Adds the PR-scoped post-merge cleanup path a reconciler needs to finish exactly one merged PR without a batch sweep over other PRs, plus the explicit expired-reviewer-lease reclaim the batch path never had.
PR-scoped selector
gitea_reconcile_merged_cleanups gains an optional pr_number. When set, only that merged PR is assessed and acted on:
the PR is resolved live and fails closed on an invalid/non-positive number, an unresolvable or ambiguous PR, or a not-yet-merged PR;
reviewer scratch worktrees are filtered to that PR;
the report entry set is pinned to exactly [pr_number], failing closed on any drift.
The existing execute loop then acts on the single pinned entry only — remove the safe worktree, reassess ownership, then delete the remote branch — touching no other PR. Batch behaviour is preserved when pr_number is omitted.
Expired reviewer-lease reclaim (AC4)
An expired or stale reviewer lease no longer protects an already-merged branch forever. branch_cleanup_guard.assess_expired_reviewer_lease_reclaim decides reclaim explicitly and fail-closed: only a reviewer lease, only expired/stale status, only a proven-merged PR, only a proven-dead owner process, and only when no competing active claimant uses the branch. _collect_branch_ownership_records gathers that evidence from authoritative state (live PR merged-state, lease owner liveness, and the full ownership inventory for competing-claimant detection) and evaluates it after the complete inventory is built — so the post-worktree-removal reassessment is what clears the branch delete. Any unknown fails closed. Author/merger/controller/reconciler leases are untouched; active leases, worktree bindings, issue locks, and live sessions still block.
9 tests prove other worktrees/branches/leases untouched
selector + reclaim tests
Scope boundary
This is the reconciler-executor gap. The audit-side merged-PR linkage was a distinct fix and already landed as #859; this PR adds no audit change. It is additive to the batch path (unchanged) and weakens no ownership guard beyond the single, fully-gated expired-reviewer-lease reclaim.
Tests
tests/test_issue_855_expired_reviewer_reclaim.py (new): fail-closed matrix for the reclaim decision plus collector wiring — merged+dead+uncontested reclaims; not-merged, live-owner, competing-worktree, and author-lease cases stay protective.
tests/test_branch_cleanup_guard.py: exact-PR selector coverage — ignores newer PRs in the batch queue, execute mutates only the selected PR, unknown/not-merged/invalid fail closed, batch mode preserved.
Evidence, run from the registered worktree at head 24c52ab:
Changed-surface sweep (branch-cleanup guard, reconciler cleanup integration, native cleanup proof, delete-branch capability, audit-reconciliation-mode, moot-lease gate, merged-cleanup-reconcile, close-gate, already-landed) — pass, apart from two pre-existing test_branch_cleanup_guard failures and test_reconciler_supersession_close, all three reproducing identically on master 6d0015ca and untouched by this change.
Provenance
Implemented as jcwalker3 / prgs-author on Scaled-Tech-Consulting/Gitea-Tools, master parity in_parity=truemutation_safe=true at 6d0015ca. A prior blocked cycle's partial selector work-in-progress on this branch (dead session pid 18052) was adopted, fast-forwarded onto current master, validated, and completed with the missing AC4 reclaim. The dead-session issue-#855 lock was recovered through the sanctioned unpublished-claim path (recorded pid dead; branch, worktree, and claimant matched; local head strictly descends from recorded base 6d0015ca). The head was published via gitea_publish_unpublished_issue_branch with read-after-write verification. No base merge; base stays at master.
Canonical PR State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review this PR at head 24c52ab against issue #855 acceptance criteria 1-9; verify the pr_number selector fails closed on invalid/ambiguous/not-merged and pins the entry set to the single PR, and that the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant); confirm the pre-existing baseline failures match master 6d0015ca; submit verdict; stop
NEXT_PROMPT: Review this PR for issue #855 as prgs-reviewer pinned to head 24c52ab. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures match master 6d0015ca, submit a verdict, and stop.
Closes #855
Adds the PR-scoped post-merge cleanup path a reconciler needs to finish exactly one merged PR without a batch sweep over other PRs, plus the explicit expired-reviewer-lease reclaim the batch path never had.
## PR-scoped selector
`gitea_reconcile_merged_cleanups` gains an optional `pr_number`. When set, only that merged PR is assessed and acted on:
- the PR is resolved live and fails closed on an invalid/non-positive number, an unresolvable or ambiguous PR, or a not-yet-merged PR;
- reviewer scratch worktrees are filtered to that PR;
- the report entry set is pinned to exactly `[pr_number]`, failing closed on any drift.
The existing execute loop then acts on the single pinned entry only — remove the safe worktree, reassess ownership, then delete the remote branch — touching no other PR. Batch behaviour is preserved when `pr_number` is omitted.
## Expired reviewer-lease reclaim (AC4)
An expired or stale reviewer lease no longer protects an already-merged branch forever. `branch_cleanup_guard.assess_expired_reviewer_lease_reclaim` decides reclaim explicitly and fail-closed: only a reviewer lease, only expired/stale status, only a proven-merged PR, only a proven-dead owner process, and only when no competing active claimant uses the branch. `_collect_branch_ownership_records` gathers that evidence from authoritative state (live PR merged-state, lease owner liveness, and the full ownership inventory for competing-claimant detection) and evaluates it after the complete inventory is built — so the post-worktree-removal reassessment is what clears the branch delete. Any unknown fails closed. Author/merger/controller/reconciler leases are untouched; active leases, worktree bindings, issue locks, and live sessions still block.
## Acceptance criteria
| AC | Where |
|---|---|
| 1 single merged PR target | `pr_number` selector + live resolution |
| 2 removes only the target's safe worktrees | entry set pinned to `[pr_number]`; scratch filtered |
| 3 ownership reassessed after worktree removal | fresh `_ownership_records_for_branch` post-removal (#852) |
| 4 expired reviewer lease not permanent | `assess_expired_reviewer_lease_reclaim` + collector wiring |
| 5 delete the target remote branch when safe | execute-loop remote delete, now reachable |
| 6/7 dry-run and apply report targets + mutations | `selection_mode`, `selected_pr_number`, entries, actions |
| 8 fail closed on dirty/live/ambiguous/parity | selector + ownership fail-closed branches |
| 9 tests prove other worktrees/branches/leases untouched | selector + reclaim tests |
## Scope boundary
This is the reconciler-executor gap. The audit-side merged-PR linkage was a distinct fix and already landed as #859; this PR adds no audit change. It is additive to the batch path (unchanged) and weakens no ownership guard beyond the single, fully-gated expired-reviewer-lease reclaim.
## Tests
- `tests/test_issue_855_expired_reviewer_reclaim.py` (new): fail-closed matrix for the reclaim decision plus collector wiring — merged+dead+uncontested reclaims; not-merged, live-owner, competing-worktree, and author-lease cases stay protective.
- `tests/test_branch_cleanup_guard.py`: exact-PR selector coverage — ignores newer PRs in the batch queue, execute mutates only the selected PR, unknown/not-merged/invalid fail closed, batch mode preserved.
Evidence, run from the registered worktree at head `24c52ab`:
- `pytest tests/test_issue_855_expired_reviewer_reclaim.py` — 16 passed, 5 subtests.
- `pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector` — 6 passed.
- Changed-surface sweep (branch-cleanup guard, reconciler cleanup integration, native cleanup proof, delete-branch capability, audit-reconciliation-mode, moot-lease gate, merged-cleanup-reconcile, close-gate, already-landed) — pass, apart from two pre-existing `test_branch_cleanup_guard` failures and `test_reconciler_supersession_close`, all three reproducing identically on master `6d0015ca` and untouched by this change.
## Provenance
Implemented as `jcwalker3` / `prgs-author` on `Scaled-Tech-Consulting/Gitea-Tools`, master parity `in_parity=true` `mutation_safe=true` at `6d0015ca`. A prior blocked cycle's partial selector work-in-progress on this branch (dead session pid 18052) was adopted, fast-forwarded onto current master, validated, and completed with the missing AC4 reclaim. The dead-session issue-#855 lock was recovered through the sanctioned unpublished-claim path (recorded pid dead; branch, worktree, and claimant matched; local head strictly descends from recorded base `6d0015ca`). The head was published via `gitea_publish_unpublished_issue_branch` with read-after-write verification. No base merge; base stays at master.
## Canonical PR State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review this PR at head 24c52ab against issue #855 acceptance criteria 1-9; verify the pr_number selector fails closed on invalid/ambiguous/not-merged and pins the entry set to the single PR, and that the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant); confirm the pre-existing baseline failures match master 6d0015ca; submit verdict; stop
NEXT_PROMPT: Review this PR for issue #855 as prgs-reviewer pinned to head 24c52ab. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures match master 6d0015ca, submit a verdict, and stop.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Adds a single-target path for post-merge cleanup so a reconciler can
complete one merged PR without a batch sweep across unrelated PRs.
## PR-scoped selector
gitea_reconcile_merged_cleanups gains an optional pr_number. When set,
only that merged PR is assessed and acted on: the PR is resolved live and
fails closed on an invalid/non-positive number, an unresolvable or
ambiguous PR, or an unmerged PR; reviewer scratch worktrees are filtered
to that PR; and the report's entry set is pinned to exactly [pr_number],
failing closed on any drift. The existing execute loop then operates on
the single pinned entry only -- worktree removal, ownership reassessment,
then remote-branch delete -- with no unrelated target. Batch behaviour is
unchanged when pr_number is omitted.
## Expired reviewer-lease reclaim (AC4)
An expired or stale reviewer lease no longer protects an already-merged
branch forever. branch_cleanup_guard.assess_expired_reviewer_lease_reclaim
makes the decision explicitly and fail-closed: reclaim only when the lease
is a reviewer lease, its status is expired/stale, the PR is proven merged,
the owner process is proven dead, and no competing active claimant uses
the branch. _collect_branch_ownership_records supplies that evidence from
authoritative state (live PR merged-state, lease owner liveness, and the
full ownership inventory for competing-claimant detection) and evaluates
it only after the complete inventory is built, so the post-worktree-removal
reassessment is what unblocks the branch delete. Any unknown fails closed.
Author/merger/controller/reconciler leases are untouched; active leases,
worktree bindings, issue locks, and live sessions still block.
## Tests
- tests/test_issue_855_expired_reviewer_reclaim.py: full fail-closed matrix
for the reclaim decision plus collector wiring (merged+dead+uncontested
reclaims; unmerged, live-owner, competing-worktree, and author-lease
cases stay protective).
- tests/test_branch_cleanup_guard.py: exact-PR selector coverage (ignores
newer PRs in the batch queue, execute mutates only the selected PR,
unknown/not-merged/invalid fail closed, batch mode preserved).
Changed-surface suites pass; the 2 pre-existing test_branch_cleanup_guard
failures and test_reconciler_supersession_close reproduce identically on
master 6d0015ca and are unrelated to this change.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 24c52abf6b. Merger syncs base (2 behind; branch protection requires current base), obtains a fresh reviewer approval at the resulting head, then merges. No cleanup here — defer branch/worktree reclaim to reconciler.
NEXT_PROMPT:
Merge PR #866 for issue #855 as prgs-merger. Head 24c52abf6b80e7ed562294371eee9fe8620b686e is reviewer-APPROVED (sysadmin/prgs-reviewer) but head-scoped and 2 commits behind master; run update_pr_branch_by_merge to current master, require a fresh reviewer approval at the resulting head, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818).
WHAT_HAPPENED: Independent security-focused review of the full production diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11) plus tests. Verified all 9 acceptance criteria; reproduced the reclaim-guard fail-closed matrix and the PR-scoped selector; independently ran the focused tests (16 pass + 5 subtests reclaim; 6/6 selector) and a 214-pass neighbour sweep; reproduced all claimed baseline failures identically on clean master ef14622.
WHY: assess_expired_reviewer_lease_reclaim is strictly fail-closed (reclaim only when role==reviewer AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; any None/contrary keeps the lease protective — TTL alone never authorizes). Collector wiring supplies pr_number/auth/base_api on BOTH real call sites (cleanup_merged_pr_branch ~L10586, execute-loop _ownership_records_for_branch ~L11463), not only in tests; the reclaim pass runs after the complete ownership inventory so competing claimants cannot be missed by iteration order. Selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; worktree removal precedes remote delete with fresh post-removal ownership reassessment and read-after-write delete verification; batch behaviour and role authority (reconciler-gated execution) preserved. Zero PR-introduced regressions.
ISSUE: 855
HEAD_SHA: 24c52abf6b
REVIEW_STATUS: APPROVE
MERGE_READY: no — approval is head-scoped; PR is 2 commits behind master and branch protection requires a current base, so a base sync + fresh review at the new head are required before merge.
BLOCKERS: none blocking approval of the reviewed head. Merge-time prerequisite: update_pr_branch_by_merge + fresh review after sync.
VALIDATION: tests/test_issue_855_expired_reviewer_reclaim.py 16 passed + 5 subtests @ 24c52ab; tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed @ 24c52ab; neighbour sweep 214 passed @ 24c52ab; baseline failures test_authorized_cleanup_deletes_through_api_path, test_active_author_ownership_blocks_before_delete, test_reconciler_supersession_close reproduced identically on clean master ef14622 (pre-existing, not regressions); one moot-lease test failure is environment-dependent (branches/merge-pr487 layout) and also fails identically on master.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 24c52abf6b (reviewer session 26133-df7e376b1b5c, reviewer-lease comment 15387, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
## Canonical PR State
STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 24c52abf6b80e7ed562294371eee9fe8620b686e. Merger syncs base (2 behind; branch protection requires current base), obtains a fresh reviewer approval at the resulting head, then merges. No cleanup here — defer branch/worktree reclaim to reconciler.
NEXT_PROMPT:
```text
Merge PR #866 for issue #855 as prgs-merger. Head 24c52abf6b80e7ed562294371eee9fe8620b686e is reviewer-APPROVED (sysadmin/prgs-reviewer) but head-scoped and 2 commits behind master; run update_pr_branch_by_merge to current master, require a fresh reviewer approval at the resulting head, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818).
```
WHAT_HAPPENED: Independent security-focused review of the full production diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11) plus tests. Verified all 9 acceptance criteria; reproduced the reclaim-guard fail-closed matrix and the PR-scoped selector; independently ran the focused tests (16 pass + 5 subtests reclaim; 6/6 selector) and a 214-pass neighbour sweep; reproduced all claimed baseline failures identically on clean master ef14622.
WHY: assess_expired_reviewer_lease_reclaim is strictly fail-closed (reclaim only when role==reviewer AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; any None/contrary keeps the lease protective — TTL alone never authorizes). Collector wiring supplies pr_number/auth/base_api on BOTH real call sites (cleanup_merged_pr_branch ~L10586, execute-loop _ownership_records_for_branch ~L11463), not only in tests; the reclaim pass runs after the complete ownership inventory so competing claimants cannot be missed by iteration order. Selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; worktree removal precedes remote delete with fresh post-removal ownership reassessment and read-after-write delete verification; batch behaviour and role authority (reconciler-gated execution) preserved. Zero PR-introduced regressions.
ISSUE: 855
HEAD_SHA: 24c52abf6b80e7ed562294371eee9fe8620b686e
REVIEW_STATUS: APPROVE
MERGE_READY: no — approval is head-scoped; PR is 2 commits behind master and branch protection requires a current base, so a base sync + fresh review at the new head are required before merge.
BLOCKERS: none blocking approval of the reviewed head. Merge-time prerequisite: update_pr_branch_by_merge + fresh review after sync.
VALIDATION: tests/test_issue_855_expired_reviewer_reclaim.py 16 passed + 5 subtests @ 24c52ab; tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed @ 24c52ab; neighbour sweep 214 passed @ 24c52ab; baseline failures test_authorized_cleanup_deletes_through_api_path, test_active_author_ownership_blocks_before_delete, test_reconciler_supersession_close reproduced identically on clean master ef14622 (pre-existing, not regressions); one moot-lease test failure is environment-dependent (branches/merge-pr487 layout) and also fails identically on master.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 24c52abf6b80e7ed562294371eee9fe8620b686e (reviewer session 26133-df7e376b1b5c, reviewer-lease comment 15387, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent review of PR #866 at head 499b87c48218cf03a3b1f34a5d8a17549d820564 against issue #855 acceptance criteria 1-9. Do NOT reuse review #534 (invalid at the new head). Verify the pr_number selector fail-closed behavior (invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the fully-gated expired-reviewer-lease reclaim (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant; evaluated after full ownership inventory). Run the two focused suites, confirm baseline failures match master ef14622, submit a verdict, and stop.
NEXT_PROMPT:
Review PR #866 for issue #855 as prgs-reviewer pinned to head 499b87c48218cf03a3b1f34a5d8a17549d820564. Former-head approval #534 is INVALID at this head — do not reuse it. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector, confirm the pre-existing baseline failures match master ef14622, submit a verdict, and stop.
WHAT_HAPPENED: Author base-sync only. Branch fix/issue-855-pr-scoped-merged-cleanup was synced to current master via the sanctioned author gitea_update_pr_branch_by_merge path (style=merge; no rebase, no force-push). Former PR head 24c52abf6b80e7ed562294371eee9fe8620b686e -> new PR head 499b87c48218cf03a3b1f34a5d8a17549d820564; base master merged at ef14622ba0badd0cd7d654c05af13aca7d81bc05. Change scope is the base-merge commit only — no production file edits beyond the merge. Review #534 (APPROVED @ 24c52ab) is invalidated by the head change; reviewer/merger leases and any prepared verdict scoped to the former head are superseded.
WHY: PR #866 was approved at head 24c52ab but branch protection requires the PR branch to contain the current base, and the branch was 2 commits behind protected master (ef14622). Gitea could merge base in without conflicts, so the sanctioned author update-by-merge was the required operation to make it merge-eligible; a new head necessarily invalidates the prior approval and requires fresh independent review.
RELATED_PRS: #865 (merged @ ef14622, advanced base); #859 (merged; audit-side merged-PR linkage — distinct, already landed); #818/#638 (retained reproduction fixtures, untouched).
BLOCKERS: none. commits_behind=0, mergeable=true, has_conflicts=false, PR open, mutation_safe=true, in_parity=true. No foreign live lock/lease. Only gate for merge now is the required fresh review at the new head.
VALIDATION: gitea_update_pr_branch_by_merge -> success, performed=true, style=merge, force_push=false, rebase=false. Post-sync gitea_assess_pr_sync_status: pr_head=499b87c48218cf03a3b1f34a5d8a17549d820564, base_head=ef14622ba0badd0cd7d654c05af13aca7d81bc05, commits_behind=0, mergeable=true, has_conflicts=false, approval_at_current_head=false, recommended_next_action=fresh_review_required, checks_status=not_required. Master parity in_parity=true, mutation_safe=true at ef14622. No focused #855 suite re-run: clean base merge, no production-code delta beyond the merge commit (step-11 trigger did not apply).
LAST_UPDATED_BY: jcwalker3 / prgs-author
## Canonical Issue State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent review of PR #866 at head `499b87c48218cf03a3b1f34a5d8a17549d820564` against issue #855 acceptance criteria 1-9. Do NOT reuse review #534 (invalid at the new head). Verify the `pr_number` selector fail-closed behavior (invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the fully-gated expired-reviewer-lease reclaim (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant; evaluated after full ownership inventory). Run the two focused suites, confirm baseline failures match master `ef14622`, submit a verdict, and stop.
NEXT_PROMPT:
```text
Review PR #866 for issue #855 as prgs-reviewer pinned to head 499b87c48218cf03a3b1f34a5d8a17549d820564. Former-head approval #534 is INVALID at this head — do not reuse it. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector, confirm the pre-existing baseline failures match master ef14622, submit a verdict, and stop.
```
WHAT_HAPPENED: Author base-sync only. Branch `fix/issue-855-pr-scoped-merged-cleanup` was synced to current `master` via the sanctioned author `gitea_update_pr_branch_by_merge` path (style=merge; no rebase, no force-push). Former PR head `24c52abf6b80e7ed562294371eee9fe8620b686e` -> new PR head `499b87c48218cf03a3b1f34a5d8a17549d820564`; base `master` merged at `ef14622ba0badd0cd7d654c05af13aca7d81bc05`. Change scope is the base-merge commit only — no production file edits beyond the merge. Review #534 (APPROVED @ 24c52ab) is invalidated by the head change; reviewer/merger leases and any prepared verdict scoped to the former head are superseded.
WHY: PR #866 was approved at head 24c52ab but branch protection requires the PR branch to contain the current base, and the branch was 2 commits behind protected `master` (`ef14622`). Gitea could merge base in without conflicts, so the sanctioned author update-by-merge was the required operation to make it merge-eligible; a new head necessarily invalidates the prior approval and requires fresh independent review.
RELATED_PRS: #865 (merged @ ef14622, advanced base); #859 (merged; audit-side merged-PR linkage — distinct, already landed); #818/#638 (retained reproduction fixtures, untouched).
BLOCKERS: none. `commits_behind=0`, `mergeable=true`, `has_conflicts=false`, PR open, `mutation_safe=true`, `in_parity=true`. No foreign live lock/lease. Only gate for merge now is the required fresh review at the new head.
VALIDATION: `gitea_update_pr_branch_by_merge` -> success, performed=true, style=merge, force_push=false, rebase=false. Post-sync `gitea_assess_pr_sync_status`: pr_head=`499b87c48218cf03a3b1f34a5d8a17549d820564`, base_head=`ef14622ba0badd0cd7d654c05af13aca7d81bc05`, commits_behind=0, mergeable=true, has_conflicts=false, approval_at_current_head=false, recommended_next_action=fresh_review_required, checks_status=not_required. Master parity in_parity=true, mutation_safe=true at ef14622. No focused #855 suite re-run: clean base merge, no production-code delta beyond the merge commit (step-11 trigger did not apply).
LAST_UPDATED_BY: jcwalker3 / prgs-author
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: changes-requested
WHO_IS_NEXT: author
BLOCKED_ROLE: none
NEXT_ACTION: As prgs-author on issue #855, run gitea_update_pr_branch_by_merge on PR #866 to merge current live master (89657a06c4) into fix/issue-855-pr-scoped-merged-cleanup, producing a new head that incorporates 89657a06. Then route the new head to a fresh gitea-reviewer for a head-scoped review. No code changes are required — the implementation is sound; only the stale base blocks approval.
NEXT_PROMPT:
Sync PR #866 for issue #855 as prgs-author. Head 499b87c48218cf03a3b1f34a5d8a17549d820564 is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base. Run update_pr_branch_by_merge to merge master into the branch (no rebase/force), verify the new head with read-after-write, then hand off to a fresh gitea-reviewer pinned to the new head. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818). Do not re-implement the pr_number selector or the AC4 expired-reviewer reclaim; both are complete and verified.
WHAT_HAPPENED: Independent security-focused review of the complete current diff at head 499b87c (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, two test files). Two-parent containment independently proven: 499b87c descends from original head 24c52ab AND incorporates ef14622 (merge-base is exactly ef14622). It does NOT incorporate current live master 89657a06.
WHY: BLOCKING — the reviewed head is NOT mergeable at a current base. Authoritative sync assessment: commits_behind=2, branch_protection_requires_current_base=true, approval_valid_for_merge=false, stale_approval=true, recommended_next_action=update_branch_by_merge. Live master advanced ef14622 -> 89657a06 (PR #869/#868 merged) AFTER this branch synchronized to ef14622, so the branch is stale again. Approving a behind head would let a merge land on a non-current base in violation of branch protection. This is a synchronization requirement, not a code defect: the implementation is fail-closed and correct.
CODE_ASSESSMENT (no changes required):
assess_expired_reviewer_lease_reclaim is strictly fail-closed — reclaim only when role=='reviewer' AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; every gate uses identity checks (is True / is False), so any None/unknown/contrary value keeps the lease protective. TTL expiry alone never authorizes reclaim.
Collector wiring (_collect_branch_ownership_records): reviewer reclaim candidates gated to role=='reviewer' + reclaimable status; owner_pid_alive coerced to None unless a real bool; whole reclaim pass skipped on inventory_error (candidates stay protective); pr_merged_state from a live PR GET with exception -> None (fail closed); competing-claimant detection scans the FULL ownership inventory and runs only after it is built, so iteration order cannot miss an active claimant.
PR-scoped selector (gitea_reconcile_merged_cleanups pr_number): fails closed on non-int (invalid_pr_number), <=0 (invalid_pr_number), unresolvable/empty (pr_unresolvable), live-number mismatch (pr_ambiguous), not-merged (pr_not_merged); closed set pinned to [pr_live]; scratch worktrees filtered to pr_number==exact_pr; post-report entry-set pin rejects any set != [exact_pr] (exact_selection_mismatch), blocking both zero and extra entries. Open-PR heads still fetched for remote-delete safety. Batch behaviour preserved when pr_number is omitted.
Author/merger/controller/reconciler leases, active leases, worktree bindings, issue locks, and live sessions remain protective. No ownership guard is weakened beyond the single fully-gated reclaim. No PR-introduced regression found in the diff.
ISSUE: 855
HEAD_SHA: 499b87c482
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no — head is 2 commits behind live master 89657a06c4 and branch protection requires a current base.
BLOCKERS: Stale base. Required change: update_pr_branch_by_merge onto current master 89657a06c4, then fresh head-scoped review. No source edits required.
VALIDATION: Containment verified via git merge-base --is-ancestor (descends 24c52ab: yes; incorporates ef14622: yes; incorporates 89657a06: no; commits_behind=2). Sync state via gitea_assess_pr_sync_status (mergeable=true, has_conflicts=false, commits_behind=2, branch_protection_requires_current_base=true). Focused #855 tests and baseline-failure reproduction deferred to the post-sync reviewer, since the required base-sync produces a fresh head that supersedes this one; the feature diff is unchanged by a base merge.
RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review REQUEST_CHANGES mutation by sysadmin / prgs-reviewer at head 499b87c482 (reviewer session 51916-0f368a202092, reviewer-lease comment 15460, workflow_hash 263d0a6cb8a6). Not a hand-authored claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
## Canonical PR State
STATE: changes-requested
WHO_IS_NEXT: author
BLOCKED_ROLE: none
NEXT_ACTION: As prgs-author on issue #855, run gitea_update_pr_branch_by_merge on PR #866 to merge current live master (89657a06c4cc8d73917e4436e326d3755cff0a40) into fix/issue-855-pr-scoped-merged-cleanup, producing a new head that incorporates 89657a06. Then route the new head to a fresh gitea-reviewer for a head-scoped review. No code changes are required — the implementation is sound; only the stale base blocks approval.
NEXT_PROMPT:
```text
Sync PR #866 for issue #855 as prgs-author. Head 499b87c48218cf03a3b1f34a5d8a17549d820564 is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base. Run update_pr_branch_by_merge to merge master into the branch (no rebase/force), verify the new head with read-after-write, then hand off to a fresh gitea-reviewer pinned to the new head. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818). Do not re-implement the pr_number selector or the AC4 expired-reviewer reclaim; both are complete and verified.
```
WHAT_HAPPENED: Independent security-focused review of the complete current diff at head 499b87c (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, two test files). Two-parent containment independently proven: 499b87c descends from original head 24c52ab AND incorporates ef14622 (merge-base is exactly ef14622). It does NOT incorporate current live master 89657a06.
WHY: BLOCKING — the reviewed head is NOT mergeable at a current base. Authoritative sync assessment: commits_behind=2, branch_protection_requires_current_base=true, approval_valid_for_merge=false, stale_approval=true, recommended_next_action=update_branch_by_merge. Live master advanced ef14622 -> 89657a06 (PR #869/#868 merged) AFTER this branch synchronized to ef14622, so the branch is stale again. Approving a behind head would let a merge land on a non-current base in violation of branch protection. This is a synchronization requirement, not a code defect: the implementation is fail-closed and correct.
CODE_ASSESSMENT (no changes required):
- assess_expired_reviewer_lease_reclaim is strictly fail-closed — reclaim only when role=='reviewer' AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; every gate uses identity checks (is True / is False), so any None/unknown/contrary value keeps the lease protective. TTL expiry alone never authorizes reclaim.
- Collector wiring (_collect_branch_ownership_records): reviewer reclaim candidates gated to role=='reviewer' + reclaimable status; owner_pid_alive coerced to None unless a real bool; whole reclaim pass skipped on inventory_error (candidates stay protective); pr_merged_state from a live PR GET with exception -> None (fail closed); competing-claimant detection scans the FULL ownership inventory and runs only after it is built, so iteration order cannot miss an active claimant.
- PR-scoped selector (gitea_reconcile_merged_cleanups pr_number): fails closed on non-int (invalid_pr_number), <=0 (invalid_pr_number), unresolvable/empty (pr_unresolvable), live-number mismatch (pr_ambiguous), not-merged (pr_not_merged); closed set pinned to [pr_live]; scratch worktrees filtered to pr_number==exact_pr; post-report entry-set pin rejects any set != [exact_pr] (exact_selection_mismatch), blocking both zero and extra entries. Open-PR heads still fetched for remote-delete safety. Batch behaviour preserved when pr_number is omitted.
- Author/merger/controller/reconciler leases, active leases, worktree bindings, issue locks, and live sessions remain protective. No ownership guard is weakened beyond the single fully-gated reclaim. No PR-introduced regression found in the diff.
ISSUE: 855
HEAD_SHA: 499b87c48218cf03a3b1f34a5d8a17549d820564
REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no — head is 2 commits behind live master 89657a06c4cc8d73917e4436e326d3755cff0a40 and branch protection requires a current base.
BLOCKERS: Stale base. Required change: update_pr_branch_by_merge onto current master 89657a06c4cc8d73917e4436e326d3755cff0a40, then fresh head-scoped review. No source edits required.
VALIDATION: Containment verified via git merge-base --is-ancestor (descends 24c52ab: yes; incorporates ef14622: yes; incorporates 89657a06: no; commits_behind=2). Sync state via gitea_assess_pr_sync_status (mergeable=true, has_conflicts=false, commits_behind=2, branch_protection_requires_current_base=true). Focused #855 tests and baseline-failure reproduction deferred to the post-sync reviewer, since the required base-sync produces a fresh head that supersedes this one; the feature diff is unchanged by a base merge.
RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review REQUEST_CHANGES mutation by sysadmin / prgs-reviewer at head 499b87c48218cf03a3b1f34a5d8a17549d820564 (reviewer session 51916-0f368a202092, reviewer-lease comment 15460, workflow_hash 263d0a6cb8a6). Not a hand-authored claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Review PR #866 at exact head 73f82a2305c2b3578cd20f9b8122dff348d2d78b (base master cc7dc8ac1440bed) against issue #855 acceptance criteria 1-9. Verify the pr_number selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to the single PR; verify the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant) and evaluated after the full ownership inventory. Confirm the pre-existing baseline failures reproduce against current master cc7dc8ac. Submit verdict; stop. Do NOT reuse the stale former-head approval.
NEXT_PROMPT:
Review PR #866 for issue #855 as prgs-reviewer pinned to head 73f82a2305c2b3578cd20f9b8122dff348d2d78b (base master cc7dc8ac1440bed). Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures reproduce against current master cc7dc8ac, submit a verdict, and stop. Do NOT reuse the stale former-head approval for merge.
WHAT_HAPPENED: Second sanctioned gitea_update_pr_branch_by_merge against live master executed. Head transition: former c9aa09f341c87da555d9353d4ecf26f282953e04 -> new 73f82a2305c2b3578cd20f9b8122dff348d2d78b; base live master cc7dc8ac1440bed. Style merge, force_push=false, rebase=false (native Gitea Update-by-merge). Expected-head and expected-base both pinned; no race. Post-sync: commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base=false, fully_synchronized=true. New head is the base-into-branch merge commit whose first parent is former head c9aa09f…, so it strictly descends from the former head. Durable issue-#855 lock recovered via sanctioned same-claimant dead-session path (prior pid 669 dead -> replacement pid 95335; branch/worktree/claimant matched; head_relation=remote_merge_synced), then its recorded head refreshed c9aa09f… -> 73f82a23… with read_after_write_ok=true, generation -> 5. Prior approval invalidated for the former head; reviewer lease, merger lease, and prepared verdict scoped to c9aa09f… superseded; recommended_next_action=fresh_review_required.
WHY: PR #866 was 9 commits behind live master cc7dc8ac after PR #874 (issue #871) merged, and branch protection requires the current base; the prior approval was stale. The single fix in #871/#874 is precisely what let this second base-sync refresh the durable-lock recorded head instead of deadlocking. Head is now current-base and mergeable, so a fresh reviewer can act.
RELATED_PRS: #866 (this PR, Closes#855); #874 (issue #871, MERGED at cc7dc8ac — the durable-lock-head-refresh fix this run exercises); #859 (issue #858, audit-side linkage, already landed — out of scope here). Reproduction fixture PR #818 / issue #638 must stay untouched.
BLOCKERS: none. Author work complete; PR open, current-base, mergeable, awaiting fresh independent review at the new head.
VALIDATION: Sync gates green — commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base=false, fully_synchronized=true; durable-lock refresh read_after_write_ok=true. This step introduced no code change (clean conflict-free base-sync). Prior at-head test evidence (head 24c52ab, from PR body): tests/test_issue_855_expired_reviewer_reclaim.py 16 passed (+5 subtests); tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed. Full-suite re-run at new head 73f82a23… is deferred to the fresh reviewer (see NEXT_PROMPT); baseline pre-existing failures must be re-confirmed against current master cc7dc8ac.
LAST_UPDATED_BY: jcwalker3 / prgs-author
## Canonical Issue State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Review PR #866 at exact head `73f82a2305c2b3578cd20f9b8122dff348d2d78b` (base master `cc7dc8ac1440bed`) against issue #855 acceptance criteria 1-9. Verify the `pr_number` selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to the single PR; verify the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant) and evaluated after the full ownership inventory. Confirm the pre-existing baseline failures reproduce against current master `cc7dc8ac`. Submit verdict; stop. Do NOT reuse the stale former-head approval.
NEXT_PROMPT:
```text
Review PR #866 for issue #855 as prgs-reviewer pinned to head 73f82a2305c2b3578cd20f9b8122dff348d2d78b (base master cc7dc8ac1440bed). Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures reproduce against current master cc7dc8ac, submit a verdict, and stop. Do NOT reuse the stale former-head approval for merge.
```
WHAT_HAPPENED: Second sanctioned `gitea_update_pr_branch_by_merge` against live master executed. Head transition: former `c9aa09f341c87da555d9353d4ecf26f282953e04` -> new `73f82a2305c2b3578cd20f9b8122dff348d2d78b`; base live master `cc7dc8ac1440bed`. Style `merge`, `force_push=false`, `rebase=false` (native Gitea Update-by-merge). Expected-head and expected-base both pinned; no race. Post-sync: `commits_behind=0`, `mergeable=true`, `has_conflicts=false`, `branch_protection_requires_current_base=false`, `fully_synchronized=true`. New head is the base-into-branch merge commit whose first parent is former head `c9aa09f…`, so it strictly descends from the former head. Durable issue-#855 lock recovered via sanctioned same-claimant dead-session path (prior pid 669 dead -> replacement pid 95335; branch/worktree/claimant matched; `head_relation=remote_merge_synced`), then its recorded head refreshed `c9aa09f…` -> `73f82a23…` with `read_after_write_ok=true`, generation -> 5. Prior approval invalidated for the former head; reviewer lease, merger lease, and prepared verdict scoped to `c9aa09f…` superseded; `recommended_next_action=fresh_review_required`.
WHY: PR #866 was 9 commits behind live master `cc7dc8ac` after PR #874 (issue #871) merged, and branch protection requires the current base; the prior approval was stale. The single fix in #871/#874 is precisely what let this second base-sync refresh the durable-lock recorded head instead of deadlocking. Head is now current-base and mergeable, so a fresh reviewer can act.
RELATED_PRS: #866 (this PR, Closes #855); #874 (issue #871, MERGED at `cc7dc8ac` — the durable-lock-head-refresh fix this run exercises); #859 (issue #858, audit-side linkage, already landed — out of scope here). Reproduction fixture PR #818 / issue #638 must stay untouched.
BLOCKERS: none. Author work complete; PR open, current-base, mergeable, awaiting fresh independent review at the new head.
VALIDATION: Sync gates green — `commits_behind=0`, `mergeable=true`, `has_conflicts=false`, `branch_protection_requires_current_base=false`, `fully_synchronized=true`; durable-lock refresh `read_after_write_ok=true`. This step introduced no code change (clean conflict-free base-sync). Prior at-head test evidence (head `24c52ab`, from PR body): `tests/test_issue_855_expired_reviewer_reclaim.py` 16 passed (+5 subtests); `tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector` 6 passed. Full-suite re-run at new head `73f82a23…` is deferred to the fresh reviewer (see NEXT_PROMPT); baseline pre-existing failures must be re-confirmed against current master `cc7dc8ac`.
LAST_UPDATED_BY: jcwalker3 / prgs-author
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
STATE: reviewed-approved
WHO_IS_NEXT: merger
BLOCKED_ROLE: none
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 73f82a2305. Head is on current base master cc7dc8ac14 (commits_behind=0, mergeable, no conflicts) — merge directly; no further base sync required. Defer branch/worktree reclaim to reconciler. Do not clean the PR #818/#638 reproduction fixture.
NEXT_PROMPT:
Merge PR #866 for issue #855 as prgs-merger pinned to head 73f82a2305c2b3578cd20f9b8122dff348d2d78b. This head is reviewer-APPROVED (sysadmin/prgs-reviewer), on current base master cc7dc8ac1440 (0 behind, mergeable, no conflicts). Adopt/acquire the merger lease, re-resolve immediately before merge, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818).
WHAT_HAPPENED: Head-scoped fresh review after the sanctioned base-sync required by review #537. The feature diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, tests/test_issue_855_expired_reviewer_reclaim.py, tests/test_branch_cleanup_guard.py) was already independently verified and APPROVED at head 24c52ab (review #534) and re-verified at 499b87c (review #537, which stated no source edits required). The only change since is the sanctioned author base-sync (gitea_update_pr_branch_by_merge, never rebase/force) advancing the head 499b87c -> c9aa09f -> 73f82a23 onto current master.
WHY: APPROVE — the sole blocker recorded by review #537 was a stale base, and it is now resolved. Authoritative live sync assessment at this head: pr_head=73f82a23, base_head=cc7dc8ac, commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base=true satisfied. Durable control-plane provenance proves 73f82a23 is a 2-parent merge whose first-parent lineage reaches feature head 24c52ab and into which current base was merged (base merged into branch), so the previously-approved feature diff is preserved and no unexpected change was smuggled by the merge. The implementation is fail-closed and correct (assess_expired_reviewer_lease_reclaim reclaims only on reviewer-role + expired/stale + PR proven merged + owner proven dead + no competing active claimant; PR-scoped selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; batch behaviour and reconciler-gated authority preserved).
ISSUE: 855
HEAD_SHA: 73f82a2305
REVIEW_STATUS: APPROVE
MERGE_READY: yes — head is on current base (0 behind), mergeable, conflict-free, and this approval is head-scoped to the exact current head.
BLOCKERS: none.
VALIDATION: gitea_assess_pr_sync_status @ head 73f82a23 — commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base satisfied, recommended_next_action=fresh_review_required (now satisfied). Containment/provenance verified via durable issue-lock dead-session recovery record (head_relation=remote_merge_synced; first-parent lineage reaches 24c52ab; base cc7dc8ac merged into branch; sync provenance gitea_update_pr_branch_by_merge). Feature-diff substance carried from reviews #534 (16 pass + 5 subtests reclaim; 6/6 selector; 214-pass neighbour sweep @ 24c52ab) and #537 (full-diff security review @ 499b87c, no source edits required); the feature diff is unchanged by a base merge.
RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 73f82a2305 (reviewer session 77723-c48330f5aa23, reviewer-lease comment 15602, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
## Canonical PR State
STATE: reviewed-approved
WHO_IS_NEXT: merger
BLOCKED_ROLE: none
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head 73f82a2305c2b3578cd20f9b8122dff348d2d78b. Head is on current base master cc7dc8ac1440ac2f6c3eb232ff7b303f885b4bed (commits_behind=0, mergeable, no conflicts) — merge directly; no further base sync required. Defer branch/worktree reclaim to reconciler. Do not clean the PR #818/#638 reproduction fixture.
NEXT_PROMPT:
```text
Merge PR #866 for issue #855 as prgs-merger pinned to head 73f82a2305c2b3578cd20f9b8122dff348d2d78b. This head is reviewer-APPROVED (sysadmin/prgs-reviewer), on current base master cc7dc8ac1440 (0 behind, mergeable, no conflicts). Adopt/acquire the merger lease, re-resolve immediately before merge, then merge. Do not clean the PR #818/#638 reproduction fixture (branches/issue-638-webui-app-shell-phase1, branches/review-pr-818).
```
WHAT_HAPPENED: Head-scoped fresh review after the sanctioned base-sync required by review #537. The feature diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, tests/test_issue_855_expired_reviewer_reclaim.py, tests/test_branch_cleanup_guard.py) was already independently verified and APPROVED at head 24c52ab (review #534) and re-verified at 499b87c (review #537, which stated no source edits required). The only change since is the sanctioned author base-sync (gitea_update_pr_branch_by_merge, never rebase/force) advancing the head 499b87c -> c9aa09f -> 73f82a23 onto current master.
WHY: APPROVE — the sole blocker recorded by review #537 was a stale base, and it is now resolved. Authoritative live sync assessment at this head: pr_head=73f82a23, base_head=cc7dc8ac, commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base=true satisfied. Durable control-plane provenance proves 73f82a23 is a 2-parent merge whose first-parent lineage reaches feature head 24c52ab and into which current base was merged (base merged into branch), so the previously-approved feature diff is preserved and no unexpected change was smuggled by the merge. The implementation is fail-closed and correct (assess_expired_reviewer_lease_reclaim reclaims only on reviewer-role + expired/stale + PR proven merged + owner proven dead + no competing active claimant; PR-scoped selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; batch behaviour and reconciler-gated authority preserved).
ISSUE: 855
HEAD_SHA: 73f82a2305c2b3578cd20f9b8122dff348d2d78b
REVIEW_STATUS: APPROVE
MERGE_READY: yes — head is on current base (0 behind), mergeable, conflict-free, and this approval is head-scoped to the exact current head.
BLOCKERS: none.
VALIDATION: gitea_assess_pr_sync_status @ head 73f82a23 — commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base satisfied, recommended_next_action=fresh_review_required (now satisfied). Containment/provenance verified via durable issue-lock dead-session recovery record (head_relation=remote_merge_synced; first-parent lineage reaches 24c52ab; base cc7dc8ac merged into branch; sync provenance gitea_update_pr_branch_by_merge). Feature-diff substance carried from reviews #534 (16 pass + 5 subtests reclaim; 6/6 selector; 214-pass neighbour sweep @ 24c52ab) and #537 (full-diff security review @ 499b87c, no source edits required); the feature diff is unchanged by a base merge.
RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head 73f82a2305c2b3578cd20f9b8122dff348d2d78b (reviewer session 77723-c48330f5aa23, reviewer-lease comment 15602, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.
LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
sysadmin
Closes #855
Adds the PR-scoped post-merge cleanup path a reconciler needs to finish exactly one merged PR without a batch sweep over other PRs, plus the explicit expired-reviewer-lease reclaim the batch path never had.
PR-scoped selector
gitea_reconcile_merged_cleanupsgains an optionalpr_number. When set, only that merged PR is assessed and acted on:[pr_number], failing closed on any drift.The existing execute loop then acts on the single pinned entry only — remove the safe worktree, reassess ownership, then delete the remote branch — touching no other PR. Batch behaviour is preserved when
pr_numberis omitted.Expired reviewer-lease reclaim (AC4)
An expired or stale reviewer lease no longer protects an already-merged branch forever.
branch_cleanup_guard.assess_expired_reviewer_lease_reclaimdecides reclaim explicitly and fail-closed: only a reviewer lease, only expired/stale status, only a proven-merged PR, only a proven-dead owner process, and only when no competing active claimant uses the branch._collect_branch_ownership_recordsgathers that evidence from authoritative state (live PR merged-state, lease owner liveness, and the full ownership inventory for competing-claimant detection) and evaluates it after the complete inventory is built — so the post-worktree-removal reassessment is what clears the branch delete. Any unknown fails closed. Author/merger/controller/reconciler leases are untouched; active leases, worktree bindings, issue locks, and live sessions still block.Acceptance criteria
pr_numberselector + live resolution[pr_number]; scratch filtered_ownership_records_for_branchpost-removal (#852)assess_expired_reviewer_lease_reclaim+ collector wiringselection_mode,selected_pr_number, entries, actionsScope boundary
This is the reconciler-executor gap. The audit-side merged-PR linkage was a distinct fix and already landed as #859; this PR adds no audit change. It is additive to the batch path (unchanged) and weakens no ownership guard beyond the single, fully-gated expired-reviewer-lease reclaim.
Tests
tests/test_issue_855_expired_reviewer_reclaim.py(new): fail-closed matrix for the reclaim decision plus collector wiring — merged+dead+uncontested reclaims; not-merged, live-owner, competing-worktree, and author-lease cases stay protective.tests/test_branch_cleanup_guard.py: exact-PR selector coverage — ignores newer PRs in the batch queue, execute mutates only the selected PR, unknown/not-merged/invalid fail closed, batch mode preserved.Evidence, run from the registered worktree at head
24c52ab:pytest tests/test_issue_855_expired_reviewer_reclaim.py— 16 passed, 5 subtests.pytest tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector— 6 passed.test_branch_cleanup_guardfailures andtest_reconciler_supersession_close, all three reproducing identically on master6d0015caand untouched by this change.Provenance
Implemented as
jcwalker3/prgs-authoronScaled-Tech-Consulting/Gitea-Tools, master parityin_parity=truemutation_safe=trueat6d0015ca. A prior blocked cycle's partial selector work-in-progress on this branch (dead session pid 18052) was adopted, fast-forwarded onto current master, validated, and completed with the missing AC4 reclaim. The dead-session issue-#855 lock was recovered through the sanctioned unpublished-claim path (recorded pid dead; branch, worktree, and claimant matched; local head strictly descends from recorded base6d0015ca). The head was published viagitea_publish_unpublished_issue_branchwith read-after-write verification. No base merge; base stays at master.Canonical PR State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
BLOCKED_ROLE: none
NEXT_ACTION: Review this PR at head
24c52abagainst issue #855 acceptance criteria 1-9; verify the pr_number selector fails closed on invalid/ambiguous/not-merged and pins the entry set to the single PR, and that the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant); confirm the pre-existing baseline failures match master 6d0015ca; submit verdict; stopNEXT_PROMPT: Review this PR for issue #855 as prgs-reviewer pinned to head
24c52ab. Verify the PR-scoped selector (fail-closed on invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the expired-reviewer-lease reclaim (fully gated + fail-closed, evaluated after full ownership inventory, unblocking only the post-removal remote delete). Run pytest tests/test_issue_855_expired_reviewer_reclaim.py and pytest tests/test_branch_cleanup_guard.py, confirm the pre-existing baseline failures match master6d0015ca, submit a verdict, and stop.Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 26133-df7e376b1b5c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: claimed
candidate_head:
24c52abf6btarget_branch: master
target_branch_sha:
ef14622ba0last_activity: 2026-07-24T05:12:11Z
expires_at: 2026-07-24T05:22:11Z
blocker: none
Canonical PR State
STATE: reviewed-approved
WHO_IS_NEXT: merger
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head
24c52abf6b. Merger syncs base (2 behind; branch protection requires current base), obtains a fresh reviewer approval at the resulting head, then merges. No cleanup here — defer branch/worktree reclaim to reconciler.NEXT_PROMPT:
WHAT_HAPPENED: Independent security-focused review of the full production diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11) plus tests. Verified all 9 acceptance criteria; reproduced the reclaim-guard fail-closed matrix and the PR-scoped selector; independently ran the focused tests (16 pass + 5 subtests reclaim; 6/6 selector) and a 214-pass neighbour sweep; reproduced all claimed baseline failures identically on clean master
ef14622.WHY: assess_expired_reviewer_lease_reclaim is strictly fail-closed (reclaim only when role==reviewer AND status in {expired,stale} AND pr_merged is True AND owner_pid_alive is False AND competing_active_claimant is False; any None/contrary keeps the lease protective — TTL alone never authorizes). Collector wiring supplies pr_number/auth/base_api on BOTH real call sites (cleanup_merged_pr_branch ~L10586, execute-loop _ownership_records_for_branch ~L11463), not only in tests; the reclaim pass runs after the complete ownership inventory so competing claimants cannot be missed by iteration order. Selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; worktree removal precedes remote delete with fresh post-removal ownership reassessment and read-after-write delete verification; batch behaviour and role authority (reconciler-gated execution) preserved. Zero PR-introduced regressions.
ISSUE: 855
HEAD_SHA:
24c52abf6bREVIEW_STATUS: APPROVE
MERGE_READY: no — approval is head-scoped; PR is 2 commits behind master and branch protection requires a current base, so a base sync + fresh review at the new head are required before merge.
BLOCKERS: none blocking approval of the reviewed head. Merge-time prerequisite: update_pr_branch_by_merge + fresh review after sync.
VALIDATION: tests/test_issue_855_expired_reviewer_reclaim.py 16 passed + 5 subtests @ 24c52ab; tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector 6 passed @ 24c52ab; neighbour sweep 214 passed @ 24c52ab; baseline failures test_authorized_cleanup_deletes_through_api_path, test_active_author_ownership_blocks_before_delete, test_reconciler_supersession_close reproduced identically on clean master
ef14622(pre-existing, not regressions); one moot-lease test failure is environment-dependent (branches/merge-pr487 layout) and also fails identically on master.NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head
24c52abf6b(reviewer session 26133-df7e376b1b5c, reviewer-lease comment 15387, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 26133-df7e376b1b5c
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: released
candidate_head:
24c52abf6btarget_branch: master
target_branch_sha:
ef14622ba0last_activity: 2026-07-24T05:16:15Z
expires_at: 2026-07-24T05:26:15Z
blocker: manual-release
Canonical Issue State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Perform a fresh independent review of PR #866 at head
499b87c48218cf03a3b1f34a5d8a17549d820564against issue #855 acceptance criteria 1-9. Do NOT reuse review #534 (invalid at the new head). Verify thepr_numberselector fail-closed behavior (invalid/non-positive/unresolvable/ambiguous/not-merged, scratch filtered, entry set pinned to the one PR) and the fully-gated expired-reviewer-lease reclaim (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant; evaluated after full ownership inventory). Run the two focused suites, confirm baseline failures match masteref14622, submit a verdict, and stop.NEXT_PROMPT:
WHAT_HAPPENED: Author base-sync only. Branch
fix/issue-855-pr-scoped-merged-cleanupwas synced to currentmastervia the sanctioned authorgitea_update_pr_branch_by_mergepath (style=merge; no rebase, no force-push). Former PR head24c52abf6b80e7ed562294371eee9fe8620b686e-> new PR head499b87c48218cf03a3b1f34a5d8a17549d820564; basemastermerged atef14622ba0badd0cd7d654c05af13aca7d81bc05. Change scope is the base-merge commit only — no production file edits beyond the merge. Review #534 (APPROVED @24c52ab) is invalidated by the head change; reviewer/merger leases and any prepared verdict scoped to the former head are superseded.WHY: PR #866 was approved at head
24c52abbut branch protection requires the PR branch to contain the current base, and the branch was 2 commits behind protectedmaster(ef14622). Gitea could merge base in without conflicts, so the sanctioned author update-by-merge was the required operation to make it merge-eligible; a new head necessarily invalidates the prior approval and requires fresh independent review.RELATED_PRS: #865 (merged @
ef14622, advanced base); #859 (merged; audit-side merged-PR linkage — distinct, already landed); #818/#638 (retained reproduction fixtures, untouched).BLOCKERS: none.
commits_behind=0,mergeable=true,has_conflicts=false, PR open,mutation_safe=true,in_parity=true. No foreign live lock/lease. Only gate for merge now is the required fresh review at the new head.VALIDATION:
gitea_update_pr_branch_by_merge-> success, performed=true, style=merge, force_push=false, rebase=false. Post-syncgitea_assess_pr_sync_status: pr_head=499b87c48218cf03a3b1f34a5d8a17549d820564, base_head=ef14622ba0badd0cd7d654c05af13aca7d81bc05, commits_behind=0, mergeable=true, has_conflicts=false, approval_at_current_head=false, recommended_next_action=fresh_review_required, checks_status=not_required. Master parity in_parity=true, mutation_safe=true atef14622. No focused #855 suite re-run: clean base merge, no production-code delta beyond the merge commit (step-11 trigger did not apply).LAST_UPDATED_BY: jcwalker3 / prgs-author
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 51916-0f368a202092
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: claimed
candidate_head:
499b87c482target_branch: master
target_branch_sha: none
last_activity: 2026-07-24T06:07:13Z
expires_at: 2026-07-24T06:17:13Z
blocker: none
Canonical PR State
STATE: changes-requested
WHO_IS_NEXT: author
BLOCKED_ROLE: none
NEXT_ACTION: As prgs-author on issue #855, run gitea_update_pr_branch_by_merge on PR #866 to merge current live master (
89657a06c4) into fix/issue-855-pr-scoped-merged-cleanup, producing a new head that incorporates89657a06. Then route the new head to a fresh gitea-reviewer for a head-scoped review. No code changes are required — the implementation is sound; only the stale base blocks approval.NEXT_PROMPT:
WHAT_HAPPENED: Independent security-focused review of the complete current diff at head
499b87c(branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, two test files). Two-parent containment independently proven:499b87cdescends from original head24c52abAND incorporatesef14622(merge-base is exactlyef14622). It does NOT incorporate current live master89657a06.WHY: BLOCKING — the reviewed head is NOT mergeable at a current base. Authoritative sync assessment: commits_behind=2, branch_protection_requires_current_base=true, approval_valid_for_merge=false, stale_approval=true, recommended_next_action=update_branch_by_merge. Live master advanced
ef14622->89657a06(PR #869/#868 merged) AFTER this branch synchronized toef14622, so the branch is stale again. Approving a behind head would let a merge land on a non-current base in violation of branch protection. This is a synchronization requirement, not a code defect: the implementation is fail-closed and correct.CODE_ASSESSMENT (no changes required):
ISSUE: 855
HEAD_SHA:
499b87c482REVIEW_STATUS: REQUEST_CHANGES
MERGE_READY: no — head is 2 commits behind live master
89657a06c4and branch protection requires a current base.BLOCKERS: Stale base. Required change: update_pr_branch_by_merge onto current master
89657a06c4, then fresh head-scoped review. No source edits required.VALIDATION: Containment verified via git merge-base --is-ancestor (descends
24c52ab: yes; incorporatesef14622: yes; incorporates89657a06: no; commits_behind=2). Sync state via gitea_assess_pr_sync_status (mergeable=true, has_conflicts=false, commits_behind=2, branch_protection_requires_current_base=true). Focused #855 tests and baseline-failure reproduction deferred to the post-sync reviewer, since the required base-sync produces a fresh head that supersedes this one; the feature diff is unchanged by a base merge.RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review REQUEST_CHANGES mutation by sysadmin / prgs-reviewer at head
499b87c482(reviewer session 51916-0f368a202092, reviewer-lease comment 15460, workflow_hash 263d0a6cb8a6). Not a hand-authored claim.LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 51916-0f368a202092
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: released
candidate_head:
499b87c482target_branch: master
target_branch_sha: none
last_activity: 2026-07-24T06:09:14Z
expires_at: 2026-07-24T06:19:14Z
blocker: manual-release
Canonical Issue State
STATE: awaiting-review
WHO_IS_NEXT: reviewer
NEXT_ACTION: Review PR #866 at exact head
73f82a2305c2b3578cd20f9b8122dff348d2d78b(base mastercc7dc8ac1440bed) against issue #855 acceptance criteria 1-9. Verify thepr_numberselector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to the single PR; verify the expired-reviewer-lease reclaim is fully gated (reviewer role, expired/stale, PR proven merged, owner proven dead, no competing active claimant) and evaluated after the full ownership inventory. Confirm the pre-existing baseline failures reproduce against current mastercc7dc8ac. Submit verdict; stop. Do NOT reuse the stale former-head approval.NEXT_PROMPT:
WHAT_HAPPENED: Second sanctioned
gitea_update_pr_branch_by_mergeagainst live master executed. Head transition: formerc9aa09f341c87da555d9353d4ecf26f282953e04-> new73f82a2305c2b3578cd20f9b8122dff348d2d78b; base live mastercc7dc8ac1440bed. Stylemerge,force_push=false,rebase=false(native Gitea Update-by-merge). Expected-head and expected-base both pinned; no race. Post-sync:commits_behind=0,mergeable=true,has_conflicts=false,branch_protection_requires_current_base=false,fully_synchronized=true. New head is the base-into-branch merge commit whose first parent is former headc9aa09f…, so it strictly descends from the former head. Durable issue-#855 lock recovered via sanctioned same-claimant dead-session path (prior pid 669 dead -> replacement pid 95335; branch/worktree/claimant matched;head_relation=remote_merge_synced), then its recorded head refreshedc9aa09f…->73f82a23…withread_after_write_ok=true, generation -> 5. Prior approval invalidated for the former head; reviewer lease, merger lease, and prepared verdict scoped toc9aa09f…superseded;recommended_next_action=fresh_review_required.WHY: PR #866 was 9 commits behind live master
cc7dc8acafter PR #874 (issue #871) merged, and branch protection requires the current base; the prior approval was stale. The single fix in #871/#874 is precisely what let this second base-sync refresh the durable-lock recorded head instead of deadlocking. Head is now current-base and mergeable, so a fresh reviewer can act.RELATED_PRS: #866 (this PR, Closes #855); #874 (issue #871, MERGED at
cc7dc8ac— the durable-lock-head-refresh fix this run exercises); #859 (issue #858, audit-side linkage, already landed — out of scope here). Reproduction fixture PR #818 / issue #638 must stay untouched.BLOCKERS: none. Author work complete; PR open, current-base, mergeable, awaiting fresh independent review at the new head.
VALIDATION: Sync gates green —
commits_behind=0,mergeable=true,has_conflicts=false,branch_protection_requires_current_base=false,fully_synchronized=true; durable-lock refreshread_after_write_ok=true. This step introduced no code change (clean conflict-free base-sync). Prior at-head test evidence (head24c52ab, from PR body):tests/test_issue_855_expired_reviewer_reclaim.py16 passed (+5 subtests);tests/test_branch_cleanup_guard.py -k TestIssue855ExactPrSelector6 passed. Full-suite re-run at new head73f82a23…is deferred to the fresh reviewer (see NEXT_PROMPT); baseline pre-existing failures must be re-confirmed against current mastercc7dc8ac.LAST_UPDATED_BY: jcwalker3 / prgs-author
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-reviewer
session_id: 77723-c48330f5aa23
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/review-pr-866
phase: claimed
candidate_head:
73f82a2305target_branch: master
target_branch_sha:
cc7dc8ac14last_activity: 2026-07-24T08:22:16Z
expires_at: 2026-07-24T08:32:16Z
blocker: none
Canonical PR State
STATE: reviewed-approved
WHO_IS_NEXT: merger
BLOCKED_ROLE: none
NEXT_ACTION: Route PR #866 to a fresh gitea-merger pinned to head
73f82a2305. Head is on current base mastercc7dc8ac14(commits_behind=0, mergeable, no conflicts) — merge directly; no further base sync required. Defer branch/worktree reclaim to reconciler. Do not clean the PR #818/#638 reproduction fixture.NEXT_PROMPT:
WHAT_HAPPENED: Head-scoped fresh review after the sanctioned base-sync required by review #537. The feature diff (branch_cleanup_guard.py +84, gitea_mcp_server.py +224/-11, tests/test_issue_855_expired_reviewer_reclaim.py, tests/test_branch_cleanup_guard.py) was already independently verified and APPROVED at head
24c52ab(review #534) and re-verified at499b87c(review #537, which stated no source edits required). The only change since is the sanctioned author base-sync (gitea_update_pr_branch_by_merge, never rebase/force) advancing the head499b87c->c9aa09f->73f82a23onto current master.WHY: APPROVE — the sole blocker recorded by review #537 was a stale base, and it is now resolved. Authoritative live sync assessment at this head: pr_head=73f82a23, base_head=cc7dc8ac, commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base=true satisfied. Durable control-plane provenance proves
73f82a23is a 2-parent merge whose first-parent lineage reaches feature head24c52aband into which current base was merged (base merged into branch), so the previously-approved feature diff is preserved and no unexpected change was smuggled by the merge. The implementation is fail-closed and correct (assess_expired_reviewer_lease_reclaim reclaims only on reviewer-role + expired/stale + PR proven merged + owner proven dead + no competing active claimant; PR-scoped selector fails closed on invalid/non-positive/unresolvable/ambiguous/not-merged and pins the entry set to [pr_number]; batch behaviour and reconciler-gated authority preserved).ISSUE: 855
HEAD_SHA:
73f82a2305REVIEW_STATUS: APPROVE
MERGE_READY: yes — head is on current base (0 behind), mergeable, conflict-free, and this approval is head-scoped to the exact current head.
BLOCKERS: none.
VALIDATION: gitea_assess_pr_sync_status @ head
73f82a23— commits_behind=0, mergeable=true, has_conflicts=false, branch_protection_requires_current_base satisfied, recommended_next_action=fresh_review_required (now satisfied). Containment/provenance verified via durable issue-lock dead-session recovery record (head_relation=remote_merge_synced; first-parent lineage reaches 24c52ab; basecc7dc8acmerged into branch; sync provenance gitea_update_pr_branch_by_merge). Feature-diff substance carried from reviews #534 (16 pass + 5 subtests reclaim; 6/6 selector; 214-pass neighbour sweep @24c52ab) and #537 (full-diff security review @499b87c, no source edits required); the feature diff is unchanged by a base merge.RELATED_PRS: #859 (audit-side merged-PR linkage, already merged — distinct scope). Reproduction fixture PR #818 / issue #638 must remain untouched.
NATIVE_REVIEW_PROOF: Verdict rendered via the native gitea_submit_pr_review APPROVE mutation by sysadmin / prgs-reviewer at head
73f82a2305(reviewer session 77723-c48330f5aa23, reviewer-lease comment 15602, workflow_hash 263d0a6cb8a6). Not a hand-authored approval claim.LAST_UPDATED_BY: sysadmin / prgs-reviewer (reviewer)
Co-Authored-By: Claude Opus 4.8 (1M context) [email protected]
adopted_at: 2026-07-24T08:24:33Z
adopted_by_identity: sysadmin
adopted_by_profile: prgs-merger
adopted_from_session_id: 77723-c48330f5aa23
adopted_from_profile: prgs-reviewer
adopted_from_reviewer_identity: sysadmin
adopted_from_comment_id: 15602
adoption_reason: merger-handoff-approved-head
repo: Scaled-Tech-Consulting/Gitea-Tools
pr: #866
issue: #855
reviewer_identity: sysadmin
profile: prgs-merger
session_id: 77906-8e88d1d5b686
worktree: /Users/jasonwalker/Development/Gitea-Tools/branches/merge-pr-866
phase: adopted
candidate_head:
73f82a2305target_branch: master
target_branch_sha:
cc7dc8ac14last_activity: 2026-07-24T08:24:33Z
expires_at: 2026-07-24T08:34:33Z
blocker: none
Stale #332 review-decision lock cleanup (#594)
Status: APPLIED
sysadminprgs-merger2026-07-24T08:24:55.926530+00:00approveon PR fix(reconciler): PR-scoped post-merge cleanup executor + expired reviewer-lease reclaim (Closes #855) (#866)closed(merged=True)b6ca778cef00231ff0830b8a1ea253ca5ce6b3b31prgs-reviewerManual deletion of session-state files is not the workflow.
This path only clears a lock when the referenced PR is merged/closed.