Merge pull request 'fix(author): harden dirty-session rebind inventory and journal identity (#868)' (#869) from fix/issue-868-dirty-rebind-inventory-journal into master

Complete dirty-inventory revalidation immediately before and after
bind_session_lock so added, removed, or renamed paths fail closed.
Persist and validate full recovery-journal operation identity (remote,
org, repo, claimant identity, claimant profile) on execute, resume,
retry, and already_rebound. Add focused regression coverage and the
reconciler success-path integration test.

Closes #868.

author_issue_bootstrap.py

@@ -1,976 +0,0 @@
-"""Sanctioned author issue worktree bootstrap for allocated issues (#850).
-
-Bootstraps an allocated author branch, canonical worktree under ``branches/``,
-worktree registration, issue lock, and lease/assignment binding without
-caller-side Git, Bash, or helper scripts.
-
-Features:
-1. Durable phase journal with read-after-write evidence for every phase.
-2. Idempotent replay handling via idempotency keys.
-3. Authoritative expected-base / concurrency-pin validation.
-4. Typed stale-pin refusal without silent rebasing or repointing.
-5. Canonical branches-root enforcement (path MUST be inside branches/).
-6. Preexisting work preservation (dirty tracked/untracked check, foreign ownership refusal).
-7. Compensating recovery limited strictly to artifacts created by this transition.
-8. Satisfiable exact_next_action for MCP scheduled workers.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-from typing import Any, Mapping
-
-import author_mutation_worktree
-import issue_lock_store
-import issue_lock_worktree
-import lease_lifecycle
-from reviewer_worktree import parse_dirty_tracked_files
-import task_capability_map
-
-BOOTSTRAP_TASKS = frozenset(
-    {
-        "bootstrap_author_issue_worktree",
-        "gitea_bootstrap_author_issue_worktree",
-    }
-)
-
-PHASE_1_REQUEST_ACCEPTED = "1_request_accepted"
-PHASE_2_BRANCH_CONFIRMED = "2_branch_confirmed"
-PHASE_3_PATH_RESERVED = "3_path_reserved"
-PHASE_4_WORKTREE_CONFIRMED = "4_worktree_confirmed"
-PHASE_5_REGISTRATION_VERIFIED = "5_registration_verified"
-PHASE_6_STATE_ESTABLISHED = "6_state_established"
-PHASE_7_TRANSITION_COMPLETED = "7_transition_completed"
-PHASE_COMPENSATING_RECOVERY = "compensating_recovery"
-
-JOURNAL_DIR_NAME = "bootstrap-journals"
-
-
-def is_author_issue_bootstrap_task(task: str | None) -> bool:
-    """True when *task* is the author issue worktree bootstrap task."""
-    return (task or "").strip() in BOOTSTRAP_TASKS
-
-
-def get_journal_dir(override: str | None = None) -> str:
-    """Return the root directory for durable bootstrap phase journals."""
-    if override:
-        path = override
-    elif os.environ.get("GITEA_BOOTSTRAP_JOURNAL_DIR"):
-        path = os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"]
-    else:
-        cache_dir = os.path.expanduser("~/.cache/gitea-tools")
-        path = os.path.join(cache_dir, JOURNAL_DIR_NAME)
-    os.makedirs(path, exist_ok=True)
-    return path
-
-
-def _journal_file_path(idempotency_key: str, journal_dir: str | None = None) -> str:
-    safe_key = "".join(
-        c if c.isalnum() or c in ("-", "_", ".") else "_"
-        for c in idempotency_key
-    )
-    return os.path.join(get_journal_dir(journal_dir), f"{safe_key}.json")
-
-
-def load_phase_journal(
-    idempotency_key: str, journal_dir: str | None = None
-) -> dict[str, Any] | None:
-    """Load a durable phase journal if it exists."""
-    path = _journal_file_path(idempotency_key, journal_dir=journal_dir)
-    if not os.path.isfile(path):
-        return None
-    try:
-        with open(path, "r", encoding="utf-8") as f:
-            return json.load(f)
-    except Exception:
-        return None
-
-
-def save_phase_journal(
-    journal: dict[str, Any], journal_dir: str | None = None
-) -> None:
-    """Persist a durable phase journal with write-through file sync."""
-    key = journal["idempotency_key"]
-    path = _journal_file_path(key, journal_dir=journal_dir)
-    tmp_path = f"{path}.tmp.{os.getpid()}"
-    with open(tmp_path, "w", encoding="utf-8") as f:
-        json.dump(journal, f, indent=2, sort_keys=True)
-    os.replace(tmp_path, path)
-
-
-def derive_default_idempotency_key(
-    remote: str,
-    org: str | None,
-    repo: str | None,
-    issue_number: int,
-    assignment_id: str | None = None,
-    lease_id: str | None = None,
-) -> str:
-    parts = [
-        "bootstrap",
-        (remote or "prgs").strip(),
-        (org or "Scaled-Tech-Consulting").strip(),
-        (repo or "Gitea-Tools").strip(),
-        f"issue-{issue_number}",
-    ]
-    if assignment_id:
-        parts.append(assignment_id.strip())
-    if lease_id:
-        parts.append(lease_id.strip())
-    return ":".join(parts)
-
-
-def run_compensating_recovery(
-    journal: dict[str, Any],
-    canonical_repo_root: str,
-    journal_dir: str | None = None,
-) -> dict[str, Any]:
-    """Execute compensating recovery for artifacts created by this transition only."""
-    artifacts = journal.get("artifacts_created") or {}
-    pending = journal.get("pending_creations") or {}
-    rolled_back: list[str] = []
-    worktree_path = journal.get("worktree_path")
-    branch_name = journal.get("branch_name")
-
-    # Roll back issue lock if created
-    if artifacts.get("lock_created") or pending.get("lock"):
-        issue_num = journal.get("issue_number")
-        session_id = journal.get("owner_session")
-        if issue_num and session_id:
-            try:
-                issue_lock_store.release_session_lock(
-                    issue_number=issue_num,
-                    session=session_id,
-                    lock_dir=journal_dir,
-                )
-                rolled_back.append(f"lock:issue-{issue_num}")
-            except Exception:
-                pass
-        artifacts["lock_created"] = False
-
-    worktree_created = (
-        artifacts.get("worktree_registered")
-        or artifacts.get("worktree_dir_created")
-        or (pending.get("worktree_path") == worktree_path and worktree_path)
-    )
-
-    if worktree_created and worktree_path:
-        if os.path.exists(worktree_path):
-            # Re-verify cleanliness before destructive removal (F-4)
-            porc_res = subprocess.run(
-                ["git", "-C", worktree_path, "status", "--porcelain"],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            is_dirty = porc_res.returncode == 0 and bool(porc_res.stdout.strip())
-            if is_dirty:
-                rolled_back.append(f"worktree_path_preserved_dirty:{worktree_path}")
-            else:
-                try:
-                    subprocess.run(
-                        [
-                            "git",
-                            "-C",
-                            canonical_repo_root,
-                            "worktree",
-                            "remove",
-                            "--force",
-                            worktree_path,
-                        ],
-                        capture_output=True,
-                        text=True,
-                        check=False,
-                    )
-                except Exception:
-                    pass
-                if os.path.exists(worktree_path):
-                    shutil.rmtree(worktree_path, ignore_errors=True)
-                try:
-                    subprocess.run(
-                        ["git", "-C", canonical_repo_root, "worktree", "prune"],
-                        capture_output=True,
-                        text=True,
-                        check=False,
-                    )
-                except Exception:
-                    pass
-                rolled_back.append(f"worktree_path:{worktree_path}")
-        else:
-            rolled_back.append(f"worktree_path:{worktree_path}")
-
-    branch_created = (
-        artifacts.get("branch_created")
-        or (pending.get("branch_name") == branch_name and branch_name)
-    )
-
-    if branch_created and branch_name:
-        try:
-            res = subprocess.run(
-                [
-                    "git",
-                    "-C",
-                    canonical_repo_root,
-                    "rev-parse",
-                    "--verify",
-                    branch_name,
-                ],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            if res.returncode == 0:
-                # Check for author commits on branch before branch deletion (F-4)
-                resolved_base = journal.get("resolved_base_sha") or "master"
-                rev_list_res = subprocess.run(
-                    [
-                        "git",
-                        "-C",
-                        canonical_repo_root,
-                        "rev-list",
-                        f"{resolved_base}..{branch_name}",
-                    ],
-                    capture_output=True,
-                    text=True,
-                    check=False,
-                )
-                has_commits = rev_list_res.returncode == 0 and bool(rev_list_res.stdout.strip())
-                if has_commits:
-                    rolled_back.append(f"branch_preserved_commits:{branch_name}")
-                else:
-                    subprocess.run(
-                        [
-                            "git",
-                            "-C",
-                            canonical_repo_root,
-                            "branch",
-                            "-D",
-                            branch_name,
-                        ],
-                        capture_output=True,
-                        text=True,
-                        check=False,
-                    )
-                    rolled_back.append(f"branch:{branch_name}")
-        except Exception:
-            pass
-
-    recovery_info = {
-        "executed": True,
-        "rolled_back": rolled_back,
-        "reason": journal.get("failure_reason"),
-    }
-    journal["compensating_recovery"] = recovery_info
-    journal["current_phase"] = PHASE_COMPENSATING_RECOVERY
-    save_phase_journal(journal, journal_dir=journal_dir)
-    return recovery_info
-
-
-def assess_author_issue_bootstrap(
-    *,
-    workspace_path: str,
-    canonical_repo_root: str,
-    current_branch: str | None = None,
-    head_sha: str | None = None,
-    porcelain_status: str = "",
-    remote_master_sha: str | None = None,
-    remote_master_sha_error: str | None = None,
-    task: str | None = None,
-) -> dict[str, Any]:
-    """Assess whether author issue worktree bootstrap may proceed from control or worktree root."""
-    root = os.path.realpath(canonical_repo_root or "")
-    workspace = os.path.realpath(workspace_path or root or ".")
-    branch = (current_branch or "").strip()
-    dirty = parse_dirty_tracked_files(porcelain_status or "")
-    under_branches = (
-        author_mutation_worktree.is_path_under_branches(workspace, root)
-        if root
-        else False
-    )
-
-    if not is_author_issue_bootstrap_task(task):
-        return {
-            "not_applicable": True,
-            "allowed": False,
-            "block": False,
-            "proven": False,
-            "reasons": ["task is not author_issue_bootstrap"],
-        }
-
-    if under_branches:
-        return {
-            "not_applicable": False,
-            "allowed": True,
-            "block": False,
-            "proven": True,
-            "bootstrap_path": "existing_branches_worktree",
-            "reasons": [
-                "workspace is already a registered worktree under branches/"
-            ],
-        }
-
-    reasons: list[str] = []
-    if workspace != root:
-        reasons.append(
-            "bootstrap requires workspace to be canonical control checkout or branches/ worktree"
-        )
-    if branch not in author_mutation_worktree.BASE_BRANCHES:
-        reasons.append(
-            f"control checkout branch '{branch}' is not an accepted base branch "
-            f"({', '.join(sorted(author_mutation_worktree.BASE_BRANCHES))})"
-        )
-    if dirty:
-        reasons.append(
-            f"control checkout has tracked local edits: {', '.join(dirty[:5])}"
-        )
-
-    if remote_master_sha_error:
-        reasons.append(
-            f"could not verify live master tip: {remote_master_sha_error}"
-        )
-    elif remote_master_sha and head_sha:
-        h = head_sha.strip().lower()
-        rm = remote_master_sha.strip().lower()
-        if h != rm:
-            reasons.append(
-                f"control checkout HEAD ({h[:12]}) != live master tip ({rm[:12]})"
-            )
-
-    if reasons:
-        return {
-            "not_applicable": False,
-            "allowed": False,
-            "block": True,
-            "proven": False,
-            "reasons": reasons,
-        }
-
-    return {
-        "not_applicable": False,
-        "allowed": True,
-        "block": False,
-        "proven": True,
-        "bootstrap_path": "clean_canonical_control_checkout",
-        "reasons": [
-            "control checkout is clean on accepted base branch matching live master"
-        ],
-    }
-
-
-import fcntl
-import stat
-
-
-class BootstrapTransitionLock:
-    """Inter-process file lock scoped to the transition identity / idempotency key."""
-
-    def __init__(self, idempotency_key: str, journal_dir: str | None = None):
-        safe_key = "".join(
-            c if c.isalnum() or c in ("-", "_", ".") else "_"
-            for c in idempotency_key
-        )
-        lock_dir = os.path.realpath(get_journal_dir(journal_dir))
-        if not os.path.isdir(lock_dir):
-            raise RuntimeError(f"Lock directory '{lock_dir}' does not exist or is not a directory")
-
-        raw_lock_path = os.path.abspath(os.path.join(lock_dir, f"{safe_key}.lock"))
-        try:
-            common = os.path.commonpath([lock_dir, os.path.dirname(raw_lock_path)])
-        except Exception:
-            common = None
-        if common != lock_dir:
-            raise RuntimeError(f"Lock path '{raw_lock_path}' escapes canonical lock directory '{lock_dir}'")
-
-        self.lock_path = raw_lock_path
-        self.fd = None
-
-    def __enter__(self):
-        if os.path.islink(self.lock_path):
-            raise RuntimeError(f"Refusing lock acquisition: lock path '{self.lock_path}' is a symlink")
-
-        flags = os.O_RDWR | os.O_CREAT
-        if hasattr(os, "O_NOFOLLOW"):
-            flags |= os.O_NOFOLLOW
-        if hasattr(os, "O_CLOEXEC"):
-            flags |= os.O_CLOEXEC
-
-        try:
-            fd = os.open(self.lock_path, flags, 0o600)
-        except OSError as exc:
-            raise RuntimeError(f"Failed to open lock file safely '{self.lock_path}': {exc}") from exc
-
-        st = os.fstat(fd)
-        if not stat.S_ISREG(st.st_mode):
-            os.close(fd)
-            raise RuntimeError(f"Lock target '{self.lock_path}' is not a regular file")
-
-        self.fd = fd
-        fcntl.flock(self.fd, fcntl.LOCK_EX)
-        return self
-
-    def __exit__(self, exc_type, exc_val, exc_tb):
-        if self.fd is not None:
-            try:
-                fcntl.flock(self.fd, fcntl.LOCK_UN)
-            except Exception:
-                pass
-            try:
-                os.close(self.fd)
-            except Exception:
-                pass
-            self.fd = None
-
-
-def bootstrap_author_issue_worktree(
-    *,
-    issue_number: int,
-    canonical_repo_root: str,
-    assignment_id: str | None = None,
-    lease_id: str | None = None,
-    expected_base_sha: str | None = None,
-    branch_name: str | None = None,
-    worktree_path: str | None = None,
-    idempotency_key: str | None = None,
-    remote: str = "prgs",
-    host: str | None = None,
-    org: str | None = "Scaled-Tech-Consulting",
-    repo: str | None = "Gitea-Tools",
-    active_identity: str | None = "jcwalker3",
-    active_profile: str | None = "prgs-author",
-    owner_session: str | None = None,
-    lock_dir: str | None = None,
-    dry_run: bool = False,
-) -> dict[str, Any]:
-    """Execute the sanctioned author issue worktree bootstrap transition."""
-    root = os.path.realpath(canonical_repo_root)
-
-    session = (owner_session or "").strip()
-    if not session:
-        return {
-            "success": False,
-            "reason_code": "missing_owner_session",
-            "message": "Missing required owner_session parameter (fail closed). Session identifier cannot be fabricated or defaulted.",
-            "exact_next_action": (
-                "Pass explicit owner_session resolved from gitea_whoami or session context."
-            ),
-        }
-
-    if active_identity is None or not str(active_identity).strip():
-        return {
-            "success": False,
-            "reason_code": "missing_active_identity",
-            "message": "Missing required active_identity parameter (fail closed). Identity cannot be fabricated or defaulted.",
-            "exact_next_action": "Pass explicit active_identity resolved from gitea_whoami.",
-        }
-    identity = str(active_identity).strip()
-
-    if active_profile is None or not str(active_profile).strip():
-        return {
-            "success": False,
-            "reason_code": "missing_active_profile",
-            "message": "Missing required active_profile parameter (fail closed). Profile cannot be fabricated or defaulted.",
-            "exact_next_action": "Pass explicit active_profile resolved from gitea_whoami.",
-        }
-    profile = str(active_profile).strip()
-
-    # Derive standard inputs
-    expected_pattern = f"issue-{issue_number}"
-    target_branch = (branch_name or "").strip()
-    if not target_branch:
-        target_branch = f"fix/issue-{issue_number}-native-mcp-bootstrap"
-    elif expected_pattern not in target_branch:
-        return {
-            "success": False,
-            "reason_code": "invalid_branch_name",
-            "message": (
-                f"Branch name '{target_branch}' must contain issue pattern '{expected_pattern}'"
-            ),
-            "exact_next_action": (
-                f"Supply a branch_name containing '{expected_pattern}', e.g., 'fix/issue-{issue_number}-...'"
-            ),
-        }
-
-    worktree_name = target_branch.replace("/", "-")
-    target_worktree = (worktree_path or "").strip()
-    if not target_worktree:
-        target_worktree = os.path.join(root, "branches", worktree_name)
-    target_worktree = os.path.realpath(os.path.abspath(target_worktree))
-
-    key = (idempotency_key or "").strip()
-    if not key:
-        key = derive_default_idempotency_key(
-            remote=remote,
-            org=org,
-            repo=repo,
-            issue_number=issue_number,
-            assignment_id=assignment_id,
-            lease_id=lease_id,
-        )
-
-    # Acquire cross-process file lock scoped to the idempotency key / transition identity
-    with BootstrapTransitionLock(key, journal_dir=lock_dir):
-        # Idempotency check
-        existing = load_phase_journal(key, journal_dir=lock_dir)
-        if existing and existing.get("completed"):
-            if (
-                existing.get("issue_number") == issue_number
-                and existing.get("branch_name") == target_branch
-                and os.path.realpath(existing.get("worktree_path", ""))
-                == target_worktree
-            ):
-                return {
-                    "success": True,
-                    "replayed": True,
-                    "message": (
-                        f"Idempotent replay: worktree for issue #{issue_number} already bootstrapped at {target_worktree}"
-                    ),
-                    "issue_number": issue_number,
-                    "branch_name": target_branch,
-                    "worktree_path": target_worktree,
-                    "base_sha": existing.get("resolved_base_sha"),
-                    "lease_id": existing.get("lease_id"),
-                    "assignment_id": existing.get("assignment_id"),
-                    "idempotency_key": key,
-                    "phase_journal": existing,
-                    "exact_next_action": (
-                        "Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue') "
-                        "and proceed with author implementation in the bootstrapped worktree."
-                    ),
-                }
-            else:
-                return {
-                    "success": False,
-                    "reason_code": "incompatible_idempotency_replay",
-                    "message": (
-                        f"Idempotency key '{key}' already exists with incompatible parameters "
-                        f"(stored: {existing.get('branch_name')}, {existing.get('worktree_path')}; "
-                        f"requested: {target_branch}, {target_worktree})"
-                    ),
-                    "exact_next_action": (
-                        "Supply a unique idempotency_key or pass compatible parameters."
-                    ),
-                }
-
-        # Initialize or resume Phase Journal
-        if existing:
-            journal = existing
-            artifacts = journal.setdefault("artifacts_created", {})
-            artifacts.setdefault("branch_created", False)
-            artifacts.setdefault("worktree_dir_created", False)
-            artifacts.setdefault("worktree_registered", False)
-            artifacts.setdefault("lock_created", False)
-        else:
-            journal = {
-                "idempotency_key": key,
-                "issue_number": issue_number,
-                "assignment_id": assignment_id,
-                "lease_id": lease_id,
-                "expected_base_sha": expected_base_sha,
-                "resolved_base_sha": None,
-                "branch_name": target_branch,
-                "worktree_path": target_worktree,
-                "active_identity": identity,
-                "active_profile": profile,
-                "owner_session": session,
-                "remote": remote,
-                "org": org,
-                "repo": repo,
-                "phases": {},
-                "artifacts_created": {
-                    "branch_created": False,
-                    "worktree_dir_created": False,
-                    "worktree_registered": False,
-                    "lock_created": False,
-                },
-                "current_phase": PHASE_1_REQUEST_ACCEPTED,
-                "completed": False,
-            }
-
-        # Fetch current live master SHA
-        try:
-            rev_res = subprocess.run(
-                ["git", "-C", root, "rev-parse", "HEAD"],
-                capture_output=True,
-                text=True,
-                check=True,
-            )
-            live_master_sha = rev_res.stdout.strip()
-        except Exception as exc:
-            return {
-                "success": False,
-                "reason_code": "git_rev_parse_failed",
-                "message": f"Could not determine repository HEAD: {exc}",
-                "exact_next_action": "Verify repository git state and retry.",
-            }
-
-        # Phase 1: REQUEST_ACCEPTED & Concurrency Pin Check
-        if expected_base_sha:
-            exp_norm = expected_base_sha.strip().lower()
-            live_norm = live_master_sha.lower()
-            if exp_norm != live_norm:
-                journal["failure_reason"] = (
-                    f"stale concurrency pin: expected {exp_norm[:12]} != live {live_norm[:12]}"
-                )
-                save_phase_journal(journal, journal_dir=lock_dir)
-                return {
-                    "success": False,
-                    "reason_code": "stale_concurrency_pin",
-                    "message": (
-                        f"Expected base SHA {exp_norm[:12]} does not match live master SHA {live_norm[:12]} (fail closed)."
-                    ),
-                    "expected_base_sha": expected_base_sha,
-                    "live_master_sha": live_master_sha,
-                    "exact_next_action": (
-                        "Re-evaluate assignment against current live master SHA and retry with updated expected_base_sha."
-                    ),
-                }
-
-        journal["resolved_base_sha"] = live_master_sha
-        journal["phases"][PHASE_1_REQUEST_ACCEPTED] = {
-            "status": "completed",
-            "live_master_sha": live_master_sha,
-            "expected_base_sha": expected_base_sha,
-        }
-        journal["current_phase"] = PHASE_2_BRANCH_CONFIRMED
-        save_phase_journal(journal, journal_dir=lock_dir)
-
-        if dry_run:
-            return {
-                "success": True,
-                "dry_run": True,
-                "message": f"Dry-run: validated bootstrap intent for issue #{issue_number}",
-                "issue_number": issue_number,
-                "branch_name": target_branch,
-                "worktree_path": target_worktree,
-                "base_sha": live_master_sha,
-                "phase_journal": journal,
-                "exact_next_action": "Run without dry_run=True to execute bootstrap.",
-            }
-
-        # Phase 2: BRANCH_CONFIRMED
-        was_branch_created_previously = journal["artifacts_created"].get("branch_created", False)
-        pending_branch = (journal.get("pending_creations") or {}).get("branch_name")
-
-        branch_check = subprocess.run(
-            ["git", "-C", root, "rev-parse", "--verify", target_branch],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if branch_check.returncode == 0:
-            branch_head = branch_check.stdout.strip()
-            # Verify branch head descends from base
-            anc_check = subprocess.run(
-                [
-                    "git",
-                    "-C",
-                    root,
-                    "merge-base",
-                    "--is-ancestor",
-                    live_master_sha,
-                    branch_head,
-                ],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            if anc_check.returncode != 0 and branch_head.lower() != live_master_sha.lower():
-                # F-8: Check if branch shares a common ancestor with live master
-                mb_check = subprocess.run(
-                    ["git", "-C", root, "merge-base", live_master_sha, branch_head],
-                    capture_output=True,
-                    text=True,
-                    check=False,
-                )
-                if mb_check.returncode != 0 or not mb_check.stdout.strip():
-                    journal["failure_reason"] = (
-                        f"existing branch '{target_branch}' HEAD ({branch_head[:12]}) is incompatible with live master ({live_master_sha[:12]})"
-                    )
-                    save_phase_journal(journal, journal_dir=lock_dir)
-                    return {
-                        "success": False,
-                        "reason_code": "incompatible_existing_branch",
-                        "message": (
-                            f"Existing branch '{target_branch}' HEAD ({branch_head[:12]}) is incompatible with live master ({live_master_sha[:12]})."
-                        ),
-                        "exact_next_action": (
-                            "Inspect or sync the existing branch with master before bootstrapping."
-                        ),
-                    }
-            # Preserve creation provenance monotonically across interruption and replay
-            if was_branch_created_previously or pending_branch == target_branch:
-                journal["artifacts_created"]["branch_created"] = True
-            else:
-                journal["artifacts_created"]["branch_created"] = False
-        else:
-            # Persist creation intent/provenance to disk BEFORE executing external mutation
-            journal.setdefault("pending_creations", {})["branch_name"] = target_branch
-            journal["artifacts_created"]["branch_created"] = True
-            save_phase_journal(journal, journal_dir=lock_dir)
-
-            # Create branch
-            create_res = subprocess.run(
-                ["git", "-C", root, "branch", target_branch, live_master_sha],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            if create_res.returncode != 0:
-                journal["artifacts_created"]["branch_created"] = False
-                journal.get("pending_creations", {}).pop("branch_name", None)
-                journal["failure_reason"] = (
-                    f"failed to create git branch '{target_branch}': {create_res.stderr.strip()}"
-                )
-                save_phase_journal(journal, journal_dir=lock_dir)
-                return {
-                    "success": False,
-                    "reason_code": "branch_creation_failed",
-                    "message": f"Failed to create git branch '{target_branch}': {create_res.stderr.strip()}",
-                    "exact_next_action": "Verify branch availability and retry.",
-                }
-
-        journal["phases"][PHASE_2_BRANCH_CONFIRMED] = {
-            "status": "completed",
-            "branch_name": target_branch,
-            "created": journal["artifacts_created"]["branch_created"],
-        }
-        journal["current_phase"] = PHASE_3_PATH_RESERVED
-        save_phase_journal(journal, journal_dir=lock_dir)
-
-        # Phase 3: PATH_RESERVED & Phase 4: WORKTREE_CONFIRMED
-        if not author_mutation_worktree.is_path_under_branches(
-            target_worktree, root
-        ):
-            journal["failure_reason"] = (
-                f"target_worktree '{target_worktree}' is outside canonical branches/ root"
-            )
-            run_compensating_recovery(journal, root, journal_dir=lock_dir)
-            return {
-                "success": False,
-                "reason_code": "path_outside_canonical_branches_root",
-                "message": (
-                    f"Worktree path '{target_worktree}' is outside canonical branches/ root (fail closed)."
-                ),
-                "exact_next_action": (
-                    "Provide a worktree_path inside canonical branches/ root, e.g., 'branches/issue-...'"
-                ),
-            }
-
-        was_dir_created_previously = journal["artifacts_created"].get("worktree_dir_created", False)
-        was_registered_previously = journal["artifacts_created"].get("worktree_registered", False)
-        pending_wt = (journal.get("pending_creations") or {}).get("worktree_path")
-
-        dir_exists = os.path.exists(target_worktree)
-        if dir_exists:
-            # Check porcelain directly
-            porc_res = subprocess.run(
-                ["git", "-C", target_worktree, "status", "--porcelain"],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            dirty = (
-                parse_dirty_tracked_files(porc_res.stdout)
-                if porc_res.returncode == 0
-                else []
-            )
-            if dirty or (porc_res.returncode == 0 and porc_res.stdout.strip()):
-                journal["failure_reason"] = (
-                    f"target worktree '{target_worktree}' contains dirty tracked/untracked files"
-                )
-                run_compensating_recovery(journal, root, journal_dir=lock_dir)
-                return {
-                    "success": False,
-                    "reason_code": "preexisting_dirty_worktree",
-                    "message": (
-                        f"Preexisting worktree '{target_worktree}' has dirty tracked/untracked files (fail closed)."
-                    ),
-                    "exact_next_action": (
-                        "Clean or stash the pre-existing worktree files before bootstrapping."
-                    ),
-                }
-
-            # Check registered branch
-            wt_state = issue_lock_worktree.read_worktree_git_state(target_worktree)
-            wt_branch = (wt_state.get("current_branch") or "").strip()
-            if wt_branch and wt_branch != target_branch:
-                journal["failure_reason"] = (
-                    f"existing worktree '{target_worktree}' is on branch '{wt_branch}' != expected '{target_branch}'"
-                )
-                run_compensating_recovery(journal, root, journal_dir=lock_dir)
-                return {
-                    "success": False,
-                    "reason_code": "incompatible_existing_directory",
-                    "message": (
-                        f"Existing worktree '{target_worktree}' is registered to branch '{wt_branch}' instead of '{target_branch}'."
-                    ),
-                    "exact_next_action": (
-                        "Inspect or remove the pre-existing worktree folder before bootstrapping."
-                    ),
-                }
-            if was_dir_created_previously or pending_wt == target_worktree:
-                journal["artifacts_created"]["worktree_dir_created"] = True
-                journal["artifacts_created"]["worktree_registered"] = True
-            else:
-                journal["artifacts_created"]["worktree_dir_created"] = False
-                journal["artifacts_created"]["worktree_registered"] = False
-        else:
-            # Persist creation intent/provenance to disk BEFORE executing external worktree add mutation
-            journal.setdefault("pending_creations", {})["worktree_path"] = target_worktree
-            journal["artifacts_created"]["worktree_dir_created"] = True
-            journal["artifacts_created"]["worktree_registered"] = True
-            save_phase_journal(journal, journal_dir=lock_dir)
-
-            wt_add_res = subprocess.run(
-                [
-                    "git",
-                    "-C",
-                    root,
-                    "worktree",
-                    "add",
-                    target_worktree,
-                    target_branch,
-                ],
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-            if wt_add_res.returncode != 0:
-                journal["artifacts_created"]["worktree_dir_created"] = False
-                journal["artifacts_created"]["worktree_registered"] = False
-                journal.get("pending_creations", {}).pop("worktree_path", None)
-                journal["failure_reason"] = (
-                    f"git worktree add failed: {wt_add_res.stderr.strip()}"
-                )
-                run_compensating_recovery(journal, root, journal_dir=lock_dir)
-                return {
-                    "success": False,
-                    "reason_code": "worktree_add_failed",
-                    "message": f"Failed to execute git worktree add: {wt_add_res.stderr.strip()}",
-                    "exact_next_action": "Verify git worktree capabilities and retry.",
-                }
-
-        journal["phases"][PHASE_3_PATH_RESERVED] = {
-            "status": "completed",
-            "worktree_path": target_worktree,
-            "preexisting_dir": dir_exists,
-        }
-        journal["current_phase"] = PHASE_4_WORKTREE_CONFIRMED
-        save_phase_journal(journal, journal_dir=lock_dir)
-
-        # Phase 5: REGISTRATION_VERIFIED
-        wt_list_res = subprocess.run(
-            ["git", "-C", root, "worktree", "list", "--porcelain"],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        norm_target = os.path.realpath(target_worktree)
-        found_registration = False
-        if wt_list_res.returncode == 0:
-            for block in wt_list_res.stdout.split("\n\n"):
-                lines = block.strip().splitlines()
-                worktree_line = next(
-                    (l[9:].strip() for l in lines if l.startswith("worktree ")),
-                    None,
-                )
-                if worktree_line and os.path.realpath(worktree_line) == norm_target:
-                    found_registration = True
-                    break
-
-        if not found_registration:
-            journal["failure_reason"] = (
-                f"worktree registration for '{target_worktree}' not found in git worktree list"
-            )
-            run_compensating_recovery(journal, root, journal_dir=lock_dir)
-            return {
-                "success": False,
-                "reason_code": "worktree_registration_verification_failed",
-                "message": f"Worktree '{target_worktree}' registration verification failed.",
-                "exact_next_action": "Check git worktree list integrity and retry.",
-            }
-
-        journal["phases"][PHASE_4_WORKTREE_CONFIRMED] = {
-            "status": "completed",
-            "worktree_path": target_worktree,
-        }
-        journal["phases"][PHASE_5_REGISTRATION_VERIFIED] = {
-            "status": "completed",
-            "registered": True,
-        }
-        journal["current_phase"] = PHASE_6_STATE_ESTABLISHED
-        save_phase_journal(journal, journal_dir=lock_dir)
-
-        # Phase 6: STATE_ESTABLISHED — Issue Lock Acquisition
-        from datetime import datetime, timezone
-        try:
-            lock_data = {
-                "remote": remote,
-                "org": org or "Scaled-Tech-Consulting",
-                "repo": repo or "Gitea-Tools",
-                "issue_number": issue_number,
-                "branch": target_branch,
-                "branch_name": target_branch,
-                "worktree_path": target_worktree,
-                "owner_session": session,
-                "claimant": {
-                    "username": identity,
-                    "profile": profile,
-                },
-                "assignment_id": assignment_id,
-                "lease_id": lease_id,
-                "expected_base_sha": live_master_sha,
-                "created_at": datetime.now(timezone.utc).isoformat(),
-            }
-            journal.setdefault("pending_creations", {})["lock"] = True
-            journal["artifacts_created"]["lock_created"] = True
-            save_phase_journal(journal, journal_dir=lock_dir)
-
-            lock_res = issue_lock_store.bind_session_lock(lock_data, lock_dir=lock_dir)
-        except Exception as exc:
-            journal["artifacts_created"]["lock_created"] = False
-            journal.get("pending_creations", {}).pop("lock", None)
-            journal["failure_reason"] = f"issue lock binding failed: {exc}"
-            run_compensating_recovery(journal, root, journal_dir=lock_dir)
-            return {
-                "success": False,
-                "reason_code": "issue_lock_acquisition_failed",
-                "message": f"Could not bind canonical issue lock for issue #{issue_number}: {exc}",
-                "exact_next_action": "Verify lease/assignment state and retry.",
-            }
-
-        journal["phases"][PHASE_6_STATE_ESTABLISHED] = {
-            "status": "completed",
-            "lock": lock_res,
-        }
-        journal["phases"][PHASE_7_TRANSITION_COMPLETED] = {
-            "status": "completed",
-        }
-        journal["current_phase"] = PHASE_7_TRANSITION_COMPLETED
-        journal["completed"] = True
-        save_phase_journal(journal, journal_dir=lock_dir)
-
-        return {
-            "success": True,
-            "replayed": False,
-            "message": (
-                f"Successfully bootstrapped author issue worktree for issue #{issue_number} "
-                f"at branch '{target_branch}' and worktree '{target_worktree}'."
-            ),
-            "issue_number": issue_number,
-            "branch_name": target_branch,
-            "worktree_path": target_worktree,
-            "base_sha": live_master_sha,
-            "lease_id": lease_id,
-            "assignment_id": assignment_id,
-            "idempotency_key": key,
-            "lock_state": lock_res,
-            "phase_journal": journal,
-            "exact_next_action": (
-                "Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue') "
-                "and proceed with author implementation in the bootstrapped worktree."
-            ),
-        }

author_mutation_worktree.py

@@ -40,66 +40,22 @@ def _normalize_path(path: str) -> str:
     return (path or "").replace("\\", "/").rstrip("/")
 
 
-def get_canonical_branches_root(project_root: str | None = None) -> str:
-    """Return the absolute path of the canonical branches directory for *project_root*."""
-    root = os.path.realpath(project_root) if project_root else os.path.realpath(os.getcwd())
-    canonical_repo_root = resolve_canonical_repo_root(root, root)
-    return os.path.realpath(os.path.join(canonical_repo_root, "branches"))
-
-
 def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
-    """True when *path* resolves inside a canonical ``branches/`` directory."""
-    if not path or not str(path).strip():
+    """True when *path* resolves inside ``<project_root>/branches/``."""
+    normalized = _normalize_path(path)
+    if not normalized:
         return False
-    try:
-        real_path = os.path.realpath(os.path.abspath(str(path).strip()))
-    except Exception:
-        return False
-
-    branches_root = get_canonical_branches_root(project_root or real_path)
-    try:
-        common = os.path.commonpath([branches_root, real_path])
-    except Exception:
-        return False
-
-    if common != branches_root:
-        return False
-
-    rel = os.path.relpath(real_path, branches_root)
-    return rel != "." and not rel.startswith("..")
-
-
-def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str) -> str:
-    """Return the stable repository root for *workspace_path* via git metadata (#460)."""
-    p = (workspace_path or "").strip()
-    if p:
-        try:
-            res = subprocess.run(
-                ["git", "-C", p, "rev-parse", "--git-common-dir"],
-                capture_output=True,
-                text=True,
-                check=True,
-            )
-            common = _realpath_git_common_dir(p, res.stdout)
-            if common.endswith(f"{os.sep}.git") or os.path.basename(common) == ".git":
-                candidate_root = os.path.dirname(common)
-                real_p = os.path.realpath(p)
-                try:
-                    if os.path.commonpath([candidate_root, real_p]) == candidate_root:
-                        return candidate_root
-                except Exception:
-                    pass
-        except Exception:
-            pass
-
-    fallback = os.path.realpath(fallback_project_root or workspace_path or ".")
-    norm = fallback.replace("\\", "/")
-    if "/branches/" in norm:
-        return os.path.realpath(norm.split("/branches/")[0])
-    elif norm.endswith("/branches"):
-        return os.path.realpath(os.path.dirname(fallback))
-
-    return fallback
+    if "/branches/" in f"{normalized}/":
+        return True
+    if normalized.endswith("/branches"):
+        return True
+    if project_root:
+        root = _normalize_path(os.path.realpath(project_root))
+        real = _normalize_path(os.path.realpath(path))
+        if real.startswith(f"{root}/"):
+            rel = real[len(root) + 1 :]
+            return rel == "branches" or rel.startswith("branches/")
+    return False
 
 
 def resolve_mutation_workspace(
@@ -131,6 +87,29 @@ def _realpath_git_common_dir(workspace_path: str, common_dir: str) -> str:
     return os.path.realpath(os.path.join(workspace_path, raw))
 
 
+def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str) -> str:
+    """Return the stable repository root for *workspace_path* via git metadata (#460)."""
+    path = (workspace_path or "").strip()
+    fallback = os.path.realpath(fallback_project_root)
+    if not path:
+        return fallback
+    try:
+        res = subprocess.run(
+            ["git", "-C", path, "rev-parse", "--git-common-dir"],
+            capture_output=True,
+            text=True,
+            check=True,
+        )
+        common = _realpath_git_common_dir(path, res.stdout)
+    except Exception:
+        return fallback
+    if common.endswith(f"{os.sep}.git"):
+        return os.path.dirname(common)
+    if os.path.basename(common) == ".git":
+        return os.path.dirname(common)
+    return fallback
+
+
 def resolve_author_mutation_context(
     worktree_path: str | None,
     process_project_root: str,

create_issue_bootstrap.py

@@ -247,8 +247,7 @@ def bootstrap_permits_control_checkout(
     """
     if not isinstance(assessment, dict):
         return False
-    import author_issue_bootstrap
-    if not is_create_issue_task(task) and not author_issue_bootstrap.is_author_issue_bootstrap_task(task):
+    if not is_create_issue_task(task):
         return False
 
     # Positive proof: the assessment must affirmatively allow, with no

docs/mcp-tool-inventory.md

@@ -69,7 +69,6 @@ that gates each call, not which tools exist.
 - `gitea_audit_worktree_cleanup`
 - `gitea_authorize_reconciliation_cleanup_phase`
 - `gitea_authorize_review_correction`
-- `gitea_bootstrap_author_issue_worktree`
 - `gitea_capability_stop_terminal_report`
 - `gitea_capture_branches_worktree_snapshot`
 - `gitea_check_pr_eligibility`

gitea_mcp_server.py

@@ -440,13 +440,32 @@ def _session_author_lock_worktree() -> str | None:
 
     Used to derive the author mutation workspace when no explicit
     ``worktree_path`` or env binding is provided. Never invents a path.
+
+    #864: a session pointer whose owner PID is dead and is not this process
+    must not force workspace binding for other issues — rebind is required for
+    that issue, and a stale dead-owner pointer must not poison unrelated work.
     """
     try:
         lock = issue_lock_store.read_session_issue_lock() or {}
     except Exception:
         return None
     path = (lock.get("worktree_path") or "").strip()
-    return path or None
+    if not path:
+        return None
+    pid = lock.get("session_pid")
+    if pid is None:
+        pid = lock.get("pid")
+    try:
+        pid_i = int(pid) if pid is not None else None
+    except (TypeError, ValueError):
+        pid_i = None
+    if (
+        pid_i is not None
+        and pid_i != os.getpid()
+        and not issue_lock_store.is_process_alive(pid_i)
+    ):
+        return None
+    return path
 
 
 def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
@@ -958,32 +977,6 @@ def _create_issue_bootstrap_assessment(
     """
     import create_issue_bootstrap as _cib
 
-    import author_issue_bootstrap as _aib
-    if _aib.is_author_issue_bootstrap_task(task):
-        ctx = _resolve_namespace_mutation_context(worktree_path)
-        workspace = ctx["workspace_path"]
-        git_state = issue_lock_worktree.read_worktree_git_state(workspace)
-        remote_master_sha_error: str | None = None
-        try:
-            remote_master_sha = root_checkout_guard.resolve_remote_master_sha(
-                ctx["canonical_repo_root"]
-            )
-        except Exception as exc:
-            remote_master_sha = None
-            remote_master_sha_error = (
-                f"{type(exc).__name__}: {exc}".strip() or "resolver failed"
-            )
-        return _aib.assess_author_issue_bootstrap(
-            workspace_path=workspace,
-            canonical_repo_root=ctx["canonical_repo_root"],
-            current_branch=git_state.get("current_branch"),
-            head_sha=git_state.get("head_sha"),
-            porcelain_status=git_state.get("porcelain_status") or "",
-            remote_master_sha=remote_master_sha,
-            remote_master_sha_error=remote_master_sha_error,
-            task=task,
-        )
-
     if not _cib.is_create_issue_task(task):
         return None
 
@@ -1476,7 +1469,7 @@ def verify_preflight_purity(
             dirty_files = sorted(
                 _parse_porcelain_entries(_get_workspace_porcelain(workspace))
             )
-            if dirty_files and task != "commit_files":
+            if dirty_files:
                 raise RuntimeError(
                     nwb.format_namespace_workspace_binding_error(
                         role_kind=role,
@@ -2057,6 +2050,7 @@ import issue_lock_store  # noqa: E402
 import issue_lock_adoption  # noqa: E402
 import issue_lock_recovery  # noqa: E402
 import issue_lock_renewal  # noqa: E402
+import dirty_same_claimant_session_rebind  # noqa: E402  # #864
 import stacked_pr_support  # noqa: E402
 import merge_approval_gate  # noqa: E402
 import review_quarantine  # noqa: E402  # #695 contaminated formal-review quarantine
@@ -4368,6 +4362,263 @@ def gitea_lock_issue(
     return result
 
 
+@mcp.tool()
+def gitea_rebind_dirty_same_claimant_author_session(
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    old_pid: int,
+    expected_local_head: str,
+    expected_remote_head: str,
+    expected_dirty_paths: list[str],
+    expected_fingerprints: dict,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    dry_run: bool = False,
+    authorize_reconciler_execute: bool = False,
+) -> dict:
+    """Rebind a dirty registered issue worktree to this session (#864).
+
+    Sanctioned only when every pin agrees: same claimant, dead old_pid matching
+    the durable lock, matching local/remote heads, exact dirty path set, and
+    per-path sha256 fingerprints. Preserves every tracked/untracked byte.
+    Does not sync remote, create recovery worktrees, clean, reset, or move heads.
+
+    Role gate:
+    * author — must match the lock claimant identity/profile
+    * reconciler — execute only when ``authorize_reconciler_execute=True``
+    * reviewer/merger — always refuse
+
+    ``gitea.issue.comment`` (author map entry) is required for mutation; dry_run
+    still assesses fully but writes nothing. Permission alone is never ownership
+    proof — every pin is re-checked server-side.
+
+    Args:
+        issue_number: Tracking issue number on the durable lock.
+        branch_name: Exact locked branch name.
+        worktree_path: Registered dirty worktree path (must be under branches/).
+        old_pid: Dead owner PID recorded on the lock (must match session_pid/pid).
+        expected_local_head: Full local HEAD sha the caller observed.
+        expected_remote_head: Full remote-tracking HEAD sha the caller observed.
+        expected_dirty_paths: Exact set of dirty relative paths (tracked+untracked).
+        expected_fingerprints: Map of relative path -> sha256 hex of file bytes.
+        remote: Known instance — 'dadeschools' or 'prgs'.
+        host/org/repo: Optional target overrides (validated against binding).
+        dry_run: When true, assess only (no lock/session writes).
+        authorize_reconciler_execute: Reconciler-only execute gate.
+    """
+    role = _profile_role_kind(get_profile())
+    role_norm = (role or "").strip().lower()
+
+    # Permission: authors need comment; dry_run assess is reachable under read
+    # for diagnosis, but execute always needs comment. Reconciler execute also
+    # needs comment when authorized.
+    if dry_run:
+        read_block = _profile_operation_gate("gitea.read")
+        if read_block:
+            return {
+                "success": False,
+                "dry_run": True,
+                "reasons": read_block,
+                "permission_report": _permission_block_report("gitea.read"),
+            }
+    else:
+        blocked = _profile_permission_block(
+            task_capability_map.required_permission(
+                "rebind_dirty_same_claimant_author_session"
+            ),
+            issue_number=issue_number,
+            remote=remote,
+            host=host,
+            org=org,
+            repo=repo,
+            org_explicit=org is not None,
+            repo_explicit=repo is not None,
+        )
+        if blocked:
+            return blocked
+
+    if role_norm in {"reviewer", "merger"}:
+        return {
+            "success": False,
+            "dry_run": bool(dry_run),
+            "outcome": dirty_same_claimant_session_rebind.REFUSED,
+            "reasons": [
+                f"role '{role_norm}' cannot rebind dirty same-claimant author "
+                "sessions (fail closed)"
+            ],
+        }
+    if role_norm == "reconciler" and not authorize_reconciler_execute and not dry_run:
+        return {
+            "success": False,
+            "dry_run": False,
+            "outcome": dirty_same_claimant_session_rebind.REFUSED,
+            "reasons": [
+                "reconciler role requires authorize_reconciler_execute=True "
+                "to execute dirty same-claimant rebind (fail closed)"
+            ],
+        }
+
+    h, o, r = _resolve(remote, host, org, repo)
+    try:
+        identity = _authenticated_username(h)
+    except Exception:
+        identity = None
+    profile = get_profile()
+    profile_name = profile.get("profile_name")
+
+    existing = _load_existing_issue_lock(
+        remote=remote, org=o, repo=r, issue_number=issue_number
+    )
+    resolved_wt = os.path.realpath(os.path.abspath((worktree_path or "").strip()))
+    inv = dirty_same_claimant_session_rebind.collect_dirty_inventory(resolved_wt)
+
+    branch_res = subprocess.run(
+        ["git", "-C", resolved_wt, "branch", "--show-current"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    current_branch = (branch_res.stdout or "").strip() or None
+    head_res = subprocess.run(
+        ["git", "-C", resolved_wt, "rev-parse", "HEAD"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    local_head = (head_res.stdout or "").strip() if head_res.returncode == 0 else None
+
+    # Observe remote-tracking head without network when possible.
+    remote_head = None
+    for ref in (
+        f"refs/remotes/origin/{branch_name}",
+        f"origin/{branch_name}",
+        f"refs/remotes/{remote}/{branch_name}",
+        f"{remote}/{branch_name}",
+    ):
+        rh = subprocess.run(
+            ["git", "-C", resolved_wt, "rev-parse", "--verify", "--quiet", ref],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if rh.returncode == 0 and (rh.stdout or "").strip():
+            remote_head = (rh.stdout or "").strip()
+            break
+    if remote_head is None:
+        # Fall back to caller's pin only for observation absence — assessment
+        # still requires pin==observed, so missing observation fails closed.
+        remote_head = None
+
+    # Competing live locks (other issues / other worktrees).
+    competing_live = []
+    for entry in issue_lock_store.list_live_locks():
+        competing_live.append(entry)
+
+    # Session pointers that claim this issue lock.
+    competing_sessions = []
+    lock_dir = issue_lock_store.default_lock_dir()
+    lock_path = issue_lock_store.lock_file_path(
+        remote=remote, org=o, repo=r, issue_number=issue_number, lock_dir=lock_dir
+    )
+    try:
+        for name in os.listdir(lock_dir):
+            if not name.startswith("session-") or not name.endswith(".json"):
+                continue
+            ptr = issue_lock_store.read_lock_file(os.path.join(lock_dir, name))
+            if not ptr:
+                continue
+            ptr_lock = str(ptr.get("lock_file_path") or "").strip()
+            if not ptr_lock:
+                continue
+            try:
+                same = os.path.realpath(ptr_lock) == os.path.realpath(lock_path)
+            except OSError:
+                same = ptr_lock == lock_path
+            if not same:
+                continue
+            try:
+                sess_pid = int(str(name)[len("session-") : -len(".json")])
+            except ValueError:
+                sess_pid = ptr.get("pid")
+            competing_sessions.append(
+                {
+                    "pid": sess_pid,
+                    "lock_file_path": ptr_lock,
+                    "live": issue_lock_store.is_process_alive(sess_pid),
+                }
+            )
+    except OSError:
+        pass
+
+    # Best-effort workflow-lease scan: any live lock file whose work_lease is a
+    # non-author workflow lease on this issue/branch counts as active.
+    workflow_lease_active = False
+    for path in issue_lock_store.iter_lock_files(lock_dir):
+        rec = issue_lock_store.read_lock_file(path)
+        if not rec:
+            continue
+        lease = rec.get("work_lease") if isinstance(rec.get("work_lease"), dict) else {}
+        op = str(lease.get("operation_type") or "")
+        if op and op != issue_lock_store.AUTHOR_ISSUE_WORK_LEASE:
+            if rec.get("issue_number") == issue_number or str(
+                rec.get("branch_name") or ""
+            ) == branch_name:
+                if issue_lock_store.is_lease_live(rec):
+                    workflow_lease_active = True
+                    break
+
+    repo_root = _canonical_local_git_root()
+    # permission_allowed reflects profile gate only — never ownership proof.
+    permission_allowed = True
+
+    result = dirty_same_claimant_session_rebind.apply_dirty_same_claimant_session_rebind(
+        remote=remote,
+        org=o,
+        repo=r,
+        issue_number=issue_number,
+        branch_name=branch_name,
+        worktree_path=resolved_wt,
+        claimant_identity=identity,
+        claimant_profile=profile_name,
+        old_pid=old_pid,
+        expected_local_head=expected_local_head,
+        expected_remote_head=expected_remote_head,
+        expected_dirty_paths=list(expected_dirty_paths or []),
+        expected_fingerprints=dict(expected_fingerprints or {}),
+        existing_lock=existing,
+        current_identity=identity,
+        current_profile=profile_name,
+        role_kind=role_norm or role,
+        current_pid=os.getpid(),
+        current_branch=current_branch,
+        local_head=local_head,
+        remote_head=remote_head,
+        dirty_inventory=inv,
+        competing_live_locks=competing_live,
+        competing_sessions=competing_sessions,
+        workflow_lease_active=workflow_lease_active,
+        authorize_reconciler_execute=bool(authorize_reconciler_execute),
+        permission_allowed=permission_allowed,
+        repo_root=repo_root,
+        dry_run=bool(dry_run),
+        lock_dir=lock_dir,
+    )
+    result["observed"] = {
+        "local_head": local_head,
+        "remote_head": remote_head,
+        "current_branch": current_branch,
+        "dirty_paths": inv.get("dirty_paths"),
+        "fingerprints": inv.get("fingerprints"),
+        "identity": identity,
+        "profile": profile_name,
+        "role_kind": role_norm,
+    }
+    return result
+
+
 @mcp.tool()
 def gitea_assess_work_issue_duplicate(
     issue_number: int,
@@ -9036,7 +9287,6 @@ def gitea_commit_files(
     host: str | None = None,
     org: str | None = None,
     repo: str | None = None,
-    worktree_path: str | None = None,
 ) -> dict:
     """Commit changes to multiple files in a Gitea repository in a single atomic commit.
 
@@ -9049,46 +9299,10 @@ def gitea_commit_files(
         host: Override the Gitea host.
         org: Override the owner/organization.
         repo: Override the repository name.
-        worktree_path: Optional worktree path for author mutation context.
 
     Returns:
         dict with success status and commit/branch information.
     """
-    if worktree_path is None:
-        lock_data = issue_lock_store.read_session_issue_lock() or {}
-        worktree_path = lock_data.get("worktree_path")
-        if not worktree_path:
-            try:
-                prof = get_profile()
-                uname = prof.get("username") or prof.get("profile_name")
-                for path in issue_lock_store.iter_lock_files():
-                    lk = issue_lock_store.read_lock_file(path) or {}
-                    claimant = lk.get("claimant") or {}
-                    if lk.get("remote") == remote and (claimant.get("username") == uname or lk.get("profile") == prof.get("profile_name")):
-                        issue_lock_store.bind_session_lock(lk, renewal_sanctioned=True)
-                        worktree_path = lk.get("worktree_path")
-                        break
-            except Exception:
-                pass
-
-    if worktree_path is None and files:
-        for f in files:
-            p = f.get("workspace_path") or f.get("local_path") or ""
-            if p and os.path.isabs(p):
-                real_p = os.path.realpath(p)
-                real_root = os.path.realpath(PROJECT_ROOT)
-                branches_dir = os.path.join(real_root, "branches")
-                if real_p.startswith(branches_dir + os.sep):
-                    rel_sub = os.path.relpath(real_p, branches_dir)
-                    wt_folder = rel_sub.split(os.sep)[0]
-                    if wt_folder and wt_folder != "..":
-                        worktree_path = os.path.join(branches_dir, wt_folder)
-                        break
-
-    if worktree_path:
-        os.environ["GITEA_AUTHOR_WORKTREE"] = worktree_path
-        os.environ["GITEA_ACTIVE_WORKTREE"] = worktree_path
-
     ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
         "commit_files"
     )
@@ -9101,7 +9315,7 @@ def gitea_commit_files(
             "reasons": block_reasons,
         }
     blocked = _namespace_mutation_block(
-        "commit_files", commit="", branch="", remote=remote, worktree_path=worktree_path
+        "commit_files", commit="", branch="", remote=remote
     )
     if blocked:
         return blocked
@@ -9129,7 +9343,7 @@ def gitea_commit_files(
         )
 
     # #735: forward explicit org/repo into shared anti-stomp preflight.
-    verify_preflight_purity(remote=remote, worktree_path=worktree_path, task="commit_files", org=org, repo=repo)
+    verify_preflight_purity(remote, task="commit_files", org=org, repo=repo)
     processed_files, source_proofs = _prepare_commit_payload_files(files)
 
     h, o, r = _resolve(remote, host, org, repo)
@@ -9406,96 +9620,6 @@ def gitea_publish_unpublished_issue_branch(
     }
 
 
-@mcp.tool()
-def gitea_bootstrap_author_issue_worktree(
-    issue_number: int,
-    assignment_id: str | None = None,
-    lease_id: str | None = None,
-    expected_base_sha: str | None = None,
-    branch_name: str | None = None,
-    worktree_path: str | None = None,
-    idempotency_key: str | None = None,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    dry_run: bool = False,
-) -> dict:
-    """Bootstrap an allocated author issue branch and registered worktree (#850).
-
-    Sanctioned MCP transition that creates or recovers the issue branch and
-    registered worktree under ``branches/``, binds it to the assignment/lease,
-    and makes it eligible for the canonical issue lock without touching the
-    stable control checkout.
-
-    Args:
-        issue_number: Allocated issue number to bootstrap.
-        assignment_id: Optional allocation assignment ID.
-        lease_id: Optional workflow lease ID.
-        expected_base_sha: Authoritative expected base SHA / concurrency pin.
-        branch_name: Optional custom branch name (must match issue-<N> pattern).
-        worktree_path: Optional custom worktree path under branches/.
-        idempotency_key: Optional key for idempotent replay/resume.
-        remote: Known instance — 'dadeschools' or 'prgs'.
-        host: Override Gitea host.
-        org: Override Org.
-        repo: Override Repo.
-        dry_run: Report planned transition without mutating repository.
-    """
-    task = "bootstrap_author_issue_worktree"
-    ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
-        task
-    )
-    if not ok:
-        return _author_mutation_block(block_reasons)
-
-    blocked = _namespace_mutation_block(task, remote=remote)
-    if blocked:
-        return blocked
-    blocked = _profile_permission_block(
-        task_capability_map.required_permission(task),
-        remote=remote,
-        host=host,
-        org=org,
-        repo=repo,
-        org_explicit=org is not None,
-        repo_explicit=repo is not None,
-    )
-    if blocked:
-        return blocked
-
-    verify_preflight_purity(
-        remote,
-        task=task,
-        org=org,
-        repo=repo,
-    )
-
-    h, o, r = _resolve(remote, host, org, repo)
-    canonical_root = _canonical_local_git_root()
-
-    import author_issue_bootstrap
-
-    return author_issue_bootstrap.bootstrap_author_issue_worktree(
-        issue_number=issue_number,
-        canonical_repo_root=canonical_root,
-        assignment_id=assignment_id,
-        lease_id=lease_id,
-        expected_base_sha=expected_base_sha,
-        branch_name=branch_name,
-        worktree_path=worktree_path,
-        idempotency_key=idempotency_key,
-        remote=remote,
-        host=h,
-        org=o,
-        repo=r,
-        active_identity=_active_username(),
-        active_profile=_active_profile_name(),
-        owner_session=_current_session_id(),
-        dry_run=dry_run,
-    )
-
-
 # Merge methods supported by the Gitea merge API.
 _MERGE_METHODS = ("merge", "squash", "rebase")
 
@@ -11395,127 +11519,163 @@ def gitea_reconcile_merged_cleanups(
     if dry_run:
         report["dry_run"] = True
         report["executed"] = False
+        # #851: surface planned lifecycle order so dry-run matches execute.
+        report["planned_execution_orders"] = {
+            str(entry.get("pr_number")): entry.get("planned_execution_order") or []
+            for entry in (report.get("entries") or [])
+        }
         return {"success": True, "performed": False, **report}
 
     verify_preflight_purity(
         remote, task="reconcile_merged_cleanups", org=org, repo=repo
     )
     actions: list[dict] = []
+    project_root = _canonical_local_git_root()
+
+    def _ownership_records_for_branch(
+        head_branch: str, pr_num_int: int | None
+    ) -> list[dict]:
+        ownership_bundle = _collect_branch_ownership_records(
+            remote=remote,
+            host=h,
+            org=o,
+            repo=r,
+            branch=head_branch,
+            pr_number=pr_num_int,
+            project_root=project_root,
+            auth=auth,
+            base_api=base,
+        )
+        ownership_records = list(ownership_bundle.get("records") or [])
+        if ownership_bundle.get("inventory_error"):
+            ownership_records.append(
+                {
+                    "category": (
+                        branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
+                    ),
+                    "status": "unknown",
+                    "remote": remote,
+                    "host": h,
+                    "org": o,
+                    "repo": r,
+                    "branch": head_branch,
+                    "reclaim_allowed": False,
+                    "role": "inventory",
+                }
+            )
+        return ownership_records
+
+    def _attempt_owned_remote_delete(
+        *,
+        head_branch: str,
+        pr_num_int: int | None,
+        after_worktree_removal: bool = False,
+    ) -> dict:
+        """Fail-closed remote delete with live ownership reassessment (#851)."""
+        import urllib.parse
+
+        ownership_records = _ownership_records_for_branch(head_branch, pr_num_int)
+        ownership = branch_cleanup_guard.assess_active_branch_ownership(
+            remote=remote,
+            org=o,
+            repo=r,
+            branch=head_branch,
+            host=h,
+            records=ownership_records,
+        )
+        if ownership.get("block"):
+            return {
+                "action": "delete_remote_branch",
+                "branch": head_branch,
+                "success": False,
+                "performed": False,
+                "delete_acknowledged": False,
+                "verified_absent": False,
+                "blocker_kind": "active_branch_ownership",
+                "reasons": ownership.get("reasons") or [],
+                "blocking_categories": ownership.get("blocking_categories") or [],
+                "after_worktree_removal": after_worktree_removal,
+                "ownership_reassessed": after_worktree_removal,
+            }
+
+        encoded = urllib.parse.quote(head_branch, safe="")
+        url = f"{base}/branches/{encoded}"
+        with _audited(
+            "delete_branch",
+            host=h,
+            remote=remote,
+            org=o,
+            repo=r,
+            target_branch=head_branch,
+            request_metadata={
+                "branch": head_branch,
+                "source": "reconcile_merged_cleanups",
+                "ownership_checked": True,
+                "after_worktree_removal": after_worktree_removal,
+            },
+        ):
+            api_request("DELETE", url, auth)
+        readback = _probe_remote_branch(h, o, r, auth, head_branch)
+        readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
+            readback
+        )
+        verified = bool(readback_assessment.get("verified_absent"))
+        return {
+            "action": "delete_remote_branch",
+            "branch": head_branch,
+            "success": bool(readback_assessment.get("ok")),
+            "performed": True,
+            "delete_acknowledged": True,
+            "verified_absent": verified,
+            "readback": readback_assessment.get("readback"),
+            "reasons": readback_assessment.get("reasons") or [],
+            "after_worktree_removal": after_worktree_removal,
+            "ownership_reassessed": after_worktree_removal,
+        }
+
     for entry in report.get("entries") or []:
         head_branch = entry.get("head_branch") or ""
         remote_assessment = entry.get("remote_branch") or {}
         local_assessment = entry.get("local_worktree") or {}
+        pr_num = entry.get("pr_number")
+        try:
+            pr_num_int = int(pr_num) if pr_num is not None else None
+        except (TypeError, ValueError):
+            pr_num_int = None
 
-        if remote_assessment.get("safe_to_delete_remote"):
-            import urllib.parse
-
-            pr_num = entry.get("pr_number")
-            try:
-                pr_num_int = int(pr_num) if pr_num is not None else None
-            except (TypeError, ValueError):
-                pr_num_int = None
-            ownership_bundle = _collect_branch_ownership_records(
-                remote=remote,
-                host=h,
-                org=o,
-                repo=r,
-                branch=head_branch,
-                pr_number=pr_num_int,
-                project_root=_canonical_local_git_root(),
-                auth=auth,
-                base_api=base,
-            )
-            ownership_records = list(ownership_bundle.get("records") or [])
-            if ownership_bundle.get("inventory_error"):
-                ownership_records.append(
-                    {
-                        "category": (
-                            branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
-                        ),
-                        "status": "unknown",
-                        "remote": remote,
-                        "host": h,
-                        "org": o,
-                        "repo": r,
-                        "branch": head_branch,
-                        "reclaim_allowed": False,
-                        "role": "inventory",
-                    }
-                )
-            ownership = branch_cleanup_guard.assess_active_branch_ownership(
-                remote=remote,
-                org=o,
-                repo=r,
-                branch=head_branch,
-                host=h,
-                records=ownership_records,
-            )
-            if ownership.get("block"):
-                actions.append(
-                    {
-                        "action": "delete_remote_branch",
-                        "branch": head_branch,
-                        "success": False,
-                        "performed": False,
-                        "delete_acknowledged": False,
-                        "verified_absent": False,
-                        "blocker_kind": "active_branch_ownership",
-                        "reasons": ownership.get("reasons") or [],
-                        "blocking_categories": ownership.get(
-                            "blocking_categories"
-                        )
-                        or [],
-                    }
-                )
-                continue
-
-            encoded = urllib.parse.quote(head_branch, safe="")
-            url = f"{base}/branches/{encoded}"
-            with _audited(
-                "delete_branch",
-                host=h,
-                remote=remote,
-                org=o,
-                repo=r,
-                target_branch=head_branch,
-                request_metadata={
-                    "branch": head_branch,
-                    "source": "reconcile_merged_cleanups",
-                    "ownership_checked": True,
-                },
-            ):
-                api_request("DELETE", url, auth)
-            readback = _probe_remote_branch(h, o, r, auth, head_branch)
-            readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
-                readback
-            )
-            verified = bool(readback_assessment.get("verified_absent"))
-            actions.append(
-                {
-                    "action": "delete_remote_branch",
-                    "branch": head_branch,
-                    "success": bool(readback_assessment.get("ok")),
-                    "performed": True,
-                    "delete_acknowledged": True,
-                    "verified_absent": verified,
-                    "readback": readback_assessment.get("readback"),
-                    "reasons": readback_assessment.get("reasons") or [],
-                }
-            )
-
+        # #851 lifecycle: when the target worktree is independently safe, remove
+        # it first so worktree_binding ownership does not permanently strand
+        # both the worktree and the remote branch. Never skip worktree removal
+        # merely because remote delete would be blocked by that binding.
+        # Ownership protection for remote delete remains fail-closed below.
+        worktree_removed = False
         if local_assessment.get("safe_to_remove_worktree"):
             result = merged_cleanup_reconcile.remove_local_worktree(
-                _canonical_local_git_root(),
+                project_root,
                 head_branch,
                 worktree_path=local_assessment.get("worktree_path"),
             )
             actions.append({"action": "remove_local_worktree", **result})
+            # Idempotent resume: absent worktree is already gone.
+            msg = (result.get("message") or "").lower()
+            worktree_removed = bool(result.get("success")) or (
+                "not found" in msg
+            )
+
+        if remote_assessment.get("safe_to_delete_remote"):
+            actions.append(
+                _attempt_owned_remote_delete(
+                    head_branch=head_branch,
+                    pr_num_int=pr_num_int,
+                    after_worktree_removal=worktree_removed,
+                )
+            )
 
     for scratch in report.get("reviewer_scratch_entries") or []:
         if not scratch.get("safe_to_remove_worktree"):
             continue
         result = merged_cleanup_reconcile.remove_reviewer_scratch_worktree(
-            _canonical_local_git_root(), scratch.get("worktree_path") or ""
+            project_root, scratch.get("worktree_path") or ""
         )
         actions.append({"action": "remove_reviewer_scratch_worktree", **result})
 
@@ -11751,6 +11911,7 @@ def gitea_audit_worktree_cleanup(
     org: str | None = None,
     repo: str | None = None,
     ttl_hours: float = worktree_cleanup_audit.DEFAULT_TTL_HOURS,
+    merged_pr_limit: int = 200,
 ) -> dict:
     """Read-only: classify every session-owned worktree under ``branches/`` (#401).
 
@@ -11761,17 +11922,26 @@ def gitea_audit_worktree_cleanup(
     the active issue-lock branch is read from the local lock file and treated
     as active work. Deletes nothing and mutates no Gitea state.
 
-    Fails closed if the live open-PR list cannot be fetched: without it,
-    removability cannot be proven, so no candidates are returned.
+    Merged PRs are fetched as well, so an issue worktree can be linked to the
+    PR that owns its branch (#858). Such a worktree only becomes removable
+    when that owning PR is unambiguous and merged, the worktree head is
+    already contained in authoritative master, and nothing else protects it —
+    no open or competing PR, lease, issue lock, live session, dirty file, or
+    protected/control checkout. Anything unproven keeps it classified as
+    active issue work.
+
+    Fails closed if the live open-PR list, the merged-PR list, or the
+    control-plane lease state cannot be read: without them removability
+    cannot be proven, so no candidates are returned.
 
     Args:
         remote: Known instance — 'dadeschools' or 'prgs'.
         host: Override the Gitea host.
         org: Override the owner/organization.
         repo: Override the repository name.
-        ttl_hours: Age (hours) after which a clean issue/conflict-fix
-            worktree becomes stale-removable (default from
-            GITEA_WORKTREE_TTL_HOURS).
+        ttl_hours: Age (hours) after which a clean conflict-fix worktree
+            becomes stale-removable (default from GITEA_WORKTREE_TTL_HOURS).
+        merged_pr_limit: Max closed PRs scanned for merged-PR ownership.
 
     Returns:
         dict with per-worktree classifications, counts, removable
@@ -11807,22 +11977,84 @@ def gitea_audit_worktree_cleanup(
         if (pr.get("head") or {}).get("ref")
     }
 
+    # #858: merged PRs are the ownership evidence that lets a landed issue
+    # worktree stop being reported as active work. Without them the audit can
+    # never agree with the PR-scoped reconciler, so treat a fetch failure the
+    # same way an open-PR fetch failure is treated: fail closed.
+    try:
+        closed_prs = api_get_all(
+            f"{repo_api_url(h, o, r)}/pulls?state=closed", auth, limit=merged_pr_limit
+        )
+    except Exception as exc:
+        return {
+            "success": False,
+            "performed": False,
+            "open_pr_state_verified": True,
+            "merged_pr_state_verified": False,
+            "reasons": [
+                "could not fetch merged PRs; worktree ownership unverified "
+                f"(fail closed): {_redact(str(exc))}"
+            ],
+        }
+    merged_prs = [pr for pr in closed_prs if (pr.get("merged") or pr.get("merged_at"))]
+    pr_index = worktree_cleanup_audit.build_pr_index(list(open_prs) + merged_prs)
+
+    # #858: the auditor already accepted lease evidence but nothing ever
+    # supplied it, so every worktree looked unleased. Removability is now
+    # reachable for issue worktrees, so authoritative control-plane leases
+    # must be readable or the audit fails closed.
+    db, lease_errs = _control_plane_db_or_error()
+    if db is None:
+        return {
+            "success": False,
+            "performed": False,
+            "open_pr_state_verified": True,
+            "merged_pr_state_verified": True,
+            "lease_state_verified": False,
+            "reasons": [
+                "could not read control-plane leases; worktree protection "
+                "unverified (fail closed)",
+                *lease_errs,
+            ],
+        }
+    lease_result = lease_lifecycle.list_active_leases(
+        db, remote=remote, org=o, repo=r, include_non_active=False, limit=500
+    )
+    leased_issue_numbers: set[int] = set()
+    live_session_paths: set[str] = set()
+    for lease in lease_result.get("leases") or []:
+        if lease.get("work_kind") == "issue" and lease.get("work_number") is not None:
+            try:
+                leased_issue_numbers.add(int(lease["work_number"]))
+            except (TypeError, ValueError):
+                pass
+        if lease.get("worktree_path"):
+            live_session_paths.add(str(lease["worktree_path"]))
+
     active_issue_branches: set[str] = set()
     lock = merged_cleanup_reconcile.read_issue_lock(ISSUE_LOCK_FILE)
     if lock and lock.get("branch_name"):
         active_issue_branches.add(str(lock["branch_name"]).strip())
 
+    master_ref = f"{remote}/master" if remote in REMOTES else "origin/master"
     report = worktree_cleanup_audit.audit_branches_directory(
         _canonical_local_git_root(),
         open_pr_branches=open_pr_branches,
         active_issue_branches=active_issue_branches,
         now=datetime.now(timezone.utc),
         ttl_hours=ttl_hours,
+        pr_index=pr_index,
+        leased_issue_numbers=leased_issue_numbers,
+        live_session_paths=live_session_paths,
+        master_ref=master_ref,
     )
     return {
         "success": True,
         "performed": False,
         "open_pr_state_verified": True,
+        "merged_pr_state_verified": True,
+        "lease_state_verified": True,
+        "master_ref": master_ref,
         "task_mode": "work-issue",
         **report,
     }
@@ -19356,12 +19588,6 @@ def gitea_resolve_task_capability(
     task: str,
     remote: str = "dadeschools",
     host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    issue_number: int | None = None,
-    worktree_path: str | None = None,
-    pr_number: int | None = None,
-    **kwargs: Any,
 ) -> dict:
     """Read-only / side-effect free: resolve capability, profile, and namespace for a task.
 
@@ -19378,14 +19604,13 @@ def gitea_resolve_task_capability(
         remote: Known remote instance name.
         host: Optional override for the Gitea host.
     """
-    task_key = task_capability_map._canonical_preflight_task(task)
     TASK_MAP = task_capability_map.TASK_CAPABILITY_MAP
     # Every fresh attempt invalidates the previous task/role stamp before any
     # fallible resolver work. Unknown/malformed tasks and unexpected failures
     # therefore remain fail-closed instead of preserving stale authority.
     _clear_resolved_capability_stamp()
 
-    if task_key not in TASK_MAP:
+    if task not in TASK_MAP:
         # #723: structured fail-closed unknown_task (never raise into internal_error).
         profile = get_profile()
         h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
@@ -19431,8 +19656,8 @@ def gitea_resolve_task_capability(
             result["cleared_stale_denial"] = True
         return result
 
-    required_permission = task_capability_map.required_permission(task_key)
-    required_role = task_capability_map.required_role(task_key)
+    required_permission = task_capability_map.required_permission(task)
+    required_role = task_capability_map.required_role(task)
     role_exclusive_tasks = task_capability_map.ROLE_EXCLUSIVE_TASKS
 
     infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
@@ -19618,10 +19843,7 @@ def gitea_resolve_task_capability(
     available_in_session = allowed_in_current_session
     runtime_stale_blocker = False
 
-    if (
-        "PYTEST_CURRENT_TEST" not in os.environ
-        or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ
-    ) and os.environ.get("GITEA_ALLOW_STALE_RUNTIME") != "1":
+    if "PYTEST_CURRENT_TEST" not in os.environ or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ:
         runtime_reasons = _check_mcp_runtimes_diagnostics(task, matching_profiles)
         if runtime_reasons:
             restart_required = True

issue_lock_provenance.py

@@ -16,11 +16,16 @@ ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock
 SOURCE_LOCK_ISSUE = "gitea_lock_issue"
 SOURCE_LOCK_ADOPTION = "gitea_lock_issue_adoption"
 SOURCE_OPERATOR_OVERRIDE = "operator_override"
+# #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
+SOURCE_DIRTY_SAME_CLAIMANT_REBIND = (
+    "gitea_rebind_dirty_same_claimant_author_session"
+)
 
 SANCTIONED_LOCK_SOURCES = frozenset({
     SOURCE_LOCK_ISSUE,
     SOURCE_LOCK_ADOPTION,
     SOURCE_OPERATOR_OVERRIDE,
+    SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
 })
 
 _OPERATOR_OVERRIDE_ENV = "GITEA_ISSUE_LOCK_OPERATOR_OVERRIDE"

role_session_router.py

@@ -73,8 +73,6 @@ AUTHOR_TASKS = frozenset({
     "claim_issue",
     "create_branch",
     "push_branch",
-    "bootstrap_author_issue_worktree",
-    "gitea_bootstrap_author_issue_worktree",
     "create_pr",
     "comment_pr",
     "address_pr_change_requests",

task_capability_map.py

@@ -32,6 +32,17 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
+    # #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
+    # Author MCP tool path. Reconciler execute is gated inside the tool via
+    # authorize_reconciler_execute + role_kind checks (not this map entry).
+    "rebind_dirty_same_claimant_author_session": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "gitea_rebind_dirty_same_claimant_author_session": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
     "set_issue_labels": {
         "permission": "gitea.issue.comment",
         "role": "author",
@@ -58,14 +69,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.branch.create",
         "role": "author",
     },
-    "bootstrap_author_issue_worktree": {
-        "permission": "gitea.branch.create",
-        "role": "author",
-    },
-    "gitea_bootstrap_author_issue_worktree": {
-        "permission": "gitea.branch.create",
-        "role": "author",
-    },
     "push_branch": {
         "permission": "gitea.branch.push",
         "role": "author",
@@ -485,8 +488,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
 # merger lease (#763).
 _PREFLIGHT_TASK_TRANSITIONS = frozenset({
     ("review_pr", "acquire_reviewer_pr_lease"),
-    ("work_issue", "bootstrap_author_issue_worktree"),
-    ("bootstrap_author_issue_worktree", "lock_issue"),
 })
 
 
@@ -533,8 +534,6 @@ ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
-        "bootstrap_author_issue_worktree",
-        "gitea_bootstrap_author_issue_worktree",
         "publish_unpublished_branch",
         "create_pr",
         "commit_files",
@@ -560,7 +559,6 @@ ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
     "gitea_set_issue_labels": "set_issue_labels",
     "gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
     "gitea_create_label": "create_label",
-    "gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
     "gitea_commit_files": "commit_files",
 }
 

tests/test_author_issue_bootstrap.py

@@ -1,483 +0,0 @@
-"""Regression test suite for native author issue worktree bootstrap (#850)."""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-import tempfile
-import unittest
-from unittest import mock
-
-import author_issue_bootstrap
-import task_capability_map
-
-
-def _concurrent_bootstrap_worker(args: tuple[str, int, str, str, str, str]) -> dict:
-    repo_dir, issue_num, key, lock_dir, journal_dir, master_sha = args
-    os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = journal_dir
-    return author_issue_bootstrap.bootstrap_author_issue_worktree(
-        issue_number=issue_num,
-        canonical_repo_root=repo_dir,
-        expected_base_sha=master_sha,
-        idempotency_key=key,
-        lock_dir=lock_dir,
-        owner_session="session-concurrent-test",
-        active_identity="jcwalker3",
-        active_profile="prgs-author",
-    )
-
-
-class TestAuthorIssueBootstrap(unittest.TestCase):
-    """Test suite covering AC1-AC10 and comment #14959 specification."""
-
-    def setUp(self):
-        self.tmp_dir = tempfile.mkdtemp(prefix="test_bootstrap_")
-        self.repo_dir = os.path.join(self.tmp_dir, "repo")
-        os.makedirs(self.repo_dir)
-
-        # Initialize synthetic git repo
-        subprocess.run(["git", "init", "-b", "master"], cwd=self.repo_dir, check=True, capture_output=True)
-        subprocess.run(["git", "config", "user.name", "Test User"], cwd=self.repo_dir, check=True)
-        subprocess.run(["git", "config", "user.email", "[email protected]"], cwd=self.repo_dir, check=True)
-
-        readme = os.path.join(self.repo_dir, "README.md")
-        with open(readme, "w", encoding="utf-8") as f:
-            f.write("# Test Repo\n")
-        subprocess.run(["git", "add", "README.md"], cwd=self.repo_dir, check=True, capture_output=True)
-        subprocess.run(["git", "commit", "-m", "initial commit"], cwd=self.repo_dir, check=True, capture_output=True)
-
-        rev_res = subprocess.run(["git", "rev-parse", "HEAD"], cwd=self.repo_dir, capture_output=True, text=True, check=True)
-        self.master_sha = rev_res.stdout.strip()
-
-        self.branches_dir = os.path.join(self.repo_dir, "branches")
-        os.makedirs(self.branches_dir, exist_ok=True)
-        self.lock_dir = os.path.join(self.tmp_dir, "locks")
-        os.makedirs(self.lock_dir, exist_ok=True)
-        self.journal_dir = os.path.join(self.tmp_dir, "journals")
-        os.makedirs(self.journal_dir, exist_ok=True)
-        os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = self.journal_dir
-
-    def tearDown(self):
-        os.environ.pop("GITEA_BOOTSTRAP_JOURNAL_DIR", None)
-        shutil.rmtree(self.tmp_dir, ignore_errors=True)
-
-    def test_bootstrap_success_path(self):
-        """AC1/AC3/AC8: Successful bootstrap creates branch, worktree, registration, and lock proof."""
-        key = "test_key_success_1"
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            assignment_id="asn-12345",
-            lease_id="lease-67890",
-            expected_base_sha=self.master_sha,
-            idempotency_key=key,
-            remote="prgs",
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertTrue(res.get("success"), f"Bootstrap failed: {res}")
-        self.assertFalse(res.get("replayed"))
-        self.assertEqual(res.get("issue_number"), 850)
-        self.assertEqual(res.get("base_sha"), self.master_sha)
-        self.assertIn("branches/fix-issue-850-native-mcp-bootstrap", res.get("worktree_path"))
-
-        # Verify worktree directory exists and is registered
-        worktree_path = res["worktree_path"]
-        self.assertTrue(os.path.isdir(worktree_path))
-
-        wt_list = subprocess.run(["git", "-C", self.repo_dir, "worktree", "list"], capture_output=True, text=True, check=True)
-        self.assertIn(worktree_path, wt_list.stdout)
-
-        # Verify phase journal written
-        journal = author_issue_bootstrap.load_phase_journal(key, journal_dir=self.lock_dir)
-        self.assertIsNotNone(journal)
-        self.assertTrue(journal.get("completed"))
-        self.assertEqual(journal.get("current_phase"), author_issue_bootstrap.PHASE_7_TRANSITION_COMPLETED)
-
-    def test_idempotent_replay(self):
-        """Item 2: Replaying with identical key returns cached transition without duplicate creation."""
-        key = "test_key_idempotent_1"
-        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            idempotency_key=key,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertTrue(res1["success"], f"res1 failed: {res1}")
-        self.assertFalse(res1.get("replayed"))
-
-        # Second call
-        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            idempotency_key=key,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertTrue(res2["success"], f"res2 failed: {res2}")
-        self.assertTrue(res2.get("replayed"))
-        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
-
-    def test_stale_concurrency_pin_refusal(self):
-        """Item 3: Mismatched expected base SHA fails closed without silent rebasing."""
-        stale_sha = "0000000000000000000000000000000000000000"
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            expected_base_sha=stale_sha,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "stale_concurrency_pin")
-        self.assertIn("exact_next_action", res)
-
-    def test_path_outside_branches_root_refusal(self):
-        """Item 6: Worktree path outside branches/ root is refused."""
-        outside_path = os.path.join(self.tmp_dir, "outside_worktree")
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            worktree_path=outside_path,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "path_outside_canonical_branches_root")
-
-    def test_preexisting_dirty_worktree_preservation(self):
-        """Item 6: Preexisting dirty worktree fails closed and is NOT modified or cleaned."""
-        branch = "fix/issue-850-dirty-test"
-        wt_path = os.path.join(self.branches_dir, "fix-issue-850-dirty-test")
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
-
-        # Create dirty untracked file
-        dirty_file = os.path.join(wt_path, "dirty.txt")
-        with open(dirty_file, "w") as f:
-            f.write("dirty edits\n")
-
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            branch_name=branch,
-            worktree_path=wt_path,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "preexisting_dirty_worktree")
-
-        # Prove dirty file is preserved byte-for-byte
-        self.assertTrue(os.path.exists(dirty_file))
-        with open(dirty_file, "r") as f:
-            self.assertEqual(f.read(), "dirty edits\n")
-
-    def test_compensating_recovery_on_failed_phase(self):
-        """AC4/Item 4: Failure during transition rolls back ONLY newly created artifacts."""
-        key = "test_key_recovery_1"
-        # Simulate partial progress in journal
-        journal = {
-            "idempotency_key": key,
-            "issue_number": 850,
-            "branch_name": "fix/issue-850-recovery-test",
-            "worktree_path": os.path.join(self.branches_dir, "fix-issue-850-recovery-test"),
-            "artifacts_created": {
-                "branch_created": True,
-                "worktree_dir_created": True,
-                "worktree_registered": True,
-                "lock_created": False,
-            },
-            "failure_reason": "simulated lock failure",
-            "current_phase": author_issue_bootstrap.PHASE_5_REGISTRATION_VERIFIED,
-            "completed": False,
-        }
-        # Create the branch and worktree manually to simulate partial state
-        subprocess.run(["git", "-C", self.repo_dir, "branch", journal["branch_name"]], check=True, capture_output=True)
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", journal["worktree_path"], journal["branch_name"]], check=True, capture_output=True)
-
-        # Run compensating recovery
-        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir)
-        self.assertTrue(rec["executed"])
-        self.assertIn(f"worktree_path:{journal['worktree_path']}", rec["rolled_back"])
-        self.assertIn(f"branch:{journal['branch_name']}", rec["rolled_back"])
-
-        # Prove worktree directory and branch were rolled back
-        self.assertFalse(os.path.exists(journal["worktree_path"]))
-        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", journal["branch_name"]], capture_output=True, text=True, check=False)
-        self.assertNotEqual(branch_check.returncode, 0)
-
-    def test_cross_process_concurrency(self):
-        """Review #525 Finding 1: Genuine cross-process concurrency locking prevents corruption."""
-        import concurrent.futures
-
-        key = "test_concurrent_key_850"
-        args = (self.repo_dir, 850, key, self.lock_dir, self.journal_dir, self.master_sha)
-
-        with concurrent.futures.ProcessPoolExecutor(max_workers=2) as executor:
-            fut1 = executor.submit(_concurrent_bootstrap_worker, args)
-            fut2 = executor.submit(_concurrent_bootstrap_worker, args)
-            res1 = fut1.result(timeout=10)
-            res2 = fut2.result(timeout=10)
-
-        self.assertTrue(res1["success"], f"res1 failed: {res1}")
-        self.assertTrue(res2["success"], f"res2 failed: {res2}")
-        # One process performs creation, the other process receives idempotent replay
-        replayed_count = sum(1 for r in (res1, res2) if r.get("replayed"))
-        created_count = sum(1 for r in (res1, res2) if not r.get("replayed"))
-        self.assertEqual(replayed_count, 1)
-        self.assertEqual(created_count, 1)
-        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
-
-    def test_interrupted_replay_preserves_artifacts_created_provenance(self):
-        """Review #525 Finding 2: Replaying incomplete journal preserves creation provenance monotonically."""
-        key = "test_key_interrupted_replay_1"
-        branch = "fix/issue-850-interrupted-replay"
-        wt_path = os.path.join(self.branches_dir, "fix-issue-850-interrupted-replay")
-
-        # Simulate Phase 2/3 completion where branch and worktree directory were created by this transition
-        journal = {
-            "idempotency_key": key,
-            "issue_number": 850,
-            "branch_name": branch,
-            "worktree_path": wt_path,
-            "active_identity": "jcwalker3",
-            "active_profile": "prgs-author",
-            "remote": "prgs",
-            "org": "Scaled-Tech-Consulting",
-            "repo": "Gitea-Tools",
-            "phases": {
-                author_issue_bootstrap.PHASE_1_REQUEST_ACCEPTED: {"status": "completed"},
-                author_issue_bootstrap.PHASE_2_BRANCH_CONFIRMED: {"status": "completed", "created": True},
-            },
-            "artifacts_created": {
-                "branch_created": True,
-                "worktree_dir_created": True,
-                "worktree_registered": True,
-                "lock_created": False,
-            },
-            "current_phase": author_issue_bootstrap.PHASE_3_PATH_RESERVED,
-            "completed": False,
-        }
-        # Pre-create the branch and worktree on disk to simulate partial state after crash
-        subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
-        author_issue_bootstrap.save_phase_journal(journal, journal_dir=self.lock_dir)
-
-        # Now resume/replay the transition but simulate lock binding failure during Phase 6
-        with mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Lock failure test")):
-            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-                issue_number=850,
-                canonical_repo_root=self.repo_dir,
-                branch_name=branch,
-                worktree_path=wt_path,
-                idempotency_key=key,
-                lock_dir=self.lock_dir,
-                owner_session="session-test-1234",
-            )
-
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "issue_lock_acquisition_failed")
-
-        # Verify that compensating recovery correctly deleted transition-created branch & worktree
-        # because creation provenance was preserved across replay (NOT downgraded to False!)
-        self.assertFalse(os.path.exists(wt_path))
-        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
-        self.assertNotEqual(branch_check.returncode, 0)
-
-    def test_transition_created_only_compensation(self):
-        """Review #525 Finding 4: Preexisting branch is NOT deleted by compensation when only worktree was transition-created."""
-        key = "test_key_preexisting_branch_compensation"
-        preexisting_branch = "fix/issue-850-preexisting"
-        wt_path = os.path.join(self.branches_dir, "fix-issue-850-preexisting")
-
-        # Create branch BEFORE bootstrap (preexisting branch)
-        subprocess.run(["git", "-C", self.repo_dir, "branch", preexisting_branch, self.master_sha], check=True, capture_output=True)
-
-        # Call bootstrap with simulated failure during Phase 6 (lock binding)
-        with mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Simulated lock failure")):
-            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-                issue_number=850,
-                canonical_repo_root=self.repo_dir,
-                branch_name=preexisting_branch,
-                worktree_path=wt_path,
-                idempotency_key=key,
-                lock_dir=self.lock_dir,
-                owner_session="session-test-1234",
-            )
-
-        self.assertFalse(res["success"])
-        # Worktree dir was created by transition -> removed by compensation
-        self.assertFalse(os.path.exists(wt_path))
-
-        # Preexisting branch was NOT created by transition -> MUST BE PRESERVED!
-        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", preexisting_branch], capture_output=True, text=True, check=False)
-        self.assertEqual(branch_check.returncode, 0, "Preexisting branch was deleted by mistake!")
-
-    def test_incompatible_idempotency_replay_refusal(self):
-        """Review #525 Finding 4: Replaying key with incompatible parameters returns refusal."""
-        key = "test_key_incompatible_replay"
-        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            branch_name="fix/issue-850-param-a",
-            idempotency_key=key,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertTrue(res1["success"])
-
-        # Second call with different branch_name
-        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            branch_name="fix/issue-850-param-b",
-            idempotency_key=key,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        self.assertFalse(res2["success"])
-        self.assertEqual(res2.get("reason_code"), "incompatible_idempotency_replay")
-
-    def test_exact_next_action_satisfiable_via_mcp(self):
-        """Review #525 Finding 4: exact_next_action provides satisfiable MCP actions, not shell commands."""
-        key = "test_key_next_action_mcp"
-        stale_sha = "0000000000000000000000000000000000000000"
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            expected_base_sha=stale_sha,
-            lock_dir=self.lock_dir,
-            owner_session="session-test-1234",
-        )
-        next_action = res.get("exact_next_action", "")
-        self.assertNotIn("scripts/worktree-start", next_action)
-        self.assertNotIn("git worktree add", next_action)
-        self.assertNotIn("bash", next_action.lower())
-
-    def test_missing_owner_session_refusal(self):
-        """Finding D: Missing owner_session context fails closed with typed refusal and zero mutation."""
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            owner_session=None,
-            lock_dir=self.lock_dir,
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "missing_owner_session")
-        self.assertIn("exact_next_action", res)
-
-    def test_symlink_lock_file_refusal(self):
-        """Finding C: BootstrapTransitionLock refuses to follow symlinks."""
-        key = "test_symlink_lock_key"
-        safe_key = "".join(c if c.isalnum() or c in ("-", "_", ".") else "_" for c in key)
-        lock_path = os.path.join(self.lock_dir, f"{safe_key}.lock")
-        target_file = os.path.join(self.tmp_dir, "fake_target")
-        with open(target_file, "w") as f:
-            f.write("target")
-        os.symlink(target_file, lock_path)
-
-        with self.assertRaises(RuntimeError) as ctx:
-            with author_issue_bootstrap.BootstrapTransitionLock(key, journal_dir=self.lock_dir):
-                pass
-        self.assertIn("symlink", str(ctx.exception).lower())
-
-    def test_lock_directory_escape_refusal(self):
-        """Finding C: BootstrapTransitionLock refuses keys that escape lock directory."""
-        with mock.patch("os.path.abspath", return_value="/tmp/outside/evil_key.lock"):
-            with self.assertRaises(RuntimeError) as ctx:
-                author_issue_bootstrap.BootstrapTransitionLock("key", journal_dir=self.lock_dir)
-        self.assertIn("escapes", str(ctx.exception).lower())
-
-    def test_missing_active_identity_refusal(self):
-        """F-5: Missing active_identity parameter fails closed."""
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            owner_session="session-test-1234",
-            active_identity=None,
-            active_profile="prgs-author",
-            lock_dir=self.lock_dir,
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "missing_active_identity")
-
-    def test_missing_active_profile_refusal(self):
-        """F-5: Missing active_profile parameter fails closed."""
-        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
-            issue_number=850,
-            canonical_repo_root=self.repo_dir,
-            owner_session="session-test-1234",
-            active_identity="jcwalker3",
-            active_profile=None,
-            lock_dir=self.lock_dir,
-        )
-        self.assertFalse(res["success"])
-        self.assertEqual(res.get("reason_code"), "missing_active_profile")
-
-    def test_dirty_worktree_preserved_during_recovery(self):
-        """F-4: Compensating recovery does not delete dirty worktree."""
-        branch = "fix/issue-850-rec-dirty"
-        wt_path = os.path.join(self.branches_dir, "fix-issue-850-rec-dirty")
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
-        dirty_file = os.path.join(wt_path, "dirty.txt")
-        with open(dirty_file, "w") as f:
-            f.write("uncommitted work")
-
-        journal = {
-            "idempotency_key": "test_dirty_rec",
-            "issue_number": 850,
-            "branch_name": branch,
-            "worktree_path": wt_path,
-            "artifacts_created": {
-                "worktree_dir_created": True,
-                "worktree_registered": True,
-            },
-            "failure_reason": "test dirty recovery",
-        }
-        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir, journal_dir=self.lock_dir)
-        self.assertTrue(os.path.exists(wt_path))
-        self.assertIn(f"worktree_path_preserved_dirty:{wt_path}", rec["rolled_back"])
-
-    def test_branch_with_commits_preserved_during_recovery(self):
-        """F-4: Compensating recovery does not delete branch with author commits."""
-        branch = "fix/issue-850-rec-commits"
-        subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
-        # Add a commit on the branch
-        wt_path = os.path.join(self.branches_dir, "fix-issue-850-rec-commits")
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
-        cfile = os.path.join(wt_path, "commit.txt")
-        with open(cfile, "w") as f:
-            f.write("author commit")
-        subprocess.run(["git", "-C", wt_path, "add", "commit.txt"], check=True, capture_output=True)
-        subprocess.run(["git", "-C", wt_path, "commit", "-m", "author commit"], check=True, capture_output=True)
-        subprocess.run(["git", "-C", self.repo_dir, "worktree", "remove", "--force", wt_path], check=True, capture_output=True)
-
-        journal = {
-            "idempotency_key": "test_commits_rec",
-            "issue_number": 850,
-            "branch_name": branch,
-            "resolved_base_sha": self.master_sha,
-            "artifacts_created": {
-                "branch_created": True,
-            },
-            "failure_reason": "test commit branch recovery",
-        }
-        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir, journal_dir=self.lock_dir)
-        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
-        self.assertEqual(branch_check.returncode, 0, "Branch with commits was deleted!")
-        self.assertIn(f"branch_preserved_commits:{branch}", rec["rolled_back"])
-
-    def test_task_capability_map_integration(self):
-        """Verify task_capability_map has bootstrap_author_issue_worktree configured correctly."""
-        self.assertEqual(task_capability_map.required_role("bootstrap_author_issue_worktree"), "author")
-        self.assertEqual(task_capability_map.required_permission("bootstrap_author_issue_worktree"), "gitea.branch.create")
-        self.assertTrue(task_capability_map.preflight_task_matches("work_issue", "bootstrap_author_issue_worktree"))
-        self.assertTrue(task_capability_map.preflight_task_matches("bootstrap_author_issue_worktree", "lock_issue"))
-
-
-if __name__ == "__main__":
-    unittest.main()
-

tests/test_author_mutation_worktree.py

@@ -28,21 +28,6 @@ class TestPathUnderBranches(unittest.TestCase):
             amw.is_path_under_branches("/repo/other-checkout", self.ROOT)
         )
 
-    def test_unrelated_branches_dir_fails(self):
-        self.assertFalse(
-            amw.is_path_under_branches("/tmp/branches/evil", self.ROOT)
-        )
-
-    def test_prefix_confusion_fails(self):
-        self.assertFalse(
-            amw.is_path_under_branches(f"{self.ROOT}/branches-other/foo", self.ROOT)
-        )
-
-    def test_traversal_fails(self):
-        self.assertFalse(
-            amw.is_path_under_branches(f"{self.ROOT}/branches/../evil", self.ROOT)
-        )
-
 
 class TestAssessAuthorMutationWorktree(unittest.TestCase):
     ROOT = "/repo/Gitea-Tools"

tests/test_issue_858_audit_merged_pr_aware.py

@@ -0,0 +1,551 @@
+"""Merged-PR awareness for the worktree cleanup audit (#858).
+
+Before #858 an ``issue_work`` worktree could never leave ``active_issue_work``:
+the audit had no PR linkage at all (``pr_number`` was structurally ``None``)
+and its only route to ``clean_stale_removable`` was a TTL derived from a
+``last_used_at`` that nothing ever populated. A merged, clean, unprotected
+worktree was therefore reported as active work forever, disagreeing with the
+PR-scoped reconciler.
+
+These tests use fabricated temporary repositories and synthetic PR records
+only. Nothing here removes a worktree or deletes a branch.
+"""
+
+import os
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
+
+import merged_cleanup_reconcile as mcr  # noqa: E402
+import worktree_cleanup_audit as wca  # noqa: E402
+
+
+MERGED_BRANCH = "feat/issue-777-timeline"
+MERGED_PATH = "/repo/branches/issue-777-timeline"
+HEAD_SHA = "a" * 40
+
+
+def _pr(number, branch, *, merged=True, sha=HEAD_SHA, state=None):
+    """Synthetic Gitea PR payload."""
+    return {
+        "number": number,
+        "head": {"ref": branch, "sha": sha},
+        "merged_at": "2026-07-24T01:00:00Z" if merged else None,
+        "state": state or ("closed" if merged else "open"),
+    }
+
+
+def _porcelain(*entries):
+    out = []
+    for path, branch, sha in entries:
+        out.append(f"worktree {path}")
+        out.append(f"HEAD {sha}")
+        if branch is None:
+            out.append("detached")
+        else:
+            out.append(f"branch refs/heads/{branch}")
+        out.append("")
+    return "\n".join(out)
+
+
+class _AuditHarness(unittest.TestCase):
+    """Runs audit_branches_directory over a fabricated worktree listing."""
+
+    PORCELAIN = _porcelain(
+        ("/repo", "master", "f" * 40),
+        (MERGED_PATH, MERGED_BRANCH, HEAD_SHA),
+    )
+
+    def run_audit(self, *, dirty_paths=(), contained=True, **kwargs):
+        def fake_dirty(path):
+            if path in dirty_paths:
+                return {"exists": True, "dirty": True, "dirty_files": [" M x.py"]}
+            return {"exists": True, "dirty": False, "dirty_files": []}
+
+        with patch.object(
+            wca, "list_worktrees",
+            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
+        ), patch.object(
+            wca, "read_worktree_dirty", side_effect=fake_dirty
+        ), patch.object(
+            wca, "git_worktree_list", return_value="(mocked)"
+        ), patch.object(
+            wca, "is_head_ancestor_of_ref", return_value=contained
+        ):
+            report = wca.audit_branches_directory("/repo", **kwargs)
+        return {wt["path"]: wt for wt in report["worktrees"]}, report
+
+    def merged_audit(self, **kwargs):
+        kwargs.setdefault("pr_index", wca.build_pr_index([_pr(849, MERGED_BRANCH)]))
+        kwargs.setdefault("master_ref", "prgs/master")
+        return self.run_audit(**kwargs)
+
+
+class TestMergedWorktreeBecomesRemovable(_AuditHarness):
+    def test_clean_merged_issue_worktree_is_linked_and_removable(self):
+        by_path, report = self.merged_audit()
+        entry = by_path[MERGED_PATH]
+
+        self.assertEqual(entry["classification"], wca.CLASS_CLEAN_STALE_REMOVABLE)
+        self.assertTrue(entry["removable"])
+        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_MERGED)
+        self.assertEqual(entry["merged_pr_cleanup"]["block_reasons"], [])
+        self.assertIn(MERGED_PATH, [c["path"] for c in report["removable_candidates"]])
+
+    def test_pr_number_populated_from_authoritative_linkage(self):
+        by_path, _ = self.merged_audit()
+        self.assertEqual(by_path[MERGED_PATH]["pr_number"], 849)
+
+    def test_regression_without_pr_evidence_stays_active_issue_work(self):
+        """The pre-#858 behaviour, still correct when no PR state is supplied."""
+        by_path, _ = self.run_audit()
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+        self.assertIsNone(entry["pr_number"])
+
+
+class TestProtectiveSignalsSurvive(_AuditHarness):
+    def test_open_pr_worktree_is_not_removable(self):
+        index = wca.build_pr_index([_pr(900, MERGED_BRANCH, merged=False)])
+        by_path, _ = self.run_audit(
+            pr_index=index,
+            master_ref="prgs/master",
+            open_pr_branches={MERGED_BRANCH},
+        )
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_OPEN_PR)
+        self.assertFalse(entry["removable"])
+        # linkage still reports the owning PR, it just is not merge proof
+        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_OPEN)
+        self.assertEqual(entry["pr_number"], 900)
+
+    def test_dirty_tracked_worktree_is_not_removable(self):
+        by_path, _ = self.merged_audit(dirty_paths=(MERGED_PATH,))
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["classification"], wca.CLASS_DIRTY_LOCAL)
+        self.assertFalse(entry["removable"])
+        self.assertIn(
+            "worktree has uncommitted changes",
+            entry["merged_pr_cleanup"]["block_reasons"],
+        )
+
+    def test_untracked_only_worktree_is_not_removable(self):
+        """``git status --porcelain`` reports untracked files as dirty too."""
+        def untracked(path):
+            if path == MERGED_PATH:
+                return {"exists": True, "dirty": True, "dirty_files": ["?? scratch.txt"]}
+            return {"exists": True, "dirty": False, "dirty_files": []}
+
+        with patch.object(
+            wca, "list_worktrees",
+            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
+        ), patch.object(
+            wca, "read_worktree_dirty", side_effect=untracked
+        ), patch.object(
+            wca, "git_worktree_list", return_value="(mocked)"
+        ), patch.object(
+            wca, "is_head_ancestor_of_ref", return_value=True
+        ):
+            report = wca.audit_branches_directory(
+                "/repo",
+                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
+                master_ref="prgs/master",
+            )
+        entry = {wt["path"]: wt for wt in report["worktrees"]}[MERGED_PATH]
+        self.assertEqual(entry["classification"], wca.CLASS_DIRTY_LOCAL)
+        self.assertFalse(entry["removable"])
+
+    def test_active_lease_by_issue_number_is_protective(self):
+        by_path, _ = self.merged_audit(leased_issue_numbers={777})
+        entry = by_path[MERGED_PATH]
+        self.assertTrue(entry["has_active_lease"])
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+
+    def test_active_lease_by_branch_is_protective(self):
+        by_path, _ = self.merged_audit(leased_branches={MERGED_BRANCH})
+        entry = by_path[MERGED_PATH]
+        self.assertTrue(entry["has_active_lease"])
+        self.assertFalse(entry["removable"])
+
+    def test_active_issue_lock_is_protective(self):
+        by_path, _ = self.merged_audit(active_issue_branches={MERGED_BRANCH})
+        entry = by_path[MERGED_PATH]
+        self.assertTrue(entry["has_active_issue_lock"])
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+
+    def test_live_session_worktree_is_protective(self):
+        by_path, _ = self.merged_audit(live_session_paths={MERGED_PATH})
+        entry = by_path[MERGED_PATH]
+        self.assertTrue(entry["has_live_session"])
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+
+    def test_head_not_contained_in_master_is_not_removable(self):
+        by_path, _ = self.merged_audit(contained=False)
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+        self.assertIn(
+            "worktree head is not contained in authoritative master "
+            "(unmerged commits remain)",
+            entry["merged_pr_cleanup"]["block_reasons"],
+        )
+
+    def test_unknown_containment_fails_closed(self):
+        by_path, _ = self.merged_audit(contained=None)
+        entry = by_path[MERGED_PATH]
+        self.assertFalse(entry["removable"])
+        self.assertIn(
+            "containment of the worktree head in master is unknown",
+            entry["merged_pr_cleanup"]["block_reasons"],
+        )
+
+    def test_missing_master_ref_fails_closed(self):
+        by_path, _ = self.run_audit(
+            pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)])
+        )
+        self.assertFalse(by_path[MERGED_PATH]["removable"])
+
+    def test_unmerged_owning_pr_is_not_removable(self):
+        index = wca.build_pr_index([_pr(901, MERGED_BRANCH, merged=False)])
+        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
+        entry = by_path[MERGED_PATH]
+        self.assertFalse(entry["removable"])
+        self.assertIn(
+            "owning PR #901 is not merged",
+            entry["merged_pr_cleanup"]["block_reasons"],
+        )
+
+    def test_control_checkout_is_never_removable(self):
+        by_path, _ = self.merged_audit()
+        control = by_path["/repo"]
+        self.assertTrue(control["is_protected"])
+        self.assertEqual(control["classification"], wca.CLASS_UNSAFE_UNKNOWN)
+        self.assertFalse(control["removable"])
+
+    def test_control_checkout_not_removable_even_if_linked_and_merged(self):
+        """A merged PR on the control checkout must not unlock removal."""
+        porcelain = _porcelain(("/repo", MERGED_BRANCH, HEAD_SHA))
+        with patch.object(
+            wca, "list_worktrees", return_value=wca.parse_worktree_porcelain(porcelain)
+        ), patch.object(
+            wca, "read_worktree_dirty",
+            return_value={"exists": True, "dirty": False, "dirty_files": []},
+        ), patch.object(
+            wca, "git_worktree_list", return_value="(mocked)"
+        ), patch.object(
+            wca, "is_head_ancestor_of_ref", return_value=True
+        ):
+            report = wca.audit_branches_directory(
+                "/repo",
+                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
+                master_ref="prgs/master",
+            )
+        entry = report["worktrees"][0]
+        self.assertEqual(entry["classification"], wca.CLASS_UNSAFE_UNKNOWN)
+        self.assertFalse(entry["removable"])
+
+
+class TestAmbiguousLinkageFailsClosed(_AuditHarness):
+    def test_competing_prs_on_one_branch_fail_closed(self):
+        index = wca.build_pr_index(
+            [_pr(849, MERGED_BRANCH), _pr(860, MERGED_BRANCH)]
+        )
+        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_AMBIGUOUS)
+        self.assertIsNone(entry["pr_number"])
+        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(entry["removable"])
+
+    def test_merged_plus_open_pr_on_one_branch_fails_closed(self):
+        index = wca.build_pr_index(
+            [_pr(849, MERGED_BRANCH), _pr(861, MERGED_BRANCH, merged=False)]
+        )
+        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_AMBIGUOUS)
+        self.assertFalse(entry["removable"])
+
+    def test_no_owning_pr_fails_closed(self):
+        by_path, _ = self.run_audit(
+            pr_index=wca.build_pr_index([_pr(849, "feat/other-branch")]),
+            master_ref="prgs/master",
+        )
+        entry = by_path[MERGED_PATH]
+        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_NONE)
+        self.assertFalse(entry["removable"])
+
+    def test_malformed_pr_records_are_dropped_not_guessed(self):
+        index = wca.build_pr_index(
+            [
+                {"number": None, "head": {"ref": MERGED_BRANCH}},
+                {"number": 5, "head": {}},
+                {"number": "not-an-int", "head": {"ref": MERGED_BRANCH}},
+            ]
+        )
+        self.assertEqual(index, {})
+        self.assertEqual(
+            wca.resolve_owning_pr(branch=MERGED_BRANCH, pr_index=index)["status"],
+            wca.LINKAGE_NONE,
+        )
+
+    def test_detached_worktree_has_no_branch_linkage(self):
+        self.assertEqual(
+            wca.resolve_owning_pr(branch=None, pr_index={})["status"],
+            wca.LINKAGE_UNKNOWN,
+        )
+
+
+class TestUnrelatedClassificationsUnchanged(unittest.TestCase):
+    """Non-issue_work worktrees keep their pre-#858 classifications."""
+
+    PORCELAIN = _porcelain(
+        ("/repo", "master", "f" * 40),
+        ("/repo/branches/review-pr42", "review-pr42", "2" * 40),
+        ("/repo/branches/baseline-master-x", "baseline-master-x", "3" * 40),
+        ("/repo/branches/conflict-fix-pr50", "conflict-fix-pr50", "4" * 40),
+        ("/repo/branches/review-pr99", None, "5" * 40),
+    )
+
+    def _audit(self, **kwargs):
+        with patch.object(
+            wca, "list_worktrees",
+            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
+        ), patch.object(
+            wca, "read_worktree_dirty",
+            return_value={"exists": True, "dirty": False, "dirty_files": []},
+        ), patch.object(
+            wca, "git_worktree_list", return_value="(mocked)"
+        ), patch.object(
+            wca, "is_head_ancestor_of_ref", return_value=True
+        ):
+            report = wca.audit_branches_directory("/repo", **kwargs)
+        return {wt["path"]: wt for wt in report["worktrees"]}
+
+    def test_classifications_identical_with_and_without_pr_evidence(self):
+        without = self._audit()
+        with_evidence = self._audit(
+            pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
+            master_ref="prgs/master",
+        )
+        self.assertEqual(
+            {p: e["classification"] for p, e in without.items()},
+            {p: e["classification"] for p, e in with_evidence.items()},
+        )
+
+    def test_lease_on_issue_does_not_capture_similarly_named_scratch_trees(self):
+        """A lease on issue 777 protects issue work, not baseline/review trees."""
+        porcelain = _porcelain(
+            ("/repo/branches/baseline-master-issue-777", "baseline-issue-777", "7" * 40),
+            ("/repo/branches/issue-777-timeline", MERGED_BRANCH, HEAD_SHA),
+        )
+        with patch.object(
+            wca, "list_worktrees", return_value=wca.parse_worktree_porcelain(porcelain)
+        ), patch.object(
+            wca, "read_worktree_dirty",
+            return_value={"exists": True, "dirty": False, "dirty_files": []},
+        ), patch.object(
+            wca, "git_worktree_list", return_value="(mocked)"
+        ), patch.object(
+            wca, "is_head_ancestor_of_ref", return_value=True
+        ):
+            report = wca.audit_branches_directory(
+                "/repo",
+                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
+                master_ref="prgs/master",
+                leased_issue_numbers={777},
+            )
+        by_path = {wt["path"]: wt for wt in report["worktrees"]}
+
+        baseline = by_path["/repo/branches/baseline-master-issue-777"]
+        self.assertFalse(baseline["has_active_lease"])
+        self.assertEqual(baseline["classification"], wca.CLASS_CLEAN_STALE_REMOVABLE)
+
+        issue_work = by_path["/repo/branches/issue-777-timeline"]
+        self.assertTrue(issue_work["has_active_lease"])
+        self.assertFalse(issue_work["removable"])
+
+    def test_review_and_baseline_still_removable(self):
+        by_path = self._audit(
+            pr_index=wca.build_pr_index([]), master_ref="prgs/master"
+        )
+        self.assertEqual(
+            by_path["/repo/branches/review-pr42"]["classification"],
+            wca.CLASS_CLEAN_STALE_REMOVABLE,
+        )
+        self.assertEqual(
+            by_path["/repo/branches/baseline-master-x"]["classification"],
+            wca.CLASS_CLEAN_STALE_REMOVABLE,
+        )
+        self.assertEqual(
+            by_path["/repo/branches/review-pr99"]["classification"],
+            wca.CLASS_DETACHED_REVIEW_LEFTOVER,
+        )
+
+    def test_conflict_fix_ttl_behaviour_unchanged(self):
+        """conflict_fix still needs only TTL expiry; #858 did not touch it."""
+        self.assertEqual(
+            wca.classify_worktree(
+                workflow_type=wca.WORKFLOW_CONFLICT_FIX,
+                is_dirty=False,
+                ttl_expired=True,
+            ),
+            wca.CLASS_CLEAN_STALE_REMOVABLE,
+        )
+        self.assertEqual(
+            wca.classify_worktree(
+                workflow_type=wca.WORKFLOW_CONFLICT_FIX,
+                is_dirty=False,
+                ttl_expired=False,
+            ),
+            wca.CLASS_ACTIVE_ISSUE_WORK,
+        )
+
+    def test_issue_work_ttl_alone_no_longer_grants_removal(self):
+        """Age is not landing proof: TTL alone must not reclaim issue work."""
+        self.assertEqual(
+            wca.classify_worktree(
+                workflow_type=wca.WORKFLOW_ISSUE_WORK,
+                is_dirty=False,
+                ttl_expired=True,
+            ),
+            wca.CLASS_ACTIVE_ISSUE_WORK,
+        )
+
+
+class TestAssessorPerformsNoDeletion(_AuditHarness):
+    def test_audit_never_removes_a_worktree(self):
+        with patch.object(wca, "remove_worktree") as removal:
+            self.merged_audit()
+        removal.assert_not_called()
+
+    def test_audit_shells_out_to_no_destructive_git_command(self):
+        seen = []
+        real_run = subprocess.run
+
+        def recording_run(cmd, *args, **kwargs):
+            seen.append(cmd)
+            return real_run(["true"], *args, **kwargs)
+
+        with patch.object(subprocess, "run", side_effect=recording_run):
+            wca.audit_branches_directory("/nonexistent-repo-for-audit")
+
+        joined = [" ".join(c) if isinstance(c, list) else str(c) for c in seen]
+        for cmd in joined:
+            self.assertNotIn("worktree remove", cmd)
+            self.assertNotIn("branch -D", cmd)
+            self.assertNotIn("push", cmd)
+
+
+class TestAgreementWithPrScopedReconciler(unittest.TestCase):
+    """The audit and merged_cleanup_reconcile must agree on identical input.
+
+    Uses a real throwaway git repository so containment is computed by git
+    rather than asserted. Nothing outside the temporary directory is touched.
+    """
+
+    def _git(self, *args):
+        subprocess.run(
+            ["git", "-C", self.root, *args],
+            check=True,
+            capture_output=True,
+            text=True,
+        )
+
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.root = os.path.realpath(self._tmp.name)
+        self._git("init", "-b", "master", ".")
+        self._git("config", "user.email", "[email protected]")
+        self._git("config", "user.name", "Test")
+        with open(os.path.join(self.root, "seed.txt"), "w") as fh:
+            fh.write("seed\n")
+        self._git("add", "seed.txt")
+        self._git("commit", "-m", "seed")
+
+        self.branch = "feat/issue-777-timeline"
+        self._git("checkout", "-b", self.branch)
+        with open(os.path.join(self.root, "feature.txt"), "w") as fh:
+            fh.write("feature\n")
+        self._git("add", "feature.txt")
+        self._git("commit", "-m", "feature")
+        self.head_sha = subprocess.run(
+            ["git", "-C", self.root, "rev-parse", "HEAD"],
+            capture_output=True, text=True, check=True,
+        ).stdout.strip()
+        self._git("checkout", "master")
+        self._git("merge", "--no-ff", "-m", "merge feature", self.branch)
+
+        self.worktree = os.path.join(self.root, "branches", "issue-777-timeline")
+        self._git("worktree", "add", self.worktree, self.branch)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def _pr_index(self):
+        return wca.build_pr_index(
+            [
+                {
+                    "number": 849,
+                    "head": {"ref": self.branch, "sha": self.head_sha},
+                    "merged_at": "2026-07-24T01:00:00Z",
+                }
+            ]
+        )
+
+    def _audit_entry(self):
+        report = wca.audit_branches_directory(
+            self.root, pr_index=self._pr_index(), master_ref="master"
+        )
+        return next(wt for wt in report["worktrees"] if wt["path"] == self.worktree)
+
+    def _reconciler_entry(self):
+        return mcr.assess_local_worktree_cleanup(
+            pr_number=849,
+            head_branch=self.branch,
+            merged=True,
+            worktree_state=mcr.resolve_cleanup_worktree_state(
+                project_root=self.root,
+                head_branch=self.branch,
+                issue_number=777,
+                pr_head_sha=self.head_sha,
+                target_ref="master",
+            ),
+            active_lock=False,
+        )
+
+    def test_both_assessors_agree_the_worktree_is_safe(self):
+        audit_entry = self._audit_entry()
+        reconciler = self._reconciler_entry()
+
+        self.assertTrue(reconciler["safe_to_remove_worktree"], reconciler)
+        self.assertTrue(audit_entry["removable"], audit_entry)
+        self.assertEqual(audit_entry["pr_number"], reconciler["pr_number"])
+        self.assertEqual(audit_entry["merged_pr_cleanup"]["block_reasons"], [])
+        self.assertEqual(reconciler["block_reasons"], [])
+
+    def test_both_assessors_agree_a_dirty_worktree_is_unsafe(self):
+        with open(os.path.join(self.worktree, "feature.txt"), "a") as fh:
+            fh.write("local edit\n")
+
+        audit_entry = self._audit_entry()
+        reconciler = self._reconciler_entry()
+
+        self.assertFalse(audit_entry["removable"])
+        self.assertFalse(reconciler["safe_to_remove_worktree"])
+
+    def test_worktree_still_present_after_audit(self):
+        self._audit_entry()
+        self.assertTrue(os.path.isdir(self.worktree))
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_task_capability_role_invariants.py

@@ -139,8 +139,6 @@ EXPECTED_ROLE_EXCLUSIVE_TASKS = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
-        "bootstrap_author_issue_worktree",
-        "gitea_bootstrap_author_issue_worktree",
         # #812 AC20: publishing an unpublished local head is author-only for the
         # same reason every other push is — it writes a branch to the remote.
         "publish_unpublished_branch",

tests/test_worktree_cleanup_audit.py

@@ -134,13 +134,35 @@ class TestClassification(unittest.TestCase):
         self.assertEqual(cls, wca.CLASS_ACTIVE_OPEN_PR)
         self.assertFalse(wca.is_removable(cls))
 
-    def test_stale_clean_issue_worktree_removable(self):
-        # Scenario 5: clean issue worktree, TTL expired, no lock -> removable.
+    def test_stale_clean_issue_worktree_needs_merged_pr_proof(self):
+        # Scenario 5 (#858): age is not proof that the branch landed, so a
+        # TTL-expired issue worktree stays active work. Only authoritative
+        # merged-PR evidence makes it removable, which is what keeps a
+        # worktree holding unmerged commits from being reclaimed by age.
         cls = wca.classify_worktree(
             workflow_type=wca.WORKFLOW_ISSUE_WORK,
             is_dirty=False,
             ttl_expired=True,
         )
+        self.assertEqual(cls, wca.CLASS_ACTIVE_ISSUE_WORK)
+        self.assertFalse(wca.is_removable(cls))
+
+        cls = wca.classify_worktree(
+            workflow_type=wca.WORKFLOW_ISSUE_WORK,
+            is_dirty=False,
+            ttl_expired=True,
+            merged_pr_cleanup={"proven": True},
+        )
+        self.assertEqual(cls, wca.CLASS_CLEAN_STALE_REMOVABLE)
+        self.assertTrue(wca.is_removable(cls))
+
+    def test_stale_clean_conflict_fix_worktree_removable(self):
+        # conflict_fix keeps the original TTL rule; #858 changed issue work only.
+        cls = wca.classify_worktree(
+            workflow_type=wca.WORKFLOW_CONFLICT_FIX,
+            is_dirty=False,
+            ttl_expired=True,
+        )
         self.assertEqual(cls, wca.CLASS_CLEAN_STALE_REMOVABLE)
         self.assertTrue(wca.is_removable(cls))
 

worktree_cleanup_audit.py

@@ -34,7 +34,11 @@ import subprocess
 from datetime import datetime, timezone
 from typing import Any
 
-from merged_cleanup_reconcile import branch_worktree_folder, read_local_worktree_state
+from merged_cleanup_reconcile import (
+    branch_worktree_folder,
+    is_head_ancestor_of_ref,
+    read_local_worktree_state,
+)
 from reviewer_worktree import parse_dirty_tracked_files, REVIEW_WORKTREE_RE
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
@@ -67,6 +71,14 @@ REMOVABLE_CLASSES = frozenset(
     {CLASS_CLEAN_STALE_REMOVABLE, CLASS_DETACHED_REVIEW_LEFTOVER}
 )
 
+# Merged-PR linkage outcomes for issue worktrees (#858). Only ``LINKAGE_MERGED``
+# is ownership proof; every other outcome leaves the worktree protected.
+LINKAGE_MERGED = "merged_pr"
+LINKAGE_OPEN = "open_pr"
+LINKAGE_NONE = "no_owning_pr"
+LINKAGE_AMBIGUOUS = "ambiguous"
+LINKAGE_UNKNOWN = "unknown"
+
 _ISSUE_REF_RE = re.compile(r"issue-(\d+)", re.IGNORECASE)
 _ISSUE_BRANCH_PREFIXES = ("feat/", "fix/", "docs/", "chore/")
 
@@ -169,6 +181,186 @@ def is_ttl_expired(
     return (now_dt - last).total_seconds() > ttl_hours * 3600.0
 
 
+def build_pr_index(prs: list[dict[str, Any]] | None) -> dict[str, list[dict[str, Any]]]:
+    """Index PR records by head branch for deterministic worktree linkage (#858).
+
+    Accepts Gitea PR payloads (``head`` as a dict) and pre-flattened records
+    (``head_branch``/``head_sha``). Records without a usable head branch or
+    number are dropped rather than guessed at, so a branch is only ever linked
+    to a PR the caller actually proved.
+    """
+    index: dict[str, list[dict[str, Any]]] = {}
+    for pr in prs or []:
+        head = pr.get("head")
+        if isinstance(head, dict):
+            head_branch = head.get("ref")
+            head_sha = head.get("sha")
+        else:
+            head_branch = pr.get("head_branch") or (head if isinstance(head, str) else None)
+            head_sha = pr.get("head_sha")
+        number = pr.get("number")
+        if not head_branch or number is None:
+            continue
+        try:
+            pr_number = int(number)
+        except (TypeError, ValueError):
+            continue
+        index.setdefault(str(head_branch).strip(), []).append(
+            {
+                "pr_number": pr_number,
+                "head_branch": str(head_branch).strip(),
+                "head_sha": head_sha,
+                "merged": bool(pr.get("merged") or pr.get("merged_at")),
+                "state": pr.get("state"),
+            }
+        )
+    return index
+
+
+def resolve_owning_pr(
+    *,
+    branch: str | None,
+    pr_index: dict[str, list[dict[str, Any]]] | None,
+) -> dict[str, Any]:
+    """Resolve the single PR that owns ``branch``, failing closed when unclear.
+
+    Ownership is only ``LINKAGE_MERGED`` when exactly one PR claims the branch
+    and that PR is merged. Several distinct PRs on one branch is a competing
+    claim (``LINKAGE_AMBIGUOUS``), and a still-open owner is reported as
+    ``LINKAGE_OPEN`` — both keep the worktree protected while still exposing
+    the PR number the audit resolved.
+    """
+    if pr_index is None:
+        return {
+            "status": LINKAGE_UNKNOWN,
+            "pr_number": None,
+            "candidate_pr_numbers": [],
+            "reasons": ["live PR state was not supplied; ownership unproven"],
+        }
+    branch_name = (branch or "").strip()
+    if not branch_name:
+        return {
+            "status": LINKAGE_UNKNOWN,
+            "pr_number": None,
+            "candidate_pr_numbers": [],
+            "reasons": ["worktree has no attached branch; ownership unproven"],
+        }
+
+    candidates = list(pr_index.get(branch_name) or [])
+    numbers = sorted({c["pr_number"] for c in candidates})
+    if not candidates:
+        return {
+            "status": LINKAGE_NONE,
+            "pr_number": None,
+            "candidate_pr_numbers": [],
+            "reasons": [f"no PR claims branch '{branch_name}'"],
+        }
+    if len(numbers) > 1:
+        return {
+            "status": LINKAGE_AMBIGUOUS,
+            "pr_number": None,
+            "candidate_pr_numbers": numbers,
+            "reasons": [
+                f"branch '{branch_name}' is claimed by competing PRs {numbers}; "
+                "ownership is ambiguous"
+            ],
+        }
+
+    owner = candidates[0]
+    pr_number = owner["pr_number"]
+    if owner.get("head_branch") != branch_name:
+        return {
+            "status": LINKAGE_UNKNOWN,
+            "pr_number": pr_number,
+            "candidate_pr_numbers": numbers,
+            "reasons": [
+                f"PR #{pr_number} head branch '{owner.get('head_branch')}' does not "
+                f"match worktree branch '{branch_name}'"
+            ],
+        }
+    if not owner.get("merged"):
+        return {
+            "status": LINKAGE_OPEN,
+            "pr_number": pr_number,
+            "candidate_pr_numbers": numbers,
+            "pr_head_sha": owner.get("head_sha"),
+            "reasons": [f"owning PR #{pr_number} is not merged"],
+        }
+    return {
+        "status": LINKAGE_MERGED,
+        "pr_number": pr_number,
+        "candidate_pr_numbers": numbers,
+        "pr_head_sha": owner.get("head_sha"),
+        "reasons": [],
+    }
+
+
+def assess_merged_pr_worktree_cleanup(
+    *,
+    linkage: dict[str, Any] | None,
+    head_sha: str | None,
+    head_in_master: bool | None,
+    is_dirty: bool,
+    has_open_pr: bool,
+    has_active_lease: bool,
+    has_active_issue_lock: bool,
+    is_protected: bool,
+    has_live_session: bool = False,
+) -> dict[str, Any]:
+    """Decide whether a merged issue worktree satisfies the full cleanup policy.
+
+    Every condition must be independently proven: conclusive merged-PR
+    ownership, agreement between the worktree branch and the PR head branch,
+    containment of the worktree head in authoritative master (which is what
+    proves no unmerged commits remain), absence of any open/competing PR,
+    lease, issue lock, or live session, a clean tree, and a worktree that is
+    not the protected control checkout. Anything unknown blocks.
+    """
+    link = linkage or {
+        "status": LINKAGE_UNKNOWN,
+        "pr_number": None,
+        "reasons": ["no linkage assessment supplied"],
+    }
+    status = link.get("status")
+    reasons: list[str] = []
+
+    if status != LINKAGE_MERGED:
+        reasons.extend(
+            link.get("reasons") or ["owning PR could not be conclusively identified"]
+        )
+    if is_protected:
+        reasons.append("worktree is protected or the stable control checkout")
+    if is_dirty:
+        reasons.append("worktree has uncommitted changes")
+    if has_open_pr:
+        reasons.append("worktree branch has an open PR")
+    if has_active_lease:
+        reasons.append("worktree has an active lease")
+    if has_active_issue_lock:
+        reasons.append("an active issue lock references this branch")
+    if has_live_session:
+        reasons.append("a live process or session is using this worktree")
+    if not head_sha:
+        reasons.append("worktree head sha is unknown")
+    if head_in_master is None:
+        reasons.append("containment of the worktree head in master is unknown")
+    elif not head_in_master:
+        reasons.append(
+            "worktree head is not contained in authoritative master "
+            "(unmerged commits remain)"
+        )
+
+    proven = not reasons
+    return {
+        "linkage_status": status,
+        "pr_number": link.get("pr_number"),
+        "pr_head_sha": link.get("pr_head_sha"),
+        "head_in_master": head_in_master,
+        "proven": proven,
+        "block_reasons": reasons,
+    }
+
+
 def classify_worktree(
     *,
     workflow_type: str,
@@ -181,6 +373,8 @@ def classify_worktree(
     ttl_expired: bool = False,
     is_protected: bool = False,
     metadata_known: bool = True,
+    merged_pr_cleanup: dict[str, Any] | None = None,
+    has_live_session: bool = False,
 ) -> str:
     """Classify a worktree, safety-first: any preservation signal wins.
 
@@ -199,6 +393,8 @@ def classify_worktree(
         return CLASS_ACTIVE_ISSUE_WORK  # never auto-deleted (criterion 8)
     if has_active_issue_lock:
         return CLASS_ACTIVE_ISSUE_WORK
+    if has_live_session:
+        return CLASS_ACTIVE_ISSUE_WORK  # a live session still owns this tree
     if not metadata_known or workflow_type == WORKFLOW_UNKNOWN:
         return CLASS_UNSAFE_UNKNOWN  # never auto-deleted without proof
 
@@ -207,7 +403,15 @@ def classify_worktree(
         if is_detached or branch_gone:
             return CLASS_DETACHED_REVIEW_LEFTOVER
         return CLASS_CLEAN_STALE_REMOVABLE
-    # issue_work / conflict_fix: only removable once the TTL has expired.
+    if workflow_type == WORKFLOW_ISSUE_WORK:
+        # #858: an issue worktree becomes removable only on authoritative
+        # merged-PR evidence satisfying the whole cleanup policy. Age alone
+        # never proves the branch landed, so TTL cannot qualify one by itself
+        # — otherwise a worktree holding unmerged commits would be reclaimed.
+        if (merged_pr_cleanup or {}).get("proven"):
+            return CLASS_CLEAN_STALE_REMOVABLE
+        return CLASS_ACTIVE_ISSUE_WORK
+    # conflict_fix: only removable once the TTL has expired.
     if ttl_expired:
         return CLASS_CLEAN_STALE_REMOVABLE
     return CLASS_ACTIVE_ISSUE_WORK
@@ -400,6 +604,20 @@ def remove_worktree(project_root: str, path: str) -> dict[str, Any]:
     }
 
 
+def head_contained_in_ref(
+    project_root: str, head_sha: str | None, ref: str | None
+) -> bool | None:
+    """Return True when ``head_sha`` is already contained in ``ref``.
+
+    Shares :mod:`merged_cleanup_reconcile`'s ancestry check so the audit and
+    the PR-scoped reconciler agree on what "already landed" means (#858).
+    Returns None when containment cannot be determined, which fails closed.
+    """
+    if not head_sha or not ref:
+        return None
+    return is_head_ancestor_of_ref(project_root, head_sha, ref)
+
+
 def _is_under_branches(project_root: str, path: str) -> bool:
     branches_root = os.path.join(os.path.abspath(project_root), "branches")
     return os.path.abspath(path or "").startswith(branches_root + os.sep)
@@ -413,16 +631,30 @@ def audit_branches_directory(
     active_issue_branches: set[str] | None = None,
     now: datetime | str | None = None,
     ttl_hours: float = DEFAULT_TTL_HOURS,
+    pr_index: dict[str, list[dict[str, Any]]] | None = None,
+    leased_issue_numbers: set[int] | None = None,
+    live_session_paths: set[str] | None = None,
+    master_ref: str | None = None,
 ) -> dict[str, Any]:
     """Classify every session-owned worktree under ``branches/``.
 
     Read-only: shells out to git for discovery and dirty state, then applies
     the pure classifier. Returns per-worktree classifications, counts, the
     list of removable candidates, and the ``git worktree list`` proof.
+
+    ``pr_index`` (see :func:`build_pr_index`) supplies the authoritative PR
+    ownership used to link issue worktrees to their merged PR (#858).
+    ``master_ref`` is the ref a worktree head must be contained in before it
+    can be considered landed. Both are optional and their absence only ever
+    fails closed: without them no issue worktree becomes removable.
     """
     open_pr_branches = open_pr_branches or set()
     leased_branches = leased_branches or set()
     active_issue_branches = active_issue_branches or set()
+    leased_issue_numbers = leased_issue_numbers or set()
+    live_session_paths = {
+        os.path.abspath(p) for p in (live_session_paths or set()) if p
+    }
 
     worktrees: list[dict[str, Any]] = []
     for entry in list_worktrees(project_root):
@@ -433,12 +665,42 @@ def audit_branches_directory(
         )
         dirty_state = read_worktree_dirty(path)
         is_dirty = bool(dirty_state.get("dirty"))
+        head_sha = entry.get("head")
+        linkage = resolve_owning_pr(branch=branch, pr_index=pr_index)
         metadata = build_worktree_metadata(
-            path=path, branch=branch, head_sha=entry.get("head")
+            path=path,
+            branch=branch,
+            head_sha=head_sha,
+            pr_number=linkage.get("pr_number"),
         )
         has_open_pr = bool(branch) and branch in open_pr_branches
-        has_active_lease = bool(branch) and branch in leased_branches
+        # A lease on issue N protects that issue's own work worktree. It must
+        # not incidentally protect a baseline/review scratch tree that merely
+        # carries the same issue marker in its name, which would change the
+        # classification of worktrees this policy does not own.
+        has_active_lease = (bool(branch) and branch in leased_branches) or (
+            metadata["workflow_type"] == WORKFLOW_ISSUE_WORK
+            and metadata.get("issue_number") is not None
+            and metadata["issue_number"] in leased_issue_numbers
+        )
         has_active_lock = bool(branch) and branch in active_issue_branches
+        has_live_session = bool(path) and os.path.abspath(path) in live_session_paths
+        head_in_master = (
+            head_contained_in_ref(project_root, head_sha, master_ref)
+            if master_ref
+            else None
+        )
+        merged_pr_cleanup = assess_merged_pr_worktree_cleanup(
+            linkage=linkage,
+            head_sha=head_sha,
+            head_in_master=head_in_master,
+            is_dirty=is_dirty,
+            has_open_pr=has_open_pr,
+            has_active_lease=has_active_lease,
+            has_active_issue_lock=has_active_lock,
+            is_protected=is_protected,
+            has_live_session=has_live_session,
+        )
         ttl_expired = is_ttl_expired(
             last_used_at=metadata.get("last_used_at"), now=now, ttl_hours=ttl_hours
         )
@@ -452,6 +714,8 @@ def audit_branches_directory(
             branch_gone=branch is None and not entry.get("detached"),
             ttl_expired=ttl_expired,
             is_protected=is_protected,
+            merged_pr_cleanup=merged_pr_cleanup,
+            has_live_session=has_live_session,
         )
         metadata["cleanup_eligibility"] = classification
         worktrees.append(
@@ -463,7 +727,10 @@ def audit_branches_directory(
                 "has_open_pr": has_open_pr,
                 "has_active_lease": has_active_lease,
                 "has_active_issue_lock": has_active_lock,
+                "has_live_session": has_live_session,
                 "is_protected": is_protected,
+                "merged_pr_linkage": linkage,
+                "merged_pr_cleanup": merged_pr_cleanup,
                 "classification": classification,
                 "removable": is_removable(classification),
             }