 self._resolve_target_branch(),
                 repo.project_github,
             )
             if inputs.reviewers_email:
-                log.info("Reviewers (from inputs/config): %s", inputs.reviewers_email)
+                log.debug(
+                    "Reviewers (from inputs/config): %s", inputs.reviewers_email
+                )
             elif os.getenv("REVIEWERS_EMAIL"):
-                log.info(
+                log.debug(
                     "Reviewers (from environment): %s",
                     os.getenv("REVIEWERS_EMAIL"),
                 )
@@ -2383,16 +3679,20 @@ class Orchestrator:
         # DNS resolution for Gerrit host
         try:
             socket.getaddrinfo(gerrit.host, None)
-            log.info("DNS resolution for Gerrit host '%s' succeeded", gerrit.host)
+            log.debug(
+                "DNS resolution for Gerrit host '%s' succeeded", gerrit.host
+            )
         except Exception as exc:
             msg = "DNS resolution failed"
             raise OrchestratorError(msg) from exc
 
         # SSH (TCP) reachability on Gerrit port
         try:
-            with socket.create_connection((gerrit.host, gerrit.port), timeout=5):
+            with socket.create_connection(
+                (gerrit.host, gerrit.port), timeout=5
+            ):
                 pass
-            log.info(
+            log.debug(
                 "SSH TCP connectivity to %s:%s verified",
                 gerrit.host,
                 gerrit.port,
@@ -2403,7 +3703,10 @@ class Orchestrator:
 
         # Gerrit REST reachability and optional auth check
         base_path = os.getenv("GERRIT_HTTP_BASE_PATH", "").strip().strip("/")
-        http_user = os.getenv("GERRIT_HTTP_USER", "").strip() or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
+        http_user = (
+            os.getenv("GERRIT_HTTP_USER", "").strip()
+            or os.getenv("GERRIT_SSH_USER_G2G", "").strip()
+        )
         http_pass = os.getenv("GERRIT_HTTP_PASSWORD", "").strip()
         self._verify_gerrit_rest(gerrit.host, base_path, http_user, http_pass)
 
@@ -2413,10 +3716,12 @@ class Orchestrator:
             repo_obj = get_repo_from_env(client)
             if gh.pr_number is not None:
                 pr_obj = get_pull(repo_obj, gh.pr_number)
-                log.info("GitHub PR #%s metadata loaded successfully", gh.pr_number)
+                log.debug(
+                    "GitHub PR #%s metadata loaded successfully", gh.pr_number
+                )
                 try:
                     title, _ = get_pr_title_body(pr_obj)
-                    log.info("GitHub PR title: %s", title)
+                    log.debug("GitHub PR title: %s", title)
                 except Exception as exc:
                     log.debug("Failed to read PR title: %s", exc)
             else:
@@ -2432,16 +3737,20 @@ class Orchestrator:
             raise OrchestratorError(msg) from exc
 
         # Log effective targets
-        log.info(
+        log.debug(
             "Dry-run targets: Gerrit project=%s branch=%s topic_prefix=GH-%s",
             repo.project_gerrit,
             self._resolve_target_branch(),
             repo.project_github,
         )
         if inputs.reviewers_email:
-            log.info("Reviewers (from inputs/config): %s", inputs.reviewers_email)
+            log.debug(
+                "Reviewers (from inputs/config): %s", inputs.reviewers_email
+            )
         elif os.getenv("REVIEWERS_EMAIL"):
-            log.info("Reviewers (from environment): %s", os.getenv("REVIEWERS_EMAIL"))
+            log.info(
+                "Reviewers (from environment): %s", os.getenv("REVIEWERS_EMAIL")
+            )
 
     def _verify_gerrit_rest(
         self,
@@ -2452,41 +3761,36 @@ class Orchestrator:
     ) -> None:
         """Probe Gerrit REST endpoint with optional auth.
 
-        Uses the centralized URL builder to construct the API endpoint
-        for consistent URL handling across the application.
+        Uses the centralized gerrit_rest client to ensure proper base path
+        handling and consistent API interactions.
         """
+        from .gerrit_rest import build_client_for_host
 
-        def _build_client(url: str) -> Any:
-            if http_user and http_pass:
-                if GerritRestAPI is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_MISSING)
-                if HTTPBasicAuth is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_AUTH_MISSING)
-                return GerritRestAPI(url=url, auth=HTTPBasicAuth(http_user, http_pass))
-            else:
-                if GerritRestAPI is None:
-                    raise OrchestratorError(_MSG_PYGERRIT2_MISSING)
-                return GerritRestAPI(url=url)
+        try:
+            # Use centralized client builder that handles base path correctly
+            client = build_client_for_host(
+                host,
+                timeout=8.0,
+                max_attempts=3,
+                http_user=http_user,
+                http_password=http_pass,
+            )
 
-        def _probe(url: str) -> None:
-            rest: Any = _build_client(url)
+            # Test connectivity with appropriate endpoint
             if http_user and http_pass:
-                _ = rest.get("/accounts/self")
-                log.info(
+                _ = client.get("/accounts/self")
+                log.debug(
                     "Gerrit REST authenticated access verified for user '%s'",
                     http_user,
                 )
             else:
-                _ = rest.get("/dashboard/self")
-                log.info("Gerrit REST endpoint reachable (unauthenticated)")
+                _ = client.get("/dashboard/self")
+                log.debug("Gerrit REST endpoint reachable (unauthenticated)")
 
-        # Create centralized URL builder for REST probing
-        url_builder = create_gerrit_url_builder(host, base_path)
-        api_url = url_builder.api_url()
-
-        try:
-            _probe(api_url)
         except Exception as exc:
+            # Use centralized URL builder for consistent error reporting
+            url_builder = create_gerrit_url_builder(host, base_path)
+            api_url = url_builder.api_url()
             log.warning("Gerrit REST probe failed for %s: %s", api_url, exc)
 
     # ---------------