Merge branch 'master' into fix/issue-855-pr-scoped-merged-cleanup

Adds a single-target path for post-merge cleanup so a reconciler can
complete one merged PR without a batch sweep across unrelated PRs.

## PR-scoped selector

gitea_reconcile_merged_cleanups gains an optional pr_number. When set,
only that merged PR is assessed and acted on: the PR is resolved live and
fails closed on an invalid/non-positive number, an unresolvable or
ambiguous PR, or an unmerged PR; reviewer scratch worktrees are filtered
to that PR; and the report's entry set is pinned to exactly [pr_number],
failing closed on any drift. The existing execute loop then operates on
the single pinned entry only -- worktree removal, ownership reassessment,
then remote-branch delete -- with no unrelated target. Batch behaviour is
unchanged when pr_number is omitted.

## Expired reviewer-lease reclaim (AC4)

An expired or stale reviewer lease no longer protects an already-merged
branch forever. branch_cleanup_guard.assess_expired_reviewer_lease_reclaim
makes the decision explicitly and fail-closed: reclaim only when the lease
is a reviewer lease, its status is expired/stale, the PR is proven merged,
the owner process is proven dead, and no competing active claimant uses
the branch. _collect_branch_ownership_records supplies that evidence from
authoritative state (live PR merged-state, lease owner liveness, and the
full ownership inventory for competing-claimant detection) and evaluates
it only after the complete inventory is built, so the post-worktree-removal
reassessment is what unblocks the branch delete. Any unknown fails closed.

Author/merger/controller/reconciler leases are untouched; active leases,
worktree bindings, issue locks, and live sessions still block.

## Tests

- tests/test_issue_855_expired_reviewer_reclaim.py: full fail-closed matrix
  for the reclaim decision plus collector wiring (merged+dead+uncontested
  reclaims; unmerged, live-owner, competing-worktree, and author-lease
  cases stay protective).
- tests/test_branch_cleanup_guard.py: exact-PR selector coverage (ignores
  newer PRs in the batch queue, execute mutates only the selected PR,
  unknown/not-merged/invalid fail closed, batch mode preserved).

Changed-surface suites pass; the 2 pre-existing test_branch_cleanup_guard
failures and test_reconciler_supersession_close reproduce identically on
master 6d0015ca and are unrelated to this change.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

branch_cleanup_guard.py

@@ -525,6 +525,90 @@ def assess_ownership_record_activity(record: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+# Reviewer-lease reclaim is only reachable from a non-live (expired/stale) lease.
+_RECLAIMABLE_REVIEWER_STATUSES = _EXPIRED_STATUSES | _STALE_STATUSES
+
+
+def is_active_ownership_status(status: str | None) -> bool:
+    """True when *status* denotes live/active ownership of a branch (#855).
+
+    Used to decide whether a *competing* active claimant still uses a branch
+    when weighing an expired reviewer lease for reclaim. Expired, stale,
+    released, and terminal statuses are not active.
+    """
+    return _norm_str(status).lower() in _ACTIVE_OWNERSHIP_STATUSES
+
+
+def assess_expired_reviewer_lease_reclaim(
+    *,
+    role: str,
+    status: str,
+    pr_merged: bool | None,
+    owner_pid_alive: bool | None,
+    competing_active_claimant: bool | None,
+) -> dict[str, Any]:
+    """Decide, explicitly and fail-closed, whether an expired reviewer lease
+    may stop protecting an already-merged branch (#855 AC4).
+
+    An expired reviewer lease should not protect a merged branch forever once
+    its work is done and no live claimant remains. Reclaim is permitted only
+    when **every** condition below is provably satisfied; any unknown
+    (``None``) or contrary value keeps the lease protective:
+
+    - the lease is a ``reviewer`` lease (author/merger/controller/reconciler
+      leases are out of scope and always keep protecting);
+    - its status is expired or stale (never an active/live lease);
+    - the PR is proven merged (``pr_merged is True``);
+    - the lease owner process is proven dead (``owner_pid_alive is False``);
+    - no competing active claimant uses the branch
+      (``competing_active_claimant is False``).
+
+    Returns a decision dict with ``reclaim_allowed`` and, when refused, the
+    fail-closed ``reasons``. The reasons never contain secrets — only the
+    role, the status, and which condition was unproven.
+    """
+    reasons: list[str] = []
+    normalized_role = _norm_str(role).lower()
+    normalized_status = _norm_str(status).lower()
+
+    if normalized_role != "reviewer":
+        reasons.append(
+            f"lease role '{normalized_role or 'unknown'}' is not a reviewer "
+            "lease; expired-reviewer reclaim does not apply"
+        )
+    if normalized_status not in _RECLAIMABLE_REVIEWER_STATUSES:
+        reasons.append(
+            f"lease status '{normalized_status or 'unknown'}' is not expired "
+            "or stale; only a non-live reviewer lease may be reclaimed"
+        )
+    if pr_merged is not True:
+        reasons.append(
+            "PR merged state is not proven true; reclaim requires an "
+            "already-merged PR (fail closed)"
+        )
+    if owner_pid_alive is not False:
+        reasons.append(
+            "lease owner process liveness is not proven dead; a live owner "
+            "still protects the branch (fail closed)"
+        )
+    if competing_active_claimant is not False:
+        reasons.append(
+            "a competing active claimant may still use the branch; reclaim "
+            "requires no other active ownership (fail closed)"
+        )
+
+    allowed = not reasons
+    return {
+        "reclaim_allowed": allowed,
+        "role": normalized_role,
+        "status": normalized_status,
+        "decision": (
+            "reclaim_expired_reviewer_lease" if allowed else "keep_protecting"
+        ),
+        "reasons": [] if allowed else reasons,
+    }
+
+
 def assess_active_branch_ownership(
     *,
     remote: str,

gitea_mcp_server.py

@@ -440,13 +440,32 @@ def _session_author_lock_worktree() -> str | None:
 
     Used to derive the author mutation workspace when no explicit
     ``worktree_path`` or env binding is provided. Never invents a path.
+
+    #864: a session pointer whose owner PID is dead and is not this process
+    must not force workspace binding for other issues — rebind is required for
+    that issue, and a stale dead-owner pointer must not poison unrelated work.
     """
     try:
         lock = issue_lock_store.read_session_issue_lock() or {}
     except Exception:
         return None
     path = (lock.get("worktree_path") or "").strip()
-    return path or None
+    if not path:
+        return None
+    pid = lock.get("session_pid")
+    if pid is None:
+        pid = lock.get("pid")
+    try:
+        pid_i = int(pid) if pid is not None else None
+    except (TypeError, ValueError):
+        pid_i = None
+    if (
+        pid_i is not None
+        and pid_i != os.getpid()
+        and not issue_lock_store.is_process_alive(pid_i)
+    ):
+        return None
+    return path
 
 
 def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
@@ -2031,6 +2050,7 @@ import issue_lock_store  # noqa: E402
 import issue_lock_adoption  # noqa: E402
 import issue_lock_recovery  # noqa: E402
 import issue_lock_renewal  # noqa: E402
+import dirty_same_claimant_session_rebind  # noqa: E402  # #864
 import stacked_pr_support  # noqa: E402
 import merge_approval_gate  # noqa: E402
 import review_quarantine  # noqa: E402  # #695 contaminated formal-review quarantine
@@ -4342,6 +4362,263 @@ def gitea_lock_issue(
     return result
 
 
+@mcp.tool()
+def gitea_rebind_dirty_same_claimant_author_session(
+    issue_number: int,
+    branch_name: str,
+    worktree_path: str,
+    old_pid: int,
+    expected_local_head: str,
+    expected_remote_head: str,
+    expected_dirty_paths: list[str],
+    expected_fingerprints: dict,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    dry_run: bool = False,
+    authorize_reconciler_execute: bool = False,
+) -> dict:
+    """Rebind a dirty registered issue worktree to this session (#864).
+
+    Sanctioned only when every pin agrees: same claimant, dead old_pid matching
+    the durable lock, matching local/remote heads, exact dirty path set, and
+    per-path sha256 fingerprints. Preserves every tracked/untracked byte.
+    Does not sync remote, create recovery worktrees, clean, reset, or move heads.
+
+    Role gate:
+    * author — must match the lock claimant identity/profile
+    * reconciler — execute only when ``authorize_reconciler_execute=True``
+    * reviewer/merger — always refuse
+
+    ``gitea.issue.comment`` (author map entry) is required for mutation; dry_run
+    still assesses fully but writes nothing. Permission alone is never ownership
+    proof — every pin is re-checked server-side.
+
+    Args:
+        issue_number: Tracking issue number on the durable lock.
+        branch_name: Exact locked branch name.
+        worktree_path: Registered dirty worktree path (must be under branches/).
+        old_pid: Dead owner PID recorded on the lock (must match session_pid/pid).
+        expected_local_head: Full local HEAD sha the caller observed.
+        expected_remote_head: Full remote-tracking HEAD sha the caller observed.
+        expected_dirty_paths: Exact set of dirty relative paths (tracked+untracked).
+        expected_fingerprints: Map of relative path -> sha256 hex of file bytes.
+        remote: Known instance — 'dadeschools' or 'prgs'.
+        host/org/repo: Optional target overrides (validated against binding).
+        dry_run: When true, assess only (no lock/session writes).
+        authorize_reconciler_execute: Reconciler-only execute gate.
+    """
+    role = _profile_role_kind(get_profile())
+    role_norm = (role or "").strip().lower()
+
+    # Permission: authors need comment; dry_run assess is reachable under read
+    # for diagnosis, but execute always needs comment. Reconciler execute also
+    # needs comment when authorized.
+    if dry_run:
+        read_block = _profile_operation_gate("gitea.read")
+        if read_block:
+            return {
+                "success": False,
+                "dry_run": True,
+                "reasons": read_block,
+                "permission_report": _permission_block_report("gitea.read"),
+            }
+    else:
+        blocked = _profile_permission_block(
+            task_capability_map.required_permission(
+                "rebind_dirty_same_claimant_author_session"
+            ),
+            issue_number=issue_number,
+            remote=remote,
+            host=host,
+            org=org,
+            repo=repo,
+            org_explicit=org is not None,
+            repo_explicit=repo is not None,
+        )
+        if blocked:
+            return blocked
+
+    if role_norm in {"reviewer", "merger"}:
+        return {
+            "success": False,
+            "dry_run": bool(dry_run),
+            "outcome": dirty_same_claimant_session_rebind.REFUSED,
+            "reasons": [
+                f"role '{role_norm}' cannot rebind dirty same-claimant author "
+                "sessions (fail closed)"
+            ],
+        }
+    if role_norm == "reconciler" and not authorize_reconciler_execute and not dry_run:
+        return {
+            "success": False,
+            "dry_run": False,
+            "outcome": dirty_same_claimant_session_rebind.REFUSED,
+            "reasons": [
+                "reconciler role requires authorize_reconciler_execute=True "
+                "to execute dirty same-claimant rebind (fail closed)"
+            ],
+        }
+
+    h, o, r = _resolve(remote, host, org, repo)
+    try:
+        identity = _authenticated_username(h)
+    except Exception:
+        identity = None
+    profile = get_profile()
+    profile_name = profile.get("profile_name")
+
+    existing = _load_existing_issue_lock(
+        remote=remote, org=o, repo=r, issue_number=issue_number
+    )
+    resolved_wt = os.path.realpath(os.path.abspath((worktree_path or "").strip()))
+    inv = dirty_same_claimant_session_rebind.collect_dirty_inventory(resolved_wt)
+
+    branch_res = subprocess.run(
+        ["git", "-C", resolved_wt, "branch", "--show-current"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    current_branch = (branch_res.stdout or "").strip() or None
+    head_res = subprocess.run(
+        ["git", "-C", resolved_wt, "rev-parse", "HEAD"],
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    local_head = (head_res.stdout or "").strip() if head_res.returncode == 0 else None
+
+    # Observe remote-tracking head without network when possible.
+    remote_head = None
+    for ref in (
+        f"refs/remotes/origin/{branch_name}",
+        f"origin/{branch_name}",
+        f"refs/remotes/{remote}/{branch_name}",
+        f"{remote}/{branch_name}",
+    ):
+        rh = subprocess.run(
+            ["git", "-C", resolved_wt, "rev-parse", "--verify", "--quiet", ref],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+        if rh.returncode == 0 and (rh.stdout or "").strip():
+            remote_head = (rh.stdout or "").strip()
+            break
+    if remote_head is None:
+        # Fall back to caller's pin only for observation absence — assessment
+        # still requires pin==observed, so missing observation fails closed.
+        remote_head = None
+
+    # Competing live locks (other issues / other worktrees).
+    competing_live = []
+    for entry in issue_lock_store.list_live_locks():
+        competing_live.append(entry)
+
+    # Session pointers that claim this issue lock.
+    competing_sessions = []
+    lock_dir = issue_lock_store.default_lock_dir()
+    lock_path = issue_lock_store.lock_file_path(
+        remote=remote, org=o, repo=r, issue_number=issue_number, lock_dir=lock_dir
+    )
+    try:
+        for name in os.listdir(lock_dir):
+            if not name.startswith("session-") or not name.endswith(".json"):
+                continue
+            ptr = issue_lock_store.read_lock_file(os.path.join(lock_dir, name))
+            if not ptr:
+                continue
+            ptr_lock = str(ptr.get("lock_file_path") or "").strip()
+            if not ptr_lock:
+                continue
+            try:
+                same = os.path.realpath(ptr_lock) == os.path.realpath(lock_path)
+            except OSError:
+                same = ptr_lock == lock_path
+            if not same:
+                continue
+            try:
+                sess_pid = int(str(name)[len("session-") : -len(".json")])
+            except ValueError:
+                sess_pid = ptr.get("pid")
+            competing_sessions.append(
+                {
+                    "pid": sess_pid,
+                    "lock_file_path": ptr_lock,
+                    "live": issue_lock_store.is_process_alive(sess_pid),
+                }
+            )
+    except OSError:
+        pass
+
+    # Best-effort workflow-lease scan: any live lock file whose work_lease is a
+    # non-author workflow lease on this issue/branch counts as active.
+    workflow_lease_active = False
+    for path in issue_lock_store.iter_lock_files(lock_dir):
+        rec = issue_lock_store.read_lock_file(path)
+        if not rec:
+            continue
+        lease = rec.get("work_lease") if isinstance(rec.get("work_lease"), dict) else {}
+        op = str(lease.get("operation_type") or "")
+        if op and op != issue_lock_store.AUTHOR_ISSUE_WORK_LEASE:
+            if rec.get("issue_number") == issue_number or str(
+                rec.get("branch_name") or ""
+            ) == branch_name:
+                if issue_lock_store.is_lease_live(rec):
+                    workflow_lease_active = True
+                    break
+
+    repo_root = _canonical_local_git_root()
+    # permission_allowed reflects profile gate only — never ownership proof.
+    permission_allowed = True
+
+    result = dirty_same_claimant_session_rebind.apply_dirty_same_claimant_session_rebind(
+        remote=remote,
+        org=o,
+        repo=r,
+        issue_number=issue_number,
+        branch_name=branch_name,
+        worktree_path=resolved_wt,
+        claimant_identity=identity,
+        claimant_profile=profile_name,
+        old_pid=old_pid,
+        expected_local_head=expected_local_head,
+        expected_remote_head=expected_remote_head,
+        expected_dirty_paths=list(expected_dirty_paths or []),
+        expected_fingerprints=dict(expected_fingerprints or {}),
+        existing_lock=existing,
+        current_identity=identity,
+        current_profile=profile_name,
+        role_kind=role_norm or role,
+        current_pid=os.getpid(),
+        current_branch=current_branch,
+        local_head=local_head,
+        remote_head=remote_head,
+        dirty_inventory=inv,
+        competing_live_locks=competing_live,
+        competing_sessions=competing_sessions,
+        workflow_lease_active=workflow_lease_active,
+        authorize_reconciler_execute=bool(authorize_reconciler_execute),
+        permission_allowed=permission_allowed,
+        repo_root=repo_root,
+        dry_run=bool(dry_run),
+        lock_dir=lock_dir,
+    )
+    result["observed"] = {
+        "local_head": local_head,
+        "remote_head": remote_head,
+        "current_branch": current_branch,
+        "dirty_paths": inv.get("dirty_paths"),
+        "fingerprints": inv.get("fingerprints"),
+        "identity": identity,
+        "profile": profile_name,
+        "role_kind": role_norm,
+    }
+    return result
+
+
 @mcp.tool()
 def gitea_assess_work_issue_duplicate(
     issue_number: int,
@@ -10839,6 +11116,9 @@ def _collect_branch_ownership_records(
     """
     records: list[dict] = []
     inventory_error = False
+    # #855 AC4: expired/stale reviewer-lease records eligible for an explicit
+    # reclaim decision, evaluated after the full ownership inventory is built.
+    reviewer_reclaim_candidates: list[tuple[dict, bool | None]] = []
     target_branch = (branch or "").strip()
     if not target_branch:
         return {"records": records, "inventory_error": False}
@@ -10987,15 +11267,28 @@ def _collect_branch_ownership_records(
                 else:
                     status = freshness_status
                     reclaim_allowed = False
-                records.append(
-                    _base_rec(
-                        category=category,
-                        status=status,
-                        reclaim_allowed=reclaim_allowed,
-                        role=role,
-                        host=lease_host or host_n or host,
-                    )
+                rec = _base_rec(
+                    category=category,
+                    status=status,
+                    reclaim_allowed=reclaim_allowed,
+                    role=role,
+                    host=lease_host or host_n or host,
                 )
+                records.append(rec)
+                # #855 AC4: a reviewer lease that is expired/stale (its owner
+                # gone) becomes a candidate for an explicit, fail-closed
+                # reclaim decision made once the full inventory is known.
+                if (
+                    role == "reviewer"
+                    and status
+                    in branch_cleanup_guard._RECLAIMABLE_REVIEWER_STATUSES
+                ):
+                    owner_alive = (
+                        fr.get("owner_pid_alive") if isinstance(fr, dict) else None
+                    )
+                    reviewer_reclaim_candidates.append(
+                        (rec, owner_alive if isinstance(owner_alive, bool) else None)
+                    )
     except Exception:
         # O1: fail closed on control-plane inventory errors.
         inventory_error = True
@@ -11066,6 +11359,44 @@ def _collect_branch_ownership_records(
             )
         )
 
+    # #855 AC4: decide, explicitly and fail-closed, whether any expired/stale
+    # reviewer lease may stop protecting an already-merged branch. This runs
+    # only after the full ownership inventory is built, so a competing active
+    # claimant (an active lease, author session, worktree binding, or active
+    # reviewer comment lease) is visible. An inventory failure keeps every
+    # reclaim candidate protective (reclaim_allowed stays False).
+    if reviewer_reclaim_candidates and not inventory_error:
+        pr_merged_state: bool | None = None
+        if pr_number is not None and auth and base_api:
+            try:
+                pr_live = api_request(
+                    "GET", f"{base_api}/pulls/{int(pr_number)}", auth
+                )
+                if isinstance(pr_live, dict) and pr_live:
+                    pr_merged_state = bool(
+                        pr_live.get("merged") or pr_live.get("merged_at")
+                    )
+            except Exception:
+                # Unknown merged state fails closed (candidate stays protective).
+                pr_merged_state = None
+        for cand_rec, owner_alive in reviewer_reclaim_candidates:
+            competing = any(
+                other is not cand_rec
+                and branch_cleanup_guard.is_active_ownership_status(
+                    other.get("status")
+                )
+                for other in records
+            )
+            decision = branch_cleanup_guard.assess_expired_reviewer_lease_reclaim(
+                role=str(cand_rec.get("role")),
+                status=str(cand_rec.get("status")),
+                pr_merged=pr_merged_state,
+                owner_pid_alive=owner_alive,
+                competing_active_claimant=competing,
+            )
+            cand_rec["reclaim_allowed"] = decision["reclaim_allowed"]
+            cand_rec["reclaim_decision"] = decision["decision"]
+
     return {"records": records, "inventory_error": inventory_error}
 
 
@@ -11128,6 +11459,7 @@ def gitea_reconcile_merged_cleanups(
     dry_run: bool = True,
     execute_confirmed: bool = False,
     limit: int = 50,
+    pr_number: int | None = None,
     remote: str = "dadeschools",
     host: str | None = None,
     org: str | None = None,
@@ -11138,7 +11470,11 @@ def gitea_reconcile_merged_cleanups(
     Args:
         dry_run: Defaults to True. When True, only builds the reconciliation report.
         execute_confirmed: Must be True when dry_run=False.
-        limit: Max number of closed PRs to inspect.
+        limit: Max number of closed PRs to inspect (batch mode only; ignored when
+            ``pr_number`` is set).
+        pr_number: Optional exact merged PR selector (#855). When set, only that
+            PR is assessed/acted on (fail closed if missing, unmerged, or
+            ambiguous). When omitted, existing batch behaviour is preserved.
         remote: Known Gitea instance ('dadeschools' or 'prgs').
         host: Override the Gitea host.
         org: Override the owner/organization.
@@ -11173,11 +11509,120 @@ def gitea_reconcile_merged_cleanups(
                 "audit_phase": audit_reconciliation_mode.current_phase(),
             }
 
+    # #855: optional exact PR pin. Fail closed before any inventory mutation.
+    exact_pr: int | None = None
+    if pr_number is not None:
+        try:
+            exact_pr = int(pr_number)
+        except (TypeError, ValueError):
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": "exact_pr",
+                "selected_pr_number": pr_number,
+                "reasons": [
+                    f"pr_number={pr_number!r} is not a valid integer "
+                    "(fail closed; no mutation)"
+                ],
+                "blocker_kind": "invalid_pr_number",
+            }
+        if exact_pr <= 0:
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": "exact_pr",
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"pr_number={exact_pr} must be a positive integer "
+                    "(fail closed; no mutation)"
+                ],
+                "blocker_kind": "invalid_pr_number",
+            }
+
     h, o, r = _resolve(remote, host, org, repo)
     auth = _auth(h)
     base = repo_api_url(h, o, r)
-    closed_prs = api_get_all(f"{base}/pulls?state=closed", auth, limit=limit)
-    open_prs = api_get_all(f"{base}/pulls?state=open", auth)
+
+    selection_mode = "batch"
+    closed_prs: list[dict] = []
+    open_prs: list[dict] = []
+    if exact_pr is not None:
+        selection_mode = "exact_pr"
+        try:
+            pr_live = api_request("GET", f"{base}/pulls/{exact_pr}", auth)
+        except Exception as exc:
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": selection_mode,
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"PR #{exact_pr} could not be uniquely resolved "
+                    f"(fail closed; no mutation): {_redact(str(exc))}"
+                ],
+                "blocker_kind": "pr_unresolvable",
+            }
+        if not isinstance(pr_live, dict) or not pr_live:
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": selection_mode,
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"PR #{exact_pr} could not be uniquely resolved "
+                    "(empty response; fail closed; no mutation)"
+                ],
+                "blocker_kind": "pr_unresolvable",
+            }
+        live_number = pr_live.get("number")
+        try:
+            live_number_int = int(live_number) if live_number is not None else None
+        except (TypeError, ValueError):
+            live_number_int = None
+        if live_number_int != exact_pr:
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": selection_mode,
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"PR #{exact_pr} resolution is ambiguous or mismatched "
+                    f"(live number={live_number!r}; fail closed; no mutation)"
+                ],
+                "blocker_kind": "pr_ambiguous",
+            }
+        if not (pr_live.get("merged") or pr_live.get("merged_at")):
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": selection_mode,
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"PR #{exact_pr} is not merged "
+                    "(exact-target cleanup requires a merged PR; "
+                    "fail closed; no mutation)"
+                ],
+                "blocker_kind": "pr_not_merged",
+            }
+        closed_prs = [pr_live]
+        # Exact mode still needs open heads for remote-delete safety gates.
+        open_prs = api_get_all(f"{base}/pulls?state=open", auth)
+    else:
+        # Preserve historical call order (closed then open) for batch callers/tests.
+        closed_prs = api_get_all(f"{base}/pulls?state=closed", auth, limit=limit)
+        open_prs = api_get_all(f"{base}/pulls?state=open", auth)
 
     merged_closed: list[dict] = []
     remote_branch_exists: dict[str, bool] = {}
@@ -11204,6 +11649,13 @@ def gitea_reconcile_merged_cleanups(
     scratch_candidates = merged_cleanup_reconcile.discover_reviewer_scratch_worktrees(
         _canonical_local_git_root()
     )
+    # #855: exact-target never inventories or mutates foreign PR scratch trees.
+    if exact_pr is not None:
+        scratch_candidates = [
+            s
+            for s in scratch_candidates
+            if int(s.get("pr_number") or 0) == int(exact_pr)
+        ]
     active_reviewer_leases: dict[int, bool] = {}
     pr_states: dict[int, dict] = {}
     for scratch in scratch_candidates:
@@ -11238,6 +11690,33 @@ def gitea_reconcile_merged_cleanups(
         active_reviewer_leases=active_reviewer_leases,
         pr_states=pr_states,
     )
+    report["selection_mode"] = selection_mode
+    if exact_pr is not None:
+        report["selected_pr_number"] = exact_pr
+        # Fail closed if exact pin somehow produced other or zero entries.
+        entries = list(report.get("entries") or [])
+        entry_numbers = []
+        for entry in entries:
+            try:
+                entry_numbers.append(int(entry.get("pr_number")))
+            except (TypeError, ValueError):
+                entry_numbers.append(entry.get("pr_number"))
+        if entry_numbers != [exact_pr]:
+            return {
+                "success": False,
+                "performed": False,
+                "executed": False,
+                "dry_run": bool(dry_run),
+                "selection_mode": selection_mode,
+                "selected_pr_number": exact_pr,
+                "reasons": [
+                    f"exact PR #{exact_pr} selection produced unexpected "
+                    f"candidate set {entry_numbers!r} "
+                    "(fail closed; no mutation)"
+                ],
+                "blocker_kind": "exact_selection_mismatch",
+                "entries": entries,
+            }
 
     if dry_run:
         report["dry_run"] = True

issue_lock_provenance.py

@@ -16,11 +16,16 @@ ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock
 SOURCE_LOCK_ISSUE = "gitea_lock_issue"
 SOURCE_LOCK_ADOPTION = "gitea_lock_issue_adoption"
 SOURCE_OPERATOR_OVERRIDE = "operator_override"
+# #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
+SOURCE_DIRTY_SAME_CLAIMANT_REBIND = (
+    "gitea_rebind_dirty_same_claimant_author_session"
+)
 
 SANCTIONED_LOCK_SOURCES = frozenset({
     SOURCE_LOCK_ISSUE,
     SOURCE_LOCK_ADOPTION,
     SOURCE_OPERATOR_OVERRIDE,
+    SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
 })
 
 _OPERATOR_OVERRIDE_ENV = "GITEA_ISSUE_LOCK_OPERATOR_OVERRIDE"

task_capability_map.py

@@ -32,6 +32,17 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
+    # #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
+    # Author MCP tool path. Reconciler execute is gated inside the tool via
+    # authorize_reconciler_execute + role_kind checks (not this map entry).
+    "rebind_dirty_same_claimant_author_session": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
+    "gitea_rebind_dirty_same_claimant_author_session": {
+        "permission": "gitea.issue.comment",
+        "role": "author",
+    },
     "set_issue_labels": {
         "permission": "gitea.issue.comment",
         "role": "author",

tests/test_branch_cleanup_guard.py

@@ -1639,6 +1639,358 @@ class TestSecondRemediationIntegration(unittest.TestCase):
         self.assertTrue(ownership_calls)
 
 
+class TestIssue855ExactPrSelector(unittest.TestCase):
+    """#855: exact pr_number pin for reconcile_merged_cleanups (#851 lifecycle)."""
+
+    def setUp(self):
+        self._remotes = patch.dict(
+            mcp_server.REMOTES,
+            {
+                "prgs": {
+                    "host": "gitea.example.com",
+                    "org": "Scaled-Tech-Consulting",
+                    "repo": "Gitea-Tools",
+                }
+            },
+        )
+        self._remotes.start()
+        patch("gitea_audit.audit_enabled", return_value=False).start()
+        self.mock_api = patch("mcp_server.api_request").start()
+        self.mock_all = patch("mcp_server.api_get_all", return_value=[]).start()
+        patch("mcp_server.get_auth_header", return_value=FAKE_AUTH).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.is_head_ancestor_of_ref",
+            return_value=True,
+        ).start()
+        patch(
+            "mcp_server.get_profile",
+            return_value=dict(RECONCILER_WITH_DELETE),
+        ).start()
+        patch(
+            "mcp_server._profile_operation_gate",
+            return_value=[],
+        ).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            return_value={"records": [], "inventory_error": False},
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.discover_reviewer_scratch_worktrees",
+            return_value=[],
+        ).start()
+        patch("mcp_server.verify_preflight_purity", return_value=None).start()
+        patch(
+            "mcp_server.audit_reconciliation_mode.check_cleanup_execution_allowed",
+            return_value=(True, []),
+        ).start()
+
+    def tearDown(self):
+        patch.stopall()
+
+    def _merged_pr(self, number, branch, sha="c" * 40):
+        return {
+            "number": number,
+            "title": f"PR {number}",
+            "body": f"Closes #{number - 4}",
+            "merged": True,
+            "merged_at": "2026-07-23T12:00:00Z",
+            "merge_commit_sha": "f" * 40,
+            "state": "closed",
+            "head": {"ref": branch, "sha": sha},
+            "base": {"ref": "master"},
+        }
+
+    def test_exact_pr_848_ignores_newer_852_in_batch_queue(self):
+        """pr_number=848 selects only #848 even when #852 is newer/first."""
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        pr_848 = self._merged_pr(
+            848, "fix/issue-844-exclude-epic-containers", sha="c3f282ba" + "0" * 32
+        )
+        # Closed list would rank #852 first in batch mode; exact pin must ignore it.
+        closed_batch = [
+            self._merged_pr(852, "fix/issue-851-cleanup-worktree-before-remote-delete"),
+            pr_848,
+            self._merged_pr(849, "fix/issue-849-other"),
+            self._merged_pr(846, "fix/issue-846-other"),
+            self._merged_pr(845, "fix/issue-845-other"),
+        ]
+        batch_fetch_calls = []
+
+        def fake_api(method, url, *args, **kwargs):
+            if method == "GET" and url.rstrip("/").endswith("/pulls/848"):
+                return dict(pr_848)
+            if method == "GET" and "/pulls/" in url:
+                raise AssertionError(f"unexpected PR fetch: {url}")
+            if method == "GET" and "/branches/" in url:
+                return {"name": "present"}
+            return {}
+
+        def fake_all(url, auth, limit=None):
+            batch_fetch_calls.append((url, limit))
+            if "state=open" in url:
+                return []
+            if "state=closed" in url:
+                # Exact mode must not use the closed batch list.
+                raise AssertionError(
+                    "exact pr_number mode must not page closed PRs: " + url
+                )
+            return []
+
+        self.mock_api.side_effect = fake_api
+        self.mock_all.side_effect = fake_all
+        patch(
+            "mcp_server._remote_branch_exists",
+            return_value=True,
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            side_effect=lambda **kwargs: {
+                "entries": [
+                    {
+                        "pr_number": int(pr["number"]),
+                        "head_branch": (pr.get("head") or {}).get("ref"),
+                        "issue_number": 844,
+                        "remote_branch": {
+                            "safe_to_delete_remote": True,
+                            "head_branch": (pr.get("head") or {}).get("ref"),
+                        },
+                        "local_worktree": {
+                            "safe_to_remove_worktree": True,
+                            "worktree_path": (
+                                "/tmp/branches/fix-issue-844-exclude-epic-containers"
+                            ),
+                        },
+                        "planned_execution_order": (
+                            mcp_server.merged_cleanup_reconcile.plan_cleanup_execution_order(
+                                remote_assessment={"safe_to_delete_remote": True},
+                                local_assessment={"safe_to_remove_worktree": True},
+                            )
+                        ),
+                    }
+                    for pr in kwargs.get("closed_prs") or []
+                    if pr.get("merged_at") or pr.get("merged")
+                ],
+                "reviewer_scratch_entries": [],
+                "merged_pr_count": len(kwargs.get("closed_prs") or []),
+            },
+        ).start()
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=True,
+            pr_number=848,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertTrue(res.get("success"))
+        self.assertFalse(res.get("performed"))
+        self.assertEqual(res.get("selection_mode"), "exact_pr")
+        self.assertEqual(res.get("selected_pr_number"), 848)
+        entries = res.get("entries") or []
+        self.assertEqual(len(entries), 1, entries)
+        self.assertEqual(entries[0].get("pr_number"), 848)
+        self.assertEqual(
+            entries[0].get("head_branch"),
+            "fix/issue-844-exclude-epic-containers",
+        )
+        # No other PR appears in plan.
+        self.assertEqual(list((res.get("planned_execution_orders") or {}).keys()), ["848"])
+        plan = (res.get("planned_execution_orders") or {}).get("848") or []
+        actions = [s.get("action") for s in plan]
+        self.assertEqual(
+            actions,
+            [
+                "remove_local_worktree",
+                "reassess_branch_ownership",
+                "delete_remote_branch",
+            ],
+        )
+        # Prove we never scanned the multi-PR closed batch.
+        self.assertFalse(any("state=closed" in (u or "") for u, _ in batch_fetch_calls))
+        # closed_batch fixture must remain unused (sanity).
+        self.assertEqual(closed_batch[0]["number"], 852)
+
+    def test_exact_pr_execute_only_mutates_selected_pr(self):
+        """Execute with pr_number must never touch #845/#846/#849/#852."""
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        pr_848 = self._merged_pr(848, "fix/issue-844-exclude-epic-containers")
+        worktree_path = "/tmp/branches/fix-issue-844-exclude-epic-containers"
+        remove_calls = []
+        delete_api_calls = []
+        ownership_branches = []
+
+        def fake_api(method, url, *args, **kwargs):
+            if method == "GET" and url.rstrip("/").endswith("/pulls/848"):
+                return dict(pr_848)
+            if method == "DELETE":
+                delete_api_calls.append(url)
+                # Forbid foreign PR branch deletion by URL content.
+                for forbidden in ("845", "846", "849", "852"):
+                    self.assertNotIn(forbidden, url)
+            return {}
+
+        def fake_remove(project_root, branch, worktree_path=None):
+            remove_calls.append({"branch": branch, "worktree_path": worktree_path})
+            return {
+                "success": True,
+                "performed": True,
+                "message": f"removed {worktree_path}",
+                "worktree_path": worktree_path,
+            }
+
+        def fake_collect(**kwargs):
+            ownership_branches.append(kwargs.get("branch"))
+            return {"records": [], "inventory_error": False}
+
+        def fake_probe(h, o, r, auth, br):
+            return guard.classify_branch_readback_http_status(
+                404, not_found_scope=guard.NOT_FOUND_SCOPE_BRANCH
+            )
+
+        self.mock_api.side_effect = fake_api
+        self.mock_all.side_effect = lambda url, auth, limit=None: []
+        patch("mcp_server._remote_branch_exists", return_value=True).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value={
+                "entries": [
+                    {
+                        "pr_number": 848,
+                        "head_branch": "fix/issue-844-exclude-epic-containers",
+                        "remote_branch": {"safe_to_delete_remote": True},
+                        "local_worktree": {
+                            "safe_to_remove_worktree": True,
+                            "worktree_path": worktree_path,
+                        },
+                        "planned_execution_order": [
+                            {"action": "remove_local_worktree", "phase": 1},
+                            {"action": "reassess_branch_ownership", "phase": 2},
+                            {"action": "delete_remote_branch", "phase": 3},
+                        ],
+                    }
+                ],
+                "reviewer_scratch_entries": [
+                    # Foreign scratch must be filtered before report execute loop;
+                    # if present here it would still be a test failure if acted on.
+                ],
+                "merged_pr_count": 1,
+            },
+        ).start()
+        patch(
+            "mcp_server.merged_cleanup_reconcile.remove_local_worktree",
+            side_effect=fake_remove,
+        ).start()
+        patch(
+            "mcp_server._collect_branch_ownership_records",
+            side_effect=fake_collect,
+        ).start()
+        patch("mcp_server._probe_remote_branch", side_effect=fake_probe).start()
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            pr_number=848,
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+        )
+        self.assertTrue(res.get("performed") or res.get("executed"))
+        self.assertEqual(res.get("selection_mode"), "exact_pr")
+        self.assertEqual(res.get("selected_pr_number"), 848)
+        actions = res.get("actions") or []
+        pr_numbers_touched = {
+            a.get("pr_number") for a in actions if a.get("pr_number") is not None
+        }
+        self.assertTrue(pr_numbers_touched.issubset({None, 848}) or not pr_numbers_touched)
+        removes = [a for a in actions if a.get("action") == "remove_local_worktree"]
+        deletes = [a for a in actions if a.get("action") == "delete_remote_branch"]
+        self.assertEqual(len(removes), 1)
+        self.assertEqual(remove_calls[0]["branch"], "fix/issue-844-exclude-epic-containers")
+        self.assertEqual(len(deletes), 1)
+        self.assertTrue(deletes[0].get("success"))
+        self.assertTrue(deletes[0].get("after_worktree_removal"))
+        self.assertEqual(len(delete_api_calls), 1)
+        self.assertEqual(
+            ownership_branches, ["fix/issue-844-exclude-epic-containers"]
+        )
+
+    def test_exact_pr_unknown_fails_closed_without_mutation(self):
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        def fake_api(method, url, *args, **kwargs):
+            if method == "GET" and "/pulls/99999" in url:
+                raise RuntimeError("HTTP 404 Not Found")
+            raise AssertionError(f"unexpected API call {method} {url}")
+
+        self.mock_api.side_effect = fake_api
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=True,
+            pr_number=99999,
+            remote="prgs",
+        )
+        self.assertFalse(res.get("success"))
+        self.assertFalse(res.get("performed"))
+        self.assertEqual(res.get("blocker_kind"), "pr_unresolvable")
+        self.assertIn("99999", " ".join(res.get("reasons") or []))
+
+    def test_exact_pr_not_merged_fails_closed(self):
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        def fake_api(method, url, *args, **kwargs):
+            if method == "GET" and url.rstrip("/").endswith("/pulls/900"):
+                return {
+                    "number": 900,
+                    "merged": False,
+                    "merged_at": None,
+                    "state": "open",
+                    "head": {"ref": "feat/x", "sha": "a" * 40},
+                }
+            raise AssertionError(f"unexpected {method} {url}")
+
+        self.mock_api.side_effect = fake_api
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=False,
+            execute_confirmed=True,
+            pr_number=900,
+            remote="prgs",
+        )
+        self.assertFalse(res.get("success"))
+        self.assertFalse(res.get("performed"))
+        self.assertEqual(res.get("blocker_kind"), "pr_not_merged")
+
+    def test_exact_pr_invalid_number_fails_closed(self):
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        res = gitea_reconcile_merged_cleanups(
+            dry_run=True,
+            pr_number=0,
+            remote="prgs",
+        )
+        self.assertFalse(res.get("success"))
+        self.assertEqual(res.get("blocker_kind"), "invalid_pr_number")
+        self.mock_api.assert_not_called()
+
+    def test_batch_mode_still_works_without_pr_number(self):
+        """Unfiltered batch path remains backward compatible."""
+        from mcp_server import gitea_reconcile_merged_cleanups
+
+        self.mock_all.side_effect = lambda url, auth, limit=None: []
+        self.mock_api.side_effect = lambda *a, **k: {}
+        patch(
+            "mcp_server.merged_cleanup_reconcile.build_reconciliation_report",
+            return_value={
+                "entries": [],
+                "reviewer_scratch_entries": [],
+                "merged_pr_count": 0,
+            },
+        ).start()
+        res = gitea_reconcile_merged_cleanups(dry_run=True, remote="prgs", limit=10)
+        self.assertTrue(res.get("success"))
+        self.assertEqual(res.get("selection_mode"), "batch")
+        self.assertIsNone(res.get("selected_pr_number"))
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_dirty_same_claimant_session_rebind.py

@@ -0,0 +1,845 @@
+"""Integration tests for dirty same-claimant author-session rebind (#864).
+
+Uses real temp git repos/worktrees and a temp GITEA_ISSUE_LOCK_DIR. Does not
+mutate any real #860/#864 worktree on disk.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import tempfile
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import dirty_same_claimant_session_rebind as rebind  # noqa: E402
+import issue_lock_provenance  # noqa: E402
+import issue_lock_store as ils  # noqa: E402
+import issue_lock_worktree  # noqa: E402
+
+ISSUE = 864
+BRANCH = f"fix/issue-{ISSUE}-dirty-same-claimant-session-rebind"
+REMOTE = "prgs"
+ORG = "Scaled-Tech-Consulting"
+REPO = "Gitea-Tools"
+IDENTITY = "jcwalker3"
+PROFILE = "prgs-author"
+
+
+def _git(cwd: str, *args: str, check: bool = True) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        ["git", "-C", cwd, *args],
+        capture_output=True,
+        text=True,
+        check=check,
+    )
+
+
+def dead_pid() -> int:
+    proc = subprocess.Popen([sys.executable, "-c", "pass"])
+    proc.wait()
+    return proc.pid
+
+
+def future_ts(hours: int = 4) -> str:
+    return (
+        (datetime.now(timezone.utc) + timedelta(hours=hours))
+        .isoformat()
+        .replace("+00:00", "Z")
+    )
+
+
+@pytest.fixture
+def lock_dir(tmp_path, monkeypatch):
+    d = tmp_path / "issue-locks"
+    d.mkdir()
+    monkeypatch.setenv("GITEA_ISSUE_LOCK_DIR", str(d))
+    return str(d)
+
+
+@pytest.fixture
+def dirty_repo(tmp_path):
+    """Canonical repo root with branches/<name> worktree and dirty content."""
+    root = tmp_path / "repo"
+    root.mkdir()
+    main = root / "main"
+    main.mkdir()
+    subprocess.run(["git", "init", "-q", str(main)], check=True, capture_output=True)
+    _git(str(main), "config", "user.email", "t@t")
+    _git(str(main), "config", "user.name", "t")
+    (main / "README.md").write_text("base\n", encoding="utf-8")
+    _git(str(main), "add", "README.md")
+    _git(str(main), "commit", "-q", "-m", "base")
+    _git(str(main), "branch", "-M", "master")
+
+    # Bare remote + origin tracking so remote head is observable offline.
+    bare = tmp_path / "remote.git"
+    subprocess.run(
+        ["git", "init", "--bare", "-q", str(bare)], check=True, capture_output=True
+    )
+    _git(str(main), "remote", "add", "origin", str(bare))
+    _git(str(main), "push", "-q", "origin", "master:master")
+
+    branches = root / "branches"
+    branches.mkdir()
+    wt_name = f"fix-issue-{ISSUE}-dirty-same-claimant-session-rebind"
+    wt = branches / wt_name
+    _git(str(main), "worktree", "add", "-q", "-b", BRANCH, str(wt))
+    _git(str(wt), "push", "-q", "-u", "origin", BRANCH)
+
+    # Seed committed files we will dirty.
+    tracked = [
+        "dirty_same_claimant_session_rebind.py",
+        "issue_lock_provenance.py",
+        "task_capability_map.py",
+    ]
+    for rel in tracked:
+        p = wt / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(f"seed {rel}\n", encoding="utf-8")
+    _git(str(wt), "add", *tracked)
+    _git(str(wt), "commit", "-q", "-m", "seed tracked")
+    _git(str(wt), "push", "-q", "origin", BRANCH)
+
+    # Dirty tracked + untracked.
+    for rel in tracked:
+        (wt / rel).write_text(f"dirty {rel}\n", encoding="utf-8")
+    untracked = [
+        "tests/test_dirty_same_claimant_session_rebind.py",
+        "docs/runbook-dirty-rebind.md",
+        "scratch/notes-untracked.txt",
+        "extra_untracked.txt",
+    ]
+    for rel in untracked:
+        p = wt / rel
+        p.parent.mkdir(parents=True, exist_ok=True)
+        p.write_text(f"untracked {rel}\n", encoding="utf-8")
+
+    inv = rebind.collect_dirty_inventory(str(wt))
+    assert inv["ok"], inv.get("reasons")
+    head = _git(str(wt), "rev-parse", "HEAD").stdout.strip()
+    remote_head = _git(
+        str(wt), "rev-parse", f"refs/remotes/origin/{BRANCH}"
+    ).stdout.strip()
+    assert head == remote_head
+
+    return {
+        "root": str(root),
+        "main": str(main),
+        "worktree": str(wt),
+        "branch": BRANCH,
+        "inventory": inv,
+        "local_head": head,
+        "remote_head": remote_head,
+        "dirty_paths": list(inv["dirty_paths"]),
+        "fingerprints": dict(inv["fingerprints"]),
+    }
+
+
+def _make_lock(
+    *,
+    worktree: str,
+    pid: int,
+    lock_dir: str,
+    identity: str = IDENTITY,
+    profile: str = PROFILE,
+    **overrides,
+) -> dict:
+    lease = {
+        "operation_type": ils.AUTHOR_ISSUE_WORK_LEASE,
+        "issue_number": ISSUE,
+        "branch": BRANCH,
+        "worktree_path": worktree,
+        "claimant": {"username": identity, "profile": profile},
+        "created_at": "2026-01-01T00:00:00Z",
+        "expires_at": future_ts(),
+        "last_heartbeat_at": "2026-01-01T00:00:00Z",
+    }
+    lock = {
+        "issue_number": ISSUE,
+        "branch_name": BRANCH,
+        "worktree_path": worktree,
+        "remote": REMOTE,
+        "org": ORG,
+        "repo": REPO,
+        "session_pid": pid,
+        "pid": pid,
+        "work_lease": lease,
+        "lock_generation": 1,
+        "lock_provenance": issue_lock_provenance.build_sanctioned_lock_provenance(
+            tool="gitea_lock_issue",
+            claimant={"username": identity, "profile": profile},
+        ),
+    }
+    lock.update(overrides)
+    path = ils.lock_file_path(
+        remote=REMOTE, org=ORG, repo=REPO, issue_number=ISSUE, lock_dir=lock_dir
+    )
+    lock["lock_file_path"] = path
+    ils.save_lock_file(path, lock)
+    # Stale session pointer for the dead owner.
+    ptr = {
+        "pid": pid,
+        "lock_file_path": path,
+        "issue_number": ISSUE,
+        "branch_name": BRANCH,
+        "remote": REMOTE,
+        "org": ORG,
+        "repo": REPO,
+    }
+    ils.save_lock_file(os.path.join(lock_dir, f"session-{pid}.json"), ptr)
+    return ils.read_lock_file(path) or lock
+
+
+def _apply_kwargs(repo, lock, lock_dir, **overrides):
+    kwargs = {
+        "remote": REMOTE,
+        "org": ORG,
+        "repo": REPO,
+        "issue_number": ISSUE,
+        "branch_name": BRANCH,
+        "worktree_path": repo["worktree"],
+        "claimant_identity": IDENTITY,
+        "claimant_profile": PROFILE,
+        "old_pid": lock.get("session_pid") or lock.get("pid"),
+        "expected_local_head": repo["local_head"],
+        "expected_remote_head": repo["remote_head"],
+        "expected_dirty_paths": repo["dirty_paths"],
+        "expected_fingerprints": repo["fingerprints"],
+        "existing_lock": lock,
+        "current_identity": IDENTITY,
+        "current_profile": PROFILE,
+        "role_kind": "author",
+        "current_pid": os.getpid(),
+        "current_branch": BRANCH,
+        "local_head": repo["local_head"],
+        "remote_head": repo["remote_head"],
+        "dirty_inventory": repo["inventory"],
+        "competing_live_locks": [],
+        "competing_sessions": [],
+        "workflow_lease_active": False,
+        "repo_root": repo["root"],
+        "dry_run": False,
+        "lock_dir": lock_dir,
+    }
+    kwargs.update(overrides)
+    return kwargs
+
+
+# ── 1. Successful dead-PID same-claimant dirty rebind ───────────────────────
+
+
+def test_successful_dead_pid_same_claimant_dirty_rebind(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert result["success"], result
+    assert result["outcome"] == rebind.REBIND_SANCTIONED
+    assert result["old_pid"] == old
+    assert result["new_pid"] == os.getpid()
+    assert result["generation_after"] == result["generation_before"] + 1
+
+    rebound = ils.read_lock_file(result["lock_path"])
+    assert rebound is not None
+    assert int(rebound["session_pid"]) == os.getpid()
+    assert int(rebound["pid"]) == os.getpid()
+    assert (
+        rebound.get("lock_provenance", {}).get("source")
+        == issue_lock_provenance.SOURCE_DIRTY_SAME_CLAIMANT_REBIND
+    )
+    assert rebound.get("rebind_record", {}).get("old_pid") == old
+
+
+# ── 2. Byte-for-byte preservation ───────────────────────────────────────────
+
+
+def test_byte_for_byte_preservation(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    before = {
+        rel: rebind.content_fingerprint(os.path.join(dirty_repo["worktree"], rel))
+        for rel in dirty_repo["dirty_paths"]
+    }
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert result["success"], result
+    after = {
+        rel: rebind.content_fingerprint(os.path.join(dirty_repo["worktree"], rel))
+        for rel in dirty_repo["dirty_paths"]
+    }
+    assert before == after
+    assert result["fingerprints"] == before
+
+
+# ── 3. Exact dirty-path and fingerprint enforcement ─────────────────────────
+
+
+def test_extra_dirty_path_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    pins = list(dirty_repo["dirty_paths"])[:-1]  # missing one observed path
+    fps = {p: dirty_repo["fingerprints"][p] for p in pins}
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            expected_dirty_paths=pins,
+            expected_fingerprints=fps,
+        )
+    )
+    assert not result["success"]
+    assert any("unexpected paths" in r for r in result["reasons"])
+
+
+def test_missing_expected_dirty_path_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    pins = list(dirty_repo["dirty_paths"]) + ["not_really_dirty.txt"]
+    fps = dict(dirty_repo["fingerprints"])
+    fps["not_really_dirty.txt"] = "0" * 64
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            expected_dirty_paths=pins,
+            expected_fingerprints=fps,
+        )
+    )
+    assert not result["success"]
+    assert any("missing expected" in r for r in result["reasons"])
+
+
+def test_modified_fingerprint_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    fps = dict(dirty_repo["fingerprints"])
+    victim = dirty_repo["dirty_paths"][0]
+    fps[victim] = "f" * 64
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            expected_fingerprints=fps,
+        )
+    )
+    assert not result["success"]
+    assert any("fingerprint disagreement" in r for r in result["reasons"])
+
+
+# ── 4. Atomic session-pointer replacement ───────────────────────────────────
+
+
+def test_session_pointer_points_to_lock(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert result["success"], result
+    new_ptr_path = os.path.join(lock_dir, f"session-{os.getpid()}.json")
+    assert os.path.exists(new_ptr_path)
+    ptr = ils.read_lock_file(new_ptr_path)
+    assert ptr is not None
+    assert os.path.realpath(ptr["lock_file_path"]) == os.path.realpath(
+        result["lock_path"]
+    )
+    # Old pointer removed when it targeted this lock.
+    old_ptr = os.path.join(lock_dir, f"session-{old}.json")
+    assert not os.path.exists(old_ptr)
+    assert result.get("removed_old_session_pointer") is True
+
+
+# ── 5. Retry after interruption (journal mid-state) ─────────────────────────
+
+
+def test_retry_after_journal_mid_state(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    jpath = rebind.journal_path(lock_dir, ISSUE)
+    rebind._atomic_write_json(
+        jpath,
+        {
+            "phase": rebind.JOURNAL_PHASE_PRE_BIND,
+            "issue_number": ISSUE,
+            "old_pid": old,
+            "new_pid": os.getpid(),
+            "expected_generation": 1,
+        },
+    )
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert result["success"], result
+    assert result["journal_phase"] == rebind.JOURNAL_PHASE_COMPLETE
+
+    # Second apply is already_rebound (retry-safe).
+    rebound_lock = ils.read_lock_file(result["lock_path"])
+    result2 = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            rebound_lock,
+            lock_dir,
+            old_pid=old,
+            existing_lock=rebound_lock,
+        )
+    )
+    assert result2["success"], result2
+    assert result2["already_rebound"] is True
+
+
+# ── 6. Active-PID refusal ───────────────────────────────────────────────────
+
+
+def test_active_pid_refused(dirty_repo, lock_dir):
+    live = os.getpid()
+    # Use a different "current" identity of session via fake current_pid...
+    # Owner is live (this process). Rebind must refuse.
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=live, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=live,
+            current_pid=live + 10_000_000,  # distinct "new" session id for pin check
+        )
+    )
+    assert not result["success"]
+    assert any("still alive" in r for r in result["reasons"])
+
+
+# ── 7. Foreign claimant refusal ─────────────────────────────────────────────
+
+
+def test_foreign_claimant_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            current_identity="someone-else",
+            claimant_identity="someone-else",
+        )
+    )
+    assert not result["success"]
+    assert any("foreign claimant" in r or "does not match" in r for r in result["reasons"])
+
+
+# ── 8. Profile mismatch refusal ─────────────────────────────────────────────
+
+
+def test_profile_mismatch_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            current_profile="other-profile",
+            claimant_profile="other-profile",
+        )
+    )
+    assert not result["success"]
+    assert any("profile" in r for r in result["reasons"])
+
+
+# ── 9. Competing session/lock/lease refusal ─────────────────────────────────
+
+
+def test_competing_live_lock_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    competing = [
+        {
+            "issue_number": ISSUE,
+            "branch_name": BRANCH,
+            "worktree_path": dirty_repo["worktree"] + "-other",
+            "pid": os.getpid(),
+        }
+    ]
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            competing_live_locks=competing,
+        )
+    )
+    assert not result["success"]
+    assert any("competing live lock" in r for r in result["reasons"])
+
+
+def test_competing_session_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            competing_sessions=[
+                {"pid": os.getpid(), "lock_file_path": lock["lock_file_path"], "live": True}
+            ],
+        )
+    )
+    # current_pid is os.getpid(), so same session is skipped — use another live pid.
+    # Spawn a long-lived process to act as competing live session.
+    rival = subprocess.Popen([sys.executable, "-c", "import time; time.sleep(30)"])
+    try:
+        result = rebind.apply_dirty_same_claimant_session_rebind(
+            **_apply_kwargs(
+                dirty_repo,
+                lock,
+                lock_dir,
+                old_pid=old,
+                competing_sessions=[
+                    {
+                        "pid": rival.pid,
+                        "lock_file_path": lock["lock_file_path"],
+                        "live": True,
+                    }
+                ],
+            )
+        )
+        assert not result["success"]
+        assert any("competing live session" in r for r in result["reasons"])
+    finally:
+        rival.kill()
+        rival.wait()
+
+
+def test_workflow_lease_active_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            workflow_lease_active=True,
+        )
+    )
+    assert not result["success"]
+    assert any("workflow lease" in r for r in result["reasons"])
+
+
+# ── 10. Local- and remote-head movement refusal ─────────────────────────────
+
+
+def test_local_head_movement_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            expected_local_head="b" * 40,
+        )
+    )
+    assert not result["success"]
+    assert any("local head" in r for r in result["reasons"])
+
+
+def test_remote_head_movement_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            expected_remote_head="c" * 40,
+        )
+    )
+    assert not result["success"]
+    assert any("remote head" in r for r in result["reasons"])
+
+
+# ── 11. Path/symlink/registration mismatches ────────────────────────────────
+
+
+def test_worktree_not_under_branches_refused(dirty_repo, lock_dir, tmp_path):
+    old = dead_pid()
+    # Use a path outside branches/ as the declared worktree (still real dir).
+    outside = tmp_path / "outside-wt"
+    outside.mkdir()
+    lock = _make_lock(worktree=str(outside), pid=old, lock_dir=lock_dir)
+    # Inventory empty for outside path; use empty pins to hit path gate first
+    # by providing matching empty-ish inventory after we force path checks.
+    inv = {
+        "dirty_paths": dirty_repo["dirty_paths"],
+        "fingerprints": dirty_repo["fingerprints"],
+        "ok": True,
+        "reasons": [],
+    }
+    result = rebind.assess_dirty_same_claimant_session_rebind(
+        remote=REMOTE,
+        org=ORG,
+        repo=REPO,
+        issue_number=ISSUE,
+        branch_name=BRANCH,
+        worktree_path=str(outside),
+        claimant_identity=IDENTITY,
+        claimant_profile=PROFILE,
+        old_pid=old,
+        expected_local_head=dirty_repo["local_head"],
+        expected_remote_head=dirty_repo["remote_head"],
+        expected_dirty_paths=dirty_repo["dirty_paths"],
+        expected_fingerprints=dirty_repo["fingerprints"],
+        existing_lock=lock,
+        current_identity=IDENTITY,
+        current_profile=PROFILE,
+        role_kind="author",
+        current_pid=os.getpid(),
+        current_branch=BRANCH,
+        local_head=dirty_repo["local_head"],
+        remote_head=dirty_repo["remote_head"],
+        dirty_inventory=inv,
+        repo_root=dirty_repo["root"],
+    )
+    assert not result["rebind_sanctioned"]
+    assert any("branches/" in r for r in result["reasons"])
+
+
+def test_lock_worktree_mismatch_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(
+        worktree=dirty_repo["worktree"] + "-elsewhere",
+        pid=old,
+        lock_dir=lock_dir,
+    )
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert not result["success"]
+    assert any("does not match declared" in r for r in result["reasons"])
+
+
+# ── 12. Malformed lock/session records ──────────────────────────────────────
+
+
+def test_malformed_lock_missing_pid_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    lock.pop("session_pid", None)
+    lock.pop("pid", None)
+    ils.save_lock_file(lock["lock_file_path"], lock)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert not result["success"]
+    assert any("incomplete" in r or "session_pid" in r for r in result["reasons"])
+
+
+def test_empty_old_pid_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=None)
+    )
+    assert not result["success"]
+    assert any("old_pid" in r for r in result["reasons"])
+
+
+def test_reviewer_role_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old, role_kind="reviewer")
+    )
+    assert not result["success"]
+    assert any("reviewer" in r for r in result["reasons"])
+
+
+def test_reconciler_without_authorize_refused(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(
+            dirty_repo,
+            lock,
+            lock_dir,
+            old_pid=old,
+            role_kind="reconciler",
+            authorize_reconciler_execute=False,
+        )
+    )
+    assert not result["success"]
+    assert any("authorize_reconciler_execute" in r for r in result["reasons"])
+
+
+# ── 13. No duplicate ownership after success or retry ───────────────────────
+
+
+def test_no_duplicate_ownership_after_success_or_retry(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    r1 = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old)
+    )
+    assert r1["success"], r1
+    rebound = ils.read_lock_file(r1["lock_path"])
+    r2 = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, rebound, lock_dir, old_pid=old, existing_lock=rebound)
+    )
+    assert r2["success"], r2
+    assert r2["already_rebound"] is True
+
+    # Only one durable lock file for this issue; session pointer is current pid.
+    # Skip session pointers and rebind journals (dotfiles / non-lock records).
+    matching = []
+    for p in ils.iter_lock_files(lock_dir):
+        name = os.path.basename(p)
+        if name.startswith(".") or name.startswith("session-"):
+            continue
+        rec = ils.read_lock_file(p)
+        if not rec:
+            continue
+        if (
+            rec.get("issue_number") == ISSUE
+            and rec.get("remote") == REMOTE
+            and rec.get("branch_name") == BRANCH
+            and rec.get("session_pid") is not None
+        ):
+            matching.append(rec)
+    assert len(matching) == 1
+    assert int(matching[0]["session_pid"]) == os.getpid()
+    # No live session pointer for the dead old pid.
+    assert not os.path.exists(os.path.join(lock_dir, f"session-{old}.json"))
+
+
+# ── 14. Ordinary dirty-worktree locking remains fail-closed ─────────────────
+
+
+def test_ordinary_dirty_lock_worktree_assessment_blocks(dirty_repo):
+    porcelain = dirty_repo["inventory"]["porcelain_status"]
+    assessment = issue_lock_worktree.assess_issue_lock_worktree(
+        worktree_path=dirty_repo["worktree"],
+        current_branch=BRANCH,
+        porcelain_status=porcelain,
+        base_equivalent=False,
+    )
+    assert assessment["block"] is True
+    assert any(
+        "tracked file edits exist before issue lock" in r
+        for r in assessment["reasons"]
+    )
+
+
+# ── 15. Fixture matching #860 class with 7 fingerprint-pinned dirty paths ───
+
+
+def test_issue_860_regression_fixture_spec():
+    spec = rebind.build_issue_860_regression_fixture_spec()
+    assert spec["claimant_identity"] == "jcwalker3"
+    assert spec["claimant_profile"] == "prgs-author"
+    assert spec["old_pid_alive"] is False
+    assert spec["live_session_pointer"] is None
+    assert spec["dirty_path_count"] == 7
+    assert len(spec["expected_dirty_paths"]) == 7
+    assert len(spec["expected_fingerprints"]) == 7
+    assert spec["expected_local_head"] == spec["expected_remote_head"]
+    for path in spec["expected_dirty_paths"]:
+        assert path in spec["expected_fingerprints"]
+        assert len(spec["expected_fingerprints"][path]) == 64
+
+
+def test_dry_run_does_not_write(dirty_repo, lock_dir):
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    before = ils.read_lock_file(lock["lock_file_path"])
+    result = rebind.apply_dirty_same_claimant_session_rebind(
+        **_apply_kwargs(dirty_repo, lock, lock_dir, old_pid=old, dry_run=True)
+    )
+    assert result["success"], result
+    assert result["dry_run"] is True
+    after = ils.read_lock_file(lock["lock_file_path"])
+    assert after["session_pid"] == before["session_pid"]
+    assert not os.path.exists(os.path.join(lock_dir, f"session-{os.getpid()}.json"))
+
+
+def test_provenance_source_is_sanctioned():
+    assert (
+        issue_lock_provenance.SOURCE_DIRTY_SAME_CLAIMANT_REBIND
+        in issue_lock_provenance.SANCTIONED_LOCK_SOURCES
+    )
+    assessment = issue_lock_provenance.assess_lock_file_for_create_pr(
+        {
+            "work_lease": {"operation_type": "author_issue_work"},
+            "lock_provenance": {
+                "source": issue_lock_provenance.SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
+                "written_by_tool": issue_lock_provenance.SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
+                "written_at": "2026-01-01T00:00:00Z",
+            },
+        }
+    )
+    assert assessment["proven"] is True
+
+
+def test_permission_allowed_is_not_ownership_proof(dirty_repo, lock_dir):
+    """permission_allowed=True must not bypass foreign claimant refusal."""
+    old = dead_pid()
+    lock = _make_lock(worktree=dirty_repo["worktree"], pid=old, lock_dir=lock_dir)
+    result = rebind.assess_dirty_same_claimant_session_rebind(
+        remote=REMOTE,
+        org=ORG,
+        repo=REPO,
+        issue_number=ISSUE,
+        branch_name=BRANCH,
+        worktree_path=dirty_repo["worktree"],
+        claimant_identity=IDENTITY,
+        claimant_profile=PROFILE,
+        old_pid=old,
+        expected_local_head=dirty_repo["local_head"],
+        expected_remote_head=dirty_repo["remote_head"],
+        expected_dirty_paths=dirty_repo["dirty_paths"],
+        expected_fingerprints=dirty_repo["fingerprints"],
+        existing_lock=lock,
+        current_identity="intruder",
+        current_profile=PROFILE,
+        role_kind="author",
+        current_pid=os.getpid(),
+        current_branch=BRANCH,
+        local_head=dirty_repo["local_head"],
+        remote_head=dirty_repo["remote_head"],
+        dirty_inventory=dirty_repo["inventory"],
+        permission_allowed=True,
+        repo_root=dirty_repo["root"],
+    )
+    assert not result["rebind_sanctioned"]
+    assert any("does not match active identity" in r for r in result["reasons"])
+
+
+def test_content_fingerprint_stable(tmp_path):
+    p = tmp_path / "f.txt"
+    p.write_bytes(b"abc123")
+    a = rebind.content_fingerprint(str(p))
+    b = rebind.content_fingerprint(str(p))
+    assert a == b
+    assert len(a) == 64

tests/test_issue_855_expired_reviewer_reclaim.py

@@ -0,0 +1,244 @@
+"""#855 AC4: an expired reviewer lease must not indefinitely protect an
+already-merged branch when no live claimant exists.
+
+Two layers are covered:
+
+* ``branch_cleanup_guard.assess_expired_reviewer_lease_reclaim`` — the pure,
+  fail-closed reclaim decision. Every condition must be provably satisfied or
+  the lease keeps protecting the branch.
+* ``gitea_mcp_server._collect_branch_ownership_records`` — the wiring that
+  supplies authoritative evidence (PR merged state, owner-process liveness,
+  competing ownership) to that decision, and flips an expired reviewer lease
+  to reclaimable only under the full policy.
+
+All inputs are fabricated; no real repository, lease, or credential is used.
+"""
+
+import importlib
+import unittest
+from unittest.mock import patch
+
+import branch_cleanup_guard
+
+mcp_server = importlib.import_module("gitea_mcp_server")
+
+FAKE_AUTH = "token fake"
+REMOTE = "prgs"
+ORG = "Scaled-Tech-Consulting"
+REPO = "Gitea-Tools"
+HOST = "gitea.prgs.cc"
+BRANCH = "feat/issue-638-webui-app-shell-phase1"
+PR_NUMBER = 818
+
+
+class TestAssessExpiredReviewerLeaseReclaim(unittest.TestCase):
+    """Pure fail-closed reclaim decision (#855 AC4)."""
+
+    def _call(self, **overrides):
+        base = dict(
+            role="reviewer",
+            status="expired",
+            pr_merged=True,
+            owner_pid_alive=False,
+            competing_active_claimant=False,
+        )
+        base.update(overrides)
+        return branch_cleanup_guard.assess_expired_reviewer_lease_reclaim(**base)
+
+    def test_full_policy_satisfied_allows_reclaim(self):
+        out = self._call()
+        self.assertTrue(out["reclaim_allowed"])
+        self.assertEqual(out["reasons"], [])
+        self.assertEqual(out["decision"], "reclaim_expired_reviewer_lease")
+
+    def test_stale_dead_process_reviewer_also_reclaimable(self):
+        out = self._call(status="stale_dead_process")
+        self.assertTrue(out["reclaim_allowed"])
+
+    def test_non_reviewer_role_never_reclaims(self):
+        for role in ("author", "merger", "controller", "reconciler", "unknown"):
+            with self.subTest(role=role):
+                out = self._call(role=role)
+                self.assertFalse(out["reclaim_allowed"])
+                self.assertTrue(out["reasons"])
+                self.assertEqual(out["decision"], "keep_protecting")
+
+    def test_active_status_never_reclaims(self):
+        out = self._call(status="active")
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_pr_not_merged_blocks_reclaim(self):
+        out = self._call(pr_merged=False)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_pr_merged_unknown_fails_closed(self):
+        out = self._call(pr_merged=None)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_owner_process_alive_blocks_reclaim(self):
+        out = self._call(owner_pid_alive=True)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_owner_liveness_unknown_fails_closed(self):
+        out = self._call(owner_pid_alive=None)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_competing_active_claimant_blocks_reclaim(self):
+        out = self._call(competing_active_claimant=True)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_competing_claimant_unknown_fails_closed(self):
+        out = self._call(competing_active_claimant=None)
+        self.assertFalse(out["reclaim_allowed"])
+
+    def test_reasons_never_leak_secrets(self):
+        out = self._call(role="author")
+        blob = " ".join(out["reasons"]).lower()
+        self.assertNotIn("token", blob)
+        self.assertNotIn("password", blob)
+
+
+class _FakeLease(dict):
+    pass
+
+
+class TestCollectorExpiredReviewerReclaimWiring(unittest.TestCase):
+    """`_collect_branch_ownership_records` supplies authoritative evidence and
+    flips an expired reviewer lease to reclaimable only under the full policy."""
+
+    def _run(
+        self,
+        *,
+        lease_role="reviewer",
+        lease_freshness="stale_dead_process",
+        owner_pid_alive=False,
+        pr_merged=True,
+        extra_leases=None,
+        worktree_on_branch=False,
+    ):
+        lease = _FakeLease(
+            role=lease_role,
+            work_kind="pr",
+            work_number=PR_NUMBER,
+            branch=BRANCH,
+            status="active",
+            owner_pid=999999,
+            remote=REMOTE,
+            org=ORG,
+            repo=REPO,
+            host=HOST,
+            freshness={
+                "freshness": lease_freshness,
+                "owner_pid": 999999,
+                "owner_pid_alive": owner_pid_alive,
+                "expired_by_time": lease_freshness == "expired",
+            },
+        )
+        leases = [lease] + list(extra_leases or [])
+
+        pr_payload = {
+            "number": PR_NUMBER,
+            "merged": pr_merged,
+            "merged_at": "2026-07-23T00:00:00Z" if pr_merged else None,
+            "head": {"ref": BRANCH},
+        }
+
+        def fake_api_request(method, url, *a, **k):
+            if method == "GET" and f"/pulls/{PR_NUMBER}" in url:
+                return pr_payload
+            raise AssertionError(f"unexpected api_request {method} {url}")
+
+        wt_entries = []
+        if worktree_on_branch:
+            wt_entries = [{"branch": BRANCH, "path": f"/x/branches/{BRANCH}"}]
+
+        with patch.object(
+            mcp_server.lease_lifecycle,
+            "list_active_leases",
+            return_value={"leases": leases},
+        ), patch.object(
+            mcp_server.control_plane_db, "get_db", return_value=object(), create=True
+        ), patch.object(
+            mcp_server.issue_lock_store, "iter_lock_files", return_value=[]
+        ), patch.object(
+            mcp_server.worktree_cleanup_audit,
+            "list_worktrees",
+            return_value=wt_entries,
+        ), patch.object(
+            mcp_server, "api_get_all", return_value=[]
+        ), patch.object(
+            mcp_server, "api_request", side_effect=fake_api_request
+        ):
+            return mcp_server._collect_branch_ownership_records(
+                remote=REMOTE,
+                host=HOST,
+                org=ORG,
+                repo=REPO,
+                branch=BRANCH,
+                pr_number=PR_NUMBER,
+                project_root="/x",
+                auth=FAKE_AUTH,
+                base_api="https://gitea.prgs.cc/api/v1/repos/x/y",
+            )
+
+    def _reviewer_records(self, bundle):
+        return [
+            rec
+            for rec in bundle["records"]
+            if rec.get("category")
+            == branch_cleanup_guard.OWNERSHIP_CATEGORY_REVIEWER_LEASE
+        ]
+
+    def test_merged_dead_uncontested_reviewer_lease_is_reclaimable(self):
+        bundle = self._run()
+        self.assertFalse(bundle["inventory_error"])
+        recs = self._reviewer_records(bundle)
+        self.assertEqual(len(recs), 1)
+        self.assertTrue(recs[0]["reclaim_allowed"])
+        # And the guard consequently does not block deletion on it.
+        ownership = branch_cleanup_guard.assess_active_branch_ownership(
+            remote=REMOTE, org=ORG, repo=REPO, branch=BRANCH, host=HOST,
+            records=bundle["records"],
+        )
+        self.assertFalse(ownership["block"])
+
+    def test_unmerged_pr_keeps_reviewer_lease_protective(self):
+        bundle = self._run(pr_merged=False)
+        recs = self._reviewer_records(bundle)
+        self.assertEqual(len(recs), 1)
+        self.assertFalse(recs[0]["reclaim_allowed"])
+        ownership = branch_cleanup_guard.assess_active_branch_ownership(
+            remote=REMOTE, org=ORG, repo=REPO, branch=BRANCH, host=HOST,
+            records=bundle["records"],
+        )
+        self.assertTrue(ownership["block"])
+
+    def test_owner_process_alive_keeps_reviewer_lease_protective(self):
+        bundle = self._run(owner_pid_alive=True, lease_freshness="expired")
+        recs = self._reviewer_records(bundle)
+        self.assertFalse(recs[0]["reclaim_allowed"])
+
+    def test_competing_worktree_binding_keeps_reviewer_lease_protective(self):
+        bundle = self._run(worktree_on_branch=True)
+        recs = self._reviewer_records(bundle)
+        self.assertFalse(recs[0]["reclaim_allowed"])
+        ownership = branch_cleanup_guard.assess_active_branch_ownership(
+            remote=REMOTE, org=ORG, repo=REPO, branch=BRANCH, host=HOST,
+            records=bundle["records"],
+        )
+        self.assertTrue(ownership["block"])
+
+    def test_expired_author_lease_never_reclaimed_by_reviewer_policy(self):
+        bundle = self._run(lease_role="author")
+        author_recs = [
+            rec
+            for rec in bundle["records"]
+            if rec.get("category")
+            == branch_cleanup_guard.OWNERSHIP_CATEGORY_AUTHOR_LEASE
+        ]
+        self.assertEqual(len(author_recs), 1)
+        self.assertFalse(author_recs[0]["reclaim_allowed"])
+
+
+if __name__ == "__main__":
+    unittest.main()