feat(lastcode): wait for PR gates in an Action

.agents/skills/_references/external-review-mechanics.md

@@ -125,8 +125,14 @@ Accept Codex as clean only when its result was produced after the latest relevan
 push, identifies the exact `headRefOid` (for a formal review, its `commit_id`
 matches), and gives an explicit no-issues result or terminal clean reaction. A
 generic review wrapper, silence, or absence of inline findings is insufficient by
-itself. After a push, request `@codex review` once unless a current request is
-already active.
+itself. After a push, request review once unless a current request is already
+active. Bind the request to the full current head SHA using exactly these two
+lines so resumable PR actions can distinguish it from an older request:
+
+```text
+@codex review
+<!-- lastcode-review-head: HEAD_SHA -->
+```
 
 Read all review threads with GraphQL pagination. `gh api --paginate` supplies the
 next `$endCursor`; keep `pageInfo` in the query so it cannot silently truncate at
@@ -181,9 +187,24 @@ gh api graphql \
   }'
 ```
 
+When a current-head finding exists only as a top-level issue comment or
+body-only formal review and the agent rejects it without pushing a fix, record
+that judgement with this exact single-line issue comment before relaunching
+`Wait for PR`. Use `comment:COMMENT_ID` for an issue comment or
+`review:REVIEW_ID` for a formal review, plus the full current head SHA:
+
+```text
+<!-- lastcode-review-handled: ARTIFACT_ID head: HEAD_SHA -->
+```
+
+The marker is unnecessary after a fix push because the new head invalidates the
+old finding, and unnecessary for inline findings because thread resolution is
+the durable handled state.
+
 Before merge, take a fresh snapshot and require all of these on the same head:
 
-- terminal-clean Codex result;
+- terminal-clean Codex result, or durable handled evidence for every exact-head
+  finding;
 - zero unresolved review threads, including outdated threads;
 - required checks and local validation are green;
 - mergeability is clean and the expected base SHA has not moved.

.agents/skills/lastcode-pr/SKILL.md

@@ -47,9 +47,13 @@ current GitHub thread and review-query mechanics.
 1. Inspect comments and thread-level review state newer than the latest push.
 2. Verify each bot finding against the source. Fix real defects; reply with a
    concrete reason when a finding is false. Resolve only addressed threads.
-3. Request `@codex review` after each fix push. Do not merge until Codex gives an
-   explicit clean result for the exact current head and no review thread remains
-   unresolved.
+   When rejecting a top-level issue-comment or body-only formal finding without
+   pushing a fix or resolving an inline thread, post the exact handled marker
+   documented in the external-review reference before relaunching `Wait for PR`.
+3. After each fix push, request review using the exact-head format in
+   `../_references/external-review-mechanics.md`. Do not merge until Codex gives
+   an explicit clean result or every finding for the exact current head has a
+   durable handled state, and no review thread remains unresolved.
 4. Run `pnpm lastcode:ci` from a clean branch. Its full-CI stamp must match the
    exact head and fetched `origin/lastcode/main` base.
 5. Use `pnpm lastcode:merge`; do not bypass the guarded merge in the GitHub UI.

apps/server/src/entrypoint.test.ts

@@ -53,7 +53,7 @@ describe("isEntrypoint", () => {
 
     expect(
       isEntrypoint({
-        moduleUrl: NodeURL.pathToFileURL(real).href,
+        moduleUrl: NodeURL.pathToFileURL(NodeFS.realpathSync(real)).href,
         entryPath: link,
         runtimeMain: undefined,
       }),

apps/server/src/vcs/GitVcsDriverCore.test.ts

@@ -1226,6 +1226,7 @@ it.layer(TestLayer)("GitVcsDriver core integration", (it) => {
         yield* git(remote, ["init", "--bare"]);
         yield* git(cwd, ["remote", "add", "origin", remote]);
         yield* git(cwd, ["push", "-u", "origin", initialBranch]);
+        yield* git(cwd, ["remote", "set-head", "origin", initialBranch]);
         yield* git(cwd, ["checkout", "-b", "feature/no-upstream"]);
         yield* writeTextFile(cwd, "feature.txt", "feature\n");
         yield* git(cwd, ["add", "feature.txt"]);
@@ -1549,8 +1550,8 @@ it.layer(TestLayer)("GitVcsDriver core integration", (it) => {
 
         // Two threads can record the same worktree path; the second delete
         // must be a no-op instead of exit 128.
-        yield* driver.removeWorktree({ cwd, path: worktreePath });
-        yield* driver.removeWorktree({ cwd, path: worktreePath });
+        yield* driver.removeWorktree({ cwd, path: worktreePath, allowMissing: true });
+        yield* driver.removeWorktree({ cwd, path: worktreePath, allowMissing: true });
       }),
     );
 
@@ -1576,6 +1577,7 @@ it.layer(TestLayer)("GitVcsDriver core integration", (it) => {
         yield* driver.removeWorktree({
           cwd,
           path: pathService.join(worktreesRoot, "never-registered"),
+          allowMissing: true,
         });
 
         const registered = yield* git(cwd, ["worktree", "list", "--porcelain"]);