Support and verify merge-queue lifecycle

[mchwang]

PR #23 intentionally blocks guarded merging when an applicable GitHub ruleset contains merge_queue. gh pr merge can exit successfully after enqueueing while the pull request remains open, so treating command success as a completed merge is unsafe.

Add merge-queue lifecycle support before enabling this path:

• model queued separately from merged;
• keep the action disabled while queued;
• poll or subscribe until GitHub confirms MERGED or reports queue removal/failure;
• preserve the exact reviewed head and surface the terminal reason;
• add controlled regressions for enqueue success, delayed merge, queue removal, head replacement, and retry.

[mchwang]

K1 assignment (2026-09-24)

• Owner: Codex, current task
• Baseline: b181d152ed522cf0ea6179d0ab7f0b45b00a6a4f (origin/main)
• Branch: codex/merge-queue-k1
• Exact files: github/merge.ts, test/merge.test.ts
• Scope: K1 only — publish a read-only adapter contract and recorded fixtures for queued, removed, failed, and merged states. Do not enable merge queues, persist lifecycle state, add retries, or change runner/UI files; those remain K2/K3.
• Contract: every observation is bound to the expected pull request and reviewed head; queued is distinct from merged; terminal removal/failure preserves a reason; incomplete or ambiguous GitHub data fails closed.
• Done when: focused merge tests, full unit tests, typecheck, exact-head CI, and the review loop pass on a separate PR.

No file overlaps with the current D/E PRs were found.

[mchwang]

K2/K3 assignment and lifecycle contract (2026-09-24)

• Owner: Codex, this K-lane task
• Baseline: 13a7b308011c1ea5ef57ec974c5c338584538ec2 (origin/main)
• Branch: codex/merge-queue-k2-k3
• Exact owned files: runner/store.ts, runner/merge.ts, github/merge.ts, web/server.ts, web/public/app.js, test/store.test.ts, test/merge.test.ts, test/browser/review.spec.ts, and a K-specific implementation note under docs/implementation/. web/public/index.html/style.css will remain unchanged unless the acceptance UI cannot be expressed accessibly with the existing controls. No active F/G/H/I/J task or open PR owns these exact files; active D and H diffs are disjoint.
• Done when: npm test && npm run typecheck && npm run test:browser pass at the exact pushed head, including controlled regressions for enqueue success, delayed merge, queue removal, failure, head replacement, and retry.

Lifecycle and state holders:

• Durable SQLite attempt (authoritative): submitting -> queued -> merged | removed | failed. A retry creates a new attempt only from removed/failed, only while the same plan revision, snapshot, review version, and reviewed head remain current. merged is final. A replaced head is terminal for the old attempt and requires a freshly reviewed snapshot; it is never retryable from the old review.
• In-memory coordinator ownership: at most one enqueue or queue inspection mutates an attempt at a time. Each publication compares the opaque attempt ID and expected active state so an old poll cannot overwrite a retry or newer terminal result. Cancellation/shutdown retains ownership until the underlying GitHub call settles.
• GitHub subprocess/API: enqueue command success is persisted as queued, never merged. Queue observations alone move queued to confirmed merged, removed, or failed; terminal reasons are retained verbatim after validation. Transient/ambiguous observation errors fail closed and leave the durable attempt queued rather than inventing completion.
• HTTP/UI: the merge POST admits one enqueue/retry; a narrow merge-status GET polls only queue state and never rebuilds Git history. While submitting/queued the action stays disabled. Poll responses patch only merge state, preserving current selection, drafts, attachments, navigation, and scroll. Terminal removal/failure exposes the reason; retry is shown only when the captured review context is still exact.
• Shutdown: outer POST admission closes first; an admitted enqueue/inspection is aborted and awaited before Store close. A partially received request cannot cross the shutdown boundary.

Interface contract:

• K1 MergeQueueGateway.inspectQueue(reviewedHead) remains the only external queue observation boundary and every observation stays bound to the exact reviewed head.
• Store begin/transition operations are compare-and-swap on identity + attempt ID + legal source state and retain historical attempts.
• MergeCoordinator enables a merge-queue gate only when the gateway implements the K1 queue contract. Queue-based merging remains blocked for adapters without it.
• The browser receives a durable public lifecycle record plus whether the current exact review may start or retry; it never supplies SHAs, attempt IDs, or queue conclusions.