Land tested merge-train batches through one protected PR

[shiny-code-app]

Strict up-to-date protection made the second source PR stale after the first source PR merged, despite a tested combined candidate. Multi-entry merge batches now create one PR for the exact candidate and land it once through the normal protected merge endpoint. Each source PR keeps a separate admission and outcome. Completion requires provider-confirmed indirect merging, exact source heads, Git ancestry, and the tested tree. This implements the owner-approved decision in #2518.

The controller reconciles interrupted effects before dispatch, preflights all members before writing admissions, waits briefly for GitHub readback, and retires obsolete generated PRs without changing source PRs or branches. Edited generated PRs, failed checks, changed members, and policy changes can recover through normal replanning. Old records retain their hashes. Managed feedback links each constituent to the protected batch PR. A manual merge without a preceding admission remains an explicit reconciliation boundary; the generated PR states that it must be landed by the controller.

Validation at 87c9bde1:

• All 3,621 local unittest targets passed after the final fixes; 165 focused regressions include real admission/storage, interrupted landing, blocked-member preflight, and policy retirement.
• Ruff, formatting, and mypy pass. Generated contracts and frontend validation passed; later edits do not change those schemas or UI files.
• Two independent Anthropic claude-opus-5-5 reviews completed. Lifecycle findings were fixed and regression-tested; deliberate reconciliation boundaries and the rejected blanket GitHub BLOCKED precheck are explained in the review comments.
• IDE coverage was explicit: initial modified files, then each follow-up's edited files. The final five-file inspection is RED, with 28 findings: 19 on unchanged lines, seven internal adapter-method accesses, one deliberate test-double cast, and one strict boolean check. These remaining findings were reviewed as intentional; no suppression or profile change was made. This is not a blanket GREEN claim.
• All 33 source checks and all 32 candidate checks passed, with no blocking CodeQL alerts or external review comments. The supported LP controller merged the PR in workflow 36285072689.

Prerequisite #2519 is merged and deployed at 51701bac. After this implementation is landed and deployed, the genuine pair #2516/#2517 must still qualify #2494 through one controller landing pass, with persisted per-entry outcomes, managed feedback, and deployed-image verification. Merging this implementation alone does not close #2494.

Refs #2494, #2518.

Delivery: merged at 0de8d835ab3e9bd9accc2839c61a75a5caec86f7; post-merge CI, Security, CodeQL, and Deploy Launchplane succeeded. Live runtime readback matches the built image sha256:20cae5b52120d8f118094d319936c639d8741e59c208f68e62b69f813c788242. Landing trace launchplane_req_0bc91f88d97d44648da85ceeb359fad9, admission merge-admission-db53c7d5cc18f9540870eec4, outcome merge-landing-outcome-d78f300c3693a8a1093ecc1a; exact landing confirmed. Primary checkout refreshed cleanly to that landing.

[shiny-code-app]

Independent review by Anthropic claude-opus-5-5 found one high, three medium, and three low findings. Commit a9b817cd addresses the actionable lifecycle defects:

• Repository identity now uses the existing case-normalizing helper. The capitalization regression reproduced before the fix.
• Closed batch PRs and terminal failed checks retire the exact candidate and landing plan; member changes reflow normally without an operator reconciliation fence. Pending checks cannot mask a changed source head. Closed/pending-change regressions reproduced before the fix, and five HTTP controller scenarios now cover observation, failed checks, planning, landing, and supersession.
• Failure and supersession close only the exact bound unmerged batch PR, idempotently. Source PRs and branches stay intact. A merged or indeterminate batch effect cannot be retired as unused.
• Shared-effect diagnostics cover every unresolved member. Refusal guidance tells operators to refresh source PRs and rebuild the candidate.
• The review's real-storage test gap is covered by an interrupted shared merge through the real GuardedMergeAdmission, live evaluator fixture, and filesystem store: both immutable admissions persist, recovery records both landed outcomes, and the provider receives exactly one merge.

The low-severity permanently contradictory source-head case remains fail-closed and is documented: a confirmed batch merge is never discarded or called unused merely to release the train. An automatic override/disposition is outside the approved contract. Brief normal GitHub readback lag is handled with bounded read-only waits inside the landing pass; a test proves both entries complete in that pass after a delayed indirect-merge observation.

Validation after the fixes: 152 combined adapter/admission/controller tests and 51 final focused tests pass, with Ruff, formatting, and mypy clean. A full local suite, fresh hosted CI, and a focused second Anthropic review are running. Final IDE inspection remains pending; the earlier RED triage is retained, not relabeled GREEN. No ready label has been added.

[shiny-code-app]

Follow-up review by Anthropic claude-opus-5-5 identified three medium and three low lifecycle concerns. The final fixes are in c4fd8a6e, integrated onto deployed prerequisite 51701bac by 87c9bde1; the merge did not change the validated code tree (a2bdb0073aab24bbd991115e6c05c8d47c3da452).

• Retirement now identifies Launchplane's exact generated ref and repository, independently of mutable PR head/body/draft/base fields. Those edits remain merge blockers but no longer block closing an unused generated PR. Tests exercise all four drift cases. Closed history from another candidate SHA no longer prevents a rebuilt candidate from getting a new PR. Merged or unknown current effects remain fenced.
• Policy retirement closes generated PRs before superseding records, including pending candidates and planned landings when the policy changes from merge to squash. A real controller/provider/filesystem test proves both cases without source merges or new admissions.
• Batch preflight evaluates every member before writing the first admission. A real-store test runs a blocked second member twice and observes zero admissions, outcomes, or merge calls.
• Out-of-controller merges without a preceding admission, or after the prior attempt's conclusive rejection, remain an explicit reconciliation boundary. The generated PR and policy docs now state that boundary and tell operators to let the controller merge it. This does not invent retroactive admission evidence or add an operator override.
• A blanket mergeable_state=blocked precheck is declined: Report actionable merge refusals and preserve recovery certainty #2519's current GitHub metadata reported BLOCKED with all checks passing, yet its authorized LP merge succeeded at 51701bac. That aggregate flag is not a reliable substitute for the protected endpoint's decision. Positive behind evidence is still handled specifically, and actual refusals retain their structured diagnosis and trace.
• The remaining request for a fully integrated real-store test of the controller's provider checkpoint will be exercised by the required genuine two-entry service qualification. Existing tests cover persisted admissions/outcomes, shared-effect interruption, HTTP controller lifecycle, and exact adapter effects; no live completion is claimed yet.

All 165 combined regression tests pass, including six real-store admission/policy tests, with Ruff, formatting, and mypy clean. Final full local tests, hosted CI, and post-test IDE inspection are pending. This PR remains unqueued. No source PR, protection rule, credential, grant, or real Owner decision changed.

[cbusillo]

Launchplane completed the merge-train step for this pull request.

• Repository: cbusillo/launchplane
• Base branch: main
• Pull request: Land tested merge-train batches through one protected PR #2524
• Controller action: land_batch
• Controller record: merge-train-batch-landing-plan-20260927T011724Z-317c2f3c9e4cd0f1

Launchplane finished the merge-train step for this pull request.

Launchplane manages this comment and will update it as the train moves.