diff --git a/.github/workflows/label-pr-review-state.yml b/.github/workflows/label-pr-review-state.yml
index 459dcf50bd..302c8b1a1c 100644
--- a/.github/workflows/label-pr-review-state.yml
+++ b/.github/workflows/label-pr-review-state.yml
@@ -47,12 +47,15 @@ on:
 
 permissions:
     # This privileged workflow only reads PR/check metadata and writes issue labels,
-    # comments, and commit statuses. All unspecified permissions, including contents,
-    # are none; no fork code or configuration is checked out or executed.
+    # comments, and commit statuses. All unspecified permissions are none; contents is
+    # read-only and used only for the commit-parent lookup below. No fork code or
+    # configuration is checked out or executed.
     pull-requests: write
     issues: write
     checks: read
     statuses: write
+    # Reading a commit's parents is metadata only; no PR code is checked out or executed.
+    contents: read
 
 # Concurrency is keyed at two levels (issue #1707):
 #
@@ -100,6 +103,7 @@ jobs:
         runs-on: ubuntu-latest
         outputs:
             pr_numbers: ${{ steps.resolve.outputs.pr_numbers }}
+            open_pr_heads: ${{ steps.resolve.outputs.open_pr_heads }}
         env:
             # Mirrors the workflow-level concurrency group so the run's queueing
             # identity is visible in the logs (kept in sync by the workflow tests).
@@ -146,6 +150,7 @@ jobs:
                       // pull_request_review runs report the base repository as
                       // head_repository (issue #2133).
                       let prNumbers = [];
+                      let openPrsCache = null;
                       if (context.payload.pull_request?.number) {
                         prNumbers = [context.payload.pull_request.number];
                       } else if (context.eventName === 'issue_comment') {
@@ -178,14 +183,14 @@ jobs:
                           );
                         }
                       } else {
-                        const openPrs = await github.paginate(github.rest.pulls.list, {
+                        openPrsCache = await github.paginate(github.rest.pulls.list, {
                           owner, repo, state: 'open', per_page: 100,
                         });
                         // GitHub rejects matrices over 256 jobs, so the sweep pages the
                         // sorted open-PR list: consecutive runs rotate through
                         // fixed-size windows by run number, covering every open PR on a
                         // bounded cadence without ever exceeding the limit.
-                        const allNumbers = openPrs.map(pr => pr.number).sort((a, b) => a - b);
+                        const allNumbers = openPrsCache.map(pr => pr.number).sort((a, b) => a - b);
                         const sweepPageSize = 200;
                         const pageCount = Math.max(1, Math.ceil(allNumbers.length / sweepPageSize));
                         const page = context.runNumber % pageCount;
@@ -204,6 +209,48 @@ jobs:
                       );
                       core.setOutput('pr_numbers', JSON.stringify(prNumbers));
 
+                      // Build the open-PR head map once here for every shard: a sweep would otherwise
+                      // multiply the paginated open-PR read by every shard against the Actions token
+                      // budget. Sweep triggers already hold the full open list, so the map costs them
+                      // no extra read.
+                      //
+                      // The map describes which commits are open pull request heads. It can change when a
+                      // head is (re)published (opened, reopened, synchronize), and a labeled/unlabeled
+                      // run is included for a different reason: it shares this PR's concurrency group,
+                      // so it can replace a pending synchronize run for the same PR. A replacement run
+                      // that skipped the map would skip the stacked label for the new head and leave it
+                      // stale until the hourly sweep. Reviews, comments, workflow_run completions, and
+                      // manual dispatch cannot change it (and cannot displace a synchronize run in a way
+                      // that leaves the label stale), so they skip the paginated read entirely and pass
+                      // a sentinel that tells shards the label was not evaluated.
+                      //
+                      // An empty output means the map was unavailable this run; shards then skip the
+                      // stacked label rather than deciding from an empty map.
+                      // Every execution that targets a PR reads the map: reviews, comments, manual
+                      // dispatches and workflow_run completions share this PR's concurrency group with
+                      // synchronize runs, so a displaced synchronize leaves its stacked label stale unless
+                      // the replacement run evaluates it too. The sweep already holds the list in
+                      // `openPrsCache`, so its cost is unchanged.
+                      let openPrHeadsOutput = '';
+                      if (prNumbers.length > 0) {
+                        try {
+                          const openPrsForMap = openPrsCache ?? (await github.paginate(github.rest.pulls.list, {
+                            owner, repo, state: 'open', per_page: 100,
+                          }));
+                          const heads = {};
+                          for (const candidate of openPrsForMap) {
+                            if (candidate.head?.sha) heads[candidate.head.sha.toLowerCase()] = candidate.number;
+                          }
+                          // An open-PR list with no entries is anomalous (the reconciliation
+                          // target itself is open), so treat it like an unavailable map:
+                          // shards must not decide from a map that looks empty.
+                          if (Object.keys(heads).length > 0) openPrHeadsOutput = JSON.stringify(heads);
+                        } catch (error) {
+                          core.warning(`Could not read the open pull request map: ${error.message}; shards will skip the stacked label this run`);
+                        }
+                      }
+                      core.setOutput('open_pr_heads', openPrHeadsOutput);
+
     reconcile:
         name: Zoo Code / reconcile PR review state
         needs: resolve
@@ -245,6 +292,7 @@ jobs:
         runs-on: ubuntu-latest
         env:
             PR_NUMBER: ${{ matrix.pr_number }}
+            OPEN_PR_HEADS: ${{ needs.resolve.outputs.open_pr_heads }}
             # Mirrors this job's concurrency group so a superseded shard's queueing
             # identity is visible in the logs (kept in sync by the workflow tests).
             CONCURRENCY_GROUP: >-
@@ -307,6 +355,11 @@ jobs:
                           color: 'c2e0c6',
                           description: 'Fresh community approval on the current head; maintainer review still required',
                         },
+                        {
+                          name: 'stacked',
+                          color: 'c2c2c2',
+                          description: 'Head commit sits directly on another open PR head (detected from the commit graph)',
+                        },
                       ];
                       const guideMarker = '<!-- zoo-code-pr-review-process -->';
                       const codeRabbitLabelMarkerPrefix = '<!-- coderabbit-review-label:';
@@ -351,6 +404,7 @@ jobs:
                         return pr.head?.repo?.full_name && pr.head.repo.full_name !== pr.base?.repo?.full_name;
                       }
 
+                      const stackedLabel = 'stacked';
                       if (!isReadOnlyRun) {
                         // One paginated list keeps the per-shard API budget flat no matter
                         // how many labels are managed; per-label getLabel calls would
@@ -364,6 +418,14 @@ jobs:
                           try {
                             await github.rest.issues.createLabel({ owner, repo, ...label });
                           } catch (createError) {
+                            if (label.name === stackedLabel) {
+                              // stacked is only a reviewer filter, so a failed provisioning must not stop
+                              // reconciliation for every PR. Every other managed label still fails closed,
+                              // because reconciliation cannot work without it. A concurrent shard winning
+                              // the creation race lands the label anyway; the next sweep reconciles it.
+                              core.warning(`Could not create the ${stackedLabel} label: ${createError.message}; continuing without it`);
+                              continue;
+                            }
                             // Concurrent shards for other PRs can win the creation race.
                             // Tolerate only the duplicate-label payload; any other 422
                             // must fail the shard.
@@ -431,6 +493,49 @@ jobs:
                         }
                       }
 
+                      // A stacked unit is detected from the commit graph: its head commit has exactly one
+                      // parent, and that parent is another open PR's head. The label describes that detected
+                      // relationship only -- it does not claim the PR targets the branch below it, which is
+                      // how GitHub describes a focused stacked diff. Reviewers filter on this label to tell a
+                      // unit apart from a standalone PR. It is orthogonal to the review-state labels, so it is
+                      // reconciled separately and never removed by reconcileLabels.
+
+                      async function reconcileStackedLabel(pr, openPrHeads) {
+                        if (openPrHeads === null) {
+                          // The map could not be read this run; leave the label as it is rather than
+                          // deciding from an empty map.
+                          return;
+                        }
+                        if (isReadOnlyRun && isForkPR(pr)) {
+                          core.info(`PR #${pr.number}: fork PR on a read-only run — skipping the stacked label`);
+                          return;
+                        }
+                        try {
+                          const { data: commit } = await github.rest.git.getCommit({ owner, repo, commit_sha: pr.head.sha });
+                          const parents = Array.isArray(commit.parents) ? commit.parents : [];
+                          const matchedPr = parents.length === 1
+                            ? openPrHeads.get(String(parents[0].sha).toLowerCase())
+                            : undefined;
+                          // The open-PR map can predate a push to this PR: its own previous (or now
+                          // base) head resolves back to this PR. That is not a parent PR, and it is
+                          // also not evidence that an existing stacked label is stale - leave every
+                          // stacked-label mutation untouched for this ambiguous self-match.
+                          if (matchedPr === pr.number) return;
+                          const parentPr = matchedPr;
+                          const hasLabel = pr.labels.some(label => label.name === stackedLabel);
+                          if (hasLabel && parentPr === undefined) {
+                            await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: stackedLabel });
+                            pr.labels = pr.labels.filter(label => label.name !== stackedLabel);
+                          } else if (parentPr && !hasLabel) {
+                            await github.rest.issues.addLabels({ owner, repo, issue_number: pr.number, labels: [stackedLabel] });
+                            pr.labels = pr.labels.concat([{ name: stackedLabel }]);
+                            core.info(`PR #${pr.number}: stacked on #${parentPr}`);
+                          }
+                        } catch (error) {
+                          core.warning(`PR #${pr.number}: could not reconcile the stacked label: ${error.message}`);
+
+                        }
+                      }
                       // Reconciles the independent has-conflicts flag (issue #2089).
                       // `present` is a mergeability fact, so callers pass a known read
                       // only: true for a known dirty read, false for a known read that
@@ -764,8 +869,34 @@ jobs:
 
                       const failures = [];
 
+                      // The open-PR head map is built once in the resolve job and passed through the
+                      // job env, so a sweep pays one paginated read instead of one per shard. The resolve
+                      // job passes NOT_EVALUATED_MAP when the event could not change a stacked
+                      // relationship, and an empty value when it tried to read the map and failed.
+                      // Either way existing stacked labels are left as they are: a map that is absent,
+                      // empty, or not read must never look like "no open parents" and remove them.
+                      const NOT_EVALUATED_MAP = 'not-evaluated';
+                      let openPrHeads = null;
+                      if (prs.length > 0) {
+                        const emittedMap = process.env.OPEN_PR_HEADS;
+                        if (emittedMap === NOT_EVALUATED_MAP) {
+                          core.info(
+                            `PR #${prs[0].number}: this event cannot change a stacked unit; skipping the stacked label`
+                          );
+                        } else if (emittedMap) {
+                          try {
+                            openPrHeads = new Map(Object.entries(JSON.parse(emittedMap)));
+                          } catch (error) {
+                            core.warning(`Could not read the open pull request map: ${error.message}; skipping the stacked label for this run`);
+                          }
+                        } else {
+                          core.warning('Could not read the open pull request map: the resolve job provided none; skipping the stacked label for this run');
+                        }
+                      }
+
                       for (const pr of prs) {
                         let failurePhase = 'ci-pending';
+                        await reconcileStackedLabel(pr, openPrHeads);
                         try {
                           // The matrix job reports one check per shard named
                           // "<reconciliationCheckName> (<pr_number>)", so catch both the
diff --git a/src/services/__tests__/pr-review-state-workflow.test.ts b/src/services/__tests__/pr-review-state-workflow.test.ts
index af8ad70f3d..4529215688 100644
--- a/src/services/__tests__/pr-review-state-workflow.test.ts
+++ b/src/services/__tests__/pr-review-state-workflow.test.ts
@@ -37,6 +37,9 @@ interface HarnessOptions {
 	headShaSequence?: string[]
 	fork?: boolean
 	eventName?: string
+	// pull_request_target activity type; it decides whether the resolve job reads the open-PR
+	// head map (only opened/reopened/synchronize can change a stacked relationship).
+	action?: string
 	issueCommentActor?: string
 	workflowRunAssociated?: boolean
 	workflowRunFallback?: "match" | "sha-mismatch" | "base-mismatch" | "none"
@@ -57,6 +60,7 @@ interface HarnessOptions {
 	addLabelsFailOnceName?: string
 	labelLookupStatus?: number
 	createLabelStatus?: number
+	createLabelFailOnceName?: string
 	createLabelErrors?: Array<{ code: string; field: string }>
 	existingRepoLabels?: string[]
 	listCommentsErrorStatus?: number
@@ -83,6 +87,12 @@ interface HarnessOptions {
 	timelineErrorStatus?: number
 	permissions?: Record<string, string>
 	permissionErrors?: Record<string, number>
+	commitParents?: string[]
+	getCommitErrorStatus?: number
+	openPrHeads?: Array<{ number: number; sha: string }>
+	openPrHeadsError?: boolean
+	openPrHeadsEnv?: string
+	emptyOpenList?: boolean
 	permissionErrorStatus?: number
 	requiredContexts?: string[]
 	requiredIntegrationId?: number | null
@@ -143,6 +153,9 @@ type HarnessPr = ReturnType<typeof buildHarnessPr>
 
 function createListPullRequests(options: HarnessOptions, eventName: string, pr: HarnessPr) {
 	return vi.fn(async ({ state }: { state?: string }) => {
+		if (state === "open" && options.openPrHeadsError)
+			throw Object.assign(new Error("Bad credentials"), { status: 401 })
+		if (state === "open" && options.emptyOpenList) return []
 		if (state === "open" && options.prState === "closed") return []
 		if (eventName === "workflow_run" && options.workflowRunAssociated === false) {
 			if (options.workflowRunFallback === "none" || options.workflowRunFallback === undefined) return []
@@ -156,7 +169,7 @@ function createListPullRequests(options: HarnessOptions, eventName: string, pr:
 		if (options.openPrNumbers) {
 			return options.openPrNumbers.map((number) => ({ ...pr, number }))
 		}
-		return [pr]
+		return [pr, ...(options.openPrHeads ?? []).map((entry) => ({ number: entry.number, head: { sha: entry.sha } }))]
 	})
 }
 
@@ -201,7 +214,7 @@ function buildEventPayload(eventName: string, options: HarnessOptions) {
 							},
 						}
 					: {
-							action: "ready_for_review",
+							action: options.action ?? "ready_for_review",
 							pull_request: pullRequestPayload,
 						}
 }
@@ -364,7 +377,16 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 			return { data: args }
 		},
 	)
-	const createLabel = vi.fn(async (_args: unknown) => {
+	let createdOnce = false
+	const createLabel = vi.fn(async (args: unknown) => {
+		if (
+			options.createLabelFailOnceName &&
+			(args as { name: string }).name === options.createLabelFailOnceName &&
+			!createdOnce
+		) {
+			createdOnce = true
+			throw Object.assign(new Error("Create label failed once"), { status: 500 })
+		}
 		if (options.createLabelStatus) {
 			throw Object.assign(new Error("Create label failed"), {
 				status: options.createLabelStatus,
@@ -386,6 +408,12 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 		return { data: { permission } }
 	})
 	const listPullRequests = createListPullRequests(options, eventName, pr)
+	const getCommit = vi.fn(async () => {
+		if (options.getCommitErrorStatus) {
+			throw Object.assign(new Error("Commit lookup failed"), { status: options.getCommitErrorStatus })
+		}
+		return { data: { parents: (options.commitParents ?? []).map((sha) => ({ sha })) } }
+	})
 	let pullRequestGetIndex = 0
 	const getPullRequest = vi.fn(async () => {
 		const index = pullRequestGetIndex++
@@ -453,6 +481,9 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 				createComment,
 				updateComment,
 			},
+			git: {
+				getCommit,
+			},
 			checks: {
 				listForRef: vi.fn(async () => checkRuns),
 			},
@@ -513,9 +544,16 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 		prNumber: process.env.PR_NUMBER,
 		group: process.env.CONCURRENCY_GROUP,
 		mergeabilityRetryDelayMs: process.env.MERGEABILITY_RETRY_DELAY_MS,
+		openPrHeads: process.env.OPEN_PR_HEADS,
 	}
 	process.env.PR_NUMBER = String(pr.number)
 	process.env.CONCURRENCY_GROUP = `label-pr-review-state-reconcile-${pr.number}`
+	// The resolve job builds the open-PR head map once and passes it to shards through
+	// the job env; the harness mirrors that contract. openPrHeadsError simulates a
+	// resolve-side lookup failure, which reaches shards as an empty value.
+	const headMap: Record<string, number> = { [SHA.toLowerCase()]: pr.number }
+	for (const entry of options.openPrHeads ?? []) headMap[entry.sha.toLowerCase()] = entry.number
+	process.env.OPEN_PR_HEADS = options.openPrHeadsError ? "" : (options.openPrHeadsEnv ?? JSON.stringify(headMap))
 	// The workflow waits 5s between mergeability retries in production; tests
 	// override the delay so the retries run without real waits.
 	if (options.productionMergeabilityDelay) {
@@ -530,6 +568,7 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 			["PR_NUMBER", previousEnv.prNumber],
 			["CONCURRENCY_GROUP", previousEnv.group],
 			["MERGEABILITY_RETRY_DELAY_MS", previousEnv.mergeabilityRetryDelayMs],
+			["OPEN_PR_HEADS", previousEnv.openPrHeads],
 		] as const) {
 			if (value === undefined) {
 				delete process.env[key]
@@ -556,6 +595,7 @@ function buildReconcileHarness(options: HarnessOptions = {}) {
 		warning: core.warning,
 		getPullRequest,
 		listPullRequests: github.rest.pulls.list,
+		getCommit,
 		listCommitStatusesForRef: github.rest.repos.listCommitStatusesForRef,
 		permissionFor,
 	}
@@ -620,12 +660,17 @@ async function runResolve(options: HarnessOptions = {}) {
 	}
 
 	const prNumbersOutput = setOutput.mock.calls.find(([name]) => name === "pr_numbers")?.[1] as string | undefined
+	const openPrHeadsOutput = setOutput.mock.calls.find(([name]) => name === "open_pr_heads")?.[1] as string | undefined
 	return {
 		setOutput,
 		listPullRequests,
 		getPullRequest,
 		info: core.info,
+		warning: core.warning,
 		prNumbers: () => (prNumbersOutput !== undefined ? (JSON.parse(prNumbersOutput) as number[]) : undefined),
+		// The sentinel is deliberately not JSON: pin the exact emitted value instead of guessing.
+		openPrHeadsRaw: () => openPrHeadsOutput,
+		openPrHeads: () => (openPrHeadsOutput ? (JSON.parse(openPrHeadsOutput) as Record<string, number>) : null),
 	}
 }
 
@@ -655,6 +700,7 @@ describe("PR review-state workflow", () => {
 			issues: "write",
 			checks: "read",
 			statuses: "write",
+			contents: "read",
 		})
 		expect(JSON.stringify(workflow.jobs.reconcile.steps)).not.toMatch(/actions\/checkout|\bpnpm\b|\bnpm\b/)
 		expect(workflowScript).not.toContain("@coderabbitai")
@@ -689,6 +735,262 @@ describe("PR review-state workflow", () => {
 		expect(result.createCommitStatus).toHaveBeenCalled()
 	})
 
+	it("labels a stacked unit from its head commit's parent", async () => {
+		const result = await runWorkflow({
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		// The relationship is read from the PR head commit, so the lookup must target it.
+		expect(result.getCommit).toHaveBeenCalledWith(expect.objectContaining({ commit_sha: SHA }))
+		expect(result.warning).not.toHaveBeenCalled()
+	})
+
+	it("does not label a PR stacked when the matched open head is its own", async () => {
+		const result = await runWorkflow({
+			commitParents: [OLD_SHA],
+			// The open-PR map predates this PR's latest push: its own previous head is listed.
+			openPrHeads: [{ number: 1437, sha: OLD_SHA }],
+		})
+
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+	})
+
+	it("leaves an existing stacked label untouched on a self-match while review state reconciles", async () => {
+		// A valid label must survive a run whose open-PR map still contains this PR's own
+		// previous head: a self-match is not evidence that the relationship is stale. The
+		// review-state turn still runs and must move awaiting-maintainer independently.
+		const result = await runWorkflow({
+			labels: ["stacked", "awaiting-maintainer"],
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1437, sha: OLD_SHA }],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		// The review-state reconciliation still removes the review-state label on its own.
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		const labels = ((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name)
+		expect(labels).toContain("stacked")
+		expect(labels).not.toContain("awaiting-maintainer")
+	})
+
+	it("keeps a valid stacked label through review-state reconciliation", async () => {
+		const result = await runWorkflow({
+			labels: ["stacked", "awaiting-maintainer"],
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		// The reconcileLabels turn may replace review-state labels; the orthogonal stacked
+		// label must be neither removed nor re-added, while the review-state label is removed.
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		const labels = ((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name)
+		expect(labels).toContain("stacked")
+	})
+
+	it("removes a stale stacked label when the parent is not another open PR head", async () => {
+		const result = await runWorkflow({
+			labels: ["stacked"],
+			commitParents: [OLD_SHA],
+		})
+
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+	})
+
+	it("keeps the stacked label read-only on fork review events", async () => {
+		const result = await runWorkflow({ eventName: "pull_request_review", fork: true, commitParents: [OLD_SHA] })
+
+		expect(result.addLabels).not.toHaveBeenCalled()
+		expect(result.removeLabel).not.toHaveBeenCalled()
+		expect(result.getCommit).not.toHaveBeenCalled()
+	})
+
+	// The pair of the read-only test above: the guard skips a fork PR only when the RUN is
+	// read-only too. These two pin the accept side, so dropping either half of
+	// `isReadOnlyRun && isForkPR(pr)` cannot pass silently.
+	it("adds the stacked label on a same-repository review event", async () => {
+		const result = await runWorkflow({
+			eventName: "pull_request_review",
+			fork: false,
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+
+		// A review of a base-repository PR runs with a writable token, so the label still mutates.
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+	})
+
+	it("adds the stacked label to a fork PR on a writable run", async () => {
+		const result = await runWorkflow({
+			eventName: "pull_request_target",
+			action: "synchronize",
+			fork: true,
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+
+		// pull_request_target runs in the base repository with a writable token, so a fork PR is
+		// reconciled normally; only the fork pull_request_review run is read-only.
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+	})
+	it("skips the stacked label silently when the event could not evaluate the head map", async () => {
+		const result = await runWorkflow({
+			eventName: "workflow_dispatch",
+			openPrHeadsEnv: "not-evaluated",
+			labels: ["stacked", "awaiting-maintainer"],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		// Not evaluated is not the same as unavailable: the label is left alone without a warning,
+		// because the resolve job deliberately skipped the read for a non-head-publishing event.
+		expect(result.info).toHaveBeenCalledWith(expect.stringContaining("cannot change a stacked unit"))
+		expect(result.warning).not.toHaveBeenCalledWith(expect.stringContaining("open pull request map"))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		// Review-state reconciliation still runs for the PR.
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.setFailed).not.toHaveBeenCalled()
+	})
+
+	it("warns and leaves the stacked label alone when the head map is not JSON", async () => {
+		const result = await runWorkflow({
+			openPrHeadsEnv: "{not-json",
+			labels: ["stacked"],
+		})
+
+		// A malformed map reaches the shard's JSON.parse catch: warn and leave the label as it is
+		// rather than deciding from a map that could not be read.
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("Could not read the open pull request map"))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(result.setFailed).not.toHaveBeenCalled()
+	})
+
+	it("advises instead of failing when the stacked parent cannot be read", async () => {
+		const result = await runWorkflow({ labels: ["stacked"], getCommitErrorStatus: 500 })
+
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("could not reconcile the stacked label"))
+		expect(result.setFailed).not.toHaveBeenCalled()
+		// A lookup failure is advisory: the label already on the PR must not be decided from
+		// an unreadable parent, so it stays as it is.
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(
+			((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name),
+		).toContain("stacked")
+	})
+
+	it("keeps reconciling review state when the open-PR map lookup fails", async () => {
+		const result = await runWorkflow({
+			openPrHeadsError: true,
+			labels: ["stacked", "awaiting-maintainer"],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		// The map is unavailable (resolve failed to read it), so the stacked label is left
+		// untouched instead of being decided from an empty map; the rest still reconciles.
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("Could not read the open pull request map"))
+		// Review-state reconciliation still ran for this PR despite the failed lookup.
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		expect(result.setFailed).not.toHaveBeenCalled()
+		// The map arrives through the env, so the shard itself never lists pull requests.
+		expect(result.listPullRequests).not.toHaveBeenCalled()
+	})
+
+	it("warns and leaves the label state unchanged when a stacked add fails", async () => {
+		const result = await runWorkflow({
+			commitParents: [OLD_SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+			addLabelsFailOnceName: "stacked",
+		})
+
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("could not reconcile the stacked label"))
+		// The failed add must not be recorded as a label the PR actually has.
+		expect(
+			((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name),
+		).not.toContain("stacked")
+		expect(result.setFailed).not.toHaveBeenCalled()
+	})
+
+	it("warns and leaves the label state unchanged when a stale stacked removal fails", async () => {
+		const result = await runWorkflow({
+			labels: ["stacked"],
+			commitParents: [OLD_SHA],
+			removeLabelStatus: 500,
+		})
+
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("could not reconcile the stacked label"))
+		// A failed removal leaves the label on the PR; the next run retries it.
+		expect(
+			((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name),
+		).toContain("stacked")
+		expect(result.setFailed).not.toHaveBeenCalled()
+	})
+	it("does not label a merge commit stacked when only one of its parents is an open PR head", async () => {
+		const result = await runWorkflow({
+			commitParents: [OLD_SHA, SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+
+		// A unit is one commit on top of its parent. A head with two parents is a merge on the branch
+		// itself, so the relationship is not a stacked unit even though one parent matches.
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+	})
+	it("removes a stale stacked label from a merge commit whose parent matches an open PR head", async () => {
+		const result = await runWorkflow({
+			labels: ["stacked"],
+			commitParents: [OLD_SHA, SHA],
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+
+		// Two parents means the head is a merge on the branch, not one commit on top of a unit parent,
+		// so the label that was added earlier is stale and must be removed.
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(result.addLabels).not.toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		// The removal must also clear the label recorded for this PR, not just the remote state.
+		expect(
+			((await result.getPullRequest()).data.labels || []).map((label: { name: string }) => label.name),
+		).not.toContain("stacked")
+	})
+
 	it("reconciles CodeRabbit status comments with the canonical bot identity", async () => {
 		expect(workflow.on.issue_comment.types).toEqual(["created", "edited"])
 		expect(workflow.jobs.reconcile.if).toContain("github.event.comment.user.login == 'coderabbitai[bot]'")
@@ -708,7 +1010,10 @@ describe("PR review-state workflow", () => {
 		})
 
 		expect(result.getPullRequest).toHaveBeenCalledTimes(1)
+		// The open-PR head map arrives from the resolve job's env, so the shard reads no
+		// pull-request list; reconciliation still targets only the comment's PR.
 		expect(result.listPullRequests).not.toHaveBeenCalled()
+		expect(result.getCommit).toHaveBeenCalledTimes(1)
 		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
 		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "coderabbit-review-active" }))
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["awaiting-author"] }))
@@ -762,12 +1067,24 @@ describe("PR review-state workflow", () => {
 		const result = await runWorkflow({ existingRepoLabels: [] })
 
 		expect(result.listLabelsForRepo).toHaveBeenCalledTimes(1)
-		expect(result.createLabel).toHaveBeenCalledTimes(5)
+		expect(result.createLabel).toHaveBeenCalledTimes(6)
 		const communityApproved = result.createLabel.mock.calls
 			.map(([args]) => args as { name: string; description: string })
 			.find((label) => label.name === "community-approved")
 		expect(communityApproved).toBeDefined()
 		expect(communityApproved?.description.length).toBeLessThanOrEqual(100)
+		// stacked is a label definition too, so the missing-label path must create it with the
+		// configured definition, not just a name.
+		const stacked = result.createLabel.mock.calls
+			.map(([args]) => args as { name: string; color: string; description: string })
+			.find((label) => label.name === "stacked")
+		expect(stacked).toEqual(
+			expect.objectContaining({
+				name: "stacked",
+				color: "c2c2c2",
+				description: "Head commit sits directly on another open PR head (detected from the commit graph)",
+			}),
+		)
 	})
 
 	it("fails closed when a managed label cannot be created", async () => {
@@ -776,6 +1093,29 @@ describe("PR review-state workflow", () => {
 		)
 	})
 
+	it("keeps reconciling when only the stacked label cannot be created", async () => {
+		const result = await runWorkflow({
+			existingRepoLabels: [],
+			createLabelFailOnceName: "stacked",
+			labels: ["awaiting-maintainer"],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		// stacked is only a reviewer filter, so its provisioning failure is advisory while every other
+		// managed label still fails closed.
+		expect(result.warning).toHaveBeenCalledWith(expect.stringContaining("Could not create the stacked label"))
+		expect(result.setFailed).not.toHaveBeenCalled()
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+	})
+
 	it("propagates label listing failures", async () => {
 		await expect(runWorkflow({ labelLookupStatus: 500 })).rejects.toThrow("List labels failed")
 	})
@@ -2351,17 +2691,123 @@ describe("PR review-state workflow", () => {
 		expect(pages[0].info).toHaveBeenCalledWith(expect.stringContaining("450"))
 	})
 
-	it("reconciles only the requested PR during manual dispatch", async () => {
+	it("reconciles only the requested PR during manual dispatch and still reads the head map", async () => {
 		const resolution = await runResolve({ eventName: "workflow_dispatch", workflowDispatchPrNumber: 1437 })
 
-		expect(resolution.listPullRequests).not.toHaveBeenCalled()
+		// A manual dispatch shares the PR's concurrency group with synchronize runs, so it can replace
+		// a pending run: it reads the map instead of passing a not-evaluated sentinel.
+		expect(resolution.listPullRequests).toHaveBeenCalledTimes(1)
 		expect(resolution.prNumbers()).toEqual([1437])
+		expect(resolution.openPrHeads()).toEqual({ [SHA.toLowerCase()]: 1437 })
 
-		const result = await runWorkflow({ eventName: "workflow_dispatch", workflowDispatchPrNumber: 1437 })
+		const result = await runWorkflow({
+			eventName: "workflow_dispatch",
+			workflowDispatchPrNumber: 1437,
+			openPrHeadsEnv: JSON.stringify({ [SHA.toLowerCase()]: 1437 }),
+		})
 
+		// The shard receives the sentinel through the env; only the requested PR is reconciled.
+		expect(result.listPullRequests).not.toHaveBeenCalled()
+		expect(result.warning).not.toHaveBeenCalledWith(expect.stringContaining("open pull request map"))
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["coderabbit-review-active"] }))
 	})
 
+	// labeled/unlabeled are here because such a run shares the PR's concurrency group: it can
+	// replace a pending synchronize run for the same PR, and a replacement that skipped the map
+	// would leave the stacked label stale until the hourly sweep.
+	it.each(["opened", "reopened", "synchronize", "labeled", "unlabeled"])(
+		"reads the head map on a %s event, which can publish a head commit or replace the run that would",
+		async (action) => {
+			const resolution = await runResolve({ eventName: "pull_request_target", action })
+
+			expect(resolution.listPullRequests).toHaveBeenCalledTimes(1)
+			expect(resolution.openPrHeads()).toEqual({ [SHA.toLowerCase()]: 1437 })
+		},
+	)
+
+	it("reuses the sweep's open list for the head map without an extra read", async () => {
+		const resolution = await runResolve({ eventName: "schedule" })
+
+		// The sweep already paged the open list to pick its window, so the map is free.
+		expect(resolution.listPullRequests).toHaveBeenCalledTimes(1)
+		expect(resolution.openPrHeads()).toEqual({ [SHA.toLowerCase()]: 1437 })
+	})
+
+	it("passes an empty head map to shards when the open list cannot be read", async () => {
+		const resolution = await runResolve({
+			eventName: "pull_request_target",
+			action: "synchronize",
+			openPrHeadsError: true,
+		})
+
+		// Fail-soft: review-state resolution survives, and shards skip the stacked label
+		// rather than deciding from an empty map.
+		expect(resolution.warning).toHaveBeenCalledWith(
+			expect.stringContaining("Could not read the open pull request map"),
+		)
+		expect(resolution.openPrHeads()).toBeNull()
+		expect(resolution.prNumbers()).toEqual([1437])
+	})
+
+	it("treats an empty open-PR list as an unavailable head map", async () => {
+		const resolution = await runResolve({
+			eventName: "pull_request_target",
+			action: "synchronize",
+			emptyOpenList: true,
+		})
+
+		// The target itself is open, so a zero-entry open list is anomalous; emitting it
+		// as an empty map would let shards remove valid stacked labels.
+		expect(resolution.openPrHeads()).toBeNull()
+		expect(resolution.prNumbers()).toEqual([1437])
+
+		// The shard consumes the emitted (empty) output: the stacked label stays as it
+		// is while review-state reconciliation still runs.
+		const emitted = resolution.setOutput.mock.calls.find(([name]) => name === "open_pr_heads")?.[1] as string
+		const result = await runWorkflow({
+			eventName: "workflow_dispatch",
+			workflowDispatchPrNumber: 1437,
+			openPrHeadsEnv: emitted,
+			labels: ["stacked", "awaiting-maintainer"],
+			permissions: { maintainer: "write" },
+			reviews: [
+				{
+					login: "maintainer",
+					type: "User",
+					state: "APPROVED",
+					submittedAt: REVIEWED_AT,
+				},
+			],
+		})
+
+		expect(result.removeLabel).not.toHaveBeenCalledWith(expect.objectContaining({ name: "stacked" }))
+		expect(result.removeLabel).toHaveBeenCalledWith(expect.objectContaining({ name: "awaiting-maintainer" }))
+		expect(result.setFailed).not.toHaveBeenCalled()
+	})
+
+	it("hands the resolver's head map to shards through the declared env wiring", async () => {
+		// Contract: the shard consumes exactly what resolve emits, through the job env
+		// expression under test - not a map the harness rebuilt independently.
+		expect(String(workflow.jobs.reconcile.env.OPEN_PR_HEADS)).toContain("needs.resolve.outputs.open_pr_heads")
+
+		const resolution = await runResolve({
+			eventName: "pull_request_target",
+			action: "synchronize",
+			openPrHeads: [{ number: 1436, sha: OLD_SHA }],
+		})
+		const emitted = resolution.setOutput.mock.calls.find(([name]) => name === "open_pr_heads")?.[1] as string
+
+		const result = await runWorkflow({
+			eventName: "workflow_dispatch",
+			workflowDispatchPrNumber: 1437,
+			openPrHeadsEnv: emitted,
+			commitParents: [OLD_SHA],
+		})
+
+		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["stacked"] }))
+		expect(result.warning).not.toHaveBeenCalled()
+	})
+
 	it("chains the resolve output through the matrix wiring into shard runs", async () => {
 		// End to end: the resolve output name/shape feeds the matrix expression,
 		// which feeds the shard's PR_NUMBER env. A wiring rename or shape change
@@ -2386,14 +2832,21 @@ describe("PR review-state workflow", () => {
 		}
 	})
 
-	it("reconciles the PR associated with a workflow run", async () => {
+	it("reconciles the PR associated with a workflow run and reads the head map", async () => {
 		const resolution = await runResolve({ eventName: "workflow_run" })
 
-		expect(resolution.listPullRequests).not.toHaveBeenCalled()
+		// A run completion shares the PR's concurrency group, so it evaluates the map too.
+		expect(resolution.listPullRequests).toHaveBeenCalledTimes(1)
+		expect(resolution.openPrHeads()).toEqual({ [SHA.toLowerCase()]: 1437 })
 		expect(resolution.prNumbers()).toEqual([1437])
 
-		const result = await runWorkflow({ eventName: "workflow_run" })
+		const result = await runWorkflow({
+			eventName: "workflow_run",
+			openPrHeadsEnv: JSON.stringify({ [SHA.toLowerCase()]: 1437 }),
+		})
 
+		// The shard receives the map through the env; only the requested PR is reconciled.
+		expect(result.listPullRequests).not.toHaveBeenCalled()
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["coderabbit-review-active"] }))
 	})
 
@@ -4126,8 +4579,9 @@ describe("PR review-state workflow concurrency groups (#1707)", () => {
 		})
 
 		expect(result.listLabelsForRepo).toHaveBeenCalledTimes(1)
-		// All five definitions race; every duplicate payload is tolerated.
-		expect(result.createLabel).toHaveBeenCalledTimes(5)
+		// All six definitions race: the stacked one is tolerated by its advisory path, the
+		// other five by the duplicate-payload race tolerance.
+		expect(result.createLabel).toHaveBeenCalledTimes(6)
 		expect(result.addLabels).toHaveBeenCalledWith(expect.objectContaining({ labels: ["coderabbit-review-active"] }))
 		expect(result.setFailed).not.toHaveBeenCalled()
 	})
diff --git a/src/services/checkpoints/__tests__/ShadowCheckpointService.spec.ts b/src/services/checkpoints/__tests__/ShadowCheckpointService.spec.ts
index 1da478900c..e2486edc0b 100644
--- a/src/services/checkpoints/__tests__/ShadowCheckpointService.spec.ts
+++ b/src/services/checkpoints/__tests__/ShadowCheckpointService.spec.ts
@@ -41,6 +41,15 @@ afterAll(() => {
 	}
 })
 
+// Each test gets its own shadow + workspace repo, so the shared temp dir would otherwise
+// hold one git repository pair per test until the afterAll. Removing them as soon as the test
+// ends is what keeps the git-heavy setup below inside its hook budget on Windows CI workers,
+// where the retry absorbs the window in which git's own handles and antivirus scans still
+// hold the just-used repository.
+const rmScratch = async (dir: string) => {
+	await fs.rm(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 100 })
+}
+
 const initWorkspaceRepo = async ({
 	workspaceDir,
 	userName = "Roo Code",
@@ -83,10 +92,16 @@ describe.each([[RepoPerTaskCheckpointService, "RepoPerTaskCheckpointService"]])(
 		let workspaceGit: SimpleGit
 		let testFile: string
 		let service: RepoPerTaskCheckpointService
+		let shadowDir: string
+		let workspaceDir: string
 
+		// One test setup spawns about 14 git subprocesses: workspace repo init plus shadow repo
+		// init. On a Windows CI worker, where vitest.config.ts gives this lane two workers and
+		// every spawn is scanned, that can outrun the 20s hook budget from vitest.config.ts, so
+		// setup and cleanup get the same 60s allowance the afterAll cleanup already carries.
 		beforeEach(async () => {
-			const shadowDir = path.join(tmpDir, `${prefix}-${Date.now()}`)
-			const workspaceDir = path.join(tmpDir, `workspace-${Date.now()}`)
+			shadowDir = path.join(tmpDir, `${prefix}-${Date.now()}`)
+			workspaceDir = path.join(tmpDir, `workspace-${Date.now()}`)
 			const repo = await initWorkspaceRepo({ workspaceDir })
 
 			workspaceGit = repo.git
@@ -94,11 +109,17 @@ describe.each([[RepoPerTaskCheckpointService, "RepoPerTaskCheckpointService"]])(
 
 			service = await klass.create({ taskId, shadowDir, workspaceDir, log: () => {} })
 			await service.initShadowGit()
-		})
+		}, 60_000)
 
 		afterEach(async () => {
 			vitest.restoreAllMocks()
-		})
+
+			// The standalone tests below already delete the scratch repos they create; this hook
+			// does the same for the pair created above, so the temp dir never accumulates one
+			// repository pair per test for the ~40 tests that share these hooks.
+			await rmScratch(shadowDir)
+			await rmScratch(workspaceDir)
+		}, 60_000)
 
 		afterAll(async () => {
 			await fs.rm(tmpDir, { recursive: true, force: true })
@@ -1166,6 +1187,22 @@ describe.each([[RepoPerTaskCheckpointService, "RepoPerTaskCheckpointService"]])(
 				}
 			})
 		})
+
+		describe(`${klass.name}#scratchCleanup`, () => {
+			let markedFile: string
+
+			it("writes a marker into the repository its hooks created", async () => {
+				markedFile = path.join(workspaceDir, "scratch-marker.txt")
+
+				await fs.writeFile(markedFile, "written by the marker test")
+
+				expect(await fileExistsAtPath(markedFile)).toBe(true)
+			})
+
+			it("removes the marker with the repository before the next test runs", async () => {
+				expect(await fileExistsAtPath(markedFile)).toBe(false)
+			})
+		})
 	},
 )