[garrytan]

The first live train (gate.train-ac4baf961759-43d6ed28f2bf-9a1dbb, 5 PRs, GREEN) stopped at slot 2. Slot 1 (#3324) merged as v1.91.166.0, so main now carries that stamp in CHANGELOG, VERSION, package.json and the digest. Every later pin is unstamped and was cut from the train's base, so it conflicts with main on CHANGELOG.md. GitHub marks it dirty, runs no CI and can't squash it.

The lane's natural repair is to merge main into the pin and then stamp. That head's tree is exactly the slot's train prefix T modulo stamps: the tree the train gate covered, and what main becomes after the squash. But verify --train only accepted "pin plus stamps", so it refused that head with QUEUE_TRAIN_MOVED and froze the queue.

What changes

• lib/ship-queue-train-verify.ts: a slot head now passes when it's the pin plus stamps (unchanged) or T modulo stamps. The head: line says which, for example "T2 with main merged in, same modulo stamps (4 stamp file(s))". Anything else is still QUEUE_TRAIN_MOVED, with the same freeze behavior. The post-merge check (main = T) is unchanged, so what lands is still the gated tree.
• docs/ship-policy.md: the lane procedure for slot 2 onward:
  1. git merge --no-ff --no-commit origin/main;
  2. resolve the CHANGELOG with the existing mergeChangelogs;
  3. commit;
  4. gstack-restamp --next;
  5. commit the stamp files and push.
     A conflict outside CHANGELOG.md means stop and report.

Evidence from the live train.

• The probe head: in a scratch worktree, the pin of v1.91.167.0 fix(evals): plan-design focus and tpa pitch detectors accept the rewordings Opus 5.5 uses (GSTA-57) #3320 (1685dec) with main a3ed43c merged in (only CHANGELOG.md conflicted), mergeChangelogs, then gstack-restamp --next (1.91.167.0).
• Against the train's T2 (6b0a4c8): buildReceipt gives same-modulo-stamps, where CHANGELOG.md counts as a heading stamp and VERSION, package.json and the digest as stamps.
• Against main: the probe head contains main and merges into it cleanly.

Gate integrity. A new case in test/ship-queue-train.test.ts builds a lane head whose parents are the pin and the published main, with T2's tree stamped 1.2.5.0.

• That head verifies, with MERGE_CONDITION at it.
• The same head plus one file outside the train fails with QUEUE_TRAIN_MOVED.
• With the old verify, the positive case fails.

The existing verify, freeze and repair test passes unchanged.

Checks: both train verify tests pass, typecheck is clean, the module-size and spawnsync ratchets pass, and the remote free-tier pregate passed. The macOS and Windows lanes are cleared by this PR's CI.

Plan: GSTA-49. It's an urgent fix for the queue.

[trunk-io]

😎 This pull request was merged.