@@ -41,6 +41,11 @@ import {
   type PrCheck,
 } from '../lib/merge';
 
+/** State root: honor GSTACK_HOME like every other gstack state tool. */
+function gstackHome(): string {
+  return process.env.GSTACK_HOME || join(homedir(), '.gstack');
+}
+
 // --- arg parsing --------------------------------------------------------
 
 function parseArgs(argv: string[]): { cmd: string; flags: Record<string, string>; bools: Set<string> } {
@@ -249,7 +254,7 @@ function submitViaRest(pr: number, base: string, priority?: string): { code: num
 
 /** Write last-enqueue.json — a queued marker (no merge SHA yet). */
 function writeEnqueueState(slug: string, pr: number, repo: string, regime: Regime, base: string): string {
-  const dir = join(homedir(), '.gstack', 'projects', slug);
+  const dir = join(gstackHome(), 'projects', slug);
   mkdirSync(dir, { recursive: true });
   const dest = join(dir, 'last-enqueue.json');
   const tmp = `${dest}.${process.pid}.tmp`;
@@ -408,6 +413,30 @@ async function cmdWait(flags: Record<string, string>): Promise<number> {
   return 1;
 }
 
+/**
+ * Rebase merges rewrite the PR head commit onto base with the same patch
+ * content but a new SHA. Find that commit among the newest base commits by
+ * patch-id. Returns null unless exactly one recent commit matches.
+ */
+function resolveRebasedSha(base: string, headRefOid: string): string | null {
+  if (!/^[0-9a-f]{7,40}$/i.test(headRefOid)) return null;
+  if (!/^[\w./-]+$/.test(base)) return null;
+  const patchIdOf = (rev: string): string => {
+    const r = spawnSync('bash', ['-c', `git show "$1" | git patch-id --stable`, '--', rev], {
+      encoding: 'utf-8',
+      timeout: 60000,
+    });
+    return ((r.stdout || '').trim().split(' ')[0]) || '';
+  };
+  const want = patchIdOf(headRefOid);
+  if (!want) return null;
+  const commits = run('git', ['rev-list', '--max-count=50', `origin/${base}`]).stdout
+    .split('\n')
+    .filter(Boolean);
+  const matches = commits.filter((c) => patchIdOf(c) === want);
+  return matches.length === 1 ? matches[0] : null;
+}
+
 async function cmdWriteState(flags: Record<string, string>): Promise<number> {
   const pr = flags.pr;
   const base = flags.base;
@@ -442,16 +471,26 @@ async function cmdWriteState(flags: Record<string, string>): Promise<number> {
 
   let sha = oid || '';
   let shaNote = '';
+  let shaExact = true;
   if (!sha) {
-    // rebase-null edge: use the base tip as the best available revert target.
-    const tip = run('git', ['rev-parse', `origin/${base}`]).stdout;
-    sha = tip;
-    shaNote = ' (no mergeCommit.oid — using base tip; rebase-merge repo)';
+    // rebase-null edge: the PR's commits were rewritten onto base. Resolve the
+    // rebased commit by patch-id; the base tip is NOT this PR's commit (later
+    // pushes may already be on base) so it is only an inexact last resort.
+    const resolved = resolveRebasedSha(base, headRefOid);
+    if (resolved) {
+      sha = resolved;
+      shaNote = ' (no mergeCommit.oid — rebased commit resolved by patch-id)';
+    } else {
+      sha = run('git', ['rev-parse', `origin/${base}`]).stdout;
+      shaExact = false;
+      shaNote = ' (no mergeCommit.oid — base tip, INEXACT: do not deploy-match or revert by this SHA)';
+    }
   }
 
   const state2 = buildLandState({
     pr: Number(pr),
     sha,
+    sha_exact: shaExact,
     headRefOid,
     base,
     head_branch: v.headRefName || '',
@@ -460,7 +499,7 @@ async function cmdWriteState(flags: Record<string, string>): Promise<number> {
     ts: new Date().toISOString(),
   });
 
-  const dir = join(homedir(), '.gstack', 'projects', slug);
+  const dir = join(gstackHome(), 'projects', slug);
   mkdirSync(dir, { recursive: true });
   const dest = join(dir, 'last-land.json');
   const tmp = `${dest}.${process.pid}.tmp`;
@@ -477,7 +516,7 @@ function cmdReadState(flags: Record<string, string>, bools: Set<string>): number
   const pr = flags.pr;
   const repo = flags.repo;
   if (!slug || !pr || !repo) { process.stderr.write('read-state: --slug, --pr, --repo are required\n'); return 2; }
-  const dest = join(homedir(), '.gstack', 'projects', slug, 'last-land.json');
+  const dest = join(gstackHome(), 'projects', slug, 'last-land.json');
   let state: any = null;
   if (existsSync(dest)) {
     try { state = JSON.parse(readFileSync(dest, 'utf-8')); } catch { state = null; }
@@ -494,7 +533,7 @@ function cmdReadState(flags: Record<string, string>, bools: Set<string>): number
   if (bools.has('json')) {
     process.stdout.write(JSON.stringify(state) + '\n');
   } else {
-    process.stdout.write(`LAND_SHA=${state.sha}\nLAND_BASE=${state.base}\nLAND_REGIME=${state.regime}\nLAND_HEAD=${state.head_branch}\n`);
+    process.stdout.write(`LAND_SHA=${state.sha}\nLAND_SHA_EXACT=${state.sha_exact === false ? 0 : 1}\nLAND_BASE=${state.base}\nLAND_REGIME=${state.regime}\nLAND_HEAD=${state.head_branch}\n`);
   }
   return 0;
 }
 
@@ -1237,9 +1237,12 @@ REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null)
 - **`READ_STATE_INVALID=...`** (no / stale / wrong-PR / wrong-repo handoff): **STOP.**
   "I couldn't confirm this PR actually landed (no valid landing record). I won't deploy
   off an unconfirmed merge. Re-run `/land` and check why it didn't complete."
-- **`LAND_SHA=... LAND_BASE=... LAND_REGIME=... LAND_HEAD=...`**: capture these. `LAND_SHA`
-  is the merge commit on the base branch — every deploy-workflow match and any revert
-  uses it.
+- **`LAND_SHA=... LAND_SHA_EXACT=... LAND_BASE=... LAND_REGIME=... LAND_HEAD=...`**: capture
+  these. `LAND_SHA` is the merge commit on the base branch — every deploy-workflow match and
+  any revert uses it. **If `LAND_SHA_EXACT=0`** the SHA is only the base tip at landing time
+  (rebase merge whose exact commit couldn't be resolved): still verify ancestry in 2.2, but do
+  NOT match deploy workflows by this SHA (match by workflow name + timing instead) and do NOT
+  offer a SHA-based revert — tell the user to identify the PR's commit manually first.
 
 ### 2.2: Verify the SHA is really on the base branch (H2)
 
@@ -1513,6 +1516,9 @@ If the user chose to revert at any point:
 Tell the user: "Reverting the merge now. This will create a new commit that undoes all the changes from this PR. The previous version of your site will be restored once the revert deploys."
 
 Use `LAND_SHA` (the confirmed merge commit from Step 2) as the revert target.
+**If `LAND_SHA_EXACT=0`: STOP first** — the recorded SHA is only the base tip at landing
+time and may belong to a different change. Show the user `git log origin/<base> --oneline -10`,
+have them confirm which commit is this PR's, and revert that commit instead.
 
 **Merge-queue / protected branches first (H8).** If `LAND_REGIME` is `github` or `trunk`,
 a direct push to the base branch is almost always blocked by branch protection, so go
 
@@ -338,9 +338,12 @@ REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner 2>/dev/null)
 - **`READ_STATE_INVALID=...`** (no / stale / wrong-PR / wrong-repo handoff): **STOP.**
   "I couldn't confirm this PR actually landed (no valid landing record). I won't deploy
   off an unconfirmed merge. Re-run `/land` and check why it didn't complete."
-- **`LAND_SHA=... LAND_BASE=... LAND_REGIME=... LAND_HEAD=...`**: capture these. `LAND_SHA`
-  is the merge commit on the base branch — every deploy-workflow match and any revert
-  uses it.
+- **`LAND_SHA=... LAND_SHA_EXACT=... LAND_BASE=... LAND_REGIME=... LAND_HEAD=...`**: capture
+  these. `LAND_SHA` is the merge commit on the base branch — every deploy-workflow match and
+  any revert uses it. **If `LAND_SHA_EXACT=0`** the SHA is only the base tip at landing time
+  (rebase merge whose exact commit couldn't be resolved): still verify ancestry in 2.2, but do
+  NOT match deploy workflows by this SHA (match by workflow name + timing instead) and do NOT
+  offer a SHA-based revert — tell the user to identify the PR's commit manually first.
 
 ### 2.2: Verify the SHA is really on the base branch (H2)
 
@@ -581,6 +584,9 @@ If the user chose to revert at any point:
 Tell the user: "Reverting the merge now. This will create a new commit that undoes all the changes from this PR. The previous version of your site will be restored once the revert deploys."
 
 Use `LAND_SHA` (the confirmed merge commit from Step 2) as the revert target.
+**If `LAND_SHA_EXACT=0`: STOP first** — the recorded SHA is only the base tip at landing
+time and may belong to a different change. Show the user `git log origin/<base> --oneline -10`,
+have them confirm which commit is this PR's, and revert that commit instead.
 
 **Merge-queue / protected branches first (H8).** If `LAND_REGIME` is `github` or `trunk`,
 a direct push to the base branch is almost always blocked by branch protection, so go
 
@@ -228,6 +228,13 @@ export interface LandState {
   schema_version: number;
   pr: number;
   sha: string;
+  /**
+   * False when the merge SHA could not be resolved exactly (rebase merge with
+   * no mergeCommit.oid and no unique patch-id match) and `sha` is only the
+   * base tip at landing time. Consumers must not deploy-match or revert by an
+   * inexact SHA. Absent means exact (pre-field states).
+   */
+  sha_exact?: boolean;
   headRefOid: string;
   base: string;
   head_branch: string;
@@ -239,6 +246,8 @@ export interface LandState {
 export interface BuildLandStateInput {
   pr: number;
   sha: string;
+  /** See LandState.sha_exact. Defaults to true. */
+  sha_exact?: boolean;
   headRefOid: string;
   base: string;
   head_branch: string;
@@ -257,6 +266,7 @@ export function buildLandState(input: BuildLandStateInput): LandState {
     schema_version: LAND_STATE_SCHEMA_VERSION,
     pr: input.pr,
     sha: input.sha,
+    sha_exact: input.sha_exact !== false,
     headRefOid: input.headRefOid,
     base: input.base,
     head_branch: input.head_branch,
 
@@ -208,6 +208,11 @@ describe('buildLandState', () => {
   test('refuses to build with an empty SHA (handoff would silently kill revert)', () => {
     expect(() => buildLandState({ ...base, sha: '' })).toThrow(/empty merge SHA/);
   });
+
+  test('sha_exact defaults true and false survives the round trip', () => {
+    expect(buildLandState(base).sha_exact).toBe(true);
+    expect(buildLandState({ ...base, sha_exact: false }).sha_exact).toBe(false);
+  });
 });
 
 describe('validateConsume', () => {