@feigi/fleet-ctl 3.23.6 → 3.23.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.6",
+  "version": "3.23.8",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/cell-readout.mjs

@@ -43,7 +43,9 @@
 // `fleet-implementer-<cell>` definition was most recently added, ruled by its
 // last tier-outcomes.tsv row (a `+`-joined `ticket` field rules each ticket
 // it names); a ticket counts once however many Pulls it took. A verdict FAILS
-// the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`.
+// the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`; a
+// counted ruling holding anything but `yes` or `no` in either column, blank
+// included, is refused rather than read as a pass.
 // X is to be withdrawn once it has at least STOP.verdicts verdicts and
 // floor failures ÷ verdicts is at least STOP.failRate.
 //
@@ -56,6 +58,7 @@ import { isCLI } from "./is-cli.mjs";
 import { CELL, POLICY_CELL } from "./ledger-grammar.mjs";
 import { parseTsv as parseMemberTsv } from "./member-outcomes.mjs";
 import { parseFeatures } from "./pr-cost.mjs";
+import { VERDICT, VERDICT_COLUMNS } from "./tier-outcomes.mjs";
 
 const NAME = "cell-readout";
 export const GATE = Object.freeze({ comparisons: 10, runDates: 5 });
@@ -122,6 +125,8 @@ export function readout({ features, members }) {
  * `[{ ticket, pr, run_date, closed_own_ticket, minted_false_claim, failed }]`
  * sorted by ticket, `run_date` the ruling's; `stop` is whether the stopping
  * rule withdraws the cell. `verdicts` are parsed tier-outcomes.tsv rows.
+ * Throws on a counted ruling whose `closed_own_ticket` or `minted_false_claim`
+ * is not `yes` or `no`.
  */
 export function stoppingRule({ features, members, verdicts, added }) {
   const byKey = new Map(members.map((m) => [key(m.session, m.agent), m]));
@@ -132,6 +137,9 @@ export function stoppingRule({ features, members, verdicts, added }) {
     const tickets = judged.get(p.chosen_cell);
     if (!tickets || p.run_date < added[p.chosen_cell] || !ruling.has(p.ticket) || !admissibleMember(p, byKey)) continue;
     const v = ruling.get(p.ticket);
+    for (const c of VERDICT_COLUMNS) {
+      if (!VERDICT.includes(v[c])) throw new Error(`ticket #${p.ticket} (PR #${v.pr}): ${c} is '${v[c]}', expected yes or no`);
+    }
     const failed = v.minted_false_claim === "yes" || v.closed_own_ticket === "no";
     tickets.set(p.ticket, {
       ticket: p.ticket, pr: v.pr, run_date: v.run_date,

package/scripts/cell-readout.test.mjs

@@ -441,3 +441,31 @@ test("stopping rule: a ticket counts once, judged by its last tier-outcomes row,
   assert.equal(at.verdicts.find((v) => v.ticket === second.ticket).failed, true);
   assert.equal(at.stop, true);
 });
+
+// A verdict that is neither `yes` nor `no` matches neither floor half, so read
+// as a pass it would lower the failure rate and keep the cell alive unreported.
+test("stopping rule: a counted ruling whose closed_own_ticket or minted_false_claim is not exactly yes or no is refused, naming the ticket", () => {
+  for (const [col, value] of [["closed_own_ticket", "No"], ["minted_false_claim", "YES"], ["closed_own_ticket", ""], ["minted_false_claim", ""], ["closed_own_ticket", "yes "]]) {
+    const w = world();
+    addVerdicts(w, "smol-high", 10, 0);
+    const bad = w.verdicts[3];
+    bad[col] = value;
+    assert.throws(() => judged(w, { "smol-high": "2026-09-01" }, "smol-high"),
+      new RegExp(`ticket #${bad.ticket} \\(PR #${bad.pr}\\): ${col} is '${value}', expected yes or no`), `${col}=${JSON.stringify(value)}`);
+  }
+});
+
+// What the refusal must ACCEPT: a malformed ruling on a ticket the rule does not
+// count, and every yes/no combination on one it does.
+test("stopping rule: a malformed ruling on a ticket with no counted Pull is not read, and all four yes/no pairs are", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 4, 0);
+  [["yes", "no"], ["yes", "yes"], ["no", "no"], ["no", "yes"]].forEach(([closed, minted], i) => {
+    Object.assign(w.verdicts[i], { closed_own_ticket: closed, minted_false_claim: minted });
+  });
+  w.verdicts.push(verdict({ ticket: "1381", pr: "1392", closed_own_ticket: "", minted_false_claim: "" }));
+  w.verdicts.push(verdict({ ticket: "7", pr: "8", closed_own_ticket: "No", minted_false_claim: "YES" }));
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.equal(at.verdicts.length, 4);
+  assert.deepEqual(at.verdicts.map((v) => v.failed), [false, true, true, true]);
+});

package/scripts/reaping-reap-authorizers-prose.test.mjs

@@ -0,0 +1,112 @@
+// reaping.md's reap section said reap.sh's `git update-ref -d` is
+// "authorized by that cherry check and only by it". The script halts the
+// delete on a second thing too: a fresh worktree check (`wt_holding`) over a
+// listing re-read right before it, which keeps a `[gone]` branch the cherry
+// check cleared whenever a worktree holds it or cannot be resolved. A sentence
+// naming the cherry check as the only authorizer is false as written.
+//
+// The reap-side twin of reaping-release-authorizers-prose.test.mjs, which pins
+// the release section's authorizer list. Kept apart so each section's pin can
+// be edited independently.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { between, bullet, phrase, unemphasized } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..");
+const REAPING = readFileSync(
+  join(REPO, "skills", "run-team", "references", "reaping.md"),
+  "utf8",
+);
+const SCRIPT = readFileSync(join(REPO, "scripts", "reap.sh"), "utf8");
+
+const reapSection = () =>
+  between(
+    REAPING,
+    "## Why the reap is shaped the way it is",
+    "## Why a second sweep, over worktrees rather than branches",
+    "reaping.md",
+  );
+
+// The bullet that names the delete, bounded to its own list item: it ends at
+// the next list marker, so a sibling bullet (the holder-check bullet sits
+// right after it) cannot supply the words, and rewording that sibling does
+// not move the bound.
+const deleteBullet = () =>
+  bullet(
+    reapSection(),
+    "- **The delete is `git update-ref -d`'s compare-and-swap",
+    "\n- ",
+    "reaping.md's reap section",
+  );
+
+// The clause that lists the authorizers: from "authorized by" to the
+// sentence after the bold lead, which explains the compare-and-swap. Sliced
+// emphasis-tolerantly, and every assertion below reads it through
+// `unemphasized()`, so a `**` moved onto or into the clause stays green: the
+// slice only locates the clause, and `phrase()` is matched against raw text.
+const authorizers = () =>
+  between(
+    deleteBullet(),
+    "authorized by that cherry check",
+    "Tip read before the cherry",
+    "reaping.md's reap delete bullet",
+    { emphasisTolerant: true },
+  );
+
+test("reaping.md: the reap delete's authorizer clause names the fresh worktree-holds-branch check", () => {
+  // ONE contiguous span, not keywords: "fresh" and the negation each
+  // satisfied somewhere in the slice pass a clause with either one gutted
+  // ("a check that no worktree holds the branch" has no freshness; "a fresh
+  // check ... that a worktree holds the branch" has the opposite meaning).
+  // Only a span binds the two to each other.
+  assert.match(
+    unemphasized(authorizers()),
+    phrase("a fresh check, re-read immediately before the delete, that no worktree holds the branch"),
+    "reaping.md's reap section names what authorizes the `update-ref` delete but not the fresh worktree check — reap.sh keeps a branch the cherry check cleared whenever a worktree holds it",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause does not make any one check the only authorizer", () => {
+  // The exclusivity the defect carried, in the spellings of it a reword can
+  // restore after the new words: "only by it", "only by them", "nothing
+  // else", "solely", "alone". Pinned on its own because the presence pin
+  // above stays green with any of them restored. A word list, so a spelling
+  // outside it goes unseen; `\s+` keeps a reflow between its words green.
+  assert.doesNotMatch(
+    unemphasized(authorizers()),
+    /\bonly\s+by\b|\bnothing\s+else\b|\bsolely\b|\balone\b/,
+    "reaping.md's reap section says one check alone authorizes the `update-ref` delete — reap.sh's worktree check stops that delete too",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause still names the cherry check", () => {
+  // Input the new assertions must ACCEPT: naming the worktree check must not
+  // cost the clause the check it already had.
+  assert.match(unemphasized(deleteBullet()), phrase("authorized by that cherry check"));
+});
+
+// reap.sh's executable lines, comments and `echo` diagnostics dropped. The
+// check's name and the delete command both recur in comments: an indexOf over
+// the raw text lands on either and reads as the code, so a real delete moved
+// above the check, or the check commented out, stays green. Only whole-line
+// comments drop here, so each pattern below is anchored at the start of its
+// statement: a command spelled after a `#` inside a live line is not live.
+const liveLines = () => SCRIPT.split("\n").filter((l) => !/^\s*(?:#|echo\b)/.test(l));
+
+// The one live line matching `re`. Exactly one: a first-hit search would
+// bind the pin to whichever copy comes first.
+const liveLineOf = (re, what) => {
+  const hits = liveLines().flatMap((l, i) => (re.test(l) ? [i] : []));
+  assert.equal(hits.length, 1, `reap.sh: expected exactly one live line that ${what}, found ${hits.length}`);
+  return hits[0];
+};
+
+test("reap.sh: the worktree check the prose names sits before the delete", () => {
+  // The prose names a check the script runs; pin that the script still does,
+  // and runs it before the delete, so the prose cannot outlive the check.
+  const check = liveLineOf(/^\s*if\s+wt_holding\s+"refs\/heads\/\$b"/, "runs wt_holding on the branch");
+  const del = liveLineOf(/^\s*if\s+!\s+err=\$\(git\s+update-ref\s+--no-deref\s+-d\s+"refs\/heads\/\$b"\s+"\$tip"/, "runs `git update-ref -d` on the branch at its tip");
+  assert.ok(check < del, "reap.sh runs its worktree check after the delete, not before it");
+});

package/scripts/ticket-router.test.mjs

@@ -660,7 +660,7 @@ test("--check stays green when a verdict or member row lands after the fit, for
   const fitted = readFileSync(p.table, "utf8");
   assert.equal(JSON.parse(fitted).fitted_through, "2026-10-01");
   // The ruling lands later and flips the ticket to a failure, and a fix round books against it.
-  writeFileSync(p.verdicts, tsv(VERDICT_COLUMNS, [verdictRow({ pr: "11", ticket: "1" }), verdictRow({ run_date: "2026-10-09", pr: "11", ticket: "1", minted_false_claim: "yes" })], true));
+  writeFileSync(p.verdicts, `# ${tsv(VERDICT_COLUMNS, [verdictRow({ pr: "11", ticket: "1" }), verdictRow({ run_date: "2026-10-09", pr: "11", ticket: "1", minted_false_claim: "yes" })], true)}`);
   writeFileSync(p.members, tsv(MEMBER_COLUMNS, [...members, { run_date: "2026-10-09", agent: "fix-pr-11", member: "fix-pr-11", ticket: "1", pr: "11" }].map(memberRow), true));
   const r = cli(["--check", ...p.fitArgs]);
   assert.equal(r.status, 0, r.stderr);

package/scripts/tier-outcomes.mjs

@@ -63,7 +63,8 @@ const LEDGER_SCRIPT = join(SCRIPT_DIR, "ledger.mjs");
 
 // ---------------------------------------------------------------------------
 // pure core — exercised through the CLI by tier-outcomes.test.mjs; only
-// COLUMNS and TIER_SWITCH_DATE are imported directly, the rest through argv
+// COLUMNS, LEGACY_WIDTH and TIER_SWITCH_DATE are imported directly, the rest
+// through argv
 // ---------------------------------------------------------------------------
 
 // APPENDED TO, never inserted into: every awk read-out in the file's header
@@ -81,6 +82,11 @@ export const TIER_SWITCH_DATE = "2026-09-29";
 
 const DATE = /^\d{4}-\d{2}-\d{2}$/;
 const BASE_DEFINITION = "fleet-implementer";
+// The two quality-floor columns `append` writes. Every reader fails the floor
+// on exactly `minted_false_claim=yes` or `closed_own_ticket=no`, so any other
+// spelling would read as a pass.
+export const VERDICT = Object.freeze(["yes", "no"]);
+export const VERDICT_COLUMNS = Object.freeze(["closed_own_ticket", "minted_false_claim"]);
 
 // `fleet-implementer` -> `default`, `fleet-implementer-<x>` -> `<x>`, anything
 // else (a generic `task`, a blank pre-#1066 subagent_type) -> null.
@@ -94,6 +100,11 @@ export function shortName(definition) {
 // Data rows as objects keyed by COLUMNS, plus the raw `line`. A row of any
 // width but the legacy or the full one is refused: a tab typed into `note`
 // shifts every field after it, and a reader keyed by position cannot tell.
+// So is a verdict column holding anything but `yes`, `no` or blank — blank
+// because a row backfilled without a ruling leaves both empty, so a row with
+// exactly one of the two blank is refused too: it was never written whole, and
+// a blanked `closed_own_ticket=no` or `minted_false_claim=yes` would read as a
+// pass.
 export function parseTierOutcomes(text) {
   return String(text ?? "").split("\n")
     .filter((l) => l.trim() && !l.startsWith("#"))
@@ -104,6 +115,15 @@ export function parseTierOutcomes(text) {
       }
       const row = { line };
       COLUMNS.forEach((c, i) => { row[c] = cells[i] ?? ""; });
+      for (const c of VERDICT_COLUMNS) {
+        if (row[c] !== "" && !VERDICT.includes(row[c])) {
+          throw new Error(`malformed row: ${c} is '${row[c]}', expected yes, no or blank — ${line.slice(0, 60)}`);
+        }
+      }
+      const [first, second] = VERDICT_COLUMNS;
+      if ((row[first] === "") !== (row[second] === "")) {
+        throw new Error(`malformed row: ${first} is '${row[first]}' but ${second} is '${row[second]}', expected both blank or both yes or no — ${line.slice(0, 60)}`);
+      }
       return row;
     });
 }
@@ -388,8 +408,8 @@ function append(pr, paths) {
   for (const [col, value] of Object.entries(fields)) {
     if (/[\t\r\n]/.test(value)) die(`--${col.replaceAll("_", "-")} holds a tab or newline — it would shift every field after it`);
   }
-  for (const col of ["closed_own_ticket", "minted_false_claim"]) {
-    if (!["yes", "no"].includes(fields[col])) die(`--${col.replaceAll("_", "-")} must be yes or no, got '${fields[col]}'`);
+  for (const col of VERDICT_COLUMNS) {
+    if (!VERDICT.includes(fields[col])) die(`--${col.replaceAll("_", "-")} must be yes or no, got '${fields[col]}'`);
   }
   if (fields.sizing && !["light", "heavy"].includes(fields.sizing)) die(`--sizing must be light or heavy, got '${fields.sizing}'`);
   for (const col of ["loc", "files"]) {

package/scripts/tier-outcomes.test.mjs

@@ -10,7 +10,7 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { COLUMNS, TIER_SWITCH_DATE } from "./tier-outcomes.mjs";
+import { COLUMNS, LEGACY_WIDTH, TIER_SWITCH_DATE } from "./tier-outcomes.mjs";
 import { COLUMNS as MEMBER_COLUMNS } from "./member-outcomes.mjs";
 import { writeExecStub } from "./exec-stub.mjs";
 
@@ -29,8 +29,8 @@ function memberRow({ member, ticket, type, role = "implementer" }) {
   return MEMBER_COLUMNS.map((c) => r[c]).join("\t");
 }
 
-function tierRow({ date = TIER_SWITCH_DATE, pr, ticket, tier }) {
-  return [date, pr, ticket, "routine", tier, "yes", "no", "a note with spaces", "light", "production", "40", "2"].join("\t");
+function tierRow({ date = TIER_SWITCH_DATE, pr, ticket, tier, closed = "yes", minted = "no" }) {
+  return [date, pr, ticket, "routine", tier, closed, minted, "a note with spaces", "light", "production", "40", "2"].join("\t");
 }
 
 function ledgerText(rows = [], dispatched = []) {
@@ -275,6 +275,24 @@ test("append: --class is refused as an unknown flag before anything is written",
   assert.deepEqual(f.ghCalls(), [], "refused before gh was asked");
 });
 
+test("append: a verdict that is not exactly yes or no is refused naming the flag, before gh is asked or anything is written", (t) => {
+  for (const [flag, closed, minted] of [
+    ["closed-own-ticket", "YES", "no"],
+    ["closed-own-ticket", "yes ", "no"],
+    ["minted-false-claim", "yes", "No"],
+    ["minted-false-claim", "yes", "maybe"],
+  ]) {
+    const f = fixture(t, { members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }] });
+    const before = readFileSync(f.tier, "utf8");
+    const r = f.run("append", "20", "--closed-own-ticket", closed, "--minted-false-claim", minted, "--note", "n");
+    const got = flag === "closed-own-ticket" ? closed : minted;
+    assert.equal(r.code, 2, `${flag}=${JSON.stringify(got)}\n${r.stdout}${r.stderr}`);
+    assert.ok(r.stderr.includes(`--${flag} must be yes or no, got '${got}'`), r.stderr);
+    assert.equal(readFileSync(f.tier, "utf8"), before);
+    assert.deepEqual(f.ghCalls(), [], "refused before gh was asked");
+  }
+});
+
 // ---------------------------------------------------------------------------
 // check
 // ---------------------------------------------------------------------------
@@ -467,6 +485,65 @@ test("check: a missing tier-outcomes.tsv file fails loudly instead of passing 0
   assert.match(r.stderr, /no .*tier-outcomes\.tsv — no rows to check/);
 });
 
+// Every reader of the file judges the floor as `minted_false_claim === "yes" ||
+// closed_own_ticket === "no"`, so any other spelling would read as a pass.
+test("check: a verdict column that is not yes, no or blank is refused as malformed, on full and legacy rows", (t) => {
+  for (const [col, row] of [
+    ["closed_own_ticket", tierRow({ pr: 21, ticket: 11, tier: "default", closed: "No" })],
+    ["minted_false_claim", tierRow({ pr: 21, ticket: 11, tier: "default", minted: "YES" })],
+    ["minted_false_claim", tierRow({ pr: 21, ticket: 11, tier: "default", minted: "no " })],
+    ["closed_own_ticket", tierRow({ date: PRE_SWITCH, pr: 21, ticket: 11, tier: "opus", closed: "y" }).split("\t").slice(0, LEGACY_WIDTH).join("\t")],
+  ]) {
+    const f = fixture(t, {
+      members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+      tierRows: [tierRow({ pr: 20, ticket: 10, tier: "default" }), row],
+    });
+    const r = f.run("check");
+    assert.equal(r.code, 2, `${row}\n${r.stdout}${r.stderr}`);
+    const value = row.split("\t")[COLUMNS.indexOf(col)];
+    assert.ok(r.stderr.includes(`malformed row: ${col} is '${value}', expected yes, no or blank`), r.stderr);
+    assert.equal(r.stdout, "");
+  }
+});
+
+// What the refusal must ACCEPT: the committed file carries never-ruled rows
+// with both verdict columns blank, and every reader parses the whole file.
+test("check: blank verdict columns and every yes/no pair parse, on full and legacy rows", (t) => {
+  const f = fixture(t, {
+    members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+    tierRows: [
+      tierRow({ date: PRE_SWITCH, pr: 19, ticket: 9, tier: "", closed: "", minted: "" }).split("\t").slice(0, LEGACY_WIDTH).join("\t"),
+      tierRow({ pr: 20, ticket: 10, tier: "default", closed: "", minted: "" }),
+      tierRow({ pr: 21, ticket: 10, tier: "default", closed: "yes", minted: "yes" }),
+      tierRow({ pr: 22, ticket: 10, tier: "default", closed: "no", minted: "no" }),
+      tierRow({ pr: 23, ticket: 10, tier: "default", closed: "no", minted: "yes" }),
+    ],
+  });
+  const r = f.run("check");
+  assert.equal(r.code, 0, r.stdout + r.stderr);
+  assert.match(r.stdout, /4 checked, 0 failed/);
+});
+
+// A row with ONE verdict column blank is what a hand-edit leaves when it blanks
+// a failing value; `append` never writes it and a no-ruling backfill blanks both.
+test("check: a row with exactly one verdict column blank is refused as malformed, on full and legacy rows", (t) => {
+  for (const [closed, minted] of [["", "no"], ["", "yes"], ["yes", ""], ["no", ""]]) {
+    for (const legacy of [false, true]) {
+      const full = tierRow({ date: legacy ? PRE_SWITCH : TIER_SWITCH_DATE, pr: 21, ticket: 11, tier: "default", closed, minted });
+      const row = legacy ? full.split("\t").slice(0, LEGACY_WIDTH).join("\t") : full;
+      const f = fixture(t, {
+        members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],
+        tierRows: [tierRow({ pr: 20, ticket: 10, tier: "default" }), row],
+      });
+      const r = f.run("check");
+      const label = `${JSON.stringify({ closed, minted, legacy })}\n${r.stdout}${r.stderr}`;
+      assert.equal(r.code, 2, label);
+      assert.ok(r.stderr.includes(`malformed row: closed_own_ticket is '${closed}' but minted_false_claim is '${minted}', expected both blank or both yes or no`), label);
+      assert.equal(r.stdout, "");
+    }
+  }
+});
+
 test("check --live: warns on each reviewed PR with no row, and the warning alone never fails", (t) => {
   const f = fixture(t, {
     members: [{ member: "impl-10", ticket: 10, type: "fleet-implementer" }],

package/skills/run-team/references/reaping.md

@@ -22,7 +22,7 @@ Every precondition recomputed **inside** same command as delete:
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
-- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and only by it.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
+- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
 - **A branch any worktree holds is a KEEP, checked right before the delete.** `update-ref` consults no worktree; `-D` did. So listing is re-read and worktree.sh's `wt_holding` asks: held by a `branch` line, or by detached worktree stopped mid `rebase -i` / mid `bisect` on it (admin dir's `head-name` / `BISECT_START`) — both routes `-D` refused on (#2218). Worktree it cannot resolve, or listing that will not re-read, is a KEEP. `--apply` only, like the delete: dry run cannot predict this refusal — not the same limitation `-D`'s dry run had, since an unrelated worktree elsewhere in the listing that this check cannot resolve keeps every `[gone]` branch in the pass (see below), a repo-wide case `-D` never produced.
 - **A cherry that cannot answer is a KEEP.** Capture git's output; never pipe git itself: `cmd | grep -q` takes grep's exit status, never cmd's, so a `git cherry` that dies (rc 128 — one unreadable loose object is enough) prints nothing, grep exits 1, and a dead probe reads identical to "nothing unmerged" (verified, git 2.50.1). Unanswerable probe authorizes no delete — same fail-closed shape as `worktree remove` below. Read the `+` anchored, too: the capture folds stderr in, so an unanchored match reads a `+` in a diagnostic as a commit. Pinned by a test.
 - **A worktree registry that cannot be read is a KEEP, for every `[gone]` branch in that pass.** The lookup decides whether the dirty, ignored-files and removal checks run at all; an unread registry reads identical to "no worktree", and `-D`, the delete then, needed no answer from the registry to delete a branch that has none — so failing open force-deleted merged branches blind (#622). The holder check before the delete asks only whether a worktree holds the branch, never those other questions, so the lookup still fails closed on its own. The listing is re-read per branch, so one repo-level failure keeps every `[gone]` branch in the pass, each with git's own cause. Reap runs after every merge pass, so the next one retries: nothing is lost, nothing is reaped blind.