Merge remote-tracking branch 'prgs/master' into feat/issue-639-webui-system-health-dashboard

Resolve the #638 shell landing against the #639 dashboard:

- webui/layout.py: drop the flat NAV_ITEMS tuple in favor of master's
  grouped NAV_GROUPS nav-config module.
- webui/nav.py: register /system-health as a live item in the Health
  group, satisfying issue #639 AC5 through the canonical nav source.
- docs/webui-local-dev.md: keep both additive sections (#638 shell and
  #639 dashboard).
- tests/test_webui_system_health_dashboard.py: assert the nav entry via
  iter_nav_items() instead of the removed NAV_ITEMS tuple.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

docs/webui-local-dev.md

@@ -54,6 +54,7 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
 | `/` | Home / operator overview |
 | `/health` | JSON liveness (`status`, `service`, `mode`, `timestamp`, `uptime_seconds`) |
 | `/api/v1/system/health` | Structured read-only system health (#634) |
+| `/system-health` | System-health dashboard — readiness, version/uptime, dependencies, MCP namespaces, stale-runtime parity (#639) |
 | `/queue` | Live PR and issue queue dashboard (#429) |
 | `/api/queue` | JSON queue export with pagination metadata |
 | `/projects` | Project registry list with status and onboarding progress (#427, #635) |
@@ -258,6 +259,37 @@ Not-yet-implemented surfaces (`/sessions`, `/inventory`, `/timeline`,
 surfaces are backed by #636). Mutating methods on stub routes still fail closed
 with `read-only-mvp`.
 
+## System-health dashboard (#639)
+
+`/system-health` renders the same snapshot the `/api/v1/system/health` API
+returns, so the page and the API can never disagree. Cards: overall readiness,
+stale-runtime parity, version and uptime, dependency probes, MCP namespaces,
+probe errors (only when present), and recovery pointers. `?deep=1` opts into
+the network probe exactly as the API does; the plain page load stays cheap.
+
+Field authority and honesty rules:
+
+* `ready` and `readiness_complete` are shown separately. A snapshot whose
+  required probes never ran is not the same as one that ran them and passed,
+  and the page never collapses the two into an unproven green.
+* A probe that did not run appears under **Not probed**, never as healthy.
+* `stale_runtime.mutation_safe` is displayed verbatim from the API. When the
+  runtime is stale, or when parity is indeterminate, the page warns and does
+  not claim mutation safety.
+* MCP namespaces are reported `unproven`: the web process runs outside the
+  IDE-managed MCP client and cannot prove that path (#543).
+
+Redaction is split by field kind. Free text — probe details, readiness and
+parity reasons, probe errors — passes through `system_health.redact`.
+Structured fields — commit SHAs, probe names, statuses, timestamps — are
+HTML-escaped only, because `redact`'s opaque-token rule matches any run of 32
+or more characters and would otherwise blank every 40-character git SHA, which
+is precisely the evidence the parity view exists to show.
+
+The dashboard is read-only: no restart, reload, or process-kill control. Those
+arrive in Phase 2 (#642). Recovery guidance points at the sanctioned client
+reconnect / operator restart path — never a manual daemon kill (#630).
+
 ## Deployment boundary (#435)
 
 MVP serves on loopback by default. Binding `0.0.0.0` or `::` is **refused**

gitea_mcp_server.py

@@ -440,32 +440,13 @@ def _session_author_lock_worktree() -> str | None:
 
     Used to derive the author mutation workspace when no explicit
     ``worktree_path`` or env binding is provided. Never invents a path.
-
-    #864: a session pointer whose owner PID is dead and is not this process
-    must not force workspace binding for other issues — rebind is required for
-    that issue, and a stale dead-owner pointer must not poison unrelated work.
     """
     try:
         lock = issue_lock_store.read_session_issue_lock() or {}
     except Exception:
         return None
     path = (lock.get("worktree_path") or "").strip()
-    if not path:
+    return path or None
-        return None
-    pid = lock.get("session_pid")
-    if pid is None:
-        pid = lock.get("pid")
-    try:
-        pid_i = int(pid) if pid is not None else None
-    except (TypeError, ValueError):
-        pid_i = None
-    if (
-        pid_i is not None
-        and pid_i != os.getpid()
-        and not issue_lock_store.is_process_alive(pid_i)
-    ):
-        return None
-    return path
 
 
 def _resolve_preflight_workspace_path(worktree_path: str | None = None) -> str:
@@ -2050,7 +2031,6 @@ import issue_lock_store  # noqa: E402
 import issue_lock_adoption  # noqa: E402
 import issue_lock_recovery  # noqa: E402
 import issue_lock_renewal  # noqa: E402
-import dirty_same_claimant_session_rebind  # noqa: E402  # #864
 import stacked_pr_support  # noqa: E402
 import merge_approval_gate  # noqa: E402
 import review_quarantine  # noqa: E402  # #695 contaminated formal-review quarantine
@@ -4362,263 +4342,6 @@ def gitea_lock_issue(
     return result
 
 
-@mcp.tool()
-def gitea_rebind_dirty_same_claimant_author_session(
-    issue_number: int,
-    branch_name: str,
-    worktree_path: str,
-    old_pid: int,
-    expected_local_head: str,
-    expected_remote_head: str,
-    expected_dirty_paths: list[str],
-    expected_fingerprints: dict,
-    remote: str = "dadeschools",
-    host: str | None = None,
-    org: str | None = None,
-    repo: str | None = None,
-    dry_run: bool = False,
-    authorize_reconciler_execute: bool = False,
-) -> dict:
-    """Rebind a dirty registered issue worktree to this session (#864).
-
-    Sanctioned only when every pin agrees: same claimant, dead old_pid matching
-    the durable lock, matching local/remote heads, exact dirty path set, and
-    per-path sha256 fingerprints. Preserves every tracked/untracked byte.
-    Does not sync remote, create recovery worktrees, clean, reset, or move heads.
-
-    Role gate:
-    * author — must match the lock claimant identity/profile
-    * reconciler — execute only when ``authorize_reconciler_execute=True``
-    * reviewer/merger — always refuse
-
-    ``gitea.issue.comment`` (author map entry) is required for mutation; dry_run
-    still assesses fully but writes nothing. Permission alone is never ownership
-    proof — every pin is re-checked server-side.
-
-    Args:
-        issue_number: Tracking issue number on the durable lock.
-        branch_name: Exact locked branch name.
-        worktree_path: Registered dirty worktree path (must be under branches/).
-        old_pid: Dead owner PID recorded on the lock (must match session_pid/pid).
-        expected_local_head: Full local HEAD sha the caller observed.
-        expected_remote_head: Full remote-tracking HEAD sha the caller observed.
-        expected_dirty_paths: Exact set of dirty relative paths (tracked+untracked).
-        expected_fingerprints: Map of relative path -> sha256 hex of file bytes.
-        remote: Known instance — 'dadeschools' or 'prgs'.
-        host/org/repo: Optional target overrides (validated against binding).
-        dry_run: When true, assess only (no lock/session writes).
-        authorize_reconciler_execute: Reconciler-only execute gate.
-    """
-    role = _profile_role_kind(get_profile())
-    role_norm = (role or "").strip().lower()
-
-    # Permission: authors need comment; dry_run assess is reachable under read
-    # for diagnosis, but execute always needs comment. Reconciler execute also
-    # needs comment when authorized.
-    if dry_run:
-        read_block = _profile_operation_gate("gitea.read")
-        if read_block:
-            return {
-                "success": False,
-                "dry_run": True,
-                "reasons": read_block,
-                "permission_report": _permission_block_report("gitea.read"),
-            }
-    else:
-        blocked = _profile_permission_block(
-            task_capability_map.required_permission(
-                "rebind_dirty_same_claimant_author_session"
-            ),
-            issue_number=issue_number,
-            remote=remote,
-            host=host,
-            org=org,
-            repo=repo,
-            org_explicit=org is not None,
-            repo_explicit=repo is not None,
-        )
-        if blocked:
-            return blocked
-
-    if role_norm in {"reviewer", "merger"}:
-        return {
-            "success": False,
-            "dry_run": bool(dry_run),
-            "outcome": dirty_same_claimant_session_rebind.REFUSED,
-            "reasons": [
-                f"role '{role_norm}' cannot rebind dirty same-claimant author "
-                "sessions (fail closed)"
-            ],
-        }
-    if role_norm == "reconciler" and not authorize_reconciler_execute and not dry_run:
-        return {
-            "success": False,
-            "dry_run": False,
-            "outcome": dirty_same_claimant_session_rebind.REFUSED,
-            "reasons": [
-                "reconciler role requires authorize_reconciler_execute=True "
-                "to execute dirty same-claimant rebind (fail closed)"
-            ],
-        }
-
-    h, o, r = _resolve(remote, host, org, repo)
-    try:
-        identity = _authenticated_username(h)
-    except Exception:
-        identity = None
-    profile = get_profile()
-    profile_name = profile.get("profile_name")
-
-    existing = _load_existing_issue_lock(
-        remote=remote, org=o, repo=r, issue_number=issue_number
-    )
-    resolved_wt = os.path.realpath(os.path.abspath((worktree_path or "").strip()))
-    inv = dirty_same_claimant_session_rebind.collect_dirty_inventory(resolved_wt)
-
-    branch_res = subprocess.run(
-        ["git", "-C", resolved_wt, "branch", "--show-current"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    current_branch = (branch_res.stdout or "").strip() or None
-    head_res = subprocess.run(
-        ["git", "-C", resolved_wt, "rev-parse", "HEAD"],
-        capture_output=True,
-        text=True,
-        check=False,
-    )
-    local_head = (head_res.stdout or "").strip() if head_res.returncode == 0 else None
-
-    # Observe remote-tracking head without network when possible.
-    remote_head = None
-    for ref in (
-        f"refs/remotes/origin/{branch_name}",
-        f"origin/{branch_name}",
-        f"refs/remotes/{remote}/{branch_name}",
-        f"{remote}/{branch_name}",
-    ):
-        rh = subprocess.run(
-            ["git", "-C", resolved_wt, "rev-parse", "--verify", "--quiet", ref],
-            capture_output=True,
-            text=True,
-            check=False,
-        )
-        if rh.returncode == 0 and (rh.stdout or "").strip():
-            remote_head = (rh.stdout or "").strip()
-            break
-    if remote_head is None:
-        # Fall back to caller's pin only for observation absence — assessment
-        # still requires pin==observed, so missing observation fails closed.
-        remote_head = None
-
-    # Competing live locks (other issues / other worktrees).
-    competing_live = []
-    for entry in issue_lock_store.list_live_locks():
-        competing_live.append(entry)
-
-    # Session pointers that claim this issue lock.
-    competing_sessions = []
-    lock_dir = issue_lock_store.default_lock_dir()
-    lock_path = issue_lock_store.lock_file_path(
-        remote=remote, org=o, repo=r, issue_number=issue_number, lock_dir=lock_dir
-    )
-    try:
-        for name in os.listdir(lock_dir):
-            if not name.startswith("session-") or not name.endswith(".json"):
-                continue
-            ptr = issue_lock_store.read_lock_file(os.path.join(lock_dir, name))
-            if not ptr:
-                continue
-            ptr_lock = str(ptr.get("lock_file_path") or "").strip()
-            if not ptr_lock:
-                continue
-            try:
-                same = os.path.realpath(ptr_lock) == os.path.realpath(lock_path)
-            except OSError:
-                same = ptr_lock == lock_path
-            if not same:
-                continue
-            try:
-                sess_pid = int(str(name)[len("session-") : -len(".json")])
-            except ValueError:
-                sess_pid = ptr.get("pid")
-            competing_sessions.append(
-                {
-                    "pid": sess_pid,
-                    "lock_file_path": ptr_lock,
-                    "live": issue_lock_store.is_process_alive(sess_pid),
-                }
-            )
-    except OSError:
-        pass
-
-    # Best-effort workflow-lease scan: any live lock file whose work_lease is a
-    # non-author workflow lease on this issue/branch counts as active.
-    workflow_lease_active = False
-    for path in issue_lock_store.iter_lock_files(lock_dir):
-        rec = issue_lock_store.read_lock_file(path)
-        if not rec:
-            continue
-        lease = rec.get("work_lease") if isinstance(rec.get("work_lease"), dict) else {}
-        op = str(lease.get("operation_type") or "")
-        if op and op != issue_lock_store.AUTHOR_ISSUE_WORK_LEASE:
-            if rec.get("issue_number") == issue_number or str(
-                rec.get("branch_name") or ""
-            ) == branch_name:
-                if issue_lock_store.is_lease_live(rec):
-                    workflow_lease_active = True
-                    break
-
-    repo_root = _canonical_local_git_root()
-    # permission_allowed reflects profile gate only — never ownership proof.
-    permission_allowed = True
-
-    result = dirty_same_claimant_session_rebind.apply_dirty_same_claimant_session_rebind(
-        remote=remote,
-        org=o,
-        repo=r,
-        issue_number=issue_number,
-        branch_name=branch_name,
-        worktree_path=resolved_wt,
-        claimant_identity=identity,
-        claimant_profile=profile_name,
-        old_pid=old_pid,
-        expected_local_head=expected_local_head,
-        expected_remote_head=expected_remote_head,
-        expected_dirty_paths=list(expected_dirty_paths or []),
-        expected_fingerprints=dict(expected_fingerprints or {}),
-        existing_lock=existing,
-        current_identity=identity,
-        current_profile=profile_name,
-        role_kind=role_norm or role,
-        current_pid=os.getpid(),
-        current_branch=current_branch,
-        local_head=local_head,
-        remote_head=remote_head,
-        dirty_inventory=inv,
-        competing_live_locks=competing_live,
-        competing_sessions=competing_sessions,
-        workflow_lease_active=workflow_lease_active,
-        authorize_reconciler_execute=bool(authorize_reconciler_execute),
-        permission_allowed=permission_allowed,
-        repo_root=repo_root,
-        dry_run=bool(dry_run),
-        lock_dir=lock_dir,
-    )
-    result["observed"] = {
-        "local_head": local_head,
-        "remote_head": remote_head,
-        "current_branch": current_branch,
-        "dirty_paths": inv.get("dirty_paths"),
-        "fingerprints": inv.get("fingerprints"),
-        "identity": identity,
-        "profile": profile_name,
-        "role_kind": role_norm,
-    }
-    return result
-
-
 @mcp.tool()
 def gitea_assess_work_issue_duplicate(
     issue_number: int,
@@ -11911,7 +11634,6 @@ def gitea_audit_worktree_cleanup(
     org: str | None = None,
     repo: str | None = None,
     ttl_hours: float = worktree_cleanup_audit.DEFAULT_TTL_HOURS,
-    merged_pr_limit: int = 200,
 ) -> dict:
     """Read-only: classify every session-owned worktree under ``branches/`` (#401).
 
@@ -11922,26 +11644,17 @@ def gitea_audit_worktree_cleanup(
     the active issue-lock branch is read from the local lock file and treated
     as active work. Deletes nothing and mutates no Gitea state.
 
-    Merged PRs are fetched as well, so an issue worktree can be linked to the
+    Fails closed if the live open-PR list cannot be fetched: without it,
-    PR that owns its branch (#858). Such a worktree only becomes removable
+    removability cannot be proven, so no candidates are returned.
-    when that owning PR is unambiguous and merged, the worktree head is
-    already contained in authoritative master, and nothing else protects it —
-    no open or competing PR, lease, issue lock, live session, dirty file, or
-    protected/control checkout. Anything unproven keeps it classified as
-    active issue work.
-
-    Fails closed if the live open-PR list, the merged-PR list, or the
-    control-plane lease state cannot be read: without them removability
-    cannot be proven, so no candidates are returned.
 
     Args:
         remote: Known instance — 'dadeschools' or 'prgs'.
         host: Override the Gitea host.
         org: Override the owner/organization.
         repo: Override the repository name.
-        ttl_hours: Age (hours) after which a clean conflict-fix worktree
+        ttl_hours: Age (hours) after which a clean issue/conflict-fix
-            becomes stale-removable (default from GITEA_WORKTREE_TTL_HOURS).
+            worktree becomes stale-removable (default from
-        merged_pr_limit: Max closed PRs scanned for merged-PR ownership.
+            GITEA_WORKTREE_TTL_HOURS).
 
     Returns:
         dict with per-worktree classifications, counts, removable
@@ -11977,84 +11690,22 @@ def gitea_audit_worktree_cleanup(
         if (pr.get("head") or {}).get("ref")
     }
 
-    # #858: merged PRs are the ownership evidence that lets a landed issue
-    # worktree stop being reported as active work. Without them the audit can
-    # never agree with the PR-scoped reconciler, so treat a fetch failure the
-    # same way an open-PR fetch failure is treated: fail closed.
-    try:
-        closed_prs = api_get_all(
-            f"{repo_api_url(h, o, r)}/pulls?state=closed", auth, limit=merged_pr_limit
-        )
-    except Exception as exc:
-        return {
-            "success": False,
-            "performed": False,
-            "open_pr_state_verified": True,
-            "merged_pr_state_verified": False,
-            "reasons": [
-                "could not fetch merged PRs; worktree ownership unverified "
-                f"(fail closed): {_redact(str(exc))}"
-            ],
-        }
-    merged_prs = [pr for pr in closed_prs if (pr.get("merged") or pr.get("merged_at"))]
-    pr_index = worktree_cleanup_audit.build_pr_index(list(open_prs) + merged_prs)
-
-    # #858: the auditor already accepted lease evidence but nothing ever
-    # supplied it, so every worktree looked unleased. Removability is now
-    # reachable for issue worktrees, so authoritative control-plane leases
-    # must be readable or the audit fails closed.
-    db, lease_errs = _control_plane_db_or_error()
-    if db is None:
-        return {
-            "success": False,
-            "performed": False,
-            "open_pr_state_verified": True,
-            "merged_pr_state_verified": True,
-            "lease_state_verified": False,
-            "reasons": [
-                "could not read control-plane leases; worktree protection "
-                "unverified (fail closed)",
-                *lease_errs,
-            ],
-        }
-    lease_result = lease_lifecycle.list_active_leases(
-        db, remote=remote, org=o, repo=r, include_non_active=False, limit=500
-    )
-    leased_issue_numbers: set[int] = set()
-    live_session_paths: set[str] = set()
-    for lease in lease_result.get("leases") or []:
-        if lease.get("work_kind") == "issue" and lease.get("work_number") is not None:
-            try:
-                leased_issue_numbers.add(int(lease["work_number"]))
-            except (TypeError, ValueError):
-                pass
-        if lease.get("worktree_path"):
-            live_session_paths.add(str(lease["worktree_path"]))
-
     active_issue_branches: set[str] = set()
     lock = merged_cleanup_reconcile.read_issue_lock(ISSUE_LOCK_FILE)
     if lock and lock.get("branch_name"):
         active_issue_branches.add(str(lock["branch_name"]).strip())
 
-    master_ref = f"{remote}/master" if remote in REMOTES else "origin/master"
     report = worktree_cleanup_audit.audit_branches_directory(
         _canonical_local_git_root(),
         open_pr_branches=open_pr_branches,
         active_issue_branches=active_issue_branches,
         now=datetime.now(timezone.utc),
         ttl_hours=ttl_hours,
-        pr_index=pr_index,
-        leased_issue_numbers=leased_issue_numbers,
-        live_session_paths=live_session_paths,
-        master_ref=master_ref,
     )
     return {
         "success": True,
         "performed": False,
         "open_pr_state_verified": True,
-        "merged_pr_state_verified": True,
-        "lease_state_verified": True,
-        "master_ref": master_ref,
         "task_mode": "work-issue",
         **report,
     }

issue_lock_provenance.py

@@ -16,16 +16,11 @@ ISSUE_LOCK_FILE = os.environ.get("GITEA_ISSUE_LOCK_FILE", "/tmp/gitea_issue_lock
 SOURCE_LOCK_ISSUE = "gitea_lock_issue"
 SOURCE_LOCK_ADOPTION = "gitea_lock_issue_adoption"
 SOURCE_OPERATOR_OVERRIDE = "operator_override"
-# #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
-SOURCE_DIRTY_SAME_CLAIMANT_REBIND = (
-    "gitea_rebind_dirty_same_claimant_author_session"
-)
 
 SANCTIONED_LOCK_SOURCES = frozenset({
     SOURCE_LOCK_ISSUE,
     SOURCE_LOCK_ADOPTION,
     SOURCE_OPERATOR_OVERRIDE,
-    SOURCE_DIRTY_SAME_CLAIMANT_REBIND,
 })
 
 _OPERATOR_OVERRIDE_ENV = "GITEA_ISSUE_LOCK_OPERATOR_OVERRIDE"

task_capability_map.py

@@ -32,17 +32,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
         "permission": "gitea.issue.comment",
         "role": "author",
     },
-    # #864: dirty-preserving same-claimant author-session rebind (dead owner PID).
-    # Author MCP tool path. Reconciler execute is gated inside the tool via
-    # authorize_reconciler_execute + role_kind checks (not this map entry).
-    "rebind_dirty_same_claimant_author_session": {
-        "permission": "gitea.issue.comment",
-        "role": "author",
-    },
-    "gitea_rebind_dirty_same_claimant_author_session": {
-        "permission": "gitea.issue.comment",
-        "role": "author",
-    },
     "set_issue_labels": {
         "permission": "gitea.issue.comment",
         "role": "author",

tests/test_issue_858_audit_merged_pr_aware.py

@@ -1,551 +0,0 @@
-"""Merged-PR awareness for the worktree cleanup audit (#858).
-
-Before #858 an ``issue_work`` worktree could never leave ``active_issue_work``:
-the audit had no PR linkage at all (``pr_number`` was structurally ``None``)
-and its only route to ``clean_stale_removable`` was a TTL derived from a
-``last_used_at`` that nothing ever populated. A merged, clean, unprotected
-worktree was therefore reported as active work forever, disagreeing with the
-PR-scoped reconciler.
-
-These tests use fabricated temporary repositories and synthetic PR records
-only. Nothing here removes a worktree or deletes a branch.
-"""
-
-import os
-import subprocess
-import sys
-import tempfile
-import unittest
-from unittest.mock import patch
-
-sys.path.insert(0, str(__import__("pathlib").Path(__file__).resolve().parent.parent))
-
-import merged_cleanup_reconcile as mcr  # noqa: E402
-import worktree_cleanup_audit as wca  # noqa: E402
-
-
-MERGED_BRANCH = "feat/issue-777-timeline"
-MERGED_PATH = "/repo/branches/issue-777-timeline"
-HEAD_SHA = "a" * 40
-
-
-def _pr(number, branch, *, merged=True, sha=HEAD_SHA, state=None):
-    """Synthetic Gitea PR payload."""
-    return {
-        "number": number,
-        "head": {"ref": branch, "sha": sha},
-        "merged_at": "2026-07-24T01:00:00Z" if merged else None,
-        "state": state or ("closed" if merged else "open"),
-    }
-
-
-def _porcelain(*entries):
-    out = []
-    for path, branch, sha in entries:
-        out.append(f"worktree {path}")
-        out.append(f"HEAD {sha}")
-        if branch is None:
-            out.append("detached")
-        else:
-            out.append(f"branch refs/heads/{branch}")
-        out.append("")
-    return "\n".join(out)
-
-
-class _AuditHarness(unittest.TestCase):
-    """Runs audit_branches_directory over a fabricated worktree listing."""
-
-    PORCELAIN = _porcelain(
-        ("/repo", "master", "f" * 40),
-        (MERGED_PATH, MERGED_BRANCH, HEAD_SHA),
-    )
-
-    def run_audit(self, *, dirty_paths=(), contained=True, **kwargs):
-        def fake_dirty(path):
-            if path in dirty_paths:
-                return {"exists": True, "dirty": True, "dirty_files": [" M x.py"]}
-            return {"exists": True, "dirty": False, "dirty_files": []}
-
-        with patch.object(
-            wca, "list_worktrees",
-            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
-        ), patch.object(
-            wca, "read_worktree_dirty", side_effect=fake_dirty
-        ), patch.object(
-            wca, "git_worktree_list", return_value="(mocked)"
-        ), patch.object(
-            wca, "is_head_ancestor_of_ref", return_value=contained
-        ):
-            report = wca.audit_branches_directory("/repo", **kwargs)
-        return {wt["path"]: wt for wt in report["worktrees"]}, report
-
-    def merged_audit(self, **kwargs):
-        kwargs.setdefault("pr_index", wca.build_pr_index([_pr(849, MERGED_BRANCH)]))
-        kwargs.setdefault("master_ref", "prgs/master")
-        return self.run_audit(**kwargs)
-
-
-class TestMergedWorktreeBecomesRemovable(_AuditHarness):
-    def test_clean_merged_issue_worktree_is_linked_and_removable(self):
-        by_path, report = self.merged_audit()
-        entry = by_path[MERGED_PATH]
-
-        self.assertEqual(entry["classification"], wca.CLASS_CLEAN_STALE_REMOVABLE)
-        self.assertTrue(entry["removable"])
-        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_MERGED)
-        self.assertEqual(entry["merged_pr_cleanup"]["block_reasons"], [])
-        self.assertIn(MERGED_PATH, [c["path"] for c in report["removable_candidates"]])
-
-    def test_pr_number_populated_from_authoritative_linkage(self):
-        by_path, _ = self.merged_audit()
-        self.assertEqual(by_path[MERGED_PATH]["pr_number"], 849)
-
-    def test_regression_without_pr_evidence_stays_active_issue_work(self):
-        """The pre-#858 behaviour, still correct when no PR state is supplied."""
-        by_path, _ = self.run_audit()
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-        self.assertIsNone(entry["pr_number"])
-
-
-class TestProtectiveSignalsSurvive(_AuditHarness):
-    def test_open_pr_worktree_is_not_removable(self):
-        index = wca.build_pr_index([_pr(900, MERGED_BRANCH, merged=False)])
-        by_path, _ = self.run_audit(
-            pr_index=index,
-            master_ref="prgs/master",
-            open_pr_branches={MERGED_BRANCH},
-        )
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_OPEN_PR)
-        self.assertFalse(entry["removable"])
-        # linkage still reports the owning PR, it just is not merge proof
-        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_OPEN)
-        self.assertEqual(entry["pr_number"], 900)
-
-    def test_dirty_tracked_worktree_is_not_removable(self):
-        by_path, _ = self.merged_audit(dirty_paths=(MERGED_PATH,))
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["classification"], wca.CLASS_DIRTY_LOCAL)
-        self.assertFalse(entry["removable"])
-        self.assertIn(
-            "worktree has uncommitted changes",
-            entry["merged_pr_cleanup"]["block_reasons"],
-        )
-
-    def test_untracked_only_worktree_is_not_removable(self):
-        """``git status --porcelain`` reports untracked files as dirty too."""
-        def untracked(path):
-            if path == MERGED_PATH:
-                return {"exists": True, "dirty": True, "dirty_files": ["?? scratch.txt"]}
-            return {"exists": True, "dirty": False, "dirty_files": []}
-
-        with patch.object(
-            wca, "list_worktrees",
-            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
-        ), patch.object(
-            wca, "read_worktree_dirty", side_effect=untracked
-        ), patch.object(
-            wca, "git_worktree_list", return_value="(mocked)"
-        ), patch.object(
-            wca, "is_head_ancestor_of_ref", return_value=True
-        ):
-            report = wca.audit_branches_directory(
-                "/repo",
-                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
-                master_ref="prgs/master",
-            )
-        entry = {wt["path"]: wt for wt in report["worktrees"]}[MERGED_PATH]
-        self.assertEqual(entry["classification"], wca.CLASS_DIRTY_LOCAL)
-        self.assertFalse(entry["removable"])
-
-    def test_active_lease_by_issue_number_is_protective(self):
-        by_path, _ = self.merged_audit(leased_issue_numbers={777})
-        entry = by_path[MERGED_PATH]
-        self.assertTrue(entry["has_active_lease"])
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-
-    def test_active_lease_by_branch_is_protective(self):
-        by_path, _ = self.merged_audit(leased_branches={MERGED_BRANCH})
-        entry = by_path[MERGED_PATH]
-        self.assertTrue(entry["has_active_lease"])
-        self.assertFalse(entry["removable"])
-
-    def test_active_issue_lock_is_protective(self):
-        by_path, _ = self.merged_audit(active_issue_branches={MERGED_BRANCH})
-        entry = by_path[MERGED_PATH]
-        self.assertTrue(entry["has_active_issue_lock"])
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-
-    def test_live_session_worktree_is_protective(self):
-        by_path, _ = self.merged_audit(live_session_paths={MERGED_PATH})
-        entry = by_path[MERGED_PATH]
-        self.assertTrue(entry["has_live_session"])
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-
-    def test_head_not_contained_in_master_is_not_removable(self):
-        by_path, _ = self.merged_audit(contained=False)
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-        self.assertIn(
-            "worktree head is not contained in authoritative master "
-            "(unmerged commits remain)",
-            entry["merged_pr_cleanup"]["block_reasons"],
-        )
-
-    def test_unknown_containment_fails_closed(self):
-        by_path, _ = self.merged_audit(contained=None)
-        entry = by_path[MERGED_PATH]
-        self.assertFalse(entry["removable"])
-        self.assertIn(
-            "containment of the worktree head in master is unknown",
-            entry["merged_pr_cleanup"]["block_reasons"],
-        )
-
-    def test_missing_master_ref_fails_closed(self):
-        by_path, _ = self.run_audit(
-            pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)])
-        )
-        self.assertFalse(by_path[MERGED_PATH]["removable"])
-
-    def test_unmerged_owning_pr_is_not_removable(self):
-        index = wca.build_pr_index([_pr(901, MERGED_BRANCH, merged=False)])
-        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
-        entry = by_path[MERGED_PATH]
-        self.assertFalse(entry["removable"])
-        self.assertIn(
-            "owning PR #901 is not merged",
-            entry["merged_pr_cleanup"]["block_reasons"],
-        )
-
-    def test_control_checkout_is_never_removable(self):
-        by_path, _ = self.merged_audit()
-        control = by_path["/repo"]
-        self.assertTrue(control["is_protected"])
-        self.assertEqual(control["classification"], wca.CLASS_UNSAFE_UNKNOWN)
-        self.assertFalse(control["removable"])
-
-    def test_control_checkout_not_removable_even_if_linked_and_merged(self):
-        """A merged PR on the control checkout must not unlock removal."""
-        porcelain = _porcelain(("/repo", MERGED_BRANCH, HEAD_SHA))
-        with patch.object(
-            wca, "list_worktrees", return_value=wca.parse_worktree_porcelain(porcelain)
-        ), patch.object(
-            wca, "read_worktree_dirty",
-            return_value={"exists": True, "dirty": False, "dirty_files": []},
-        ), patch.object(
-            wca, "git_worktree_list", return_value="(mocked)"
-        ), patch.object(
-            wca, "is_head_ancestor_of_ref", return_value=True
-        ):
-            report = wca.audit_branches_directory(
-                "/repo",
-                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
-                master_ref="prgs/master",
-            )
-        entry = report["worktrees"][0]
-        self.assertEqual(entry["classification"], wca.CLASS_UNSAFE_UNKNOWN)
-        self.assertFalse(entry["removable"])
-
-
-class TestAmbiguousLinkageFailsClosed(_AuditHarness):
-    def test_competing_prs_on_one_branch_fail_closed(self):
-        index = wca.build_pr_index(
-            [_pr(849, MERGED_BRANCH), _pr(860, MERGED_BRANCH)]
-        )
-        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_AMBIGUOUS)
-        self.assertIsNone(entry["pr_number"])
-        self.assertEqual(entry["classification"], wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(entry["removable"])
-
-    def test_merged_plus_open_pr_on_one_branch_fails_closed(self):
-        index = wca.build_pr_index(
-            [_pr(849, MERGED_BRANCH), _pr(861, MERGED_BRANCH, merged=False)]
-        )
-        by_path, _ = self.run_audit(pr_index=index, master_ref="prgs/master")
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_AMBIGUOUS)
-        self.assertFalse(entry["removable"])
-
-    def test_no_owning_pr_fails_closed(self):
-        by_path, _ = self.run_audit(
-            pr_index=wca.build_pr_index([_pr(849, "feat/other-branch")]),
-            master_ref="prgs/master",
-        )
-        entry = by_path[MERGED_PATH]
-        self.assertEqual(entry["merged_pr_linkage"]["status"], wca.LINKAGE_NONE)
-        self.assertFalse(entry["removable"])
-
-    def test_malformed_pr_records_are_dropped_not_guessed(self):
-        index = wca.build_pr_index(
-            [
-                {"number": None, "head": {"ref": MERGED_BRANCH}},
-                {"number": 5, "head": {}},
-                {"number": "not-an-int", "head": {"ref": MERGED_BRANCH}},
-            ]
-        )
-        self.assertEqual(index, {})
-        self.assertEqual(
-            wca.resolve_owning_pr(branch=MERGED_BRANCH, pr_index=index)["status"],
-            wca.LINKAGE_NONE,
-        )
-
-    def test_detached_worktree_has_no_branch_linkage(self):
-        self.assertEqual(
-            wca.resolve_owning_pr(branch=None, pr_index={})["status"],
-            wca.LINKAGE_UNKNOWN,
-        )
-
-
-class TestUnrelatedClassificationsUnchanged(unittest.TestCase):
-    """Non-issue_work worktrees keep their pre-#858 classifications."""
-
-    PORCELAIN = _porcelain(
-        ("/repo", "master", "f" * 40),
-        ("/repo/branches/review-pr42", "review-pr42", "2" * 40),
-        ("/repo/branches/baseline-master-x", "baseline-master-x", "3" * 40),
-        ("/repo/branches/conflict-fix-pr50", "conflict-fix-pr50", "4" * 40),
-        ("/repo/branches/review-pr99", None, "5" * 40),
-    )
-
-    def _audit(self, **kwargs):
-        with patch.object(
-            wca, "list_worktrees",
-            return_value=wca.parse_worktree_porcelain(self.PORCELAIN),
-        ), patch.object(
-            wca, "read_worktree_dirty",
-            return_value={"exists": True, "dirty": False, "dirty_files": []},
-        ), patch.object(
-            wca, "git_worktree_list", return_value="(mocked)"
-        ), patch.object(
-            wca, "is_head_ancestor_of_ref", return_value=True
-        ):
-            report = wca.audit_branches_directory("/repo", **kwargs)
-        return {wt["path"]: wt for wt in report["worktrees"]}
-
-    def test_classifications_identical_with_and_without_pr_evidence(self):
-        without = self._audit()
-        with_evidence = self._audit(
-            pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
-            master_ref="prgs/master",
-        )
-        self.assertEqual(
-            {p: e["classification"] for p, e in without.items()},
-            {p: e["classification"] for p, e in with_evidence.items()},
-        )
-
-    def test_lease_on_issue_does_not_capture_similarly_named_scratch_trees(self):
-        """A lease on issue 777 protects issue work, not baseline/review trees."""
-        porcelain = _porcelain(
-            ("/repo/branches/baseline-master-issue-777", "baseline-issue-777", "7" * 40),
-            ("/repo/branches/issue-777-timeline", MERGED_BRANCH, HEAD_SHA),
-        )
-        with patch.object(
-            wca, "list_worktrees", return_value=wca.parse_worktree_porcelain(porcelain)
-        ), patch.object(
-            wca, "read_worktree_dirty",
-            return_value={"exists": True, "dirty": False, "dirty_files": []},
-        ), patch.object(
-            wca, "git_worktree_list", return_value="(mocked)"
-        ), patch.object(
-            wca, "is_head_ancestor_of_ref", return_value=True
-        ):
-            report = wca.audit_branches_directory(
-                "/repo",
-                pr_index=wca.build_pr_index([_pr(849, MERGED_BRANCH)]),
-                master_ref="prgs/master",
-                leased_issue_numbers={777},
-            )
-        by_path = {wt["path"]: wt for wt in report["worktrees"]}
-
-        baseline = by_path["/repo/branches/baseline-master-issue-777"]
-        self.assertFalse(baseline["has_active_lease"])
-        self.assertEqual(baseline["classification"], wca.CLASS_CLEAN_STALE_REMOVABLE)
-
-        issue_work = by_path["/repo/branches/issue-777-timeline"]
-        self.assertTrue(issue_work["has_active_lease"])
-        self.assertFalse(issue_work["removable"])
-
-    def test_review_and_baseline_still_removable(self):
-        by_path = self._audit(
-            pr_index=wca.build_pr_index([]), master_ref="prgs/master"
-        )
-        self.assertEqual(
-            by_path["/repo/branches/review-pr42"]["classification"],
-            wca.CLASS_CLEAN_STALE_REMOVABLE,
-        )
-        self.assertEqual(
-            by_path["/repo/branches/baseline-master-x"]["classification"],
-            wca.CLASS_CLEAN_STALE_REMOVABLE,
-        )
-        self.assertEqual(
-            by_path["/repo/branches/review-pr99"]["classification"],
-            wca.CLASS_DETACHED_REVIEW_LEFTOVER,
-        )
-
-    def test_conflict_fix_ttl_behaviour_unchanged(self):
-        """conflict_fix still needs only TTL expiry; #858 did not touch it."""
-        self.assertEqual(
-            wca.classify_worktree(
-                workflow_type=wca.WORKFLOW_CONFLICT_FIX,
-                is_dirty=False,
-                ttl_expired=True,
-            ),
-            wca.CLASS_CLEAN_STALE_REMOVABLE,
-        )
-        self.assertEqual(
-            wca.classify_worktree(
-                workflow_type=wca.WORKFLOW_CONFLICT_FIX,
-                is_dirty=False,
-                ttl_expired=False,
-            ),
-            wca.CLASS_ACTIVE_ISSUE_WORK,
-        )
-
-    def test_issue_work_ttl_alone_no_longer_grants_removal(self):
-        """Age is not landing proof: TTL alone must not reclaim issue work."""
-        self.assertEqual(
-            wca.classify_worktree(
-                workflow_type=wca.WORKFLOW_ISSUE_WORK,
-                is_dirty=False,
-                ttl_expired=True,
-            ),
-            wca.CLASS_ACTIVE_ISSUE_WORK,
-        )
-
-
-class TestAssessorPerformsNoDeletion(_AuditHarness):
-    def test_audit_never_removes_a_worktree(self):
-        with patch.object(wca, "remove_worktree") as removal:
-            self.merged_audit()
-        removal.assert_not_called()
-
-    def test_audit_shells_out_to_no_destructive_git_command(self):
-        seen = []
-        real_run = subprocess.run
-
-        def recording_run(cmd, *args, **kwargs):
-            seen.append(cmd)
-            return real_run(["true"], *args, **kwargs)
-
-        with patch.object(subprocess, "run", side_effect=recording_run):
-            wca.audit_branches_directory("/nonexistent-repo-for-audit")
-
-        joined = [" ".join(c) if isinstance(c, list) else str(c) for c in seen]
-        for cmd in joined:
-            self.assertNotIn("worktree remove", cmd)
-            self.assertNotIn("branch -D", cmd)
-            self.assertNotIn("push", cmd)
-
-
-class TestAgreementWithPrScopedReconciler(unittest.TestCase):
-    """The audit and merged_cleanup_reconcile must agree on identical input.
-
-    Uses a real throwaway git repository so containment is computed by git
-    rather than asserted. Nothing outside the temporary directory is touched.
-    """
-
-    def _git(self, *args):
-        subprocess.run(
-            ["git", "-C", self.root, *args],
-            check=True,
-            capture_output=True,
-            text=True,
-        )
-
-    def setUp(self):
-        self._tmp = tempfile.TemporaryDirectory()
-        self.root = os.path.realpath(self._tmp.name)
-        self._git("init", "-b", "master", ".")
-        self._git("config", "user.email", "[email protected]")
-        self._git("config", "user.name", "Test")
-        with open(os.path.join(self.root, "seed.txt"), "w") as fh:
-            fh.write("seed\n")
-        self._git("add", "seed.txt")
-        self._git("commit", "-m", "seed")
-
-        self.branch = "feat/issue-777-timeline"
-        self._git("checkout", "-b", self.branch)
-        with open(os.path.join(self.root, "feature.txt"), "w") as fh:
-            fh.write("feature\n")
-        self._git("add", "feature.txt")
-        self._git("commit", "-m", "feature")
-        self.head_sha = subprocess.run(
-            ["git", "-C", self.root, "rev-parse", "HEAD"],
-            capture_output=True, text=True, check=True,
-        ).stdout.strip()
-        self._git("checkout", "master")
-        self._git("merge", "--no-ff", "-m", "merge feature", self.branch)
-
-        self.worktree = os.path.join(self.root, "branches", "issue-777-timeline")
-        self._git("worktree", "add", self.worktree, self.branch)
-
-    def tearDown(self):
-        self._tmp.cleanup()
-
-    def _pr_index(self):
-        return wca.build_pr_index(
-            [
-                {
-                    "number": 849,
-                    "head": {"ref": self.branch, "sha": self.head_sha},
-                    "merged_at": "2026-07-24T01:00:00Z",
-                }
-            ]
-        )
-
-    def _audit_entry(self):
-        report = wca.audit_branches_directory(
-            self.root, pr_index=self._pr_index(), master_ref="master"
-        )
-        return next(wt for wt in report["worktrees"] if wt["path"] == self.worktree)
-
-    def _reconciler_entry(self):
-        return mcr.assess_local_worktree_cleanup(
-            pr_number=849,
-            head_branch=self.branch,
-            merged=True,
-            worktree_state=mcr.resolve_cleanup_worktree_state(
-                project_root=self.root,
-                head_branch=self.branch,
-                issue_number=777,
-                pr_head_sha=self.head_sha,
-                target_ref="master",
-            ),
-            active_lock=False,
-        )
-
-    def test_both_assessors_agree_the_worktree_is_safe(self):
-        audit_entry = self._audit_entry()
-        reconciler = self._reconciler_entry()
-
-        self.assertTrue(reconciler["safe_to_remove_worktree"], reconciler)
-        self.assertTrue(audit_entry["removable"], audit_entry)
-        self.assertEqual(audit_entry["pr_number"], reconciler["pr_number"])
-        self.assertEqual(audit_entry["merged_pr_cleanup"]["block_reasons"], [])
-        self.assertEqual(reconciler["block_reasons"], [])
-
-    def test_both_assessors_agree_a_dirty_worktree_is_unsafe(self):
-        with open(os.path.join(self.worktree, "feature.txt"), "a") as fh:
-            fh.write("local edit\n")
-
-        audit_entry = self._audit_entry()
-        reconciler = self._reconciler_entry()
-
-        self.assertFalse(audit_entry["removable"])
-        self.assertFalse(reconciler["safe_to_remove_worktree"])
-
-    def test_worktree_still_present_after_audit(self):
-        self._audit_entry()
-        self.assertTrue(os.path.isdir(self.worktree))
-
-
-if __name__ == "__main__":
-    unittest.main()

tests/test_webui_system_health_dashboard.py

@@ -0,0 +1,345 @@
+"""Tests for the system-health dashboard view (#639).
+
+Covers the acceptance criteria directly: the page renders the health DTO
+fields (AC1), degraded dependencies are visible (AC2), stale runtime is warned
+prominently and never rendered as mutation-safe (AC3), healthy and degraded
+fixtures both render (AC4), and the shell carries a nav entry (AC5).
+"""
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from starlette.testclient import TestClient
+
+from webui.app import create_app
+from webui.deployment_boundary import scan_text_for_client_secrets
+from webui.layout import render_page
+from webui.nav import iter_nav_items
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    StaleRuntime,
+    SystemHealthSnapshot,
+    VersionInfo,
+)
+from webui.system_health_views import render_system_health_page
+
+DASHBOARD_PATH = "/system-health"
+
+
+def _version(*, known: bool = True) -> VersionInfo:
+    return VersionInfo(
+        git_sha="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd" if known else None,
+        git_describe="v0.4.1-12-g1c455b6" if known else None,
+        control_plane_schema_version=4 if known else None,
+        python_version="3.13.1",
+        known=known,
+    )
+
+
+def _parity(*, stale: bool = False, determinable: bool = True) -> StaleRuntime:
+    if stale:
+        return StaleRuntime(
+            daemon_head="aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+            checkout_head="bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+            remote_head="cccccccccccccccccccccccccccccccccccccccc",
+            stale=True,
+            determinable=True,
+            mutation_safe=False,
+            reasons=("runtime, checkout, and remote commits disagree",),
+        )
+    if not determinable:
+        return StaleRuntime(
+            daemon_head=None,
+            checkout_head=None,
+            remote_head=None,
+            stale=False,
+            determinable=False,
+            mutation_safe=False,
+            reasons=("local checkout HEAD could not be read",),
+        )
+    return StaleRuntime(
+        daemon_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        checkout_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        remote_head="1c455b6ec0f9cb761fe6248de68c17e061fb5ecd",
+        stale=False,
+        determinable=True,
+        mutation_safe=True,
+        reasons=(),
+    )
+
+
+def _snapshot(
+    *,
+    status: str = STATUS_OK,
+    ready: bool = True,
+    readiness_complete: bool = True,
+    readiness_reasons: tuple[str, ...] = (),
+    dependencies: tuple[DependencyProbe, ...] | None = None,
+    parity: StaleRuntime | None = None,
+    namespaces: tuple[dict, ...] = (),
+    probe_errors: tuple[str, ...] = (),
+    version_known: bool = True,
+) -> SystemHealthSnapshot:
+    if dependencies is None:
+        dependencies = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=1.25,
+                metadata={"schema_version": 4},
+            ),
+        )
+    return SystemHealthSnapshot(
+        status=status,
+        ready=ready,
+        readiness_complete=readiness_complete,
+        readiness_reasons=readiness_reasons,
+        service="mcp-control-plane-webui",
+        mode="read-only",
+        version=_version(known=version_known),
+        started_at="2026-07-23T19:50:47+00:00",
+        uptime_seconds=3661.5,
+        timestamp="2026-07-23T20:51:48+00:00",
+        deep_probes_requested=False,
+        dependencies=dependencies,
+        mcp_namespaces=namespaces,
+        stale_runtime=parity if parity is not None else _parity(),
+        probe_errors=probe_errors,
+    )
+
+
+class TestHealthyRender(unittest.TestCase):
+    """AC1 / AC4 — every health DTO field reaches the page."""
+
+    def setUp(self):
+        self.html = render_system_health_page(_snapshot())
+
+    def test_readiness_fields_render(self):
+        self.assertIn("System health", self.html)
+        self.assertIn("Ready", self.html)
+        self.assertIn("mcp-control-plane-webui", self.html)
+        self.assertIn("read-only", self.html)
+        self.assertIn("2026-07-23T20:51:48+00:00", self.html)
+
+    def test_version_and_uptime_render(self):
+        self.assertIn("1c455b6ec0f9cb761fe6248de68c17e061fb5ecd", self.html)
+        self.assertIn("v0.4.1-12-g1c455b6", self.html)
+        self.assertIn("3.13.1", self.html)
+        self.assertIn("3661.500s", self.html)
+        self.assertIn("1.02h", self.html)
+
+    def test_dependency_row_renders_with_latency(self):
+        self.assertIn("control_plane_db", self.html)
+        self.assertIn("sqlite", self.html)
+        self.assertIn("schema version 4", self.html)
+        self.assertIn("1.2 ms", self.html)
+
+    def test_healthy_page_shows_no_stale_warning(self):
+        self.assertNotIn("Stale runtime:", self.html)
+        self.assertNotIn("Staleness", self.html)
+
+    def test_unknown_version_is_labelled_not_faked(self):
+        html = render_system_health_page(_snapshot(version_known=False))
+        self.assertIn("unknown", html)
+        self.assertIn("unresolved", html)
+
+
+class TestDegradedRender(unittest.TestCase):
+    """AC2 — a degraded or unrun dependency is visible, not swallowed."""
+
+    def setUp(self):
+        self.deps = (
+            DependencyProbe(
+                name="control_plane_db",
+                kind="sqlite",
+                status=STATUS_OK,
+                detail="schema version 4",
+                required=True,
+                latency_ms=0.9,
+            ),
+            DependencyProbe(
+                name="repository",
+                kind="git",
+                status=STATUS_DOWN,
+                detail="repository root is not a git checkout",
+                required=True,
+                latency_ms=4.0,
+            ),
+            DependencyProbe(
+                name="gitea",
+                kind="http",
+                status=STATUS_SKIPPED,
+                detail="deep probe not requested",
+                required=False,
+            ),
+        )
+        self.html = render_system_health_page(
+            _snapshot(
+                status=STATUS_DEGRADED,
+                ready=False,
+                readiness_complete=False,
+                readiness_reasons=("required dependency 'repository' is down",),
+                dependencies=self.deps,
+            )
+        )
+
+    def test_degraded_banner_names_the_dependency(self):
+        self.assertIn("Degraded dependencies:", self.html)
+        self.assertIn("repository", self.html)
+
+    def test_not_run_probe_is_reported_separately(self):
+        self.assertIn("Not probed:", self.html)
+        self.assertIn("gitea", self.html)
+        self.assertIn("not counted", self.html)
+
+    def test_not_ready_headline_and_reason(self):
+        self.assertIn("Not ready", self.html)
+        self.assertIn("required dependency 'repository' is down", self.html)
+
+    def test_degraded_status_badge_present(self):
+        self.assertIn("badge-health-degraded", self.html)
+        self.assertIn("badge-health-down", self.html)
+
+    def test_ready_but_incomplete_is_not_shown_as_plain_ready(self):
+        html = render_system_health_page(
+            _snapshot(ready=True, readiness_complete=False)
+        )
+        self.assertIn("Ready (incomplete evidence)", html)
+
+
+class TestStaleRuntimeWarning(unittest.TestCase):
+    """AC3 — staleness is prominent and never claims mutation safety."""
+
+    def test_stale_runtime_warns_and_denies_mutation_safety(self):
+        html = render_system_health_page(_snapshot(parity=_parity(stale=True)))
+        self.assertIn("Stale runtime:", html)
+        self.assertIn("do not treat this runtime as mutation-safe", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+
+    def test_indeterminate_parity_is_not_reported_safe(self):
+        html = render_system_health_page(
+            _snapshot(parity=_parity(determinable=False))
+        )
+        self.assertIn("Staleness", html)
+        self.assertIn("<tr><th>Mutation safe</th><td>False</td></tr>", html)
+        self.assertIn("<tr><th>Determinable</th><td>False</td></tr>", html)
+
+    def test_healthy_parity_reports_mutation_safe_true(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("<tr><th>Mutation safe</th><td>True</td></tr>", html)
+
+
+class TestNamespacesAndErrors(unittest.TestCase):
+    def test_unproven_namespace_rows_render(self):
+        html = render_system_health_page(
+            _snapshot(
+                namespaces=(
+                    {
+                        "namespace": "gitea-author",
+                        "required_tool": "gitea_lock_issue",
+                        "status": STATUS_UNPROVEN,
+                        "ide_namespace_proven": False,
+                        "reason": "the web console cannot invoke the IDE-managed MCP client",
+                    },
+                )
+            )
+        )
+        self.assertIn("gitea-author", html)
+        self.assertIn("gitea_lock_issue", html)
+        self.assertIn("badge-health-unproven", html)
+
+    def test_no_namespaces_degrades_gracefully(self):
+        html = render_system_health_page(_snapshot(namespaces=()))
+        self.assertIn("No MCP namespaces are declared.", html)
+
+    def test_probe_errors_render_when_present(self):
+        html = render_system_health_page(
+            _snapshot(probe_errors=("probe raised: disk offline",))
+        )
+        self.assertIn("Probe errors", html)
+        self.assertIn("disk offline", html)
+
+    def test_probe_error_card_absent_when_clean(self):
+        self.assertNotIn("Probe errors", render_system_health_page(_snapshot()))
+
+
+class TestReadOnlyAndRedaction(unittest.TestCase):
+    def test_no_restart_or_kill_controls(self):
+        html = render_system_health_page(_snapshot())
+        self.assertNotIn("<button", html)
+        self.assertNotIn("<form", html)
+        self.assertNotIn("pkill", html)
+        self.assertIn("read-only", html)
+
+    def test_recovery_points_at_sanctioned_path(self):
+        html = render_system_health_page(_snapshot())
+        self.assertIn("Reconnect the MCP client", html)
+        self.assertIn("Never kill the daemon process manually", html)
+
+    def test_secret_shaped_detail_is_redacted(self):
+        leaky = DependencyProbe(
+            name="gitea",
+            kind="http",
+            status=STATUS_DOWN,
+            detail="auth failed for token=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
+            required=False,
+            latency_ms=12.0,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(leaky,)))
+        self.assertNotIn("ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789", html)
+
+    def test_html_in_detail_is_escaped(self):
+        hostile = DependencyProbe(
+            name="repository",
+            kind="git",
+            status=STATUS_DOWN,
+            detail="<script>alert(1)</script>",
+            required=True,
+        )
+        html = render_system_health_page(_snapshot(dependencies=(hostile,)))
+        self.assertNotIn("<script>", html)
+        self.assertIn("&lt;script&gt;", html)
+
+
+class TestNavAndRoute(unittest.TestCase):
+    """AC5 — the shell links the dashboard, and the route serves it."""
+
+    def setUp(self):
+        self.client = TestClient(create_app())
+
+    def test_nav_contains_system_health(self):
+        self.assertIn(
+            (DASHBOARD_PATH, "System health"),
+            [(item.href, item.label) for item in iter_nav_items()],
+        )
+
+    def test_rendered_shell_links_dashboard(self):
+        page = render_page(title="Home", body_html="<p>x</p>")
+        self.assertIn(f'href="{DASHBOARD_PATH}"', page)
+
+    def test_route_renders_dashboard(self):
+        response = self.client.get(DASHBOARD_PATH)
+        self.assertEqual(response.status_code, 200)
+        self.assertIn("System health", response.text)
+        self.assertIn("Stale-runtime parity", response.text)
+
+    def test_route_is_read_only(self):
+        self.assertEqual(self.client.post(DASHBOARD_PATH).status_code, 405)
+
+    def test_live_page_leaks_no_client_secret(self):
+        findings = scan_text_for_client_secrets(self.client.get(DASHBOARD_PATH).text)
+        self.assertEqual(findings, [])
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()

tests/test_worktree_cleanup_audit.py

@@ -134,35 +134,13 @@ class TestClassification(unittest.TestCase):
         self.assertEqual(cls, wca.CLASS_ACTIVE_OPEN_PR)
         self.assertFalse(wca.is_removable(cls))
 
-    def test_stale_clean_issue_worktree_needs_merged_pr_proof(self):
+    def test_stale_clean_issue_worktree_removable(self):
-        # Scenario 5 (#858): age is not proof that the branch landed, so a
+        # Scenario 5: clean issue worktree, TTL expired, no lock -> removable.
-        # TTL-expired issue worktree stays active work. Only authoritative
-        # merged-PR evidence makes it removable, which is what keeps a
-        # worktree holding unmerged commits from being reclaimed by age.
         cls = wca.classify_worktree(
             workflow_type=wca.WORKFLOW_ISSUE_WORK,
             is_dirty=False,
             ttl_expired=True,
         )
-        self.assertEqual(cls, wca.CLASS_ACTIVE_ISSUE_WORK)
-        self.assertFalse(wca.is_removable(cls))
-
-        cls = wca.classify_worktree(
-            workflow_type=wca.WORKFLOW_ISSUE_WORK,
-            is_dirty=False,
-            ttl_expired=True,
-            merged_pr_cleanup={"proven": True},
-        )
-        self.assertEqual(cls, wca.CLASS_CLEAN_STALE_REMOVABLE)
-        self.assertTrue(wca.is_removable(cls))
-
-    def test_stale_clean_conflict_fix_worktree_removable(self):
-        # conflict_fix keeps the original TTL rule; #858 changed issue work only.
-        cls = wca.classify_worktree(
-            workflow_type=wca.WORKFLOW_CONFLICT_FIX,
-            is_dirty=False,
-            ttl_expired=True,
-        )
         self.assertEqual(cls, wca.CLASS_CLEAN_STALE_REMOVABLE)
         self.assertTrue(wca.is_removable(cls))
 

webui/app.py

@@ -53,6 +53,7 @@ from webui.system_health import (
     process_uptime,
     snapshot_to_dict as system_health_to_dict,
 )
+from webui.system_health_views import render_system_health_page
 
 _READ_ONLY_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
 _AUDIT_MUTATION_PATHS = frozenset({"/audit", "/api/audit"})
@@ -161,6 +162,24 @@ async def api_system_health(request: Request) -> JSONResponse:
     return JSONResponse(payload, status_code=200 if snapshot.ready else 503)
 
 
+async def system_health(request: Request) -> HTMLResponse:
+    """Read-only system-health dashboard (#639).
+
+    Shares the #634 snapshot loader with the JSON API so the page can never
+    disagree with it. `?deep=1` opts into the network probe exactly as the API
+    does; the default page load stays cheap. The response is always 200: this
+    is an operator view that must render the degraded state, not withhold it.
+    """
+    deep = _truthy_flag(request.query_params.get("deep"))
+    snapshot = load_system_health(deep=deep)
+    return HTMLResponse(
+        render_page(
+            title="System health",
+            body_html=render_system_health_page(snapshot),
+        )
+    )
+
+
 async def queue(_request: Request) -> HTMLResponse:
     snapshot = load_queue_snapshot()
     return HTMLResponse(render_page(title="Queue", body_html=render_queue_page(snapshot)))
@@ -571,6 +590,7 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
             Route("/", home, methods=["GET"]),
             Route("/health", health, methods=["GET"]),
             Route(SYSTEM_HEALTH_API_PATH, api_system_health, methods=["GET"]),
+            Route("/system-health", system_health, methods=["GET"]),
             Route("/queue", queue, methods=["GET"]),
             Route("/api/queue", api_queue, methods=["GET"]),
             Route("/projects", projects, methods=["GET"]),

webui/layout.py

@@ -236,6 +236,25 @@ def render_page(*, title: str, body_html: str, extra_head: str = "") -> str:
     .badge-in-review {{ color: #9ec8f0; border-color: #3d5f7a; }}
     .badge-duplicate {{ color: #e0c27a; border-color: #6b5730; }}
     .badge-stale {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .badge-health-ok {{ color: #8fd19e; border-color: #3d6b4a; }}
+    .badge-health-degraded {{ color: #e0c27a; border-color: #6b5730; }}
+    .badge-health-down {{ color: #f0a8a8; border-color: #7a3b3b; }}
+    .badge-health-skipped {{ color: var(--muted); }}
+    .badge-health-unproven {{ color: #c9b8e8; border-color: #5a4a78; }}
+    .health-card {{
+      margin: 1.25rem 0;
+      padding: 0.85rem 1rem 1rem;
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      background: var(--surface);
+    }}
+    .health-card h3 {{ margin: 0 0 0.5rem; font-size: 1.05rem; }}
+    .health-card h4 {{ margin: 1rem 0 0.35rem; font-size: 0.92rem; color: var(--muted); }}
+    .health-headline {{ color: var(--text); font-size: 1rem; margin: 0 0 0.5rem; }}
+    .health-degraded {{ border-left-color: #e0c27a; }}
+    .health-stale {{ border-left-color: #f0a8a8; }}
+    ul.reasons {{ margin: 0.35rem 0; padding-left: 1.15rem; color: var(--muted); font-size: 0.9rem; }}
+    ul.reasons li {{ margin-bottom: 0.3rem; }}
   </style>
   {extra_head}
 </head>

webui/nav.py

@@ -38,6 +38,7 @@ class NavGroup:
 NAV_GROUPS: tuple[NavGroup, ...] = (
     NavGroup("Health", (
         NavItem("/health", "Liveness"),
+        NavItem("/system-health", "System health"),
     )),
     NavGroup("Traffic", (
         NavItem("/queue", "Queue"),

webui/system_health_views.py

@@ -0,0 +1,307 @@
+"""HTML views for the system-health dashboard (#639).
+
+Renders the read-only :class:`~webui.system_health.SystemHealthSnapshot`
+produced by the Phase 1 system-health API (#634). The page offers no restart,
+reload, or process-kill control: those are Phase 2 work, and manual process
+kills are the contamination path #630 exists to prevent.
+
+Every free-text field passes through :func:`webui.system_health.redact` before
+it reaches HTML, so a probe detail that captured a token or a credentialed URL
+cannot leak through the dashboard even though the API redacts it already.
+"""
+
+from __future__ import annotations
+
+import html
+
+from webui.system_health import (
+    STATUS_DEGRADED,
+    STATUS_DOWN,
+    STATUS_OK,
+    STATUS_SKIPPED,
+    STATUS_UNPROVEN,
+    DependencyProbe,
+    SystemHealthSnapshot,
+    redact,
+)
+
+_STATUS_BADGE_CLASS = {
+    STATUS_OK: "badge-health-ok",
+    STATUS_DEGRADED: "badge-health-degraded",
+    STATUS_DOWN: "badge-health-down",
+    STATUS_SKIPPED: "badge-health-skipped",
+    STATUS_UNPROVEN: "badge-health-unproven",
+}
+
+
+def _safe(value: object) -> str:
+    """Escape free text for HTML after redacting anything secret-shaped.
+
+    Use this for every value that can carry arbitrary text — probe details,
+    reasons, probe errors — because those are where a credential could ride
+    along.
+    """
+    return html.escape(redact(str(value)))
+
+
+def _esc(value: object) -> str:
+    """Escape a structured field for HTML without redacting it.
+
+    Commit SHAs, probe names, statuses, and timestamps are enumerated or
+    machine-generated, never credential-bearing. They must not go through
+    :func:`redact`: its opaque-token rule matches any 32-plus-character run,
+    so a 40-character git SHA would render as ``[redacted]`` and the parity
+    view — the one thing an operator reads this page for — would be blank.
+    """
+    return html.escape(str(value))
+
+
+def _status_badge(status: str) -> str:
+    css = _STATUS_BADGE_CLASS.get(status, "badge-health-unproven")
+    return f'<span class="badge {css}">{_esc(status)}</span>'
+
+
+def _reason_list(reasons: tuple[str, ...], *, empty: str) -> str:
+    if not reasons:
+        return f"<p class='muted'>{html.escape(empty)}</p>"
+    items = "".join(f"<li>{_safe(reason)}</li>" for reason in reasons)
+    return f"<ul class='reasons'>{items}</ul>"
+
+
+def _readiness_card(snapshot: SystemHealthSnapshot) -> str:
+    """Overall readiness.
+
+    ``ready`` and ``readiness_complete`` are shown separately on purpose: a
+    snapshot whose required probes never ran is not the same as one that ran
+    them and passed, and collapsing the two would render an unproven green.
+    """
+    if snapshot.ready and snapshot.readiness_complete:
+        headline = "Ready"
+    elif snapshot.ready:
+        headline = "Ready (incomplete evidence)"
+    else:
+        headline = "Not ready"
+
+    return (
+        "<section class='health-card'>"
+        f"<h3>Readiness {_status_badge(snapshot.status)}</h3>"
+        f"<p class='health-headline'>{html.escape(headline)}</p>"
+        "<table class='detail'>"
+        f"<tr><th>Service</th><td><code>{_esc(snapshot.service)}</code></td></tr>"
+        f"<tr><th>Mode</th><td>{_esc(snapshot.mode)}</td></tr>"
+        f"<tr><th>Ready</th><td>{_esc(snapshot.ready)}</td></tr>"
+        "<tr><th>Readiness evidence complete</th>"
+        f"<td>{_esc(snapshot.readiness_complete)}</td></tr>"
+        "<tr><th>Deep probes requested</th>"
+        f"<td>{_esc(snapshot.deep_probes_requested)}</td></tr>"
+        f"<tr><th>Observed at</th><td><code>{_esc(snapshot.timestamp)}</code></td></tr>"
+        "</table>"
+        "<h4>Readiness reasons</h4>"
+        f"{_reason_list(snapshot.readiness_reasons, empty='No readiness objections recorded.')}"
+        "</section>"
+    )
+
+
+def _version_card(snapshot: SystemHealthSnapshot) -> str:
+    version = snapshot.version
+    uptime_hours = snapshot.uptime_seconds / 3600.0
+    known = (
+        "resolved"
+        if version.known
+        else "unresolved — version fields could not be read from the checkout"
+    )
+    schema = version.control_plane_schema_version
+    return (
+        "<section class='health-card'>"
+        "<h3>Version and uptime</h3>"
+        "<table class='detail'>"
+        f"<tr><th>Git SHA</th><td><code>{_esc(version.git_sha or 'unknown')}</code></td></tr>"
+        "<tr><th>Git describe</th>"
+        f"<td><code>{_esc(version.git_describe or 'unknown')}</code></td></tr>"
+        "<tr><th>Control-plane schema</th>"
+        f"<td>{_esc(schema if schema is not None else 'unknown')}</td></tr>"
+        f"<tr><th>Python</th><td><code>{_esc(version.python_version)}</code></td></tr>"
+        f"<tr><th>Version status</th><td>{html.escape(known)}</td></tr>"
+        f"<tr><th>Started at</th><td><code>{_esc(snapshot.started_at)}</code></td></tr>"
+        "<tr><th>Uptime</th>"
+        f"<td>{snapshot.uptime_seconds:.3f}s ({uptime_hours:.2f}h)</td></tr>"
+        "</table>"
+        "</section>"
+    )
+
+
+def _dependency_rows(probes: tuple[DependencyProbe, ...]) -> str:
+    if not probes:
+        return "<p class='muted'>No dependency probes were reported.</p>"
+    rows = []
+    for probe in probes:
+        latency = (
+            f"{probe.latency_ms:.1f} ms" if probe.latency_ms is not None else "n/a"
+        )
+        rows.append(
+            "<tr>"
+            f"<td><code>{_esc(probe.name)}</code></td>"
+            f"<td>{_esc(probe.kind)}</td>"
+            f"<td>{_status_badge(probe.status)}</td>"
+            f"<td>{_esc('required' if probe.required else 'optional')}</td>"
+            f"<td>{html.escape(latency)}</td>"
+            f"<td>{_safe(probe.detail)}</td>"
+            "</tr>"
+        )
+    return (
+        "<table class='registry'><thead><tr>"
+        "<th>Dependency</th><th>Kind</th><th>Status</th><th>Requirement</th>"
+        "<th>Latency</th><th>Detail</th>"
+        "</tr></thead><tbody>"
+        f"{''.join(rows)}</tbody></table>"
+    )
+
+
+def _dependency_card(snapshot: SystemHealthSnapshot) -> str:
+    degraded = [probe for probe in snapshot.dependencies if probe.ran and not probe.healthy]
+    not_run = [probe for probe in snapshot.dependencies if not probe.ran]
+
+    banner = ""
+    if degraded:
+        names = ", ".join(sorted(probe.name for probe in degraded))
+        banner += (
+            "<div class='stub health-degraded'><p><strong>Degraded dependencies:</strong> "
+            f"{_esc(names)}</p></div>"
+        )
+    if not_run:
+        names = ", ".join(sorted(probe.name for probe in not_run))
+        banner += (
+            "<div class='stub'><p><strong>Not probed:</strong> "
+            f"{_esc(names)} — these contribute no evidence and are not counted "
+            "as healthy.</p></div>"
+        )
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Dependencies</h3>"
+        f"{banner}"
+        f"{_dependency_rows(snapshot.dependencies)}"
+        "<p class='muted'>Details are redacted at the API boundary and again "
+        "before rendering; credentials are never displayed.</p>"
+        "</section>"
+    )
+
+
+def _namespace_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.mcp_namespaces:
+        body = "<p class='muted'>No MCP namespaces are declared.</p>"
+    else:
+        rows = []
+        for entry in snapshot.mcp_namespaces:
+            rows.append(
+                "<tr>"
+                f"<td><code>{_esc(entry.get('namespace'))}</code></td>"
+                f"<td><code>{_esc(entry.get('required_tool'))}</code></td>"
+                f"<td>{_status_badge(str(entry.get('status') or STATUS_UNPROVEN))}</td>"
+                f"<td>{_esc(entry.get('ide_namespace_proven'))}</td>"
+                f"<td>{_safe(entry.get('reason'))}</td>"
+                "</tr>"
+            )
+        body = (
+            "<table class='registry'><thead><tr>"
+            "<th>Namespace</th><th>Required tool</th><th>Status</th>"
+            "<th>IDE-proven</th><th>Reason</th>"
+            "</tr></thead><tbody>"
+            f"{''.join(rows)}</tbody></table>"
+        )
+    return (
+        "<section class='health-card'>"
+        "<h3>MCP namespaces</h3>"
+        f"{body}"
+        "<p class='muted'>The web process runs outside the IDE-managed MCP "
+        "client, so namespace health is reported as unproven rather than "
+        "guessed (#543).</p>"
+        "</section>"
+    )
+
+
+def _stale_runtime_card(snapshot: SystemHealthSnapshot) -> str:
+    stale = snapshot.stale_runtime
+    if stale.stale:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Stale runtime:</strong> "
+            "the running code, the checkout, and the remote-tracking commit "
+            "disagree. Capability gates may be evaluating obsolete code — "
+            "do not treat this runtime as mutation-safe.</p></div>"
+        )
+    elif not stale.determinable:
+        warning = (
+            "<div class='stub health-stale'><p><strong>Staleness "
+            "indeterminate:</strong> parity could not be proven, so this "
+            "runtime is not reported as mutation-safe.</p></div>"
+        )
+    else:
+        warning = ""
+
+    return (
+        "<section class='health-card'>"
+        "<h3>Stale-runtime parity</h3>"
+        f"{warning}"
+        "<table class='detail'>"
+        "<tr><th>Daemon head</th>"
+        f"<td><code>{_esc(stale.daemon_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Checkout head</th>"
+        f"<td><code>{_esc(stale.checkout_head or 'unknown')}</code></td></tr>"
+        "<tr><th>Remote head</th>"
+        f"<td><code>{_esc(stale.remote_head or 'unknown')}</code></td></tr>"
+        f"<tr><th>Stale</th><td>{_esc(stale.stale)}</td></tr>"
+        f"<tr><th>Determinable</th><td>{_esc(stale.determinable)}</td></tr>"
+        f"<tr><th>Mutation safe</th><td>{_esc(stale.mutation_safe)}</td></tr>"
+        "</table>"
+        f"{_reason_list(stale.reasons, empty='Runtime, checkout, and remote agree.')}"
+        "</section>"
+    )
+
+
+def _probe_error_card(snapshot: SystemHealthSnapshot) -> str:
+    if not snapshot.probe_errors:
+        return ""
+    return (
+        "<section class='health-card'>"
+        "<h3>Probe errors</h3>"
+        f"{_reason_list(snapshot.probe_errors, empty='')}"
+        "</section>"
+    )
+
+
+def _recovery_card() -> str:
+    """Sanctioned recovery pointers only — never a manual process kill (#630)."""
+    return (
+        "<section class='health-card'>"
+        "<h3>Recovery</h3>"
+        "<p class='muted'>This dashboard is read-only. Restart and reload "
+        "controls arrive in Phase 2 (#642); until then recovery runs through "
+        "the sanctioned client reconnect / operator restart path.</p>"
+        "<ul class='reasons'>"
+        "<li><a href='/runtime'>Runtime and session view</a> — active profile, "
+        "workflow hashes, and shell health.</li>"
+        "<li>Reconnect the MCP client from the IDE, then re-run the blocked "
+        "cycle. Never kill the daemon process manually: unmanaged kills are "
+        "recorded as runtime contamination (#630).</li>"
+        "<li>See <code>docs/webui-local-dev.md</code> for the documented "
+        "recovery sequence.</li>"
+        "</ul>"
+        "</section>"
+    )
+
+
+def render_system_health_page(snapshot: SystemHealthSnapshot) -> str:
+    """Render the full system-health dashboard body."""
+    return (
+        "<h2>System health</h2>"
+        "<p class='meta'>Read-only view of the Phase 1 system-health API "
+        "(<code>/api/v1/system/health</code>). Reload this page to refresh; "
+        "nothing here polls or mutates on your behalf.</p>"
+        f"{_readiness_card(snapshot)}"
+        f"{_stale_runtime_card(snapshot)}"
+        f"{_version_card(snapshot)}"
+        f"{_dependency_card(snapshot)}"
+        f"{_namespace_card(snapshot)}"
+        f"{_probe_error_card(snapshot)}"
+        f"{_recovery_card()}"
+    )

worktree_cleanup_audit.py

@@ -34,11 +34,7 @@ import subprocess
 from datetime import datetime, timezone
 from typing import Any
 
-from merged_cleanup_reconcile import (
+from merged_cleanup_reconcile import branch_worktree_folder, read_local_worktree_state
-    branch_worktree_folder,
-    is_head_ancestor_of_ref,
-    read_local_worktree_state,
-)
 from reviewer_worktree import parse_dirty_tracked_files, REVIEW_WORKTREE_RE
 
 PROTECTED_BRANCHES = frozenset({"master", "main", "dev"})
@@ -71,14 +67,6 @@ REMOVABLE_CLASSES = frozenset(
     {CLASS_CLEAN_STALE_REMOVABLE, CLASS_DETACHED_REVIEW_LEFTOVER}
 )
 
-# Merged-PR linkage outcomes for issue worktrees (#858). Only ``LINKAGE_MERGED``
-# is ownership proof; every other outcome leaves the worktree protected.
-LINKAGE_MERGED = "merged_pr"
-LINKAGE_OPEN = "open_pr"
-LINKAGE_NONE = "no_owning_pr"
-LINKAGE_AMBIGUOUS = "ambiguous"
-LINKAGE_UNKNOWN = "unknown"
-
 _ISSUE_REF_RE = re.compile(r"issue-(\d+)", re.IGNORECASE)
 _ISSUE_BRANCH_PREFIXES = ("feat/", "fix/", "docs/", "chore/")
 
@@ -181,186 +169,6 @@ def is_ttl_expired(
     return (now_dt - last).total_seconds() > ttl_hours * 3600.0
 
 
-def build_pr_index(prs: list[dict[str, Any]] | None) -> dict[str, list[dict[str, Any]]]:
-    """Index PR records by head branch for deterministic worktree linkage (#858).
-
-    Accepts Gitea PR payloads (``head`` as a dict) and pre-flattened records
-    (``head_branch``/``head_sha``). Records without a usable head branch or
-    number are dropped rather than guessed at, so a branch is only ever linked
-    to a PR the caller actually proved.
-    """
-    index: dict[str, list[dict[str, Any]]] = {}
-    for pr in prs or []:
-        head = pr.get("head")
-        if isinstance(head, dict):
-            head_branch = head.get("ref")
-            head_sha = head.get("sha")
-        else:
-            head_branch = pr.get("head_branch") or (head if isinstance(head, str) else None)
-            head_sha = pr.get("head_sha")
-        number = pr.get("number")
-        if not head_branch or number is None:
-            continue
-        try:
-            pr_number = int(number)
-        except (TypeError, ValueError):
-            continue
-        index.setdefault(str(head_branch).strip(), []).append(
-            {
-                "pr_number": pr_number,
-                "head_branch": str(head_branch).strip(),
-                "head_sha": head_sha,
-                "merged": bool(pr.get("merged") or pr.get("merged_at")),
-                "state": pr.get("state"),
-            }
-        )
-    return index
-
-
-def resolve_owning_pr(
-    *,
-    branch: str | None,
-    pr_index: dict[str, list[dict[str, Any]]] | None,
-) -> dict[str, Any]:
-    """Resolve the single PR that owns ``branch``, failing closed when unclear.
-
-    Ownership is only ``LINKAGE_MERGED`` when exactly one PR claims the branch
-    and that PR is merged. Several distinct PRs on one branch is a competing
-    claim (``LINKAGE_AMBIGUOUS``), and a still-open owner is reported as
-    ``LINKAGE_OPEN`` — both keep the worktree protected while still exposing
-    the PR number the audit resolved.
-    """
-    if pr_index is None:
-        return {
-            "status": LINKAGE_UNKNOWN,
-            "pr_number": None,
-            "candidate_pr_numbers": [],
-            "reasons": ["live PR state was not supplied; ownership unproven"],
-        }
-    branch_name = (branch or "").strip()
-    if not branch_name:
-        return {
-            "status": LINKAGE_UNKNOWN,
-            "pr_number": None,
-            "candidate_pr_numbers": [],
-            "reasons": ["worktree has no attached branch; ownership unproven"],
-        }
-
-    candidates = list(pr_index.get(branch_name) or [])
-    numbers = sorted({c["pr_number"] for c in candidates})
-    if not candidates:
-        return {
-            "status": LINKAGE_NONE,
-            "pr_number": None,
-            "candidate_pr_numbers": [],
-            "reasons": [f"no PR claims branch '{branch_name}'"],
-        }
-    if len(numbers) > 1:
-        return {
-            "status": LINKAGE_AMBIGUOUS,
-            "pr_number": None,
-            "candidate_pr_numbers": numbers,
-            "reasons": [
-                f"branch '{branch_name}' is claimed by competing PRs {numbers}; "
-                "ownership is ambiguous"
-            ],
-        }
-
-    owner = candidates[0]
-    pr_number = owner["pr_number"]
-    if owner.get("head_branch") != branch_name:
-        return {
-            "status": LINKAGE_UNKNOWN,
-            "pr_number": pr_number,
-            "candidate_pr_numbers": numbers,
-            "reasons": [
-                f"PR #{pr_number} head branch '{owner.get('head_branch')}' does not "
-                f"match worktree branch '{branch_name}'"
-            ],
-        }
-    if not owner.get("merged"):
-        return {
-            "status": LINKAGE_OPEN,
-            "pr_number": pr_number,
-            "candidate_pr_numbers": numbers,
-            "pr_head_sha": owner.get("head_sha"),
-            "reasons": [f"owning PR #{pr_number} is not merged"],
-        }
-    return {
-        "status": LINKAGE_MERGED,
-        "pr_number": pr_number,
-        "candidate_pr_numbers": numbers,
-        "pr_head_sha": owner.get("head_sha"),
-        "reasons": [],
-    }
-
-
-def assess_merged_pr_worktree_cleanup(
-    *,
-    linkage: dict[str, Any] | None,
-    head_sha: str | None,
-    head_in_master: bool | None,
-    is_dirty: bool,
-    has_open_pr: bool,
-    has_active_lease: bool,
-    has_active_issue_lock: bool,
-    is_protected: bool,
-    has_live_session: bool = False,
-) -> dict[str, Any]:
-    """Decide whether a merged issue worktree satisfies the full cleanup policy.
-
-    Every condition must be independently proven: conclusive merged-PR
-    ownership, agreement between the worktree branch and the PR head branch,
-    containment of the worktree head in authoritative master (which is what
-    proves no unmerged commits remain), absence of any open/competing PR,
-    lease, issue lock, or live session, a clean tree, and a worktree that is
-    not the protected control checkout. Anything unknown blocks.
-    """
-    link = linkage or {
-        "status": LINKAGE_UNKNOWN,
-        "pr_number": None,
-        "reasons": ["no linkage assessment supplied"],
-    }
-    status = link.get("status")
-    reasons: list[str] = []
-
-    if status != LINKAGE_MERGED:
-        reasons.extend(
-            link.get("reasons") or ["owning PR could not be conclusively identified"]
-        )
-    if is_protected:
-        reasons.append("worktree is protected or the stable control checkout")
-    if is_dirty:
-        reasons.append("worktree has uncommitted changes")
-    if has_open_pr:
-        reasons.append("worktree branch has an open PR")
-    if has_active_lease:
-        reasons.append("worktree has an active lease")
-    if has_active_issue_lock:
-        reasons.append("an active issue lock references this branch")
-    if has_live_session:
-        reasons.append("a live process or session is using this worktree")
-    if not head_sha:
-        reasons.append("worktree head sha is unknown")
-    if head_in_master is None:
-        reasons.append("containment of the worktree head in master is unknown")
-    elif not head_in_master:
-        reasons.append(
-            "worktree head is not contained in authoritative master "
-            "(unmerged commits remain)"
-        )
-
-    proven = not reasons
-    return {
-        "linkage_status": status,
-        "pr_number": link.get("pr_number"),
-        "pr_head_sha": link.get("pr_head_sha"),
-        "head_in_master": head_in_master,
-        "proven": proven,
-        "block_reasons": reasons,
-    }
-
-
 def classify_worktree(
     *,
     workflow_type: str,
@@ -373,8 +181,6 @@ def classify_worktree(
     ttl_expired: bool = False,
     is_protected: bool = False,
     metadata_known: bool = True,
-    merged_pr_cleanup: dict[str, Any] | None = None,
-    has_live_session: bool = False,
 ) -> str:
     """Classify a worktree, safety-first: any preservation signal wins.
 
@@ -393,8 +199,6 @@ def classify_worktree(
         return CLASS_ACTIVE_ISSUE_WORK  # never auto-deleted (criterion 8)
     if has_active_issue_lock:
         return CLASS_ACTIVE_ISSUE_WORK
-    if has_live_session:
-        return CLASS_ACTIVE_ISSUE_WORK  # a live session still owns this tree
     if not metadata_known or workflow_type == WORKFLOW_UNKNOWN:
         return CLASS_UNSAFE_UNKNOWN  # never auto-deleted without proof
 
@@ -403,15 +207,7 @@ def classify_worktree(
         if is_detached or branch_gone:
             return CLASS_DETACHED_REVIEW_LEFTOVER
         return CLASS_CLEAN_STALE_REMOVABLE
-    if workflow_type == WORKFLOW_ISSUE_WORK:
+    # issue_work / conflict_fix: only removable once the TTL has expired.
-        # #858: an issue worktree becomes removable only on authoritative
-        # merged-PR evidence satisfying the whole cleanup policy. Age alone
-        # never proves the branch landed, so TTL cannot qualify one by itself
-        # — otherwise a worktree holding unmerged commits would be reclaimed.
-        if (merged_pr_cleanup or {}).get("proven"):
-            return CLASS_CLEAN_STALE_REMOVABLE
-        return CLASS_ACTIVE_ISSUE_WORK
-    # conflict_fix: only removable once the TTL has expired.
     if ttl_expired:
         return CLASS_CLEAN_STALE_REMOVABLE
     return CLASS_ACTIVE_ISSUE_WORK
@@ -604,20 +400,6 @@ def remove_worktree(project_root: str, path: str) -> dict[str, Any]:
     }
 
 
-def head_contained_in_ref(
-    project_root: str, head_sha: str | None, ref: str | None
-) -> bool | None:
-    """Return True when ``head_sha`` is already contained in ``ref``.
-
-    Shares :mod:`merged_cleanup_reconcile`'s ancestry check so the audit and
-    the PR-scoped reconciler agree on what "already landed" means (#858).
-    Returns None when containment cannot be determined, which fails closed.
-    """
-    if not head_sha or not ref:
-        return None
-    return is_head_ancestor_of_ref(project_root, head_sha, ref)
-
-
 def _is_under_branches(project_root: str, path: str) -> bool:
     branches_root = os.path.join(os.path.abspath(project_root), "branches")
     return os.path.abspath(path or "").startswith(branches_root + os.sep)
@@ -631,30 +413,16 @@ def audit_branches_directory(
     active_issue_branches: set[str] | None = None,
     now: datetime | str | None = None,
     ttl_hours: float = DEFAULT_TTL_HOURS,
-    pr_index: dict[str, list[dict[str, Any]]] | None = None,
-    leased_issue_numbers: set[int] | None = None,
-    live_session_paths: set[str] | None = None,
-    master_ref: str | None = None,
 ) -> dict[str, Any]:
     """Classify every session-owned worktree under ``branches/``.
 
     Read-only: shells out to git for discovery and dirty state, then applies
     the pure classifier. Returns per-worktree classifications, counts, the
     list of removable candidates, and the ``git worktree list`` proof.
-
-    ``pr_index`` (see :func:`build_pr_index`) supplies the authoritative PR
-    ownership used to link issue worktrees to their merged PR (#858).
-    ``master_ref`` is the ref a worktree head must be contained in before it
-    can be considered landed. Both are optional and their absence only ever
-    fails closed: without them no issue worktree becomes removable.
     """
     open_pr_branches = open_pr_branches or set()
     leased_branches = leased_branches or set()
     active_issue_branches = active_issue_branches or set()
-    leased_issue_numbers = leased_issue_numbers or set()
-    live_session_paths = {
-        os.path.abspath(p) for p in (live_session_paths or set()) if p
-    }
 
     worktrees: list[dict[str, Any]] = []
     for entry in list_worktrees(project_root):
@@ -665,42 +433,12 @@ def audit_branches_directory(
         )
         dirty_state = read_worktree_dirty(path)
         is_dirty = bool(dirty_state.get("dirty"))
-        head_sha = entry.get("head")
-        linkage = resolve_owning_pr(branch=branch, pr_index=pr_index)
         metadata = build_worktree_metadata(
-            path=path,
+            path=path, branch=branch, head_sha=entry.get("head")
-            branch=branch,
-            head_sha=head_sha,
-            pr_number=linkage.get("pr_number"),
         )
         has_open_pr = bool(branch) and branch in open_pr_branches
-        # A lease on issue N protects that issue's own work worktree. It must
+        has_active_lease = bool(branch) and branch in leased_branches
-        # not incidentally protect a baseline/review scratch tree that merely
-        # carries the same issue marker in its name, which would change the
-        # classification of worktrees this policy does not own.
-        has_active_lease = (bool(branch) and branch in leased_branches) or (
-            metadata["workflow_type"] == WORKFLOW_ISSUE_WORK
-            and metadata.get("issue_number") is not None
-            and metadata["issue_number"] in leased_issue_numbers
-        )
         has_active_lock = bool(branch) and branch in active_issue_branches
-        has_live_session = bool(path) and os.path.abspath(path) in live_session_paths
-        head_in_master = (
-            head_contained_in_ref(project_root, head_sha, master_ref)
-            if master_ref
-            else None
-        )
-        merged_pr_cleanup = assess_merged_pr_worktree_cleanup(
-            linkage=linkage,
-            head_sha=head_sha,
-            head_in_master=head_in_master,
-            is_dirty=is_dirty,
-            has_open_pr=has_open_pr,
-            has_active_lease=has_active_lease,
-            has_active_issue_lock=has_active_lock,
-            is_protected=is_protected,
-            has_live_session=has_live_session,
-        )
         ttl_expired = is_ttl_expired(
             last_used_at=metadata.get("last_used_at"), now=now, ttl_hours=ttl_hours
         )
@@ -714,8 +452,6 @@ def audit_branches_directory(
             branch_gone=branch is None and not entry.get("detached"),
             ttl_expired=ttl_expired,
             is_protected=is_protected,
-            merged_pr_cleanup=merged_pr_cleanup,
-            has_live_session=has_live_session,
         )
         metadata["cleanup_eligibility"] = classification
         worktrees.append(
@@ -727,10 +463,7 @@ def audit_branches_directory(
                 "has_open_pr": has_open_pr,
                 "has_active_lease": has_active_lease,
                 "has_active_issue_lock": has_active_lock,
-                "has_live_session": has_live_session,
                 "is_protected": is_protected,
-                "merged_pr_linkage": linkage,
-                "merged_pr_cleanup": merged_pr_cleanup,
                 "classification": classification,
                 "removable": is_removable(classification),
             }