Merge branch 'master' into feat/issue-628-autonomous-handoffs-orchestration

resolve_canonical_repo_root fallback now uses commonpath only — no
string split and no os.path.isdir gate — so MCP project_root =
branches/<wt> still resolves to the repo root when the path is not yet
on disk (#274 / review #551 regression).

author_mutation_worktree.py

@@ -40,22 +40,88 @@ def _normalize_path(path: str) -> str:
     return (path or "").replace("\\", "/").rstrip("/")
 
 
+def get_canonical_branches_root(project_root: str | None = None) -> str:
+    """Return the absolute path of the canonical branches directory for *project_root*."""
+    root = os.path.realpath(project_root) if project_root else os.path.realpath(os.getcwd())
+    canonical_repo_root = resolve_canonical_repo_root(root, root)
+    return os.path.realpath(os.path.join(canonical_repo_root, "branches"))
+
+
 def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
-    """True when *path* resolves inside ``<project_root>/branches/``."""
+    """True when *path* resolves inside a canonical ``branches/`` directory."""
-    normalized = _normalize_path(path)
+    if not path or not str(path).strip():
-    if not normalized:
         return False
-    if "/branches/" in f"{normalized}/":
+    try:
-        return True
+        real_path = os.path.realpath(os.path.abspath(str(path).strip()))
-    if normalized.endswith("/branches"):
+    except Exception:
-        return True
+        return False
-    if project_root:
+
-        root = _normalize_path(os.path.realpath(project_root))
+    branches_root = get_canonical_branches_root(project_root or real_path)
-        real = _normalize_path(os.path.realpath(path))
+    try:
-        if real.startswith(f"{root}/"):
+        common = os.path.commonpath([branches_root, real_path])
-            rel = real[len(root) + 1 :]
+    except Exception:
-            return rel == "branches" or rel.startswith("branches/")
+        return False
-    return False
+
+    if common != branches_root:
+        return False
+
+    rel = os.path.relpath(real_path, branches_root)
+    return rel != "." and not rel.startswith("..")
+
+
+def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str) -> str:
+    """Return the stable repository root for *workspace_path* via git metadata (#460)."""
+    p = (workspace_path or "").strip()
+    if p:
+        try:
+            res = subprocess.run(
+                ["git", "-C", p, "rev-parse", "--git-common-dir"],
+                capture_output=True,
+                text=True,
+                check=True,
+            )
+            common = _realpath_git_common_dir(p, res.stdout)
+            if common.endswith(f"{os.sep}.git") or os.path.basename(common) == ".git":
+                candidate_root = os.path.dirname(common)
+                real_p = os.path.realpath(p)
+                try:
+                    if os.path.commonpath([candidate_root, real_p]) == candidate_root:
+                        return candidate_root
+                except Exception:
+                    pass
+        except Exception:
+            pass
+
+    # Fallback when git metadata is unavailable. Never string-split on
+    # "/branches/" (review #531 F2 / #551): recover the repo root only via
+    # resolved-path commonpath ancestry. Do **not** require on-disk isdir —
+    # MCP may launch with project_root = branches/<wt> before that path
+    # exists, and #274 path-shaped worktree-as-project-root must still resolve.
+    fallback = os.path.realpath(fallback_project_root or workspace_path or ".")
+    cur = fallback
+    for _ in range(64):
+        parent = os.path.dirname(cur)
+        if parent == cur:
+            break
+        branches_dir = os.path.realpath(os.path.join(parent, "branches"))
+        try:
+            # Path-shaped: fallback is under parent/branches/ (commonpath).
+            if os.path.commonpath([branches_dir, fallback]) == branches_dir:
+                return parent
+        except ValueError:
+            pass
+        # Fallback path itself is the branches directory.
+        if os.path.basename(os.path.realpath(cur)) == "branches":
+            try:
+                if os.path.commonpath([os.path.realpath(cur), fallback]) == os.path.realpath(
+                    cur
+                ):
+                    return parent
+            except ValueError:
+                pass
+        cur = parent
+
+    return fallback
 
 
 def resolve_mutation_workspace(
@@ -87,29 +153,6 @@ def _realpath_git_common_dir(workspace_path: str, common_dir: str) -> str:
     return os.path.realpath(os.path.join(workspace_path, raw))
 
 
-def resolve_canonical_repo_root(workspace_path: str, fallback_project_root: str) -> str:
-    """Return the stable repository root for *workspace_path* via git metadata (#460)."""
-    path = (workspace_path or "").strip()
-    fallback = os.path.realpath(fallback_project_root)
-    if not path:
-        return fallback
-    try:
-        res = subprocess.run(
-            ["git", "-C", path, "rev-parse", "--git-common-dir"],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-        common = _realpath_git_common_dir(path, res.stdout)
-    except Exception:
-        return fallback
-    if common.endswith(f"{os.sep}.git"):
-        return os.path.dirname(common)
-    if os.path.basename(common) == ".git":
-        return os.path.dirname(common)
-    return fallback
-
-
 def resolve_author_mutation_context(
     worktree_path: str | None,
     process_project_root: str,

control_plane_db.py

@@ -599,6 +599,35 @@ class ControlPlaneDB:
                 (_ts(), session_id),
             )
 
+    def list_sessions(
+        self,
+        *,
+        statuses: Sequence[str] | None = None,
+        limit: int = 500,
+    ) -> list[dict[str, Any]]:
+        """List session rows for restart / impact analysis (#658).
+
+        Read-only. Sessions are the process-level unit an MCP restart
+        disrupts, so the restart coordinator inventories them to compute blast
+        radius. Optional ``statuses`` filter (e.g. ``('active',)``) narrows to
+        live rows. Never returns secrets — only operational metadata.
+        """
+        clauses: list[str] = []
+        params: list[Any] = []
+        if statuses:
+            placeholders = ", ".join("?" for _ in statuses)
+            clauses.append(f"status IN ({placeholders})")
+            params.extend(statuses)
+        where = ("WHERE " + " AND ".join(clauses)) if clauses else ""
+        sql = (
+            f"SELECT * FROM sessions {where} "
+            "ORDER BY last_heartbeat_at DESC LIMIT ?"
+        )
+        params.append(max(1, int(limit)))
+        with self._tx(immediate=False) as conn:
+            rows = conn.execute(sql, params).fetchall()
+            return [dict(r) for r in rows]
+
     # ── work items ────────────────────────────────────────────────────────
 
     def upsert_work_item(

create_issue_bootstrap.py

@@ -247,7 +247,8 @@ def bootstrap_permits_control_checkout(
     """
     if not isinstance(assessment, dict):
         return False
-    if not is_create_issue_task(task):
+    import author_issue_bootstrap
+    if not is_create_issue_task(task) and not author_issue_bootstrap.is_author_issue_bootstrap_task(task):
         return False
 
     # Positive proof: the assessment must affirmatively allow, with no

docs/mcp-restart-coordinator.md

@@ -0,0 +1,95 @@
+# MCP restart coordinator and impact analysis (#658)
+
+Before any sanctioned MCP restart, a central coordinator evaluates the live
+control-plane state and produces an **impact preview** so operators and the web
+console (#642 / #652) can see the blast radius *before* concurrent LLM work is
+disrupted. Uncoordinated restarts destroy in-flight author/reviewer/merger work
+and give operators no way to see what they are about to break.
+
+This lands the coordinator + impact DTO + a dry-run MCP tool. It is the single
+sanctioned entry point for restart evaluation post-#657 (which inventoried the
+restart/reload/kill paths). The **mutative apply** path — actually performing a
+restart — is a later child gated by a drain proof and is explicitly out of
+scope here.
+
+## Components
+
+| Piece | Where | Responsibility |
+|-------|-------|----------------|
+| `restart_coordinator.evaluate_restart_impact` | `restart_coordinator.py` | Pure classification: inventory → impact report DTO. No I/O, no restart. |
+| `RestartImpactReport` / `SessionImpact` / `LeaseImpact` | `restart_coordinator.py` | Console-facing DTO (`.as_dict()` is JSON-serializable). |
+| `ControlPlaneDB.list_sessions` | `control_plane_db.py` | Read-only session inventory (the process-level unit a restart kills). |
+| `gitea_request_mcp_restart` | `gitea_mcp_server.py` | MCP tool: gathers inventory from the #613 DB, calls the coordinator, returns the report. Dry-run only. |
+
+## Dimensions evaluated
+
+The coordinator classifies the inventory across the dimensions #658 requires:
+
+- **Sessions** — every active MCP session; a restart terminates all of them.
+  Liveness = `status == active` **and** the owner pid is alive **and** the
+  heartbeat is fresh (default window 15 min). Dead/stale sessions do not count
+  toward blast radius.
+- **Leases / locks** — control-plane leases joined with work items and their
+  freshness (`lease_lifecycle.classify_lease_freshness`). Only `active` (live
+  owner) leases are *disruptive*; expired / released / dead-process leases never
+  withhold a restart.
+- **Issue / PR work** — the issues and PRs behind disruptive leases.
+- **Mutations / critical sections** — a live lease carrying an author worktree
+  or a mutating phase (`implementing`, `publishing`, `merging`, …) is a
+  critical section a restart must not sever.
+- **Terminal (merge) lock** — an active terminal lock always makes a restart
+  unsafe.
+- **Prior recovery attempts** — narrower recovery already tried (e.g. sanctioned
+  client reconnects) is echoed so the operator sees the escalation history.
+
+## Verdict
+
+Exactly three verdicts, matching the acceptance criteria:
+
+| Verdict | `allow_restart` | Meaning |
+|---------|-----------------|---------|
+| `safe` | `true` | No other live sessions, no live leases, no terminal lock. |
+| `unsafe` | `false` | Live work would be disrupted and no operator override is present — **or** the inventory could not be completed (fail closed). |
+| `override` | `true` | Live work present, but an operator override accepts the blast radius. |
+
+`override_would_allow` tells the console whether an override path exists for the
+current state. `blast_radius` is a `none` / `low` / `medium` / `high` severity
+band derived from the affected session and work counts.
+
+### Fail closed
+
+If the control-plane inventory cannot be completed (DB unavailable, a listing
+failed), `inventory_complete` is `false` and the verdict is `unsafe` / deny. An
+incomplete evaluation must never green-light a restart.
+
+### Operator override authority
+
+Override authority is read from the environment variable
+`GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION` and **never** from a tool
+argument. A worker session cannot set an environment variable on an
+already-running daemon, so override cannot be self-asserted (same pattern as the
+#630 daemon-maintenance authorization). The `request_override` tool argument only
+expresses caller intent; it takes effect solely when the environment
+authorization is present.
+
+## The tool
+
+```text
+gitea_request_mcp_restart(remote, host, org, repo,
+                          dry_run=True, request_override=False,
+                          session_id=None, limit=200)
+```
+
+Read-only, dry-run, and it **never restarts anything**. `apply_supported` is
+always `false`; passing `dry_run=False` performs no restart and reports that
+apply is gated by a drain proof (a separate child).
+
+## Audit
+
+Every evaluation carries an `audit_record` (event, coordinator version, verdict,
+allow decision, blast radius, counts, timestamp) so restart decisions are
+auditable. No secrets flow through the coordinator — session ids, pids, and
+profiles are operational metadata only.
+
+A representative dry-run report is in
+[`mcp-restart-impact-sample.json`](./mcp-restart-impact-sample.json).

docs/mcp-restart-impact-sample.json

@@ -0,0 +1,148 @@
+{
+  "coordinator_version": "1.0.0-issue-658",
+  "evaluated_at": "2026-07-24T06:00:00+00:00",
+  "dry_run": true,
+  "restart_performed": false,
+  "inventory_complete": true,
+  "incomplete_reasons": [],
+  "verdict": "unsafe",
+  "allow_restart": false,
+  "override_would_allow": true,
+  "operator_override": false,
+  "blast_radius": "high",
+  "reasons": [
+    "live work would be disrupted; restart denied without operator override",
+    "1 critical section(s) in flight (active lease with a live owner)"
+  ],
+  "affected_sessions": [
+    {
+      "session_id": "prgs-author-30988-d6f43c25",
+      "role": "author",
+      "profile": "prgs-author",
+      "pid": 1,
+      "status": "active",
+      "alive": true,
+      "heartbeat_stale": false,
+      "is_requester": false,
+      "live": true
+    },
+    {
+      "session_id": "prgs-reviewer-4157-0ce9",
+      "role": "reviewer",
+      "profile": "prgs-reviewer",
+      "pid": 1,
+      "status": "active",
+      "alive": true,
+      "heartbeat_stale": false,
+      "is_requester": true,
+      "live": true
+    }
+  ],
+  "affected_leases": [
+    {
+      "lease_id": "lease-abc",
+      "session_id": "prgs-author-30988-d6f43c25",
+      "role": "author",
+      "phase": "implementing",
+      "freshness": "active",
+      "work_kind": "issue",
+      "work_number": 658,
+      "worktree_path": "/repo/branches/feat-issue-658",
+      "disruptive": true,
+      "is_mutation": true,
+      "is_critical_section": true
+    },
+    {
+      "lease_id": "lease-dead",
+      "session_id": "prgs-author-91485",
+      "role": "author",
+      "phase": "allocated",
+      "freshness": "stale_dead_process",
+      "work_kind": "issue",
+      "work_number": 651,
+      "worktree_path": null,
+      "disruptive": false,
+      "is_mutation": false,
+      "is_critical_section": false
+    }
+  ],
+  "critical_sections": [
+    {
+      "lease_id": "lease-abc",
+      "session_id": "prgs-author-30988-d6f43c25",
+      "role": "author",
+      "phase": "implementing",
+      "freshness": "active",
+      "work_kind": "issue",
+      "work_number": 658,
+      "worktree_path": "/repo/branches/feat-issue-658",
+      "disruptive": true,
+      "is_mutation": true,
+      "is_critical_section": true
+    }
+  ],
+  "affected_issues": [
+    658
+  ],
+  "affected_prs": [],
+  "mutations": [
+    {
+      "lease_id": "lease-abc",
+      "session_id": "prgs-author-30988-d6f43c25",
+      "role": "author",
+      "phase": "implementing",
+      "freshness": "active",
+      "work_kind": "issue",
+      "work_number": 658,
+      "worktree_path": "/repo/branches/feat-issue-658",
+      "disruptive": true,
+      "is_mutation": true,
+      "is_critical_section": true
+    }
+  ],
+  "terminal_lock": null,
+  "ack_state": {
+    "prgs-author-30988-d6f43c25": "pending"
+  },
+  "prior_recovery_attempts": [
+    {
+      "kind": "client_reconnect",
+      "at": "2026-07-24T06:00:00+00:00",
+      "outcome": "insufficient"
+    }
+  ],
+  "counts": {
+    "sessions_total": 2,
+    "sessions_live_other": 1,
+    "leases_total": 2,
+    "leases_disruptive": 1,
+    "critical_sections": 1,
+    "mutations": 1,
+    "affected_issues": 1,
+    "affected_prs": 0,
+    "prior_recovery_attempts": 1
+  },
+  "audit_record": {
+    "event": "restart_impact_evaluated",
+    "coordinator_version": "1.0.0-issue-658",
+    "evaluated_at": "2026-07-24T06:00:00+00:00",
+    "dry_run": true,
+    "operator_override": false,
+    "requesting_session_id": "prgs-reviewer-4157-0ce9",
+    "inventory_complete": true,
+    "verdict": "unsafe",
+    "allow_restart": false,
+    "blast_radius": "high",
+    "counts": {
+      "sessions_total": 2,
+      "sessions_live_other": 1,
+      "leases_total": 2,
+      "leases_disruptive": 1,
+      "critical_sections": 1,
+      "mutations": 1,
+      "affected_issues": 1,
+      "affected_prs": 0,
+      "prior_recovery_attempts": 1
+    }
+  }
+}

docs/mcp-tool-inventory.md

@@ -69,6 +69,7 @@ that gates each call, not which tools exist.
 - `gitea_audit_worktree_cleanup`
 - `gitea_authorize_reconciliation_cleanup_phase`
 - `gitea_authorize_review_correction`
+- `gitea_bootstrap_author_issue_worktree`
 - `gitea_capability_stop_terminal_report`
 - `gitea_capture_branches_worktree_snapshot`
 - `gitea_check_pr_eligibility`
@@ -135,6 +136,7 @@ that gates each call, not which tools exist.
 - `gitea_release_merger_pr_lease`
 - `gitea_release_reviewer_pr_lease`
 - `gitea_release_workflow_lease`
+- `gitea_request_mcp_restart`
 - `gitea_resolve_task_capability`
 - `gitea_resume_review_draft`
 - `gitea_review_pr`

docs/webui-local-dev.md

@@ -54,6 +54,7 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/` | Home / operator overview |
 | `/health` | JSON liveness (`status`, `service`, `mode`, `timestamp`, `uptime_seconds`) |
 | `/api/v1/system/health` | Structured read-only system health (#634) |
+| `/system-health` | System-health dashboard — readiness, version/uptime, dependencies, MCP namespaces, stale-runtime parity (#639) |
 | `/queue` | Live PR and issue queue dashboard (#429) |
 | `/api/queue` | JSON queue export with pagination metadata |
 | `/projects` | Project registry list with status and onboarding progress (#427, #635) |
@@ -258,6 +259,37 @@ Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
 surfaces are backed by #636). Mutating methods on stub routes still fail closed
 with `read-only-mvp`.
 
+## System-health dashboard (#639)
+
+`/system-health` renders the same snapshot the `/api/v1/system/health` API
+returns, so the page and the API can never disagree. Cards: overall readiness,
+stale-runtime parity, version and uptime, dependency probes, MCP namespaces,
+probe errors (only when present), and recovery pointers. `?deep=1` opts into
+the network probe exactly as the API does; the plain page load stays cheap.
+
+Field authority and honesty rules:
+
+* `ready` and `readiness_complete` are shown separately. A snapshot whose
+  required probes never ran is not the same as one that ran them and passed,
+  and the page never collapses the two into an unproven green.
+* A probe that did not run appears under **Not probed**, never as healthy.
+* `stale_runtime.mutation_safe` is displayed verbatim from the API. When the
+  runtime is stale, or when parity is indeterminate, the page warns and does
+  not claim mutation safety.
+* MCP namespaces are reported `unproven`: the web process runs outside the
+  IDE-managed MCP client and cannot prove that path (#543).
+
+Redaction is split by field kind. Free text — probe details, readiness and
+parity reasons, probe errors — passes through `system_health.redact`.
+Structured fields — commit SHAs, probe names, statuses, timestamps — are
+HTML-escaped only, because `redact`'s opaque-token rule matches any run of 32
+or more characters and would otherwise blank every 40-character git SHA, which
+is precisely the evidence the parity view exists to show.
+
+The dashboard is read-only: no restart, reload, or process-kill control. Those
+arrive in Phase 2 (#642). Recovery guidance points at the sanctioned client
+reconnect / operator restart path — never a manual daemon kill (#630).
+
 ## Deployment boundary (#435)
 
 MVP serves on loopback by default. Binding `0.0.0.0` or `::` is **refused**

gitea_mcp_server.py

@@ -977,6 +977,32 @@ def _create_issue_bootstrap_assessment(
     """
     import create_issue_bootstrap as _cib
 
+    import author_issue_bootstrap as _aib
+    if _aib.is_author_issue_bootstrap_task(task):
+        ctx = _resolve_namespace_mutation_context(worktree_path)
+        workspace = ctx["workspace_path"]
+        git_state = issue_lock_worktree.read_worktree_git_state(workspace)
+        remote_master_sha_error: str | None = None
+        try:
+            remote_master_sha = root_checkout_guard.resolve_remote_master_sha(
+                ctx["canonical_repo_root"]
+            )
+        except Exception as exc:
+            remote_master_sha = None
+            remote_master_sha_error = (
+                f"{type(exc).__name__}: {exc}".strip() or "resolver failed"
+            )
+        return _aib.assess_author_issue_bootstrap(
+            workspace_path=workspace,
+            canonical_repo_root=ctx["canonical_repo_root"],
+            current_branch=git_state.get("current_branch"),
+            head_sha=git_state.get("head_sha"),
+            porcelain_status=git_state.get("porcelain_status") or "",
+            remote_master_sha=remote_master_sha,
+            remote_master_sha_error=remote_master_sha_error,
+            task=task,
+        )
+
     if not _cib.is_create_issue_task(task):
         return None
 
@@ -2040,6 +2066,7 @@ import dependency_graph  # noqa: E402  # #784 durable dependency edges
 import control_plane_db  # noqa: E402
 import lease_lifecycle  # noqa: E402
 import workflow_dashboard  # noqa: E402  # #605 live queue/lease dashboard
+import restart_coordinator  # noqa: E402  # #658 MCP restart coordinator/impact
 import incident_bridge  # noqa: E402
 import sentry_observability  # noqa: E402  (#606 optional Sentry observability)
 import sentry_incident_bridge  # noqa: E402  (#607 Sentry→Gitea incident bridge)
@@ -9579,6 +9606,7 @@ def gitea_commit_files(
     host: str | None = None,
     org: str | None = None,
     repo: str | None = None,
+    worktree_path: str | None = None,
 ) -> dict:
     """Commit changes to multiple files in a Gitea repository in a single atomic commit.
 
@@ -9591,10 +9619,46 @@ def gitea_commit_files(
         host: Override the Gitea host.
         org: Override the owner/organization.
         repo: Override the repository name.
+        worktree_path: Optional worktree path for author mutation context.
 
     Returns:
         dict with success status and commit/branch information.
     """
+    if worktree_path is None:
+        lock_data = issue_lock_store.read_session_issue_lock() or {}
+        worktree_path = lock_data.get("worktree_path")
+        if not worktree_path:
+            try:
+                prof = get_profile()
+                uname = prof.get("username") or prof.get("profile_name")
+                for path in issue_lock_store.iter_lock_files():
+                    lk = issue_lock_store.read_lock_file(path) or {}
+                    claimant = lk.get("claimant") or {}
+                    if lk.get("remote") == remote and (claimant.get("username") == uname or lk.get("profile") == prof.get("profile_name")):
+                        issue_lock_store.bind_session_lock(lk, renewal_sanctioned=True)
+                        worktree_path = lk.get("worktree_path")
+                        break
+            except Exception:
+                pass
+
+    if worktree_path is None and files:
+        for f in files:
+            p = f.get("workspace_path") or f.get("local_path") or ""
+            if p and os.path.isabs(p):
+                real_p = os.path.realpath(p)
+                real_root = os.path.realpath(PROJECT_ROOT)
+                branches_dir = os.path.join(real_root, "branches")
+                if real_p.startswith(branches_dir + os.sep):
+                    rel_sub = os.path.relpath(real_p, branches_dir)
+                    wt_folder = rel_sub.split(os.sep)[0]
+                    if wt_folder and wt_folder != "..":
+                        worktree_path = os.path.join(branches_dir, wt_folder)
+                        break
+
+    if worktree_path:
+        os.environ["GITEA_AUTHOR_WORKTREE"] = worktree_path
+        os.environ["GITEA_ACTIVE_WORKTREE"] = worktree_path
+
     ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
         "commit_files"
     )
@@ -9607,7 +9671,7 @@ def gitea_commit_files(
             "reasons": block_reasons,
         }
     blocked = _namespace_mutation_block(
-        "commit_files", commit="", branch="", remote=remote
+        "commit_files", commit="", branch="", remote=remote, worktree_path=worktree_path
     )
     if blocked:
         return blocked
@@ -9635,7 +9699,7 @@ def gitea_commit_files(
         )
 
     # #735: forward explicit org/repo into shared anti-stomp preflight.
-    verify_preflight_purity(remote, task="commit_files", org=org, repo=repo)
+    verify_preflight_purity(remote=remote, worktree_path=worktree_path, task="commit_files", org=org, repo=repo)
     processed_files, source_proofs = _prepare_commit_payload_files(files)
 
     h, o, r = _resolve(remote, host, org, repo)
@@ -9912,6 +9976,96 @@ def gitea_publish_unpublished_issue_branch(
     }
 
 
+@mcp.tool()
+def gitea_bootstrap_author_issue_worktree(
+    issue_number: int,
+    assignment_id: str | None = None,
+    lease_id: str | None = None,
+    expected_base_sha: str | None = None,
+    branch_name: str | None = None,
+    worktree_path: str | None = None,
+    idempotency_key: str | None = None,
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    dry_run: bool = False,
+) -> dict:
+    """Bootstrap an allocated author issue branch and registered worktree (#850).
+
+    Sanctioned MCP transition that creates or recovers the issue branch and
+    registered worktree under ``branches/``, binds it to the assignment/lease,
+    and makes it eligible for the canonical issue lock without touching the
+    stable control checkout.
+
+    Args:
+        issue_number: Allocated issue number to bootstrap.
+        assignment_id: Optional allocation assignment ID.
+        lease_id: Optional workflow lease ID.
+        expected_base_sha: Authoritative expected base SHA / concurrency pin.
+        branch_name: Optional custom branch name (must match issue-<N> pattern).
+        worktree_path: Optional custom worktree path under branches/.
+        idempotency_key: Optional key for idempotent replay/resume.
+        remote: Known instance — 'dadeschools' or 'prgs'.
+        host: Override Gitea host.
+        org: Override Org.
+        repo: Override Repo.
+        dry_run: Report planned transition without mutating repository.
+    """
+    task = "bootstrap_author_issue_worktree"
+    ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
+        task
+    )
+    if not ok:
+        return _author_mutation_block(block_reasons)
+
+    blocked = _namespace_mutation_block(task, remote=remote)
+    if blocked:
+        return blocked
+    blocked = _profile_permission_block(
+        task_capability_map.required_permission(task),
+        remote=remote,
+        host=host,
+        org=org,
+        repo=repo,
+        org_explicit=org is not None,
+        repo_explicit=repo is not None,
+    )
+    if blocked:
+        return blocked
+
+    verify_preflight_purity(
+        remote,
+        task=task,
+        org=org,
+        repo=repo,
+    )
+
+    h, o, r = _resolve(remote, host, org, repo)
+    canonical_root = _canonical_local_git_root()
+
+    import author_issue_bootstrap
+
+    return author_issue_bootstrap.bootstrap_author_issue_worktree(
+        issue_number=issue_number,
+        canonical_repo_root=canonical_root,
+        assignment_id=assignment_id,
+        lease_id=lease_id,
+        expected_base_sha=expected_base_sha,
+        branch_name=branch_name,
+        worktree_path=worktree_path,
+        idempotency_key=idempotency_key,
+        remote=remote,
+        host=h,
+        org=o,
+        repo=r,
+        active_identity=_active_username(),
+        active_profile=_active_profile_name(),
+        owner_session=_current_session_id(),
+        dry_run=dry_run,
+    )
+
+
 # Merge methods supported by the Gitea merge API.
 _MERGE_METHODS = ("merge", "squash", "rebase")
 
@@ -12013,163 +12167,127 @@ def gitea_reconcile_merged_cleanups(
     if dry_run:
         report["dry_run"] = True
         report["executed"] = False
-        # #851: surface planned lifecycle order so dry-run matches execute.
-        report["planned_execution_orders"] = {
-            str(entry.get("pr_number")): entry.get("planned_execution_order") or []
-            for entry in (report.get("entries") or [])
-        }
         return {"success": True, "performed": False, **report}
 
     verify_preflight_purity(
         remote, task="reconcile_merged_cleanups", org=org, repo=repo
     )
     actions: list[dict] = []
-    project_root = _canonical_local_git_root()
-
-    def _ownership_records_for_branch(
-        head_branch: str, pr_num_int: int | None
-    ) -> list[dict]:
-        ownership_bundle = _collect_branch_ownership_records(
-            remote=remote,
-            host=h,
-            org=o,
-            repo=r,
-            branch=head_branch,
-            pr_number=pr_num_int,
-            project_root=project_root,
-            auth=auth,
-            base_api=base,
-        )
-        ownership_records = list(ownership_bundle.get("records") or [])
-        if ownership_bundle.get("inventory_error"):
-            ownership_records.append(
-                {
-                    "category": (
-                        branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
-                    ),
-                    "status": "unknown",
-                    "remote": remote,
-                    "host": h,
-                    "org": o,
-                    "repo": r,
-                    "branch": head_branch,
-                    "reclaim_allowed": False,
-                    "role": "inventory",
-                }
-            )
-        return ownership_records
-
-    def _attempt_owned_remote_delete(
-        *,
-        head_branch: str,
-        pr_num_int: int | None,
-        after_worktree_removal: bool = False,
-    ) -> dict:
-        """Fail-closed remote delete with live ownership reassessment (#851)."""
-        import urllib.parse
-
-        ownership_records = _ownership_records_for_branch(head_branch, pr_num_int)
-        ownership = branch_cleanup_guard.assess_active_branch_ownership(
-            remote=remote,
-            org=o,
-            repo=r,
-            branch=head_branch,
-            host=h,
-            records=ownership_records,
-        )
-        if ownership.get("block"):
-            return {
-                "action": "delete_remote_branch",
-                "branch": head_branch,
-                "success": False,
-                "performed": False,
-                "delete_acknowledged": False,
-                "verified_absent": False,
-                "blocker_kind": "active_branch_ownership",
-                "reasons": ownership.get("reasons") or [],
-                "blocking_categories": ownership.get("blocking_categories") or [],
-                "after_worktree_removal": after_worktree_removal,
-                "ownership_reassessed": after_worktree_removal,
-            }
-
-        encoded = urllib.parse.quote(head_branch, safe="")
-        url = f"{base}/branches/{encoded}"
-        with _audited(
-            "delete_branch",
-            host=h,
-            remote=remote,
-            org=o,
-            repo=r,
-            target_branch=head_branch,
-            request_metadata={
-                "branch": head_branch,
-                "source": "reconcile_merged_cleanups",
-                "ownership_checked": True,
-                "after_worktree_removal": after_worktree_removal,
-            },
-        ):
-            api_request("DELETE", url, auth)
-        readback = _probe_remote_branch(h, o, r, auth, head_branch)
-        readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
-            readback
-        )
-        verified = bool(readback_assessment.get("verified_absent"))
-        return {
-            "action": "delete_remote_branch",
-            "branch": head_branch,
-            "success": bool(readback_assessment.get("ok")),
-            "performed": True,
-            "delete_acknowledged": True,
-            "verified_absent": verified,
-            "readback": readback_assessment.get("readback"),
-            "reasons": readback_assessment.get("reasons") or [],
-            "after_worktree_removal": after_worktree_removal,
-            "ownership_reassessed": after_worktree_removal,
-        }
-
     for entry in report.get("entries") or []:
         head_branch = entry.get("head_branch") or ""
         remote_assessment = entry.get("remote_branch") or {}
         local_assessment = entry.get("local_worktree") or {}
-        pr_num = entry.get("pr_number")
-        try:
-            pr_num_int = int(pr_num) if pr_num is not None else None
-        except (TypeError, ValueError):
-            pr_num_int = None
 
-        # #851 lifecycle: when the target worktree is independently safe, remove
+        if remote_assessment.get("safe_to_delete_remote"):
-        # it first so worktree_binding ownership does not permanently strand
+            import urllib.parse
-        # both the worktree and the remote branch. Never skip worktree removal
+
-        # merely because remote delete would be blocked by that binding.
+            pr_num = entry.get("pr_number")
-        # Ownership protection for remote delete remains fail-closed below.
+            try:
-        worktree_removed = False
+                pr_num_int = int(pr_num) if pr_num is not None else None
+            except (TypeError, ValueError):
+                pr_num_int = None
+            ownership_bundle = _collect_branch_ownership_records(
+                remote=remote,
+                host=h,
+                org=o,
+                repo=r,
+                branch=head_branch,
+                pr_number=pr_num_int,
+                project_root=_canonical_local_git_root(),
+                auth=auth,
+                base_api=base,
+            )
+            ownership_records = list(ownership_bundle.get("records") or [])
+            if ownership_bundle.get("inventory_error"):
+                ownership_records.append(
+                    {
+                        "category": (
+                            branch_cleanup_guard.OWNERSHIP_CATEGORY_INVENTORY_ERROR
+                        ),
+                        "status": "unknown",
+                        "remote": remote,
+                        "host": h,
+                        "org": o,
+                        "repo": r,
+                        "branch": head_branch,
+                        "reclaim_allowed": False,
+                        "role": "inventory",
+                    }
+                )
+            ownership = branch_cleanup_guard.assess_active_branch_ownership(
+                remote=remote,
+                org=o,
+                repo=r,
+                branch=head_branch,
+                host=h,
+                records=ownership_records,
+            )
+            if ownership.get("block"):
+                actions.append(
+                    {
+                        "action": "delete_remote_branch",
+                        "branch": head_branch,
+                        "success": False,
+                        "performed": False,
+                        "delete_acknowledged": False,
+                        "verified_absent": False,
+                        "blocker_kind": "active_branch_ownership",
+                        "reasons": ownership.get("reasons") or [],
+                        "blocking_categories": ownership.get(
+                            "blocking_categories"
+                        )
+                        or [],
+                    }
+                )
+                continue
+
+            encoded = urllib.parse.quote(head_branch, safe="")
+            url = f"{base}/branches/{encoded}"
+            with _audited(
+                "delete_branch",
+                host=h,
+                remote=remote,
+                org=o,
+                repo=r,
+                target_branch=head_branch,
+                request_metadata={
+                    "branch": head_branch,
+                    "source": "reconcile_merged_cleanups",
+                    "ownership_checked": True,
+                },
+            ):
+                api_request("DELETE", url, auth)
+            readback = _probe_remote_branch(h, o, r, auth, head_branch)
+            readback_assessment = branch_cleanup_guard.assess_post_delete_readback(
+                readback
+            )
+            verified = bool(readback_assessment.get("verified_absent"))
+            actions.append(
+                {
+                    "action": "delete_remote_branch",
+                    "branch": head_branch,
+                    "success": bool(readback_assessment.get("ok")),
+                    "performed": True,
+                    "delete_acknowledged": True,
+                    "verified_absent": verified,
+                    "readback": readback_assessment.get("readback"),
+                    "reasons": readback_assessment.get("reasons") or [],
+                }
+            )
+
         if local_assessment.get("safe_to_remove_worktree"):
             result = merged_cleanup_reconcile.remove_local_worktree(
-                project_root,
+                _canonical_local_git_root(),
                 head_branch,
                 worktree_path=local_assessment.get("worktree_path"),
             )
             actions.append({"action": "remove_local_worktree", **result})
-            # Idempotent resume: absent worktree is already gone.
-            msg = (result.get("message") or "").lower()
-            worktree_removed = bool(result.get("success")) or (
-                "not found" in msg
-            )
-
-        if remote_assessment.get("safe_to_delete_remote"):
-            actions.append(
-                _attempt_owned_remote_delete(
-                    head_branch=head_branch,
-                    pr_num_int=pr_num_int,
-                    after_worktree_removal=worktree_removed,
-                )
-            )
 
     for scratch in report.get("reviewer_scratch_entries") or []:
         if not scratch.get("safe_to_remove_worktree"):
             continue
         result = merged_cleanup_reconcile.remove_reviewer_scratch_worktree(
-            project_root, scratch.get("worktree_path") or ""
+            _canonical_local_git_root(), scratch.get("worktree_path") or ""
         )
         actions.append({"action": "remove_reviewer_scratch_worktree", **result})
 
@@ -20149,6 +20267,12 @@ def gitea_resolve_task_capability(
     task: str,
     remote: str = "dadeschools",
     host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    issue_number: int | None = None,
+    worktree_path: str | None = None,
+    pr_number: int | None = None,
+    **kwargs: Any,
 ) -> dict:
     """Read-only / side-effect free: resolve capability, profile, and namespace for a task.
 
@@ -20165,13 +20289,14 @@ def gitea_resolve_task_capability(
         remote: Known remote instance name.
         host: Optional override for the Gitea host.
     """
+    task_key = task_capability_map._canonical_preflight_task(task)
     TASK_MAP = task_capability_map.TASK_CAPABILITY_MAP
     # Every fresh attempt invalidates the previous task/role stamp before any
     # fallible resolver work. Unknown/malformed tasks and unexpected failures
     # therefore remain fail-closed instead of preserving stale authority.
     _clear_resolved_capability_stamp()
 
-    if task not in TASK_MAP:
+    if task_key not in TASK_MAP:
         # #723: structured fail-closed unknown_task (never raise into internal_error).
         profile = get_profile()
         h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
@@ -20217,8 +20342,8 @@ def gitea_resolve_task_capability(
             result["cleared_stale_denial"] = True
         return result
 
-    required_permission = task_capability_map.required_permission(task)
+    required_permission = task_capability_map.required_permission(task_key)
-    required_role = task_capability_map.required_role(task)
+    required_role = task_capability_map.required_role(task_key)
     role_exclusive_tasks = task_capability_map.ROLE_EXCLUSIVE_TASKS
 
     infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
@@ -20404,7 +20529,10 @@ def gitea_resolve_task_capability(
     available_in_session = allowed_in_current_session
     runtime_stale_blocker = False
 
-    if "PYTEST_CURRENT_TEST" not in os.environ or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ:
+    if (
+        "PYTEST_CURRENT_TEST" not in os.environ
+        or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ
+    ) and os.environ.get("GITEA_ALLOW_STALE_RUNTIME") != "1":
         runtime_reasons = _check_mcp_runtimes_diagnostics(task, matching_profiles)
         if runtime_reasons:
             restart_required = True
@@ -22050,6 +22178,156 @@ def gitea_workflow_dashboard(
     return payload
 
 
+@mcp.tool()
+def gitea_request_mcp_restart(
+    remote: str = "dadeschools",
+    host: str | None = None,
+    org: str | None = None,
+    repo: str | None = None,
+    dry_run: bool = True,
+    request_override: bool = False,
+    session_id: str | None = None,
+    limit: int = 200,
+) -> dict:
+    """Evaluate a proposed MCP restart and return an impact preview (#658).
+
+    Central restart coordinator: gathers live control-plane state (sessions,
+    leases/locks, in-flight issue/PR work, mutations, worktrees) and returns a
+    blast-radius impact report with a ``safe`` / ``unsafe`` / ``override``
+    verdict, so the console (#642/#652) and operators can see what a restart
+    would disrupt *before* any concurrent LLM work is destroyed.
+
+    This tool is **dry-run and never restarts anything.** The mutative apply
+    path is a separate child gated by a drain proof (non-goal here); calling
+    with ``dry_run=False`` still performs no restart and reports that apply is
+    not yet available.
+
+    Operator override authority is read from the process environment
+    (``GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION``), never self-asserted by
+    the requesting session: ``request_override`` only expresses caller intent
+    and takes effect solely when that environment authorization is present.
+
+    Fails closed: if the control-plane inventory cannot be completed, the
+    verdict is ``unsafe`` / deny (an incomplete evaluation must never green-light
+    a restart).
+    """
+    read_block = _profile_operation_gate("gitea.read")
+    if read_block:
+        return {
+            "success": False,
+            "read_only": True,
+            "dry_run": True,
+            "restart_performed": False,
+            "reasons": read_block,
+            "permission_report": _permission_block_report("gitea.read"),
+        }
+
+    try:
+        h, o, r = _resolve(remote, host, org, repo)
+    except ValueError as exc:
+        return {
+            "success": False,
+            "read_only": True,
+            "dry_run": True,
+            "restart_performed": False,
+            "reasons": [str(exc)],
+        }
+
+    inventory_complete = True
+    incomplete_reasons: list[str] = []
+    sessions: list[dict] = []
+    leases: list[dict] = []
+    terminal_lock: dict | None = None
+
+    db, db_errs = _control_plane_db_or_error()
+    if db is None:
+        inventory_complete = False
+        incomplete_reasons.extend(
+            db_errs or ["control-plane DB unavailable; cannot evaluate restart"]
+        )
+    else:
+        try:
+            sessions = db.list_sessions(statuses=("active",), limit=max(1, int(limit)))
+        except Exception as exc:  # noqa: BLE001
+            inventory_complete = False
+            incomplete_reasons.append(
+                f"session inventory failed: {_redact(str(exc))}"
+            )
+        try:
+            lease_result = lease_lifecycle.list_active_leases(
+                db,
+                remote=remote if remote in REMOTES else remote,
+                org=o,
+                repo=r,
+                role=None,
+                include_non_active=False,
+                limit=max(1, int(limit)),
+            )
+            leases = list(lease_result.get("leases") or [])
+        except Exception as exc:  # noqa: BLE001
+            inventory_complete = False
+            incomplete_reasons.append(
+                f"lease inventory failed: {_redact(str(exc))}"
+            )
+        try:
+            terminal = db.get_active_terminal_lock(
+                remote=remote if remote in REMOTES else remote,
+                org=o,
+                repo=r,
+            )
+            if terminal:
+                terminal_lock = dict(terminal)
+        except Exception as exc:  # noqa: BLE001
+            inventory_complete = False
+            incomplete_reasons.append(
+                f"terminal lock lookup failed: {_redact(str(exc))}"
+            )
+
+    profile = get_profile()
+    profile_name = (profile.get("profile_name") or "").strip() or "session"
+    sid = (session_id or "").strip() or f"{profile_name}-{os.getpid()}"
+
+    # Override authority is read from the environment only — a worker session
+    # cannot set an env var for an already-running daemon, so it cannot be
+    # self-asserted the way a tool argument could (#630/#710 F1 pattern).
+    operator_authorized = bool(
+        (os.environ.get("GITEA_OPERATOR_RESTART_OVERRIDE_AUTHORIZATION") or "").strip()
+    )
+    operator_override = bool(request_override and operator_authorized)
+
+    inventory = {
+        "sessions": sessions,
+        "leases": leases,
+        "terminal_lock": terminal_lock,
+        "inventory_complete": inventory_complete,
+        "incomplete_reasons": incomplete_reasons,
+    }
+
+    report = restart_coordinator.evaluate_restart_impact(
+        inventory,
+        operator_override=operator_override,
+        requesting_session_id=sid,
+        dry_run=True,  # coordinator is always analysis-only (#658)
+    )
+
+    payload = report.as_dict()
+    payload["success"] = True
+    payload["read_only"] = True
+    payload["remote"] = remote
+    payload["org"] = o
+    payload["repo"] = r
+    payload["requesting_session_id"] = sid
+    payload["operator_override_requested"] = bool(request_override)
+    payload["operator_override_authorized"] = operator_authorized
+    payload["apply_supported"] = False
+    if not dry_run:
+        payload["reasons"] = list(payload.get("reasons") or []) + [
+            "apply requested but not supported: sanctioned restart apply is "
+            "gated by a drain proof (separate child); no restart performed (#658)"
+        ]
+    return payload
+
+
 @mcp.tool()
 def gitea_inspect_workflow_lease(
     lease_id: str,

pr_work_lease.py

@@ -228,25 +228,74 @@ def find_active_reviewer_lease(
     return None
 
 
+def _conflict_fix_chain_key(lease: dict) -> tuple | None:
+    """Identity of the lease chain a conflict-fix marker belongs to (#842).
+
+    Keyed by PR number, profile, head_before, and branch. Returns None when any
+    required component (pr_number, profile, head_before) is missing or malformed.
+    """
+    raw = lease.get("raw_fields") or {}
+    pr_number = lease.get("pr_number")
+    profile = (lease.get("profile") or "").strip().lower()
+    head_before = lease.get("head_before")
+    branch = (lease.get("branch") or raw.get("branch") or "").strip()
+    if not (pr_number and profile and head_before):
+        return None
+    return (pr_number, profile, head_before, branch)
+
+
+def _conflict_fix_chain_matches(key1: tuple, key2: tuple) -> bool:
+    """True when two conflict-fix chain keys refer to the same lease chain."""
+    pr1, profile1, head1, branch1 = key1
+    pr2, profile2, head2, branch2 = key2
+    if pr1 != pr2 or profile1 != profile2 or head1 != head2:
+        return False
+    if branch1 and branch2 and branch1 != branch2:
+        return False
+    return True
+
+
+def _conflict_fix_chain_terminated_after(entries: list[dict], index: int) -> bool:
+    """True when a later marker terminates the conflict-fix chain of ``entries[index]``.
+
+    Append-only newest-wins: a terminal marker (phase=released/blocked/done)
+    ends only its matching claim chain (#842).
+    """
+    key = _conflict_fix_chain_key(entries[index])
+    if key is None:
+        return False
+    for later in entries[index + 1:]:
+        phase = (later.get("phase") or "").strip().lower()
+        if phase not in _TERMINAL_CONFLICT_FIX_PHASES:
+            continue
+        later_key = _conflict_fix_chain_key(later)
+        if later_key and _conflict_fix_chain_matches(key, later_key):
+            return True
+    return False
+
+
 def find_active_conflict_fix_lease(
     comments: list[dict],
     *,
     pr_number: int,
     now: datetime | None = None,
 ) -> dict[str, Any] | None:
-    """Return the newest unexpired conflict-fix lease for *pr_number*, if any."""
+    """Return the newest unexpired, non-terminated conflict-fix lease for *pr_number*, if any."""
     now = now or datetime.now(timezone.utc)
     candidates = [
         entry for entry in _comment_entries(comments, pr_number=pr_number)
         if entry.get("lease_kind") == "conflict_fix"
     ]
-    for lease in reversed(candidates):
+    for index in range(len(candidates) - 1, -1, -1):
+        lease = candidates[index]
         if _lease_expired(lease, now=now):
             continue
         phase = (lease.get("phase") or "").strip().lower()
         if phase in _TERMINAL_CONFLICT_FIX_PHASES:
             continue
         if phase in _ACTIVE_CONFLICT_FIX_PHASES or phase:
+            if _conflict_fix_chain_terminated_after(candidates, index):
+                continue
             return lease
     return None
 

restart_coordinator.py

@@ -0,0 +1,451 @@
+"""MCP restart coordinator and impact analysis (#658).
+
+Before any sanctioned MCP restart, a central coordinator must evaluate the
+live control-plane state — active sessions, leases/locks, in-flight issue/PR
+work, mutations, worktrees, and recovery history — and produce an *impact
+preview* so operators (and the web console, #642/#652) can see the blast
+radius **before** concurrent LLM work is disrupted.
+
+Design rules (mirrors the read-only posture of ``workflow_dashboard`` /
+``lease_lifecycle``):
+
+* **Pure classification.** :func:`evaluate_restart_impact` takes an already
+  gathered inventory and returns a structured report. It never touches the
+  network, the filesystem, or a live process, so multi-session fixtures can
+  drive every branch in unit tests. The coordinator *never restarts anything*;
+  a mutative apply path is a later child gated by a drain proof (non-goal here).
+* **Fail closed.** If the inventory is not explicitly complete, the verdict is
+  ``unsafe`` / deny — an incomplete evaluation must never green-light a restart.
+* **No secrets.** Session ids, pids, and profiles are operational metadata, not
+  credentials; nothing secret flows through this module.
+
+The single sanctioned entry point post-#657 is the MCP tool
+``gitea_request_mcp_restart`` (dry-run by default), which gathers the inventory
+from the #613 control-plane DB and calls :func:`evaluate_restart_impact`.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Mapping, Sequence
+
+import lease_lifecycle
+
+COORDINATOR_VERSION = "1.0.0-issue-658"
+
+# Restart verdicts. Exactly the three the acceptance criteria name.
+VERDICT_SAFE = "safe"
+VERDICT_UNSAFE = "unsafe"
+VERDICT_OVERRIDE = "override"
+
+# Blast-radius severity bands.
+BLAST_NONE = "none"
+BLAST_LOW = "low"
+BLAST_MEDIUM = "medium"
+BLAST_HIGH = "high"
+
+# A live lease with a live owner process is treated as active in-flight work.
+LEASE_FRESHNESS_LIVE = "active"
+
+# Default staleness window for a session heartbeat (seconds). A session whose
+# last heartbeat is older than this is not counted as live even if its row is
+# still marked ``active`` — it is assumed dead/detached.
+DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS = 900
+
+
+def _utc_now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _parse_ts(value: str | None) -> datetime | None:
+    return lease_lifecycle._parse_ts(value)
+
+
+@dataclass(frozen=True)
+class SessionImpact:
+    """One MCP session a restart would terminate."""
+
+    session_id: str
+    role: str | None
+    profile: str | None
+    pid: int | None
+    status: str | None
+    alive: bool | None
+    heartbeat_stale: bool
+    is_requester: bool
+    live: bool
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "session_id": self.session_id,
+            "role": self.role,
+            "profile": self.profile,
+            "pid": self.pid,
+            "status": self.status,
+            "alive": self.alive,
+            "heartbeat_stale": self.heartbeat_stale,
+            "is_requester": self.is_requester,
+            "live": self.live,
+        }
+
+
+@dataclass(frozen=True)
+class LeaseImpact:
+    """One control-plane lease a restart would disrupt."""
+
+    lease_id: str | None
+    session_id: str | None
+    role: str | None
+    phase: str | None
+    freshness: str | None
+    work_kind: str | None
+    work_number: int | None
+    worktree_path: str | None
+    disruptive: bool
+    is_mutation: bool
+    is_critical_section: bool
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "lease_id": self.lease_id,
+            "session_id": self.session_id,
+            "role": self.role,
+            "phase": self.phase,
+            "freshness": self.freshness,
+            "work_kind": self.work_kind,
+            "work_number": self.work_number,
+            "worktree_path": self.worktree_path,
+            "disruptive": self.disruptive,
+            "is_mutation": self.is_mutation,
+            "is_critical_section": self.is_critical_section,
+        }
+
+
+@dataclass(frozen=True)
+class RestartImpactReport:
+    """Impact preview DTO returned to the console / operator (#642/#652)."""
+
+    coordinator_version: str
+    evaluated_at: str
+    dry_run: bool
+    restart_performed: bool
+    inventory_complete: bool
+    verdict: str
+    allow_restart: bool
+    override_would_allow: bool
+    operator_override: bool
+    blast_radius: str
+    reasons: list[str]
+    affected_sessions: list[SessionImpact]
+    affected_leases: list[LeaseImpact]
+    critical_sections: list[LeaseImpact]
+    affected_issues: list[int]
+    affected_prs: list[int]
+    mutations: list[LeaseImpact]
+    terminal_lock: dict[str, Any] | None
+    ack_state: dict[str, str]
+    prior_recovery_attempts: list[dict[str, Any]]
+    counts: dict[str, int]
+    audit_record: dict[str, Any]
+    incomplete_reasons: list[str] = field(default_factory=list)
+
+    def as_dict(self) -> dict[str, Any]:
+        return {
+            "coordinator_version": self.coordinator_version,
+            "evaluated_at": self.evaluated_at,
+            "dry_run": self.dry_run,
+            "restart_performed": self.restart_performed,
+            "inventory_complete": self.inventory_complete,
+            "incomplete_reasons": list(self.incomplete_reasons),
+            "verdict": self.verdict,
+            "allow_restart": self.allow_restart,
+            "override_would_allow": self.override_would_allow,
+            "operator_override": self.operator_override,
+            "blast_radius": self.blast_radius,
+            "reasons": list(self.reasons),
+            "affected_sessions": [s.as_dict() for s in self.affected_sessions],
+            "affected_leases": [l.as_dict() for l in self.affected_leases],
+            "critical_sections": [l.as_dict() for l in self.critical_sections],
+            "affected_issues": list(self.affected_issues),
+            "affected_prs": list(self.affected_prs),
+            "mutations": [l.as_dict() for l in self.mutations],
+            "terminal_lock": self.terminal_lock,
+            "ack_state": dict(self.ack_state),
+            "prior_recovery_attempts": list(self.prior_recovery_attempts),
+            "counts": dict(self.counts),
+            "audit_record": dict(self.audit_record),
+        }
+
+
+def _classify_session(
+    row: Mapping[str, Any],
+    *,
+    now: datetime,
+    requesting_session_id: str | None,
+    heartbeat_stale_seconds: int,
+) -> SessionImpact:
+    session_id = str(row.get("session_id") or "")
+    pid = row.get("pid")
+    status = (row.get("status") or "").strip().lower() or None
+    alive = lease_lifecycle.is_process_alive(pid) if pid is not None else None
+    hb = _parse_ts(row.get("last_heartbeat_at"))
+    heartbeat_stale = bool(
+        hb is not None and (now - hb).total_seconds() > heartbeat_stale_seconds
+    )
+    live = bool(status == "active" and alive is not False and not heartbeat_stale)
+    return SessionImpact(
+        session_id=session_id,
+        role=row.get("role"),
+        profile=row.get("profile"),
+        pid=pid,
+        status=status,
+        alive=alive,
+        heartbeat_stale=heartbeat_stale,
+        is_requester=bool(
+            requesting_session_id and session_id == requesting_session_id
+        ),
+        live=live,
+    )
+
+
+# Lease phases that represent an active mutation in flight (as opposed to a
+# mere allocation/claim with no work committed yet). An active lease in any of
+# these phases is a critical section a restart must not sever.
+_MUTATING_PHASES = frozenset(
+    {
+        "implementing",
+        "publishing",
+        "pushing",
+        "committing",
+        "reviewing",
+        "merging",
+        "reconciling",
+        "conflict_fix",
+    }
+)
+
+
+def _classify_lease(row: Mapping[str, Any]) -> LeaseImpact:
+    freshness_obj = row.get("freshness")
+    if isinstance(freshness_obj, Mapping):
+        freshness = str(freshness_obj.get("freshness") or "").strip().lower() or None
+    else:
+        freshness = str(freshness_obj or "").strip().lower() or None
+    phase = (row.get("phase") or "").strip().lower() or None
+    worktree = row.get("worktree_path")
+    disruptive = freshness == LEASE_FRESHNESS_LIVE
+    # A live lease is a mutation-in-flight if it carries an author worktree or
+    # its phase names a mutating step. All disruptive leases are critical
+    # sections a restart would sever regardless.
+    is_mutation = bool(
+        disruptive and (bool(worktree) or (phase in _MUTATING_PHASES))
+    )
+    number = row.get("work_number")
+    try:
+        number = int(number) if number is not None else None
+    except (TypeError, ValueError):
+        number = None
+    return LeaseImpact(
+        lease_id=row.get("lease_id"),
+        session_id=row.get("session_id"),
+        role=row.get("role"),
+        phase=phase,
+        freshness=freshness,
+        work_kind=(str(row.get("work_kind") or "").strip().lower() or None),
+        work_number=number,
+        worktree_path=worktree,
+        disruptive=disruptive,
+        is_mutation=is_mutation,
+        is_critical_section=disruptive,
+    )
+
+
+def _blast_radius(*, session_count: int, work_count: int, mutation_count: int) -> str:
+    if mutation_count > 0 or work_count >= 3 or session_count >= 3:
+        return BLAST_HIGH
+    if work_count > 0 or session_count == 2:
+        return BLAST_MEDIUM
+    if session_count == 1:
+        return BLAST_LOW
+    return BLAST_NONE
+
+
+def evaluate_restart_impact(
+    inventory: Mapping[str, Any],
+    *,
+    now: datetime | None = None,
+    operator_override: bool = False,
+    requesting_session_id: str | None = None,
+    dry_run: bool = True,
+    session_heartbeat_stale_seconds: int = DEFAULT_SESSION_HEARTBEAT_STALE_SECONDS,
+) -> RestartImpactReport:
+    """Evaluate a proposed MCP restart and return an impact preview.
+
+    ``inventory`` is a mapping with:
+
+    * ``sessions`` — session rows (session_id, role, profile, pid, status,
+      last_heartbeat_at).
+    * ``leases`` — control-plane lease rows, each ideally carrying an enriched
+      ``freshness`` dict (as :func:`lease_lifecycle.list_active_leases` returns);
+      a bare string freshness is also accepted.
+    * ``terminal_lock`` — the active terminal (merge) lock, if any.
+    * ``prior_recovery_attempts`` — narrower recovery attempts already tried
+      (e.g. sanctioned reconnects) so the operator sees escalation history.
+    * ``inventory_complete`` — bool. **Must** be explicitly True; a missing or
+      falsy value forces a deny (fail closed).
+    * ``incomplete_reasons`` — optional reasons the inventory is incomplete.
+
+    The coordinator never restarts anything: ``restart_performed`` is always
+    False and the mutative apply path is a later drain-gated child.
+    """
+    moment = now or _utc_now()
+    reasons: list[str] = []
+
+    inventory_complete = bool(inventory.get("inventory_complete", False))
+    incomplete_reasons = [str(r) for r in (inventory.get("incomplete_reasons") or [])]
+
+    sessions_raw: Sequence[Mapping[str, Any]] = inventory.get("sessions") or []
+    leases_raw: Sequence[Mapping[str, Any]] = inventory.get("leases") or []
+    terminal_lock = inventory.get("terminal_lock") or None
+    prior_recovery_attempts = [
+        dict(a) for a in (inventory.get("prior_recovery_attempts") or [])
+    ]
+
+    session_impacts = [
+        _classify_session(
+            s,
+            now=moment,
+            requesting_session_id=requesting_session_id,
+            heartbeat_stale_seconds=session_heartbeat_stale_seconds,
+        )
+        for s in sessions_raw
+    ]
+    lease_impacts = [_classify_lease(l) for l in leases_raw]
+
+    # Only *other* live sessions and live leases constitute blast radius: a
+    # restart that would kill only the requesting session with no other work in
+    # flight is safe.
+    other_live_sessions = [
+        s for s in session_impacts if s.live and not s.is_requester
+    ]
+    disruptive_leases = [l for l in lease_impacts if l.disruptive]
+    critical_sections = [l for l in lease_impacts if l.is_critical_section]
+    mutations = [l for l in lease_impacts if l.is_mutation]
+
+    affected_issues = sorted(
+        {
+            l.work_number
+            for l in disruptive_leases
+            if l.work_kind == "issue" and l.work_number is not None
+        }
+    )
+    affected_prs = sorted(
+        {
+            l.work_number
+            for l in disruptive_leases
+            if l.work_kind == "pr" and l.work_number is not None
+        }
+    )
+
+    disruptive = bool(disruptive_leases or other_live_sessions or terminal_lock)
+
+    if not inventory_complete:
+        verdict = VERDICT_UNSAFE
+        allow_restart = False
+        reasons.append(
+            "inventory incomplete: restart evaluation cannot confirm blast "
+            "radius — deny (fail closed, #658)"
+        )
+        reasons.extend(incomplete_reasons)
+    elif not disruptive:
+        verdict = VERDICT_SAFE
+        allow_restart = True
+        reasons.append("no other live sessions, live leases, or terminal lock")
+    elif operator_override:
+        verdict = VERDICT_OVERRIDE
+        allow_restart = True
+        reasons.append(
+            "live work present; operator override accepts the blast radius"
+        )
+    else:
+        verdict = VERDICT_UNSAFE
+        allow_restart = False
+        reasons.append(
+            "live work would be disrupted; restart denied without operator "
+            "override"
+        )
+
+    if critical_sections and inventory_complete:
+        reasons.append(
+            f"{len(critical_sections)} critical section(s) in flight "
+            "(active lease with a live owner)"
+        )
+    if terminal_lock:
+        reasons.append("active terminal (merge) lock present")
+
+    override_would_allow = bool(inventory_complete and disruptive)
+
+    blast_radius = _blast_radius(
+        session_count=len(other_live_sessions),
+        work_count=len(affected_issues) + len(affected_prs),
+        mutation_count=len(mutations),
+    )
+
+    # Acknowledgement is a later child (drain protocol); expose per-session
+    # placeholders so the console can render the ack column now.
+    ack_state = {s.session_id: "pending" for s in other_live_sessions}
+
+    counts = {
+        "sessions_total": len(session_impacts),
+        "sessions_live_other": len(other_live_sessions),
+        "leases_total": len(lease_impacts),
+        "leases_disruptive": len(disruptive_leases),
+        "critical_sections": len(critical_sections),
+        "mutations": len(mutations),
+        "affected_issues": len(affected_issues),
+        "affected_prs": len(affected_prs),
+        "prior_recovery_attempts": len(prior_recovery_attempts),
+    }
+
+    audit_record = {
+        "event": "restart_impact_evaluated",
+        "coordinator_version": COORDINATOR_VERSION,
+        "evaluated_at": moment.isoformat(),
+        "dry_run": dry_run,
+        "operator_override": bool(operator_override),
+        "requesting_session_id": requesting_session_id,
+        "inventory_complete": inventory_complete,
+        "verdict": verdict,
+        "allow_restart": allow_restart,
+        "blast_radius": blast_radius,
+        "counts": counts,
+    }
+
+    return RestartImpactReport(
+        coordinator_version=COORDINATOR_VERSION,
+        evaluated_at=moment.isoformat(),
+        dry_run=dry_run,
+        restart_performed=False,
+        inventory_complete=inventory_complete,
+        verdict=verdict,
+        allow_restart=allow_restart,
+        override_would_allow=override_would_allow,
+        operator_override=bool(operator_override),
+        blast_radius=blast_radius,
+        reasons=reasons,
+        affected_sessions=session_impacts,
+        affected_leases=lease_impacts,
+        critical_sections=critical_sections,
+        affected_issues=affected_issues,
+        affected_prs=affected_prs,
+        mutations=mutations,
+        terminal_lock=dict(terminal_lock)
+        if isinstance(terminal_lock, Mapping)
+        else terminal_lock,
+        ack_state=ack_state,
+        prior_recovery_attempts=prior_recovery_attempts,
+        counts=counts,
+        audit_record=audit_record,
+        incomplete_reasons=incomplete_reasons,
+    )

role_session_router.py

@@ -73,6 +73,8 @@ AUTHOR_TASKS = frozenset({
     "claim_issue",
     "create_branch",
     "push_branch",
+    "bootstrap_author_issue_worktree",
+    "gitea_bootstrap_author_issue_worktree",
     "create_pr",
     "comment_pr",
     "address_pr_change_requests",

task_capability_map.py

@@ -78,6 +78,14 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.branch.create",
         "role": "author",
     },
+    "bootstrap_author_issue_worktree": {
+        "permission": "gitea.branch.create",
+        "role": "author",
+    },
+    "gitea_bootstrap_author_issue_worktree": {
+        "permission": "gitea.branch.create",
+        "role": "author",
+    },
     "push_branch": {
         "permission": "gitea.branch.push",
         "role": "author",
@@ -497,6 +505,10 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
 # merger lease (#763).
 _PREFLIGHT_TASK_TRANSITIONS = frozenset({
     ("review_pr", "acquire_reviewer_pr_lease"),
+    # #850: native author issue worktree bootstrap
+    ("work_issue", "bootstrap_author_issue_worktree"),
+    ("bootstrap_author_issue_worktree", "lock_issue"),
+    # #860: dirty-orphan recovery and related work_issue transitions (master)
     ("work_issue", "lock_issue"),
     ("work_issue", "recover_dirty_orphaned_issue_worktree"),
     ("work_issue", "gitea_recover_dirty_orphaned_issue_worktree"),
@@ -548,6 +560,8 @@ ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
+        "bootstrap_author_issue_worktree",
+        "gitea_bootstrap_author_issue_worktree",
         "publish_unpublished_branch",
         "create_pr",
         "commit_files",
@@ -573,6 +587,7 @@ ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
     "gitea_set_issue_labels": "set_issue_labels",
     "gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
     "gitea_create_label": "create_label",
+    "gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
     "gitea_commit_files": "commit_files",
 }
 

tests/test_author_issue_bootstrap.py

@@ -0,0 +1,601 @@
+"""Regression test suite for native author issue worktree bootstrap (#850)."""
+
+from __future__ import annotations
+
+import json
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+from unittest import mock
+
+import author_issue_bootstrap
+import task_capability_map
+
+
+def _concurrent_bootstrap_worker(args: tuple[str, int, str, str, str, str]) -> dict:
+    repo_dir, issue_num, key, lock_dir, journal_dir, master_sha = args
+    os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = journal_dir
+    return author_issue_bootstrap.bootstrap_author_issue_worktree(
+        issue_number=issue_num,
+        canonical_repo_root=repo_dir,
+        expected_base_sha=master_sha,
+        idempotency_key=key,
+        lock_dir=lock_dir,
+        owner_session="session-concurrent-test",
+        active_identity="jcwalker3",
+        active_profile="prgs-author",
+    )
+
+
+class TestAuthorIssueBootstrap(unittest.TestCase):
+    """Test suite covering AC1-AC10 and comment #14959 specification."""
+
+    def setUp(self):
+        self.tmp_dir = tempfile.mkdtemp(prefix="test_bootstrap_")
+        self.repo_dir = os.path.join(self.tmp_dir, "repo")
+        os.makedirs(self.repo_dir)
+
+        # Initialize synthetic git repo
+        subprocess.run(["git", "init", "-b", "master"], cwd=self.repo_dir, check=True, capture_output=True)
+        subprocess.run(["git", "config", "user.name", "Test User"], cwd=self.repo_dir, check=True)
+        subprocess.run(["git", "config", "user.email", "[email protected]"], cwd=self.repo_dir, check=True)
+
+        readme = os.path.join(self.repo_dir, "README.md")
+        with open(readme, "w", encoding="utf-8") as f:
+            f.write("# Test Repo\n")
+        subprocess.run(["git", "add", "README.md"], cwd=self.repo_dir, check=True, capture_output=True)
+        subprocess.run(["git", "commit", "-m", "initial commit"], cwd=self.repo_dir, check=True, capture_output=True)
+
+        rev_res = subprocess.run(["git", "rev-parse", "HEAD"], cwd=self.repo_dir, capture_output=True, text=True, check=True)
+        self.master_sha = rev_res.stdout.strip()
+
+        self.branches_dir = os.path.join(self.repo_dir, "branches")
+        os.makedirs(self.branches_dir, exist_ok=True)
+        self.lock_dir = os.path.join(self.tmp_dir, "locks")
+        os.makedirs(self.lock_dir, exist_ok=True)
+        self.journal_dir = os.path.join(self.tmp_dir, "journals")
+        os.makedirs(self.journal_dir, exist_ok=True)
+        os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = self.journal_dir
+
+    def tearDown(self):
+        os.environ.pop("GITEA_BOOTSTRAP_JOURNAL_DIR", None)
+        shutil.rmtree(self.tmp_dir, ignore_errors=True)
+
+    def test_bootstrap_success_path(self):
+        """AC1/AC3/AC8: Successful bootstrap creates branch, worktree, registration, and lock proof."""
+        key = "test_key_success_1"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            # assignment_id/lease_id omitted: optional unless verified live.
+            expected_base_sha=self.master_sha,
+            idempotency_key=key,
+            remote="prgs",
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertTrue(res.get("success"), f"Bootstrap failed: {res}")
+        self.assertFalse(res.get("replayed"))
+        self.assertEqual(res.get("issue_number"), 850)
+        self.assertEqual(res.get("base_sha"), self.master_sha)
+        self.assertIn("branches/fix-issue-850-native-mcp-bootstrap", res.get("worktree_path"))
+
+        # Verify worktree directory exists and is registered
+        worktree_path = res["worktree_path"]
+        self.assertTrue(os.path.isdir(worktree_path))
+
+        wt_list = subprocess.run(["git", "-C", self.repo_dir, "worktree", "list"], capture_output=True, text=True, check=True)
+        self.assertIn(worktree_path, wt_list.stdout)
+
+        # Verify phase journal written
+        journal = author_issue_bootstrap.load_phase_journal(key, journal_dir=self.lock_dir)
+        self.assertIsNotNone(journal)
+        self.assertTrue(journal.get("completed"))
+        self.assertEqual(journal.get("current_phase"), author_issue_bootstrap.PHASE_7_TRANSITION_COMPLETED)
+
+    def test_idempotent_replay(self):
+        """Item 2: Replaying with identical key returns cached transition without duplicate creation."""
+        key = "test_key_idempotent_1"
+        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertTrue(res1["success"], f"res1 failed: {res1}")
+        self.assertFalse(res1.get("replayed"))
+
+        # Second call
+        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertTrue(res2["success"], f"res2 failed: {res2}")
+        self.assertTrue(res2.get("replayed"))
+        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
+
+    def test_stale_concurrency_pin_refusal(self):
+        """Item 3: Mismatched expected base SHA fails closed without silent rebasing."""
+        stale_sha = "0000000000000000000000000000000000000000"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            expected_base_sha=stale_sha,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "stale_concurrency_pin")
+        self.assertIn("exact_next_action", res)
+
+    def test_path_outside_branches_root_refusal(self):
+        """Item 6: Worktree path outside branches/ root is refused."""
+        outside_path = os.path.join(self.tmp_dir, "outside_worktree")
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            worktree_path=outside_path,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "path_outside_canonical_branches_root")
+
+    def test_preexisting_dirty_worktree_preservation(self):
+        """Item 6: Preexisting dirty worktree fails closed and is NOT modified or cleaned."""
+        branch = "fix/issue-850-dirty-test"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-dirty-test")
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
+
+        # Create dirty untracked file
+        dirty_file = os.path.join(wt_path, "dirty.txt")
+        with open(dirty_file, "w") as f:
+            f.write("dirty edits\n")
+
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name=branch,
+            worktree_path=wt_path,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "preexisting_dirty_worktree")
+
+        # Prove dirty file is preserved byte-for-byte
+        self.assertTrue(os.path.exists(dirty_file))
+        with open(dirty_file, "r") as f:
+            self.assertEqual(f.read(), "dirty edits\n")
+
+    def test_compensating_recovery_on_failed_phase(self):
+        """AC4/Item 4: Failure during transition rolls back ONLY newly created artifacts."""
+        key = "test_key_recovery_1"
+        # Simulate partial progress in journal
+        journal = {
+            "idempotency_key": key,
+            "issue_number": 850,
+            "branch_name": "fix/issue-850-recovery-test",
+            "worktree_path": os.path.join(self.branches_dir, "fix-issue-850-recovery-test"),
+            "artifacts_created": {
+                "branch_created": True,
+                "worktree_dir_created": True,
+                "worktree_registered": True,
+                "lock_created": False,
+            },
+            "failure_reason": "simulated lock failure",
+            "current_phase": author_issue_bootstrap.PHASE_5_REGISTRATION_VERIFIED,
+            "completed": False,
+        }
+        # Create the branch and worktree manually to simulate partial state
+        subprocess.run(["git", "-C", self.repo_dir, "branch", journal["branch_name"]], check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", journal["worktree_path"], journal["branch_name"]], check=True, capture_output=True)
+
+        # Run compensating recovery
+        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir)
+        self.assertTrue(rec["executed"])
+        self.assertIn(f"worktree_path:{journal['worktree_path']}", rec["rolled_back"])
+        self.assertIn(f"branch:{journal['branch_name']}", rec["rolled_back"])
+
+        # Prove worktree directory and branch were rolled back
+        self.assertFalse(os.path.exists(journal["worktree_path"]))
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", journal["branch_name"]], capture_output=True, text=True, check=False)
+        self.assertNotEqual(branch_check.returncode, 0)
+
+    def test_cross_process_concurrency(self):
+        """Review #525 Finding 1: Genuine cross-process concurrency locking prevents corruption."""
+        import concurrent.futures
+
+        key = "test_concurrent_key_850"
+        args = (self.repo_dir, 850, key, self.lock_dir, self.journal_dir, self.master_sha)
+
+        with concurrent.futures.ProcessPoolExecutor(max_workers=2) as executor:
+            fut1 = executor.submit(_concurrent_bootstrap_worker, args)
+            fut2 = executor.submit(_concurrent_bootstrap_worker, args)
+            res1 = fut1.result(timeout=10)
+            res2 = fut2.result(timeout=10)
+
+        self.assertTrue(res1["success"], f"res1 failed: {res1}")
+        self.assertTrue(res2["success"], f"res2 failed: {res2}")
+        # One process performs creation, the other process receives idempotent replay
+        replayed_count = sum(1 for r in (res1, res2) if r.get("replayed"))
+        created_count = sum(1 for r in (res1, res2) if not r.get("replayed"))
+        self.assertEqual(replayed_count, 1)
+        self.assertEqual(created_count, 1)
+        self.assertEqual(res1["worktree_path"], res2["worktree_path"])
+
+    def test_interrupted_replay_preserves_artifacts_created_provenance(self):
+        """Review #525 Finding 2: Replaying incomplete journal preserves creation provenance monotonically."""
+        key = "test_key_interrupted_replay_1"
+        branch = "fix/issue-850-interrupted-replay"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-interrupted-replay")
+
+        # Simulate Phase 2/3 completion where branch and worktree directory were created by this transition
+        journal = {
+            "idempotency_key": key,
+            "issue_number": 850,
+            "branch_name": branch,
+            "worktree_path": wt_path,
+            "active_identity": "jcwalker3",
+            "active_profile": "prgs-author",
+            "remote": "prgs",
+            "org": "Scaled-Tech-Consulting",
+            "repo": "Gitea-Tools",
+            "phases": {
+                author_issue_bootstrap.PHASE_1_REQUEST_ACCEPTED: {"status": "completed"},
+                author_issue_bootstrap.PHASE_2_BRANCH_CONFIRMED: {"status": "completed", "created": True},
+            },
+            "artifacts_created": {
+                "branch_created": True,
+                "worktree_dir_created": True,
+                "worktree_registered": True,
+                "lock_created": False,
+            },
+            "current_phase": author_issue_bootstrap.PHASE_3_PATH_RESERVED,
+            "completed": False,
+        }
+        # Pre-create the branch and worktree on disk to simulate partial state after crash
+        subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
+        author_issue_bootstrap.save_phase_journal(journal, journal_dir=self.lock_dir)
+
+        # Now resume/replay the transition but simulate lock binding failure during Phase 6
+        with mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Lock failure test")):
+            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+                issue_number=850,
+                canonical_repo_root=self.repo_dir,
+                branch_name=branch,
+                worktree_path=wt_path,
+                idempotency_key=key,
+                lock_dir=self.lock_dir,
+                owner_session="session-test-1234",
+            )
+
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "issue_lock_acquisition_failed")
+
+        # Verify that compensating recovery correctly deleted transition-created branch & worktree
+        # because creation provenance was preserved across replay (NOT downgraded to False!)
+        self.assertFalse(os.path.exists(wt_path))
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
+        self.assertNotEqual(branch_check.returncode, 0)
+
+    def test_transition_created_only_compensation(self):
+        """Review #525 Finding 4: Preexisting branch is NOT deleted by compensation when only worktree was transition-created."""
+        key = "test_key_preexisting_branch_compensation"
+        preexisting_branch = "fix/issue-850-preexisting"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-preexisting")
+
+        # Create branch BEFORE bootstrap (preexisting branch)
+        subprocess.run(["git", "-C", self.repo_dir, "branch", preexisting_branch, self.master_sha], check=True, capture_output=True)
+
+        # Call bootstrap with simulated failure during Phase 6 (lock binding)
+        with mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Simulated lock failure")):
+            res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+                issue_number=850,
+                canonical_repo_root=self.repo_dir,
+                branch_name=preexisting_branch,
+                worktree_path=wt_path,
+                idempotency_key=key,
+                lock_dir=self.lock_dir,
+                owner_session="session-test-1234",
+            )
+
+        self.assertFalse(res["success"])
+        # Worktree dir was created by transition -> removed by compensation
+        self.assertFalse(os.path.exists(wt_path))
+
+        # Preexisting branch was NOT created by transition -> MUST BE PRESERVED!
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", preexisting_branch], capture_output=True, text=True, check=False)
+        self.assertEqual(branch_check.returncode, 0, "Preexisting branch was deleted by mistake!")
+
+    def test_incompatible_idempotency_replay_refusal(self):
+        """Review #525 Finding 4: Replaying key with incompatible parameters returns refusal."""
+        key = "test_key_incompatible_replay"
+        res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name="fix/issue-850-param-a",
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertTrue(res1["success"])
+
+        # Second call with different branch_name
+        res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name="fix/issue-850-param-b",
+            idempotency_key=key,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res2["success"])
+        self.assertEqual(res2.get("reason_code"), "incompatible_idempotency_replay")
+
+    def test_exact_next_action_satisfiable_via_mcp(self):
+        """Review #525 Finding 4: exact_next_action provides satisfiable MCP actions, not shell commands."""
+        key = "test_key_next_action_mcp"
+        stale_sha = "0000000000000000000000000000000000000000"
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            expected_base_sha=stale_sha,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        next_action = res.get("exact_next_action", "")
+        self.assertNotIn("scripts/worktree-start", next_action)
+        self.assertNotIn("git worktree add", next_action)
+        self.assertNotIn("bash", next_action.lower())
+
+    def test_missing_owner_session_refusal(self):
+        """Finding D: Missing owner_session context fails closed with typed refusal and zero mutation."""
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            owner_session=None,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "missing_owner_session")
+        self.assertIn("exact_next_action", res)
+
+    def test_symlink_lock_file_refusal(self):
+        """Finding C: BootstrapTransitionLock refuses to follow symlinks."""
+        key = "test_symlink_lock_key"
+        safe_key = "".join(c if c.isalnum() or c in ("-", "_", ".") else "_" for c in key)
+        lock_path = os.path.join(self.lock_dir, f"{safe_key}.lock")
+        target_file = os.path.join(self.tmp_dir, "fake_target")
+        with open(target_file, "w") as f:
+            f.write("target")
+        os.symlink(target_file, lock_path)
+
+        with self.assertRaises(RuntimeError) as ctx:
+            with author_issue_bootstrap.BootstrapTransitionLock(key, journal_dir=self.lock_dir):
+                pass
+        self.assertIn("symlink", str(ctx.exception).lower())
+
+    def test_lock_directory_escape_refusal(self):
+        """Finding C: BootstrapTransitionLock refuses keys that escape lock directory."""
+        with mock.patch("os.path.abspath", return_value="/tmp/outside/evil_key.lock"):
+            with self.assertRaises(RuntimeError) as ctx:
+                author_issue_bootstrap.BootstrapTransitionLock("key", journal_dir=self.lock_dir)
+        self.assertIn("escapes", str(ctx.exception).lower())
+
+    def test_missing_active_identity_refusal(self):
+        """F-5: Missing active_identity parameter fails closed."""
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            owner_session="session-test-1234",
+            active_identity=None,
+            active_profile="prgs-author",
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "missing_active_identity")
+
+    def test_missing_active_profile_refusal(self):
+        """F-5: Missing active_profile parameter fails closed."""
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            owner_session="session-test-1234",
+            active_identity="jcwalker3",
+            active_profile=None,
+            lock_dir=self.lock_dir,
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "missing_active_profile")
+
+    def test_dirty_worktree_preserved_during_recovery(self):
+        """F-4: Compensating recovery does not delete dirty worktree."""
+        branch = "fix/issue-850-rec-dirty"
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-rec-dirty")
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
+        dirty_file = os.path.join(wt_path, "dirty.txt")
+        with open(dirty_file, "w") as f:
+            f.write("uncommitted work")
+
+        journal = {
+            "idempotency_key": "test_dirty_rec",
+            "issue_number": 850,
+            "branch_name": branch,
+            "worktree_path": wt_path,
+            "artifacts_created": {
+                "worktree_dir_created": True,
+                "worktree_registered": True,
+            },
+            "failure_reason": "test dirty recovery",
+        }
+        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir, journal_dir=self.lock_dir)
+        self.assertTrue(os.path.exists(wt_path))
+        self.assertIn(f"worktree_path_preserved_dirty:{wt_path}", rec["rolled_back"])
+
+    def test_branch_with_commits_preserved_during_recovery(self):
+        """F-4: Compensating recovery does not delete branch with author commits."""
+        branch = "fix/issue-850-rec-commits"
+        subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
+        # Add a commit on the branch
+        wt_path = os.path.join(self.branches_dir, "fix-issue-850-rec-commits")
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
+        cfile = os.path.join(wt_path, "commit.txt")
+        with open(cfile, "w") as f:
+            f.write("author commit")
+        subprocess.run(["git", "-C", wt_path, "add", "commit.txt"], check=True, capture_output=True)
+        subprocess.run(["git", "-C", wt_path, "commit", "-m", "author commit"], check=True, capture_output=True)
+        subprocess.run(["git", "-C", self.repo_dir, "worktree", "remove", "--force", wt_path], check=True, capture_output=True)
+
+        journal = {
+            "idempotency_key": "test_commits_rec",
+            "issue_number": 850,
+            "branch_name": branch,
+            "resolved_base_sha": self.master_sha,
+            "artifacts_created": {
+                "branch_created": True,
+            },
+            "failure_reason": "test commit branch recovery",
+        }
+        rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir, journal_dir=self.lock_dir)
+        branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
+        self.assertEqual(branch_check.returncode, 0, "Branch with commits was deleted!")
+        self.assertIn(f"branch_preserved_commits:{branch}", rec["rolled_back"])
+
+    def test_task_capability_map_integration(self):
+        """Verify task_capability_map has bootstrap_author_issue_worktree configured correctly."""
+        self.assertEqual(task_capability_map.required_role("bootstrap_author_issue_worktree"), "author")
+        self.assertEqual(task_capability_map.required_permission("bootstrap_author_issue_worktree"), "gitea.branch.create")
+        self.assertTrue(task_capability_map.preflight_task_matches("work_issue", "bootstrap_author_issue_worktree"))
+        self.assertTrue(task_capability_map.preflight_task_matches("bootstrap_author_issue_worktree", "lock_issue"))
+
+    def test_unverified_assignment_lease_ids_fail_closed(self):
+        """Review #531 Finding 4: fabricated assignment/lease IDs are refused."""
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            assignment_id="asn-fabricated",
+            lease_id="lease-fabricated",
+            expected_base_sha=self.master_sha,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertIn(
+            res.get("reason_code"),
+            {
+                "unknown_lease_id",
+                "assignment_lease_lookup_failed",
+                "incomplete_assignment_lease_ids",
+            },
+        )
+
+    def test_partial_assignment_lease_ids_fail_closed(self):
+        """Review #531 Finding 4: one of assignment_id/lease_id alone is incomplete."""
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            assignment_id="asn-only",
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "incomplete_assignment_lease_ids")
+
+    def test_stale_diverged_branch_is_not_accepted_via_merge_base(self):
+        """Review #531 Finding 3: any common ancestor is not enough; require master ⊆ branch."""
+        branch = "fix/issue-850-stale-divergent"
+        # Create branch from current master, then advance master so branch lacks tip.
+        subprocess.run(
+            ["git", "-C", self.repo_dir, "branch", branch, self.master_sha],
+            check=True,
+            capture_output=True,
+        )
+        # Make a new commit on master (orphan path so branch does not contain it).
+        marker = os.path.join(self.repo_dir, "master-advance.txt")
+        with open(marker, "w") as f:
+            f.write("advance master\n")
+        subprocess.run(["git", "-C", self.repo_dir, "add", "master-advance.txt"], check=True, capture_output=True)
+        subprocess.run(
+            ["git", "-C", self.repo_dir, "commit", "-m", "advance master past branch"],
+            check=True,
+            capture_output=True,
+        )
+        new_master = subprocess.run(
+            ["git", "-C", self.repo_dir, "rev-parse", "HEAD"],
+            capture_output=True,
+            text=True,
+            check=True,
+        ).stdout.strip()
+        res = author_issue_bootstrap.bootstrap_author_issue_worktree(
+            issue_number=850,
+            canonical_repo_root=self.repo_dir,
+            branch_name=branch,
+            expected_base_sha=new_master,
+            lock_dir=self.lock_dir,
+            owner_session="session-test-1234",
+        )
+        self.assertFalse(res["success"])
+        self.assertEqual(res.get("reason_code"), "incompatible_existing_branch")
+
+    def test_compensating_recovery_attempts_lease_release(self):
+        """Review #531 Finding 5: recovery invokes lease release when lease_id is present."""
+        from unittest import mock
+
+        journal = {
+            "idempotency_key": "test_lease_rec",
+            "issue_number": 850,
+            "owner_session": "session-test-1234",
+            "lease_id": "lease-abc",
+            "branch_name": "fix/issue-850-lease-rec",
+            "artifacts_created": {"lock_created": True},
+            "failure_reason": "simulated",
+            "completed": False,
+        }
+        with mock.patch.object(
+            author_issue_bootstrap.lease_lifecycle,
+            "release_lease",
+            return_value={"success": True},
+        ) as rel, mock.patch.object(
+            author_issue_bootstrap.control_plane_db,
+            "ControlPlaneDB",
+            return_value=mock.Mock(),
+        ):
+            rec = author_issue_bootstrap.run_compensating_recovery(
+                journal, self.repo_dir, journal_dir=self.lock_dir
+            )
+        self.assertTrue(rec["executed"])
+        rel.assert_called_once()
+        self.assertIn("lease:lease-abc", rec["rolled_back"])
+
+
+class TestCanonicalRootNoStringSplit(unittest.TestCase):
+    def test_fallback_uses_commonpath_not_substring_split(self):
+        """Review #531 Finding 2: no norm.split('/branches/') fallback."""
+        import inspect
+        import author_mutation_worktree as amw
+
+        src = inspect.getsource(amw.resolve_canonical_repo_root)
+        self.assertNotIn('split("/branches/")', src)
+        self.assertNotIn("split('/branches/')", src)
+
+        # Fallback recovers repo root from a nested branches worktree path.
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = os.path.join(tmp, "repo")
+            wt = os.path.join(repo, "branches", "fix-issue-850-x")
+            os.makedirs(wt)
+            # git unavailable path: pass missing workspace so fallback is used.
+            root = amw.resolve_canonical_repo_root("/missing/path", wt)
+            self.assertEqual(root, os.path.realpath(repo))
+
+
+if __name__ == "__main__":
+    unittest.main()
+

tests/test_author_mutation_worktree.py

@@ -28,6 +28,21 @@ class TestPathUnderBranches(unittest.TestCase):
             amw.is_path_under_branches("/repo/other-checkout", self.ROOT)
         )
 
+    def test_unrelated_branches_dir_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches("/tmp/branches/evil", self.ROOT)
+        )
+
+    def test_prefix_confusion_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches(f"{self.ROOT}/branches-other/foo", self.ROOT)
+        )
+
+    def test_traversal_fails(self):
+        self.assertFalse(
+            amw.is_path_under_branches(f"{self.ROOT}/branches/../evil", self.ROOT)
+        )
+
 
 class TestAssessAuthorMutationWorktree(unittest.TestCase):
     ROOT = "/repo/Gitea-Tools"
@@ -71,6 +86,13 @@ class TestAssessAuthorMutationWorktree(unittest.TestCase):
         self.assertTrue(result["proven"])
         self.assertFalse(result["block"])
 
+    def test_path_shaped_branches_ancestry_without_isdir(self):
+        """Review #551: commonpath recovery must not require on-disk isdir."""
+        fake_wt = "/repo/Gitea-Tools/branches/issue-274"
+        root = amw.resolve_canonical_repo_root(fake_wt, fake_wt)
+        self.assertEqual(root, "/repo/Gitea-Tools")
+        self.assertNotIn('split("/branches/")', open(amw.__file__).read())
+
 
 class TestPreflightIntegration(unittest.TestCase):
     def test_verify_preflight_blocks_control_checkout_with_test_porcelain(self):

tests/test_issue_628_orchestration.py

@@ -0,0 +1,199 @@
+"""Regression tests for #628 building blocks (child scope only).
+
+Honest scope: unit coverage of pre-existing APIs used by umbrella #628.
+This module does **not** implement or verify all 21 umbrella acceptance
+criteria, automatic handoff store/retrieve, multi-worker product wiring,
+or end-to-end orchestration.
+
+Covered building blocks:
+- CTH format / parse / assess (`format_cth_body`, `parse_cth_comment`,
+  `assess_cth_comment`)
+- Exclusive-ownership skip classification (`classify_skip` with
+  OWNERSHIP_FOREIGN vs OWNERSHIP_OWN)
+- Durable dependency edges (`upsert_dependency_edge` / list) and skip
+  when dependency_unmet
+- Edge state transition UNMET -> MET
+
+Parent umbrella remains #628; this slice is a scoped child issue only.
+"""
+
+import unittest
+from unittest.mock import MagicMock, patch
+import os
+import json
+import tempfile
+
+from canonical_thread_handoff import (
+    format_cth_body,
+    parse_cth_comment,
+    assess_cth_comment,
+)
+import dependency_graph
+from control_plane_db import ControlPlaneDB
+from allocator_service import (
+    WorkCandidate,
+    classify_skip,
+    ROLE_AUTHOR,
+    ROLE_REVIEWER,
+    ROLE_MERGER,
+    ROLE_RECONCILER,
+    OWNERSHIP_OWN,
+    OWNERSHIP_FOREIGN,
+)
+
+
+class TestIssue628Orchestration(unittest.TestCase):
+    def setUp(self):
+        self._tmp = tempfile.TemporaryDirectory()
+        self.db_path = os.path.join(self._tmp.name, "cp.sqlite3")
+        self.db = ControlPlaneDB(self.db_path)
+
+    def tearDown(self):
+        self._tmp.cleanup()
+
+    def test_canonical_handoff_serialization_and_retrieval(self):
+        """Building block: format/parse/assess a CTH body (not full AC1/AC2 product path)."""
+        handoff = format_cth_body(
+            cth_type="Author Handoff",
+            status="completed",
+            next_owner="reviewer",
+            current_blocker="none",
+            decision="Implementation complete, tests passing",
+            proof="pytest tests/test_issue_628_orchestration.py passed",
+            next_action="Review PR and run reviewer pre-flight",
+            ready_to_paste_prompt="Review PR for child issue #878 (parent #628)",
+        )
+        self.assertIn("CTH: Author Handoff", handoff)
+
+        parsed = parse_cth_comment(handoff)
+        self.assertIsNotNone(parsed)
+        self.assertEqual(parsed["cth_type"], "Author Handoff")
+
+        assessment = assess_cth_comment(handoff)
+        self.assertFalse(assessment["block"])
+
+    def test_exclusive_task_unit_single_owner(self):
+        """Building block: classify_skip foreign vs own ownership."""
+        candidate = WorkCandidate(
+            kind="issue",
+            number=878,
+            title="Child #878 ownership classify candidate",
+            state="open",
+            labels=["status:in-progress"],
+            blocked=False,
+            dependency_unmet=False,
+        )
+        # Foreign ownership MUST be skipped
+        skip_foreign = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_FOREIGN,
+        )
+        self.assertIsNotNone(skip_foreign)
+        self.assertIn("active lease", skip_foreign)
+
+        # Own/Self claim remains selectable for session resumption
+        skip_self = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_OWN,
+        )
+        self.assertIsNone(skip_self)
+
+    def test_durable_dependency_graph_blocking(self):
+        """Building block: unmet dependency edge + classify_skip on dependency_unmet."""
+        # Upsert a blocking dependency edge between issue 878 and blocker 601
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_UNMET,
+            blocking_condition="Target issue #601 is not closed",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "unit_test"},
+        )
+
+        edges = self.db.list_dependency_edges(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+        )
+        self.assertEqual(len(edges), 1)
+        self.assertEqual(edges[0]["state"], "unmet")
+        self.assertEqual(edges[0]["target_number"], 601)
+
+        # When dependency is unmet, candidate is blocked from selection
+        candidate = WorkCandidate(
+            kind="issue",
+            number=878,
+            title="Blocked candidate",
+            state="open",
+            labels=[],
+            blocked=False,
+            dependency_unmet=True,
+            dependency_reason="issue#878 is blocked by unmet dependency issue#601",
+        )
+        skip_reason = classify_skip(
+            c=candidate,
+            role=ROLE_AUTHOR,
+            terminal_pr=None,
+            claim_ownership=OWNERSHIP_OWN,
+        )
+        self.assertIsNotNone(skip_reason)
+        self.assertIn("issue#601", skip_reason)
+
+    def test_dependency_completion_reevaluation(self):
+        """Building block: dependency edge state can transition UNMET -> MET."""
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_UNMET,
+            blocking_condition="Target issue #601 is open",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "unit_test"},
+        )
+
+        # Mark edge as met upon target issue closure
+        self.db.upsert_dependency_edge(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+            target_kind="issue",
+            target_number=601,
+            edge_type=dependency_graph.EDGE_ISSUE_BLOCKED_BY_ISSUE,
+            state=dependency_graph.STATE_MET,
+            blocking_condition="Target issue #601 is open",
+            completion_condition="Target issue #601 is closed",
+            evidence={"source": "target_closed_event"},
+        )
+
+        edges = self.db.list_dependency_edges(
+            remote="prgs",
+            org="Scaled-Tech-Consulting",
+            repo="Gitea-Tools",
+            source_kind="issue",
+            source_number=878,
+        )
+        self.assertEqual(len(edges), 1)
+        self.assertEqual(edges[0]["state"], "met")
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_pr_work_lease.py

@@ -19,6 +19,7 @@ from pr_work_lease import (  # noqa: E402
     assess_reviewer_mutation_blocked,
     assess_reviewer_stale_head_final_report,
     format_conflict_fix_lease_body,
+    find_active_conflict_fix_lease,
     parse_conflict_fix_lease_comment,
     parse_reviewer_lease_comment,
 )
@@ -203,5 +204,157 @@ class TestFormatLease(unittest.TestCase):
         self.assertEqual(parsed["pr_number"], 376)
 
 
+class TestConflictFixLeaseLifecycle(unittest.TestCase):
+    def test_claim_followed_by_matching_release(self):
+        claim_body = _conflict_fix_body(phase="claimed", worktree="branches/fix-376")
+        expires = (NOW + timedelta(minutes=60)).isoformat().replace("+00:00", "Z")
+        release_body = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "branch: feat/fix-376",
+            "worktree: branches/fix-376",
+            "profile: prgs-author",
+            "phase: released",
+            f"head_before: {HEAD_A}",
+            f"head_after: {HEAD_B}",
+            f"expires_at: {expires}",
+        ])
+        comments = [{"body": claim_body}, {"body": release_body}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNone(lease)
+
+    def test_expired_claim_without_release(self):
+        past_expires = (NOW - timedelta(minutes=10)).isoformat().replace("+00:00", "Z")
+        claim_body = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "phase: claimed",
+            f"head_before: {HEAD_A}",
+            f"expires_at: {past_expires}",
+            "profile: prgs-author",
+        ])
+        comments = [{"body": claim_body}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNone(lease)
+
+    def test_mismatched_release_different_head(self):
+        claim_body = _conflict_fix_body(phase="claimed", worktree="branches/fix-376")
+        expires = (NOW + timedelta(minutes=60)).isoformat().replace("+00:00", "Z")
+        release_body = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "profile: prgs-author",
+            "phase: released",
+            f"head_before: {HEAD_B}",
+            f"expires_at: {expires}",
+        ])
+        comments = [{"body": claim_body}, {"body": release_body}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNotNone(lease)
+        self.assertEqual(lease["phase"], "claimed")
+
+    def test_mismatched_release_different_branch(self):
+        claim_body = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "branch: feat/branch-A",
+            "phase: claimed",
+            f"head_before: {HEAD_A}",
+            f"expires_at: {(NOW + timedelta(minutes=60)).isoformat().replace('+00:00', 'Z')}",
+            "profile: prgs-author",
+        ])
+        release_body = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "branch: feat/branch-B",
+            "phase: released",
+            f"head_before: {HEAD_A}",
+            f"expires_at: {(NOW + timedelta(minutes=60)).isoformat().replace('+00:00', 'Z')}",
+            "profile: prgs-author",
+        ])
+        comments = [{"body": claim_body}, {"body": release_body}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNotNone(lease)
+        self.assertEqual(lease["phase"], "claimed")
+
+    def test_release_followed_by_newer_claim(self):
+        claim_1 = _conflict_fix_body(phase="claimed", worktree="branches/fix-376")
+        expires = (NOW + timedelta(minutes=60)).isoformat().replace("+00:00", "Z")
+        release_1 = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "profile: prgs-author",
+            "phase: released",
+            f"head_before: {HEAD_A}",
+            f"head_after: {HEAD_B}",
+            f"expires_at: {expires}",
+        ])
+        claim_2 = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "profile: prgs-author",
+            "phase: claimed",
+            f"head_before: {HEAD_B}",
+            f"expires_at: {expires}",
+        ])
+        comments = [{"body": claim_1}, {"body": release_1}, {"body": claim_2}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNotNone(lease)
+        self.assertEqual(lease["head_before"], HEAD_B)
+
+    def test_malformed_or_ambiguous_markers(self):
+        malformed_release = "\n".join([
+            CONFLICT_FIX_LEASE_MARKER,
+            "pr: #376",
+            "phase: released",
+            # missing head_before and profile
+        ])
+        claim_body = _conflict_fix_body(phase="claimed")
+        comments = [{"body": claim_body}, {"body": malformed_release}]
+        lease = find_active_conflict_fix_lease(comments, pr_number=376, now=NOW)
+        self.assertIsNotNone(lease)
+
+    def test_pr818_historical_sequence(self):
+        comment_14696 = "\n".join([
+            "<!-- mcp-conflict-fix-lease:v1 -->",
+            "pr: #818",
+            "branch: feat/issue-638-webui-app-shell-phase1",
+            "worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-638-webui-app-shell-phase1",
+            "profile: prgs-author",
+            "session_id: unknown",
+            "phase: claimed",
+            "head_before: 08061b7b8aebdd099a37d1abf5dafcf38e4fd3fb",
+            "expires_at: 2026-07-23T07:12:13Z",
+            "reviewer_active: no",
+        ])
+        comment_14730 = "\n".join([
+            "<!-- mcp-conflict-fix-lease:v1 -->",
+            "pr: #818",
+            "branch: feat/issue-638-webui-app-shell-phase1",
+            "worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/issue-638-webui-app-shell-phase1",
+            "profile: prgs-author",
+            "session_id: prgs-author-61241-e5129c60",
+            "phase: released",
+            "head_before: 08061b7b8aebdd099a37d1abf5dafcf38e4fd3fb",
+            "head_after: 64b6eb5d5402663098de5ded3b0617cc3b3df98f",
+            "expires_at: 2026-07-23T06:05:00Z",
+            "reviewer_active: no",
+        ])
+        comments = [{"body": comment_14696}, {"body": comment_14730}]
+        check_now = datetime(2026, 7, 23, 6, 30, tzinfo=timezone.utc)
+        lease = find_active_conflict_fix_lease(comments, pr_number=818, now=check_now)
+        self.assertIsNone(lease)
+        
+        reviewer_gate = assess_reviewer_mutation_blocked(
+            pr_number=818,
+            comments=comments,
+            reviewed_head_sha="64b6eb5d5402663098de5ded3b0617cc3b3df98f",
+            live_head_sha="64b6eb5d5402663098de5ded3b0617cc3b3df98f",
+            mutation="approve",
+            now=check_now,
+        )
+        self.assertTrue(reviewer_gate["mutation_allowed"])
+
+
 if __name__ == "__main__":
     unittest.main()

tests/test_restart_coordinator.py

@@ -0,0 +1,340 @@
+"""Tests for the MCP restart coordinator and impact analysis (#658).
+
+Multi-session fixtures exercise every verdict branch: safe, unsafe (live work),
+override, and the fail-closed deny on incomplete inventory. Also covers the
+critical-section deny path and the new ``ControlPlaneDB.list_sessions``.
+"""
+
+from __future__ import annotations
+
+import os
+import tempfile
+import unittest
+from datetime import datetime, timedelta, timezone
+
+import restart_coordinator as rc
+from control_plane_db import ControlPlaneDB
+
+
+NOW = datetime(2026, 7, 24, 6, 0, 0, tzinfo=timezone.utc)
+
+
+def _ts(dt: datetime) -> str:
+    return dt.isoformat()
+
+
+def _live_pid() -> int:
+    return os.getpid()
+
+
+def _dead_pid() -> int:
+    # A pid that is essentially never alive. os.kill(0) on it raises
+    # ProcessLookupError → is_process_alive False.
+    return 2_000_000_000
+
+
+def _session(session_id, *, pid, status="active", heartbeat=None, role="author"):
+    return {
+        "session_id": session_id,
+        "role": role,
+        "profile": "prgs-author",
+        "pid": pid,
+        "status": status,
+        "last_heartbeat_at": _ts(heartbeat or NOW),
+    }
+
+
+def _lease(
+    lease_id,
+    *,
+    session_id,
+    freshness,
+    kind="issue",
+    number=658,
+    phase="allocated",
+    worktree=None,
+    role="author",
+):
+    return {
+        "lease_id": lease_id,
+        "session_id": session_id,
+        "role": role,
+        "phase": phase,
+        "work_kind": kind,
+        "work_number": number,
+        "worktree_path": worktree,
+        "freshness": {"freshness": freshness},
+    }
+
+
+class EvaluateRestartImpactTest(unittest.TestCase):
+    def test_incomplete_inventory_denies_fail_closed(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {"inventory_complete": False, "incomplete_reasons": ["db down"]},
+            now=NOW,
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertFalse(report.allow_restart)
+        self.assertFalse(report.restart_performed)
+        self.assertIn("db down", report.incomplete_reasons)
+        self.assertTrue(
+            any("fail closed" in reasoning for reasoning in report.reasons)
+        )
+
+    def test_missing_completeness_flag_denies(self) -> None:
+        # No inventory_complete key at all → treated as incomplete.
+        report = rc.evaluate_restart_impact({}, now=NOW)
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertFalse(report.allow_restart)
+
+    def test_no_other_work_is_safe(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("requester", pid=_live_pid())],
+                "leases": [],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
+        self.assertTrue(report.allow_restart)
+        self.assertEqual(report.blast_radius, rc.BLAST_NONE)
+        self.assertEqual(report.affected_issues, [])
+
+    def test_dead_foreign_session_and_lease_are_not_disruptive(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [
+                    _session("requester", pid=_live_pid()),
+                    _session("dead", pid=_dead_pid()),
+                ],
+                "leases": [
+                    _lease("l-dead", session_id="dead", freshness="stale_dead_process")
+                ],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
+        self.assertTrue(report.allow_restart)
+        self.assertEqual(report.counts["leases_disruptive"], 0)
+        self.assertEqual(report.counts["sessions_live_other"], 0)
+
+    def test_live_foreign_lease_denies_without_override(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [
+                    _session("requester", pid=_live_pid()),
+                    _session("worker", pid=_live_pid()),
+                ],
+                "leases": [
+                    _lease(
+                        "l1",
+                        session_id="worker",
+                        freshness="active",
+                        worktree="/tmp/wt-658",
+                        phase="implementing",
+                    )
+                ],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertFalse(report.allow_restart)
+        # Critical section detected: active lease with a live owner.
+        self.assertEqual(len(report.critical_sections), 1)
+        self.assertEqual(report.affected_issues, [658])
+        self.assertEqual(report.counts["mutations"], 1)
+        self.assertTrue(report.override_would_allow)
+        self.assertEqual(report.blast_radius, rc.BLAST_HIGH)
+        # Placeholder ack state for the affected session.
+        self.assertEqual(report.ack_state.get("worker"), "pending")
+
+    def test_operator_override_allows_despite_live_work(self) -> None:
+        inv = {
+            "inventory_complete": True,
+            "sessions": [
+                _session("requester", pid=_live_pid()),
+                _session("worker", pid=_live_pid()),
+            ],
+            "leases": [_lease("l1", session_id="worker", freshness="active")],
+        }
+        report = rc.evaluate_restart_impact(
+            inv,
+            now=NOW,
+            requesting_session_id="requester",
+            operator_override=True,
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_OVERRIDE)
+        self.assertTrue(report.allow_restart)
+        self.assertFalse(report.restart_performed)
+
+    def test_deny_when_critical_section_open(self) -> None:
+        # A single live author lease in a mutating phase is a critical section
+        # that must deny an un-overridden restart.
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("worker", pid=_live_pid())],
+                "leases": [
+                    _lease(
+                        "l1",
+                        session_id="worker",
+                        freshness="active",
+                        phase="merging",
+                        kind="pr",
+                        number=900,
+                    )
+                ],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertFalse(report.allow_restart)
+        self.assertEqual(report.affected_prs, [900])
+        self.assertEqual(len(report.critical_sections), 1)
+
+    def test_terminal_lock_makes_restart_unsafe(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("requester", pid=_live_pid())],
+                "leases": [],
+                "terminal_lock": {"terminal_pr": 812},
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertFalse(report.allow_restart)
+        self.assertIsNotNone(report.terminal_lock)
+        self.assertTrue(
+            any("terminal" in reasoning for reasoning in report.reasons)
+        )
+
+    def test_other_live_session_without_lease_is_disruptive(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [
+                    _session("requester", pid=_live_pid()),
+                    _session("idle-but-live", pid=_live_pid()),
+                ],
+                "leases": [],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_UNSAFE)
+        self.assertEqual(report.counts["sessions_live_other"], 1)
+
+    def test_stale_heartbeat_session_not_counted_live(self) -> None:
+        stale = NOW - timedelta(hours=2)
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [
+                    _session("requester", pid=_live_pid()),
+                    _session("stale", pid=_live_pid(), heartbeat=stale),
+                ],
+                "leases": [],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.verdict, rc.VERDICT_SAFE)
+        self.assertEqual(report.counts["sessions_live_other"], 0)
+
+    def test_prior_recovery_attempts_echoed(self) -> None:
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("requester", pid=_live_pid())],
+                "leases": [],
+                "prior_recovery_attempts": [
+                    {"kind": "client_reconnect", "at": _ts(NOW)}
+                ],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(len(report.prior_recovery_attempts), 1)
+        self.assertEqual(report.counts["prior_recovery_attempts"], 1)
+
+    def test_bare_string_freshness_accepted(self) -> None:
+        lease = _lease("l1", session_id="worker", freshness="active")
+        lease["freshness"] = "active"  # bare string, not a dict
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("worker", pid=_live_pid())],
+                "leases": [lease],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.counts["leases_disruptive"], 1)
+
+    def test_as_dict_is_serializable_dto(self) -> None:
+        import json
+
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": [_session("requester", pid=_live_pid())],
+                "leases": [],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        payload = report.as_dict()
+        # Round-trips through JSON — safe for the console DTO.
+        encoded = json.dumps(payload)
+        decoded = json.loads(encoded)
+        self.assertEqual(decoded["verdict"], rc.VERDICT_SAFE)
+        self.assertIn("audit_record", decoded)
+        self.assertEqual(decoded["audit_record"]["event"], "restart_impact_evaluated")
+        self.assertFalse(decoded["restart_performed"])
+        self.assertIn("coordinator_version", decoded)
+
+
+class ListSessionsTest(unittest.TestCase):
+    def setUp(self) -> None:
+        self._tmp = tempfile.TemporaryDirectory()
+        self.db = ControlPlaneDB(os.path.join(self._tmp.name, "cp.sqlite3"))
+
+    def tearDown(self) -> None:
+        self._tmp.cleanup()
+
+    def test_list_sessions_filters_by_status(self) -> None:
+        self.db.upsert_session(session_id="a", role="author", pid=1, status="active")
+        self.db.upsert_session(session_id="b", role="author", pid=2, status="ended")
+        active = self.db.list_sessions(statuses=("active",))
+        ids = {row["session_id"] for row in active}
+        self.assertEqual(ids, {"a"})
+        every = self.db.list_sessions()
+        self.assertEqual({row["session_id"] for row in every}, {"a", "b"})
+
+    def test_list_sessions_feeds_coordinator(self) -> None:
+        self.db.upsert_session(
+            session_id="requester", role="author", pid=os.getpid(), status="active"
+        )
+        report = rc.evaluate_restart_impact(
+            {
+                "inventory_complete": True,
+                "sessions": self.db.list_sessions(statuses=("active",)),
+                "leases": [],
+            },
+            now=NOW,
+            requesting_session_id="requester",
+        )
+        self.assertEqual(report.counts["sessions_total"], 1)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()

tests/test_task_capability_role_invariants.py

@@ -139,6 +139,8 @@ EXPECTED_ROLE_EXCLUSIVE_TASKS = frozenset(
         "gitea_release_merger_pr_lease",
         "create_branch",
         "push_branch",
+        "bootstrap_author_issue_worktree",
+        "gitea_bootstrap_author_issue_worktree",
         # #812 AC20: publishing an unpublished local head is author-only for the
         # same reason every other push is — it writes a branch to the remote.
         "publish_unpublished_branch",

tests/test_webui_system_health_dashboard.py

@@ -0,0 +1,345 @@
+"""Tests for the system-health dashboard view (#639).
+
+Covers the acceptance criteria directly: the page renders the health DTO
+fields (AC1), degraded dependencies are visible (AC2), stale runtime is warned
+prominently and never rendered as mutation-safe (AC3), healthy and degraded
+fixtures both render (AC4), and the shell carries a nav entry (AC5).
+"""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.testclient import TestClient
+
+from webui.app import create_app
+from webui.deployment_boundary import scan_text_for_client_secrets
+from webui.layout import render_page
+from webui.nav import iter_nav_items
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    StaleRuntime,
+    SystemHealthSnapshot,
+    VersionInfo,
+)
+from webui.system_health_views import render_system_health_page
+
+DASHBOARD_PATH = "/system-health"
+
+
+def _version(*, known: bool = True) -> VersionInfo:
+    return VersionInfo(
+        git_sha="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd" if known else None,
+        git_describe="v0.4.1-12-g1c455b6" if known else None,
+        control_plane_schema_version=4 if known else None,
+        python_version="3.13.1",
+        known=known,
+    )
+
+
+def _parity(*, stale: bool = False, determinable: bool = True) -> StaleRuntime:
+    if stale:
+        return StaleRuntime(
+            daemon_head="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            checkout_head="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            remote_head="cccccccccccccccccccccccccccccccccccccccc",
+            stale=True,
+            determinable=True,
+            mutation_safe=False,
+            reasons=("runtime, checkout, and remote commits disagree",),
+        )
+    if not determinable:
+        return StaleRuntime(
+            daemon_head=None,
+            checkout_head=None,
+            remote_head=None,
+            stale=False,
+            determinable=False,
+            mutation_safe=False,
+            reasons=("local checkout HEAD could not be read",),
+        )
+    return StaleRuntime(
+        daemon_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        checkout_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        remote_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        stale=False,
+        determinable=True,
+        mutation_safe=True,
+        reasons=(),
+    )
+
+
+def _snapshot(
+    *,
+    status: str = STATUS_OK,
+    ready: bool = True,
+    readiness_complete: bool = True,
+    readiness_reasons: tuple[str, ...] = (),
+    dependencies: tuple[DependencyProbe, ...] | None = None,
+    parity: StaleRuntime | None = None,
+    namespaces: tuple[dict, ...] = (),
+    probe_errors: tuple[str, ...] = (),
+    version_known: bool = True,
+) -> SystemHealthSnapshot:
+    if dependencies is None:
+        dependencies = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=1.25,
+                metadata={"schema_version": 4},
+            ),
+        )
+    return SystemHealthSnapshot(
+        status=status,
+        ready=ready,
+        readiness_complete=readiness_complete,
+        readiness_reasons=readiness_reasons,
+        service="mcp-control-plane-webui",
+        mode="read-only",
+        version=_version(known=version_known),
+        started_at="2026-07-23T19:50:47+00:00",
+        uptime_seconds=3661.5,
+        timestamp="2026-07-23T20:51:48+00:00",
+        deep_probes_requested=False,
+        dependencies=dependencies,
+        mcp_namespaces=namespaces,
+        stale_runtime=parity if parity is not None else _parity(),
+        probe_errors=probe_errors,
+    )
+
+
+class TestHealthyRender(unittest.TestCase):
+    """AC1 / AC4 — every health DTO field reaches the page."""
+
+    def setUp(self):
+        self.html = render_system_health_page(_snapshot())
+
+    def test_readiness_fields_render(self):
+        self.assertIn("System health", self.html)
+        self.assertIn("Ready", self.html)
+        self.assertIn("mcp-control-plane-webui", self.html)
+        self.assertIn("read-only", self.html)
+        self.assertIn("2026-07-23T20:51:48+00:00", self.html)
+
+    def test_version_and_uptime_render(self):
+        self.assertIn("1c455b6ec0f9cb761fe6248de68c17e061fb5ecd", self.html)
+        self.assertIn("v0.4.1-12-g1c455b6", self.html)
+        self.assertIn("3.13.1", self.html)
+        self.assertIn("3661.500s", self.html)
+        self.assertIn("1.02h", self.html)
+
+    def test_dependency_row_renders_with_latency(self):
+        self.assertIn("control_plane_db", self.html)
+        self.assertIn("sqlite", self.html)
+        self.assertIn("schema version 4", self.html)
+        self.assertIn("1.2 ms", self.html)
+
+    def test_healthy_page_shows_no_stale_warning(self):
+        self.assertNotIn("Stale runtime:", self.html)
+        self.assertNotIn("Staleness", self.html)
+
+    def test_unknown_version_is_labelled_not_faked(self):
+        html = render_system_health_page(_snapshot(version_known=False))
+        self.assertIn("unknown", html)
+        self.assertIn("unresolved", html)
+
+
+class TestDegradedRender(unittest.TestCase):
+    """AC2 — a degraded or unrun dependency is visible, not swallowed."""
+
+    def setUp(self):
+        self.deps = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=0.9,
+            ),
+            DependencyProbe(
+                name="repository",
+                kind="git",
+                status=STATUS_DOWN,
+                detail="repository root is not a git checkout",
+                required=True,
+                latency_ms=4.0,
+            ),
+            DependencyProbe(
+                name="gitea",
+                kind="http",
+                status=STATUS_SKIPPED,
+                detail="deep probe not requested",
+                required=False,
+            ),
+        )
+        self.html = render_system_health_page(
+            _snapshot(
+                status=STATUS_DEGRADED,
+                ready=False,
+                readiness_complete=False,
+                readiness_reasons=("required dependency 'repository' is down",),
+                dependencies=self.deps,
+            )
+        )
+
+    def test_degraded_banner_names_the_dependency(self):
+        self.assertIn("Degraded dependencies:", self.html)
+        self.assertIn("repository", self.html)
+
+    def test_not_run_probe_is_reported_separately(self):
+        self.assertIn("Not probed:", self.html)
+        self.assertIn("gitea", self.html)
+        self.assertIn("not counted", self.html)
+
+    def test_not_ready_headline_and_reason(self):
+        self.assertIn("Not ready", self.html)
+        self.assertIn("required dependency 'repository' is down", self.html)
+
+    def test_degraded_status_badge_present(self):
+        self.assertIn("badge-health-degraded", self.html)
+        self.assertIn("badge-health-down", self.html)
+
+    def test_ready_but_incomplete_is_not_shown_as_plain_ready(self):
+        html = render_system_health_page(
+            _snapshot(ready=True, readiness_complete=False)
+        )
+        self.assertIn("Ready (incomplete evidence)", html)
+
+
+class TestStaleRuntimeWarning(unittest.TestCase):
+    """AC3 — staleness is prominent and never claims mutation safety."""
+
+    def test_stale_runtime_warns_and_denies_mutation_safety(self):
+        html = render_system_health_page(_snapshot(parity=_parity(stale=True)))
+        self.assertIn("Stale runtime:", html)
+        self.assertIn("do not treat this runtime as mutation-safe", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+
+    def test_indeterminate_parity_is_not_reported_safe(self):
+        html = render_system_health_page(
+            _snapshot(parity=_parity(determinable=False))
+        )
+        self.assertIn("Staleness", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+        self.assertIn("<tr><th>Determinable</th><td>False</td></tr>", html)
+
+    def test_healthy_parity_reports_mutation_safe_true(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("<tr><th>Mutation safe</th><td>True</td></tr>", html)
+
+
+class TestNamespacesAndErrors(unittest.TestCase):
+    def test_unproven_namespace_rows_render(self):
+        html = render_system_health_page(
+            _snapshot(
+                namespaces=(
+                    {
+                        "namespace": "gitea-author",
+                        "required_tool": "gitea_lock_issue",
+                        "status": STATUS_UNPROVEN,
+                        "ide_namespace_proven": False,
+                        "reason": "the web console cannot invoke the IDE-managed MCP client",
+                    },
+                )
+            )
+        )
+        self.assertIn("gitea-author", html)
+        self.assertIn("gitea_lock_issue", html)
+        self.assertIn("badge-health-unproven", html)
+
+    def test_no_namespaces_degrades_gracefully(self):
+        html = render_system_health_page(_snapshot(namespaces=()))
+        self.assertIn("No MCP namespaces are declared.", html)
+
+    def test_probe_errors_render_when_present(self):
+        html = render_system_health_page(
+            _snapshot(probe_errors=("probe raised: disk offline",))
+        )
+        self.assertIn("Probe errors", html)
+        self.assertIn("disk offline", html)
+
+    def test_probe_error_card_absent_when_clean(self):
+        self.assertNotIn("Probe errors", render_system_health_page(_snapshot()))
+
+
+class TestReadOnlyAndRedaction(unittest.TestCase):
+    def test_no_restart_or_kill_controls(self):
+        html = render_system_health_page(_snapshot())
+        self.assertNotIn("<button", html)
+        self.assertNotIn("<form", html)
+        self.assertNotIn("pkill", html)
+        self.assertIn("read-only", html)
+
+    def test_recovery_points_at_sanctioned_path(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("Reconnect the MCP client", html)
+        self.assertIn("Never kill the daemon process manually", html)
+
+    def test_secret_shaped_detail_is_redacted(self):
+        leaky = DependencyProbe(
+            name="gitea",
+            kind="http",
+            status=STATUS_DOWN,
+            detail="auth failed for token=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
+            required=False,
+            latency_ms=12.0,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(leaky,)))
+        self.assertNotIn("ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", html)
+
+    def test_html_in_detail_is_escaped(self):
+        hostile = DependencyProbe(
+            name="repository",
+            kind="git",
+            status=STATUS_DOWN,
+            detail="<script>alert(1)</script>",
+            required=True,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(hostile,)))
+        self.assertNotIn("<script>", html)
+        self.assertIn("&lt;script&gt;", html)
+
+
+class TestNavAndRoute(unittest.TestCase):
+    """AC5 — the shell links the dashboard, and the route serves it."""
+
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_nav_contains_system_health(self):
+        self.assertIn(
+            (DASHBOARD_PATH, "System health"),
+            [(item.href, item.label) for item in iter_nav_items()],
+        )
+
+    def test_rendered_shell_links_dashboard(self):
+        page = render_page(title="Home", body_html="<p>x</p>")
+        self.assertIn(f'href="{DASHBOARD_PATH}"', page)
+
+    def test_route_renders_dashboard(self):
+        response = self.client.get(DASHBOARD_PATH)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("System health", response.text)
+        self.assertIn("Stale-runtime parity", response.text)
+
+    def test_route_is_read_only(self):
+        self.assertEqual(self.client.post(DASHBOARD_PATH).status_code, 405)
+
+    def test_live_page_leaks_no_client_secret(self):
+        findings = scan_text_for_client_secrets(self.client.get(DASHBOARD_PATH).text)
+        self.assertEqual(findings, [])
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()

tests/test_workspace_guard_alignment.py

@@ -35,8 +35,10 @@ class TestCanonicalRepoRoot(unittest.TestCase):
         self.assertEqual(root, CONTROL_ROOT)
 
     def test_falls_back_when_git_unavailable(self):
+        # When fallback is a path under <repo>/branches/<worktree>, recover
+        # <repo> via commonpath ancestry (never string-split on "/branches/").
         root = amw.resolve_canonical_repo_root("/missing/path", MCP_PROCESS_ROOT)
-        self.assertEqual(root, os.path.realpath(MCP_PROCESS_ROOT))
+        self.assertEqual(root, os.path.realpath(CONTROL_ROOT))
 
 
 class TestWorkspaceRepoMembership(unittest.TestCase):

webui/app.py

@@ -53,6 +53,7 @@ from webui.system_health import (
     process_uptime,
     snapshot_to_dict as system_health_to_dict,
 )
+from webui.system_health_views import render_system_health_page
 
 _READ_ONLY_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
 _AUDIT_MUTATION_PATHS = frozenset({"/audit", "/api/audit"})
@@ -161,6 +162,24 @@ async def api_system_health(request: Request) -> JSONResponse:
     return JSONResponse(payload, status_code=200 if snapshot.ready else 503)
 
 
+async def system_health(request: Request) -> HTMLResponse:
+    """Read-only system-health dashboard (#639).
+
+    Shares the #634 snapshot loader with the JSON API so the page can never
+    disagree with it. `?deep=1` opts into the network probe exactly as the API
+    does; the default page load stays cheap. The response is always 200: this
+    is an operator view that must render the degraded state, not withhold it.
+    """
+    deep = _truthy_flag(request.query_params.get("deep"))
+    snapshot = load_system_health(deep=deep)
+    return HTMLResponse(
+        render_page(
+            title="System health",
+            body_html=render_system_health_page(snapshot),
+        )
+    )
+
+
 async def queue(_request: Request) -> HTMLResponse:
     snapshot = load_queue_snapshot()
     return HTMLResponse(render_page(title="Queue", body_html=render_queue_page(snapshot)))
@@ -571,6 +590,7 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/", home, methods=["GET"]),
             Route("/health", health, methods=["GET"]),
             Route(SYSTEM_HEALTH_API_PATH, api_system_health, methods=["GET"]),
+            Route("/system-health", system_health, methods=["GET"]),
             Route("/queue", queue, methods=["GET"]),
             Route("/api/queue", api_queue, methods=["GET"]),
             Route("/projects", projects, methods=["GET"]),

webui/layout.py

@@ -236,6 +236,25 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
     .badge-in-review {{ color: #9ec8f0; border-color: #3d5f7a; }}
     .badge-duplicate {{ color: #e0c27a; border-color: #6b5730; }}
     .badge-stale {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .badge-health-ok {{ color: #8fd19e; border-color: #3d6b4a; }}
+    .badge-health-degraded {{ color: #e0c27a; border-color: #6b5730; }}
+    .badge-health-down {{ color: #f0a8a8; border-color: #7a3b3b; }}
+    .badge-health-skipped {{ color: var(--muted); }}
+    .badge-health-unproven {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .health-card {{
+      margin: 1.25rem 0;
+      padding: 0.85rem 1rem 1rem;
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      background: var(--surface);
+    }}
+    .health-card h3 {{ margin: 0 0 0.5rem; font-size: 1.05rem; }}
+    .health-card h4 {{ margin: 1rem 0 0.35rem; font-size: 0.92rem; color: var(--muted); }}
+    .health-headline {{ color: var(--text); font-size: 1rem; margin: 0 0 0.5rem; }}
+    .health-degraded {{ border-left-color: #e0c27a; }}
+    .health-stale {{ border-left-color: #f0a8a8; }}
+    ul.reasons {{ margin: 0.35rem 0; padding-left: 1.15rem; color: var(--muted); font-size: 0.9rem; }}
+    ul.reasons li {{ margin-bottom: 0.3rem; }}
   </style>
   {extra_head}
 </head>

webui/nav.py

@@ -38,6 +38,7 @@ class NavGroup:
 NAV_GROUPS: tuple[NavGroup, ...] = (
     NavGroup("Health", (
         NavItem("/health", "Liveness"),
+        NavItem("/system-health", "System health"),
     )),
     NavGroup("Traffic", (
         NavItem("/queue", "Queue"),

webui/system_health_views.py

@@ -0,0 +1,307 @@
+"""HTML views for the system-health dashboard (#639).
+
+Renders the read-only :class:`~webui.system_health.SystemHealthSnapshot`
+produced by the Phase 1 system-health API (#634). The page offers no restart,
+reload, or process-kill control: those are Phase 2 work, and manual process
+kills are the contamination path #630 exists to prevent.
+
+Every free-text field passes through :func:`webui.system_health.redact` before
+it reaches HTML, so a probe detail that captured a token or a credentialed URL
+cannot leak through the dashboard even though the API redacts it already.
+"""
+
+from __future__ import annotations
+
+import html
+
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    SystemHealthSnapshot,
+    redact,
+)
+
+_STATUS_BADGE_CLASS = {
+    STATUS_OK: "badge-health-ok",
+    STATUS_DEGRADED: "badge-health-degraded",
+    STATUS_DOWN: "badge-health-down",
+    STATUS_SKIPPED: "badge-health-skipped",
+    STATUS_UNPROVEN: "badge-health-unproven",
+}
+
+
+def _safe(value: object) -> str:
+    """Escape free text for HTML after redacting anything secret-shaped.
+
+    Use this for every value that can carry arbitrary text — probe details,
+    reasons, probe errors — because those are where a credential could ride
+    along.
+    """
+    return html.escape(redact(str(value)))
+
+
+def _esc(value: object) -> str:
+    """Escape a structured field for HTML without redacting it.
+
+    Commit SHAs, probe names, statuses, and timestamps are enumerated or
+    machine-generated, never credential-bearing. They must not go through
+    :func:`redact`: its opaque-token rule matches any 32-plus-character run,
+    so a 40-character git SHA would render as ``[redacted]`` and the parity
+    view — the one thing an operator reads this page for — would be blank.
+    """
+    return html.escape(str(value))
+
+
+def _status_badge(status: str) -> str:
+    css = _STATUS_BADGE_CLASS.get(status, "badge-health-unproven")
+    return f'<span class="badge {css}">{_esc(status)}</span>'
+
+
+def _reason_list(reasons: tuple[str, ...], *, empty: str) -> str:
+    if not reasons:
+        return f"<p class='muted'>{html.escape(empty)}</p>"
+    items = "".join(f"<li>{_safe(reason)}</li>" for reason in reasons)
+    return f"<ul class='reasons'>{items}</ul>"
+
+
+def _readiness_card(snapshot: SystemHealthSnapshot) -> str:
+    """Overall readiness.
+
+    ``ready`` and ``readiness_complete`` are shown separately on purpose: a
+    snapshot whose required probes never ran is not the same as one that ran
+    them and passed, and collapsing the two would render an unproven green.
+    """
+    if snapshot.ready and snapshot.readiness_complete:
+        headline = "Ready"
+    elif snapshot.ready:
+        headline = "Ready (incomplete evidence)"
+    else:
+        headline = "Not ready"
+
+    return (
+        "<section class='health-card'>"
+        f"<h3>Readiness {_status_badge(snapshot.status)}</h3>"
+        f"<p class='health-headline'>{html.escape(headline)}</p>"
+        "<table class='detail'>"
+        f"<tr><th>Service</th><td><code>{_esc(snapshot.service)}</code></td></tr>"
+        f"<tr><th>Mode</th><td>{_esc(snapshot.mode)}</td></tr>"
+        f"<tr><th>Ready</th><td>{_esc(snapshot.ready)}</td></tr>"
+        "<tr><th>Readiness evidence complete</th>"
+        f"<td>{_esc(snapshot.readiness_complete)}</td></tr>"
+        "<tr><th>Deep probes requested</th>"
+        f"<td>{_esc(snapshot.deep_probes_requested)}</td></tr>"
+        f"<tr><th>Observed at</th><td><code>{_esc(snapshot.timestamp)}</code></td></tr>"
+        "</table>"
+        "<h4>Readiness reasons</h4>"
+        f"{_reason_list(snapshot.readiness_reasons, empty='No readiness objections recorded.')}"
+        "</section>"
+    )
+
+
+def _version_card(snapshot: SystemHealthSnapshot) -> str:
+    version = snapshot.version
+    uptime_hours = snapshot.uptime_seconds / 3600.0
+    known = (
+        "resolved"
+        if version.known
+        else "unresolved — version fields could not be read from the checkout"
+    )
+    schema = version.control_plane_schema_version
+    return (
+        "<section class='health-card'>"
+        "<h3>Version and uptime</h3>"
+        "<table class='detail'>"
+        f"<tr><th>Git SHA</th><td><code>{_esc(version.git_sha or 'unknown')}</code></td></tr>"
+        "<tr><th>Git describe</th>"
+        f"<td><code>{_esc(version.git_describe or 'unknown')}</code></td></tr>"
+        "<tr><th>Control-plane schema</th>"
+        f"<td>{_esc(schema if schema is not None else 'unknown')}</td></tr>"
+        f"<tr><th>Python</th><td><code>{_esc(version.python_version)}</code></td></tr>"
+        f"<tr><th>Version status</th><td>{html.escape(known)}</td></tr>"
+        f"<tr><th>Started at</th><td><code>{_esc(snapshot.started_at)}</code></td></tr>"
+        "<tr><th>Uptime</th>"
+        f"<td>{snapshot.uptime_seconds:.3f}s ({uptime_hours:.2f}h)</td></tr>"
+        "</table>"
+        "</section>"
+    )
+
+
+def _dependency_rows(probes: tuple[DependencyProbe, ...]) -> str:
+    if not probes:
+        return "<p class='muted'>No dependency probes were reported.</p>"
+    rows = []
+    for probe in probes:
+        latency = (
+            f"{probe.latency_ms:.1f} ms" if probe.latency_ms is not None else "n/a"
+        )
+        rows.append(
+            "<tr>"
+            f"<td><code>{_esc(probe.name)}</code></td>"
+            f"<td>{_esc(probe.kind)}</td>"
+            f"<td>{_status_badge(probe.status)}</td>"
+            f"<td>{_esc('required' if probe.required else 'optional')}</td>"
+            f"<td>{html.escape(latency)}</td>"
+            f"<td>{_safe(probe.detail)}</td>"
+            "</tr>"
+        )
+    return (
+        "<table class='registry'><thead><tr>"
+        "<th>Dependency</th><th>Kind</th><th>Status</th><th>Requirement</th>"
+        "<th>Latency</th><th>Detail</th>"
+        "</tr></thead><tbody>"
+        f"{''.join(rows)}</tbody></table>"
+    )
+
+
+def _dependency_card(snapshot: SystemHealthSnapshot) -> str:
+    degraded = [probe for probe in snapshot.dependencies if probe.ran and not probe.healthy]
+    not_run = [probe for probe in snapshot.dependencies if not probe.ran]
+
+    banner = ""
+    if degraded:
+        names = ", ".join(sorted(probe.name for probe in degraded))
+        banner += (
+            "<div class='stub health-degraded'><p><strong>Degraded dependencies:</strong> "
+            f"{_esc(names)}</p></div>"
+        )
+    if not_run:
+        names = ", ".join(sorted(probe.name for probe in not_run))
+        banner += (
+            "<div class='stub'><p><strong>Not probed:</strong> "
+            f"{_esc(names)} — these contribute no evidence and are not counted "
+            "as healthy.</p></div>"
+        )
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Dependencies</h3>"
+        f"{banner}"
+        f"{_dependency_rows(snapshot.dependencies)}"
+        "<p class='muted'>Details are redacted at the API boundary and again "
+        "before rendering; credentials are never displayed.</p>"
+        "</section>"
+    )
+
+
+def _namespace_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.mcp_namespaces:
+        body = "<p class='muted'>No MCP namespaces are declared.</p>"
+    else:
+        rows = []
+        for entry in snapshot.mcp_namespaces:
+            rows.append(
+                "<tr>"
+                f"<td><code>{_esc(entry.get('namespace'))}</code></td>"
+                f"<td><code>{_esc(entry.get('required_tool'))}</code></td>"
+                f"<td>{_status_badge(str(entry.get('status') or STATUS_UNPROVEN))}</td>"
+                f"<td>{_esc(entry.get('ide_namespace_proven'))}</td>"
+                f"<td>{_safe(entry.get('reason'))}</td>"
+                "</tr>"
+            )
+        body = (
+            "<table class='registry'><thead><tr>"
+            "<th>Namespace</th><th>Required tool</th><th>Status</th>"
+            "<th>IDE-proven</th><th>Reason</th>"
+            "</tr></thead><tbody>"
+            f"{''.join(rows)}</tbody></table>"
+        )
+    return (
+        "<section class='health-card'>"
+        "<h3>MCP namespaces</h3>"
+        f"{body}"
+        "<p class='muted'>The web process runs outside the IDE-managed MCP "
+        "client, so namespace health is reported as unproven rather than "
+        "guessed (#543).</p>"
+        "</section>"
+    )
+
+
+def _stale_runtime_card(snapshot: SystemHealthSnapshot) -> str:
+    stale = snapshot.stale_runtime
+    if stale.stale:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Stale runtime:</strong> "
+            "the running code, the checkout, and the remote-tracking commit "
+            "disagree. Capability gates may be evaluating obsolete code — "
+            "do not treat this runtime as mutation-safe.</p></div>"
+        )
+    elif not stale.determinable:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Staleness "
+            "indeterminate:</strong> parity could not be proven, so this "
+            "runtime is not reported as mutation-safe.</p></div>"
+        )
+    else:
+        warning = ""
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Stale-runtime parity</h3>"
+        f"{warning}"
+        "<table class='detail'>"
+        "<tr><th>Daemon head</th>"
+        f"<td><code>{_esc(stale.daemon_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Checkout head</th>"
+        f"<td><code>{_esc(stale.checkout_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Remote head</th>"
+        f"<td><code>{_esc(stale.remote_head or 'unknown')}</code></td></tr>"
+        f"<tr><th>Stale</th><td>{_esc(stale.stale)}</td></tr>"
+        f"<tr><th>Determinable</th><td>{_esc(stale.determinable)}</td></tr>"
+        f"<tr><th>Mutation safe</th><td>{_esc(stale.mutation_safe)}</td></tr>"
+        "</table>"
+        f"{_reason_list(stale.reasons, empty='Runtime, checkout, and remote agree.')}"
+        "</section>"
+    )
+
+
+def _probe_error_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.probe_errors:
+        return ""
+    return (
+        "<section class='health-card'>"
+        "<h3>Probe errors</h3>"
+        f"{_reason_list(snapshot.probe_errors, empty='')}"
+        "</section>"
+    )
+
+
+def _recovery_card() -> str:
+    """Sanctioned recovery pointers only — never a manual process kill (#630)."""
+    return (
+        "<section class='health-card'>"
+        "<h3>Recovery</h3>"
+        "<p class='muted'>This dashboard is read-only. Restart and reload "
+        "controls arrive in Phase 2 (#642); until then recovery runs through "
+        "the sanctioned client reconnect / operator restart path.</p>"
+        "<ul class='reasons'>"
+        "<li><a href='/runtime'>Runtime and session view</a> — active profile, "
+        "workflow hashes, and shell health.</li>"
+        "<li>Reconnect the MCP client from the IDE, then re-run the blocked "
+        "cycle. Never kill the daemon process manually: unmanaged kills are "
+        "recorded as runtime contamination (#630).</li>"
+        "<li>See <code>docs/webui-local-dev.md</code> for the documented "
+        "recovery sequence.</li>"
+        "</ul>"
+        "</section>"
+    )
+
+
+def render_system_health_page(snapshot: SystemHealthSnapshot) -> str:
+    """Render the full system-health dashboard body."""
+    return (
+        "<h2>System health</h2>"
+        "<p class='meta'>Read-only view of the Phase 1 system-health API "
+        "(<code>/api/v1/system/health</code>). Reload this page to refresh; "
+        "nothing here polls or mutates on your behalf.</p>"
+        f"{_readiness_card(snapshot)}"
+        f"{_stale_runtime_card(snapshot)}"
+        f"{_version_card(snapshot)}"
+        f"{_dependency_card(snapshot)}"
+        f"{_namespace_card(snapshot)}"
+        f"{_probe_error_card(snapshot)}"
+        f"{_recovery_card()}"
+    )