@feigi/fleet-ctl 3.79.6 → 3.80.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.6",
+  "version": "3.80.1",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/reap.sh

@@ -434,11 +434,15 @@ keep() {
 # subshell before `gp_rc=$?` or the printf below ever run, and `gp_raw` comes
 # back empty — silently, at the one moment this function exists to not be
 # silent (measured on this exact shape).
+#
+# The capture is `probe`, over any command; `git_probe` is `probe git`.
+# pr_load's gh call below is the one other caller: its stdout fields are
+# refnames, numbers, object ids and fixed words, none of which can hold 0x02.
 gp_sep=$(printf '\002')
-git_probe() {
+probe() {
   gp_raw=$(
     {
-      if gp_o=$(git "$@" 2>&3); then gp_rc=0; else gp_rc=$?; fi
+      if gp_o=$("$@" 2>&3); then gp_rc=0; else gp_rc=$?; fi
       printf '%s' "$gp_sep$gp_o$gp_sep$gp_rc"
     } 3>&1
   )
@@ -448,6 +452,7 @@ git_probe() {
   gp_rc=${gp_raw#*"$gp_sep"}
   return "$gp_rc"
 }
+git_probe() { probe git "$@"; }
 
 # True when git's stderr says the directory walk was CUT SHORT — entries are
 # missing from $gp_out — as opposed to git merely having said something.
@@ -669,6 +674,296 @@ null_head_why() {
   return 0
 }
 
+# THE SECOND MERGE PROOF. `git cherry` answers one question — is each of this
+# branch's commits patch-equivalent to something on $base — and answers it
+# wrongly for a claim the merge bot rebased server-side onto a `main` that had
+# changed the claim's own context lines: the rebased commit carries different
+# context, so a different patch id, and the original reads `+` although
+# everything on it was merged. (A `+` is therefore not always "a commit that
+# exists nowhere else"; the keep it produces is safe but leaky.) Measured on
+# this repository's own [gone] branches, most of the stranded tips are not the
+# bot's doing at all: a member that pushes `HEAD:<branch>` from a detached
+# worktree replaces the remote branch and never moves the local ref, so the
+# local tip is a head the PR's remote branch once held.
+#
+# That is the fact this proof reads, and only GitHub records it: the PR's
+# `headRefOid` and the `beforeCommit` of every force-push on it are the heads
+# its branch held. A tip that equals one, or is an ancestor of one this clone
+# has, was pushed to the PR's remote branch and then replaced by its owner's
+# force-push — nothing on it was ever local-only. Equality or ancestry is
+# enough; no range-diff pairing, which was measured to reap none of the
+# stranded tips (every branch has a `!` pair, context drift again) and which,
+# if it accepted `!`, would also reap a local amend that was never pushed.
+#
+# It is additive. It runs only for a branch `git cherry` already keeps, after
+# that verdict, and only ever turns that keep into a reap: the cherry proof,
+# the worktree guards, the holder re-check, the compare-and-swap on the tip
+# read once and `wt_recheck_delete` are all unchanged, and the tie is computed
+# on that same frozen tip. There is no name filter.
+#
+# One lookup per branch, by head name, MERGED PRs only, and a KEEP with its
+# reason unless ALL of: exactly one PR matches (a reused name can match
+# several); its timeline of force-pushes has no next page, because the tie
+# would then be read off a partial list; its base is the branch BASE_REF
+# names; it is not cross-repository; its `headRefOid` is a commit present
+# here and an ancestor of $base_rev — the ancestry is asked of git, not
+# trusted from the API; and the tip equals one of the PR's recorded heads or
+# is an ancestor of one present here. A squash merge's head is not on $base,
+# so it stays kept.
+#
+# One aliased `gh api graphql` lookup per run, one call per $pr_chunk branches
+# and issued the first time a branch needs it, covers every [gone] branch (a
+# superset of the ones waiting: which will need it is only known branch by
+# branch). Branch names go in as GraphQL VARIABLES, never spliced into the
+# query text — `"` is legal in a refname.
+# Output is captured, never piped, and the call runs under a watchdog. Each of
+# these keeps every affected branch with its own reason and the run carries on:
+# gh missing, a non-zero exit with no complete body (a non-zero exit that DID
+# print a complete body — gh does so when the response also carries an
+# `errors` array — is read, and any alias without an entry keeps, with gh's
+# exit status and stderr in its reason), output that is not the shape the
+# script's own `--jq` produces, and a timeline with a next page. Nothing is
+# cached between runs, so an untied branch is asked about again on every pass.
+#
+# It does not apply — and the reason stays the bare `unmerged commits` — where
+# the repository has no GitHub identity to ask about: $base is not a
+# remote-tracking ref of `origin`, or `remote.origin.url` is not a
+# `host/owner/repo` URL (a local path, say). That is not a failure of the
+# proof, there is simply nobody to put the question to. `git config`, never
+# `git remote get-url`: the latter applies `insteadOf` rewrites, which would
+# name the transport rather than the repository.
+#
+# No `[a-z]`-style range anywhere in this block, and no tool whose result
+# depends on the locale: the pin above is a global, and its inventory is
+# enforced by a test.
+case "$base" in
+  origin/*) pr_base=${base#origin/} ;;
+  refs/remotes/origin/*) pr_base=${base#refs/remotes/origin/} ;;
+  *) pr_base= ;;
+esac
+pr_loaded=false
+pr_off=false
+pr_all_why=
+pr_rows=
+pr_why=
+pr_part_why=
+pr_us=$(printf '\037')
+
+# Reads `remote.origin.url` into $pr_owner, $pr_name and $pr_host. Returns 1
+# where it names no `host/owner/repo` — a local path, or a shape with no owner.
+pr_identity() {
+  pi_url=$(git config --get remote.origin.url 2>/dev/null) || return 1
+  case "$pi_url" in
+    /* | ./* | ../* | file://*) return 1 ;;
+    *://*)
+      pi_rest=${pi_url#*://}
+      pi_host=${pi_rest%%/*}
+      pi_path=${pi_rest#*/}
+      ;;
+    *:*)
+      pi_host=${pi_url%%:*}
+      pi_path=${pi_url#*:}
+      ;;
+    *) return 1 ;;
+  esac
+  pi_host=${pi_host##*@}
+  pi_host=${pi_host%%:*}
+  pi_path=${pi_path%/}
+  pi_path=${pi_path%.git}
+  pr_owner=${pi_path%%/*}
+  pr_name=${pi_path#*/}
+  pr_host=$pi_host
+  [ -n "$pr_host" ] && [ -n "$pr_owner" ] && [ "$pr_name" != "$pi_path" ] && [ -n "$pr_name" ] || return 1
+  case "$pr_name" in */*) return 1 ;; esac
+  return 0
+}
+
+# `gh "$@"`, neither prompting nor outliving <budget> seconds: the bounded-call
+# shape net_git has for git, over the same kill walk. It lives here and not in
+# net.sh because this is the one gh call in the fleet that is bounded; net.sh
+# records why the others are not. stdout is gh's, stderr is gh's, and the
+# status is gh's own — 143 or 137 when the watchdog fired (net_stalled). The
+# watchdog closes fd 3, pr_load's stderr capture: where net_kill_tree cannot
+# read `ps`, its sleep outlives the call, and holding that pipe open would
+# stall even a fast answer for the whole budget.
+gh_bounded() {
+  (
+  gb_budget=$1
+  shift
+  GH_PROMPT_DISABLED=1 GH_NO_UPDATE_NOTIFIER=1 gh "$@" </dev/null &
+  gb_pid=$!
+  { sleep "$gb_budget"; net_kill_tree "$gb_pid"; } >/dev/null 2>&1 3>&- &
+  gb_wd=$!
+  gb_status=0
+  wait "$gb_pid" 2>/dev/null || gb_status=$?
+  net_kill_tree "$gb_wd"
+  exit "$gb_status"
+  )
+}
+
+# One run's lookup. Sets $pr_off (the proof does not apply here), $pr_all_why
+# (it could not be read, for every branch) or $pr_rows (the answer).
+#
+# At most $pr_chunk aliases per call: GitHub refuses the whole query with
+# `Resource limits for this query exceeded` somewhere between 850 aliases
+# (answered) and 1000 (refused), measured against this repository, which would
+# keep every `+` branch on every run once the [gone] backlog grew that far.
+# Alias numbers stay global across calls, so pr_tie reads `b<N>` the same way
+# however many calls the answer took; any call that fails fails them all.
+pr_chunk=500
+pr_load() {
+  pr_loaded=true
+  [ -n "$pr_base" ] || { pr_off=true; return 0; }
+  pr_identity || { pr_off=true; return 0; }
+  if ! command -v gh >/dev/null 2>&1; then
+    pr_all_why="gh is not installed, so GitHub's record of this tip could not be read"
+    return 0
+  fi
+  # One line per alias, `\037`-joined and closed by a lone `.`, so a short or
+  # long row cannot be mistaken for a whole one: the same separator, and the
+  # same reason for it, as delete-merged-branch.sh's `gh pr view` read.
+  pl_jq='.data.repository | to_entries[] | .key as $k | (.value.nodes // []) as $n
+    | [$k, (if .value == null then "null" else ($n | length | tostring) end),
+       ($n[0] // {} | ((.number // "" | tostring), (.baseRefName // ""), (.isCrossRepository | tostring), (.headRefOid // ""),
+                      (.timelineItems.pageInfo.hasNextPage | tostring), ([.timelineItems.nodes[]? | .beforeCommit.oid? // empty] | join(",")))),
+       "."] | join("\u001f")'
+  pl_budget=$(net_budget 60 "${FLEET_NET_TIMEOUT:-}")
+  pl_n=0
+  for pl_b in $gone_branches; do pl_n=$((pl_n + 1)); done
+  pl_lo=0
+  while [ "$pl_lo" -lt "$pl_n" ]; do
+    pl_hi=$((pl_lo + pr_chunk))
+    pl_decl='$owner:String!,$name:String!'
+    pl_sel=
+    set -- -f "owner=$pr_owner" -f "name=$pr_name"
+    pl_i=0
+    for pl_b in $gone_branches; do
+      if [ "$pl_i" -ge "$pl_lo" ] && [ "$pl_i" -lt "$pl_hi" ]; then
+        pl_decl="$pl_decl,\$h$pl_i:String!"
+        pl_sel="${pl_sel}b$pl_i:pullRequests(headRefName:\$h$pl_i,states:MERGED,first:2){nodes{number baseRefName isCrossRepository headRefOid timelineItems(itemTypes:[HEAD_REF_FORCE_PUSHED_EVENT],first:100){pageInfo{hasNextPage} nodes{... on HeadRefForcePushedEvent{beforeCommit{oid}}}}}} "
+        set -- "$@" -f "h$pl_i=$pl_b"
+      fi
+      pl_i=$((pl_i + 1))
+    done
+    pl_query="query($pl_decl){repository(owner:\$owner,name:\$name){$pl_sel}}"
+    # `--hostname` always, github.com included: without it gh asks GH_HOST, or
+    # its own default, rather than the host origin names.
+    set -- api graphql --hostname "$pr_host" -f "query=$pl_query" "$@" --jq "$pl_jq"
+    pl_to=$pl_hi
+    [ "$pl_to" -le "$pl_n" ] || pl_to=$pl_n
+    echo "\$ gh api graphql (merged PRs by head branch, [gone] branches $((pl_lo + 1))-$pl_to of $pl_n)" >&2
+    if probe gh_bounded "$pl_budget" "$@"; then pl_rc=0; else pl_rc=$?; fi
+    pl_o=$gp_out
+    pl_err=$gp_err
+    # Every line must be a whole row; one that is not makes the body unusable.
+    pl_ok=false
+    if [ -n "$pl_o" ]; then
+      pl_ok=true
+      while IFS=$pr_us read -r pk pcnt pnum pbase pcross poid phn pbef pend; do
+        case "${pk#b}" in '' | *[!0123456789]*) pl_ok=false ;; esac
+        [ "$pk" != "${pk#b}" ] || pl_ok=false
+        [ "$pend" = . ] || pl_ok=false
+      done <<EOF
+$pl_o
+EOF
+    fi
+    if [ "$pl_ok" = true ]; then
+      pr_rows=${pr_rows:+$pr_rows
+}$pl_o
+      [ "$pl_rc" = 0 ] || pr_part_why="$pr_part_why (gh exited $pl_rc$(gp_why "$pl_err"))"
+    else
+      if [ "$pl_rc" = 0 ]; then
+        pr_all_why="gh answered with unparseable output, so GitHub's record of this tip could not be read"
+      elif net_stalled "$pl_rc"; then
+        pr_all_why="gh did not finish within ${pl_budget}s and was killed, so GitHub's record of this tip could not be read"
+      else
+        pr_all_why="gh failed (exit $pl_rc)$(gp_why "$pl_err"), so GitHub's record of this tip could not be read"
+      fi
+      pr_rows=
+      return 0
+    fi
+    pl_lo=$pl_hi
+  done
+  return 0
+}
+
+# Does GitHub's record tie branch $1, at frozen tip $2, to a head its merged PR
+# held? Returns 0 when it does; otherwise 1, with the reason in $pr_why.
+pr_tie() {
+  pt_b=$1
+  pt_tip=$2
+  pt_i=0
+  for pt_x in $gone_branches; do
+    [ "$pt_x" != "$pt_b" ] || break
+    pt_i=$((pt_i + 1))
+  done
+  pt_row=false
+  while IFS=$pr_us read -r pk pcnt pnum pbase pcross poid phn pbef pend; do
+    if [ "$pk" = "b$pt_i" ]; then pt_row=true; break; fi
+  done <<EOF
+$pr_rows
+EOF
+  if [ "$pt_row" != true ]; then
+    pr_why="GitHub's answer has no entry for $pt_b$pr_part_why"
+    return 1
+  fi
+  case "$pcnt" in
+    0) pr_why="no merged PR has the head branch $pt_b"; return 1 ;;
+    1) ;;
+    '' | null | *[!0123456789]*) pr_why="GitHub returned no usable PR list for $pt_b$pr_part_why"; return 1 ;;
+    *) pr_why="several merged PRs have the head branch $pt_b"; return 1 ;;
+  esac
+  case "$pnum" in '' | *[!0123456789]*) pnum="?" ;; esac
+  if [ "$phn" != false ]; then
+    pr_why="PR #$pnum has more force-pushes than one page of its timeline returned, so its recorded heads are incomplete"
+    return 1
+  fi
+  if [ "$pbase" != "$pr_base" ]; then
+    pr_why="PR #$pnum is based on $pbase, not $pr_base"
+    return 1
+  fi
+  if [ "$pcross" != false ]; then
+    pr_why="PR #$pnum comes from another repository"
+    return 1
+  fi
+  case "$poid" in '' | *[!0123456789abcdef]*)
+    pr_why="PR #$pnum has a headRefOid that is not a commit id: '$poid'"
+    return 1
+    ;;
+  esac
+  if ! git_probe cat-file -e "$poid^{commit}"; then
+    pr_why="PR #$pnum's headRefOid $poid is not a commit present locally"
+    return 1
+  fi
+  if git_probe merge-base --is-ancestor "$poid" "$base_rev"; then :; else
+    if [ "$?" -eq 1 ]; then
+      pr_why="PR #$pnum's headRefOid $poid is not an ancestor of $base, so it did not merge by a rebase or a merge commit onto it"
+    else
+      pr_why="cannot tell whether PR #$pnum's headRefOid $poid is an ancestor of $base$(gp_why)"
+    fi
+    return 1
+  fi
+  # The recorded heads: the head the PR ended on, then every force-pushed-over one.
+  pt_unsure=false
+  pt_unsure_why=
+  pt_rest="$poid,$pbef"
+  while [ -n "$pt_rest" ]; do
+    pt_h=${pt_rest%%,*}
+    case "$pt_rest" in *,*) pt_rest=${pt_rest#*,} ;; *) pt_rest= ;; esac
+    case "$pt_h" in '' | *[!0123456789abcdef]*) continue ;; esac
+    if [ "$pt_h" = "$pt_tip" ]; then return 0; fi
+    git_probe cat-file -e "$pt_h^{commit}" || continue
+    if git_probe merge-base --is-ancestor "$pt_tip" "$pt_h"; then return 0; else pt_rc=$?; fi
+    if [ "$pt_rc" -ne 1 ]; then pt_unsure=true; pt_unsure_why=$(gp_why); fi
+  done
+  if [ "$pt_unsure" = true ]; then
+    pr_why="cannot tell whether the tip is an ancestor of a head the PR recorded$pt_unsure_why"
+    return 1
+  fi
+  pr_why="the tip $pt_tip is not a head the PR recorded, nor an ancestor of one present locally"
+  return 1
+}
+
 # %(upstream:track) emits exactly [gone] as its own field — nothing to
 # pattern-match, and no -v/-vv trap.
 #
@@ -769,8 +1064,9 @@ for b in $gone_branches; do
   tip=$gp_out
 
   # git cherry against origin/main, not a local main: a local main never
-  # fast-forwarded reads every merged branch as unmerged. Any + line is a commit
-  # that exists nowhere else.
+  # fast-forwarded reads every merged branch as unmerged. A + line is a commit
+  # with no patch-equivalent upstream: usually one that exists nowhere else, but
+  # not always — see the second merge proof above the loop.
   #
   # Captured, not piped: `cmd | grep -q` takes grep's exit status, never cmd's,
   # so a `git cherry` that dies (exit 128 — one unreadable loose object is
@@ -833,8 +1129,22 @@ for b in $gone_branches; do
     keep "$b" "cherry scan failed — cannot tell if merged$(gp_why "$gq_err")"
     continue
   elif [ "$gq_rc" -eq 0 ]; then
-    keep "$b" "unmerged commits"
-    continue
+    # `+` is a keep unless the second proof (its header is above the loop)
+    # ties this very `$tip` to a head the branch's merged PR held. Everything
+    # after this block — the worktree guards, the holder re-check, the
+    # compare-and-swap on `$tip` — runs exactly as it does for a branch the
+    # cherry cleared.
+    [ "$pr_loaded" = true ] || pr_load
+    if [ "$pr_off" = true ]; then
+      keep "$b" "unmerged commits"
+      continue
+    elif [ -n "$pr_all_why" ]; then
+      keep "$b" "unmerged commits — $pr_all_why"
+      continue
+    elif ! pr_tie "$b" "$tip"; then
+      keep "$b" "unmerged commits — $pr_why"
+      continue
+    fi
   fi
 
   # The listing is read per branch, through worktree.sh's `wt_counts`, which

package/scripts/release-ticket.sh

@@ -1,9 +1,20 @@
 #!/bin/sh
-# Release a claim that was never dispatched: drop the in-progress label, remove
-# the worktree, delete the branch — but only when the claim provably carries no
-# work. The inverse of claim-ticket.sh.
+# Release a claim: drop the in-progress label, remove the worktree, delete the
+# branch — but only when the claim provably carries no work. The inverse of
+# claim-ticket.sh. Two claim shapes release, told apart by the branch on origin:
 #
-# Dry-run by default; --apply mutates the tracker and the filesystem.
+# - Never dispatched: no branch on origin. The branch must carry no commit
+#   beyond origin/main and no commit unique to it.
+# - Closed unmerged: the branch is on origin, and every PR of this repository
+#   whose head is that branch reads CLOSED — none OPEN, none MERGED, at least
+#   one present. The local branch must sit at the tip origin holds. Under
+#   --apply origin's tip is read again right before the remote branch is
+#   deleted, and that delete runs before the label drops. It is a plain one,
+#   not leased on the tip: a push landing between the re-read and the delete
+#   goes with the branch. A branch on origin with no PR, or with a PR list that
+#   cannot be read, blocks.
+#
+# Dry-run by default; --apply mutates the tracker, the remote and the filesystem.
 #
 # reap.sh will not do this: no merge happened, so no remote branch was ever
 # deleted, so the branch is not [gone] and reap's for-each-ref filter never
@@ -15,8 +26,10 @@
 # Every precondition is recomputed inside THIS invocation rather than trusted
 # from an earlier tool call, for the reason reap.sh gives: the dangerous
 # direction is a worktree that gained work after it was checked. Two of them are
-# recomputed a second time at the moment of the delete, which is why both
-# deletes run before the label is dropped rather than after.
+# recomputed a second time at the moment of the delete, and in closed mode
+# origin's tip is re-read at the remote delete as well, which is why every
+# delete — the remote one included — runs before the label is dropped rather
+# than after.
 #
 # The dirty check's second opinion is git's own — that is what `worktree remove`
 # without --force is for. It covers the live-directory case ONLY: `worktree
@@ -27,7 +40,8 @@
 #
 # The commit check's is this script's own: the compare-and-swap delete refuses
 # only a ref that moved, so the `ahead` count is re-run against $base right
-# before it. Why not `-d`, and what that recount does and does not cover, is
+# before it — in closed mode, a compare of the local tip against the tip origin
+# held instead. Why not `-d`, and what that recount does and does not cover, is
 # argued once at the delete site below — don't restate it here.
 set -eu
 
@@ -854,6 +868,44 @@ if [ -z "$wt" ] && [ -n "$stray" ]; then
   fi
 fi
 
+# A pushed branch — work that survives the local delete and that a PR may
+# already point at. Live query, so this one cannot be stale; a failure here is
+# an unknown answer, never a "no".
+# stderr stays on stderr, never folded into the value: the emptiness of $remote
+# IS the answer, so an SSH host-key notice on a successful query used to read as
+# a branch that exists. git's own message is more useful on the terminal anyway.
+# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
+# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
+# is the shorten-only override this lookup shares with the fleet's fetches — but
+# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
+# and nothing else, so shortening this one does not shorten that one. The rule
+# is net_budget's, in net.sh.
+ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
+ls_rc=0
+remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
+if [ "$ls_rc" -ne 0 ]; then
+  # A killed lookup and a refused one are different facts and get different
+  # words. Both leave the same verdict — the answer is unknown, so nothing is
+  # released — but only one of them names a cause this script observed.
+  if net_stalled "$ls_rc"; then
+    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
+  fi
+  die "git ls-remote failed, so whether $branch was pushed is unknown"
+fi
+
+# The tip origin holds, split off ls-remote's `<sha><TAB><ref>` line on the tab
+# itself rather than on a `[:space:]` class, which would put a locale-sensitive
+# construct under the `export LC_ALL=C` paragraph above that says there is none.
+# Whether this pushed branch is the one that releases is a tracker question,
+# asked below once nothing local blocks.
+tab=$(printf '\t')
+remote_sha=
+if [ -n "$remote" ]; then
+  remote_sha=${remote%%"$tab"*}
+  [ "${remote#*"$tab"}" = "refs/heads/$branch" ] ||
+    die "git ls-remote did not answer with refs/heads/$branch for $branch, so whether it was pushed is unknown"
+fi
+
 # An Orphaned worktree directory: this claim's directory still on disk with its
 # registration already cleared. `stray` cannot see it BY CONSTRUCTION — it is
 # awk over git's registry, and there is no registration left to match — so the
@@ -893,7 +945,10 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
     block "worktree directory $orphan is this claim's and has no registration — inspect it and remove the directory by hand"
   elif ! gone "$orphan"; then
     block "cannot tell whether an orphaned worktree directory is at $orphan, so whether #$issue can be released is unknown"
-  elif [ "$has_branch" = false ] && [ -z "$blockers" ]; then
+  elif [ "$has_branch" = false ] && [ -z "$blockers" ] && [ -z "$remote" ]; then
+    # A branch of this name on origin proves the slug right, so the die below
+    # does not fire: a closed-PR claim whose local branch is already gone
+    # releases from the remote alone.
     # A mistyped <slug>/<type> names a branch that does not exist, and without
     # this die the run would drop the label off a ticket whose real claim is
     # untouched — invisible to candidates.mjs and still in-flight. Refuse
@@ -927,7 +982,18 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
   fi
 fi
 
-if [ "$has_branch" = true ]; then
+# A closed PR's commits are the branch's whole content, so `ahead` and the `git
+# cherry` count below would refuse every one — and the PR states that tell a
+# closed-PR claim from any other pushed branch are not read until the blockers
+# below are known. So a branch on origin is held to one check here: the local
+# branch must sit at the tip origin holds. Any commit it carries beyond that is
+# unpushed, and the local delete would take it with the branch.
+if [ "$has_branch" = true ] && [ -n "$remote" ]; then
+  local_tip=$(git rev-parse --verify "refs/heads/$branch") ||
+    die "cannot read $branch's tip, so whether it matches origin's is unknown"
+  [ "$local_tip" = "$remote_sha" ] ||
+    block "$branch is not at the tip origin holds — unpushed work would be lost"
+elif [ "$has_branch" = true ]; then
   # Commits ahead — a member that did work. Measured on the branch ref rather
   # than the worktree's HEAD: the worktree above was located BY that ref, so the
   # two agree, and this still runs when the worktree is already gone.
@@ -951,32 +1017,6 @@ if [ "$has_branch" = true ]; then
   [ "$uniq" -eq 0 ] || block "$uniq commit(s) unique to $branch (git cherry)"
 fi
 
-# A pushed branch — work that survives the local delete and that a PR may
-# already point at. Live query, so this one cannot be stale; a failure here is
-# an unknown answer, never a "no".
-# stderr stays on stderr, never folded into the value: the emptiness of $remote
-# IS the answer, so an SSH host-key notice on a successful query used to read as
-# a branch that exists. git's own message is more useful on the terminal anyway.
-# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
-# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
-# is the shorten-only override this lookup shares with the fleet's fetches — but
-# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
-# and nothing else, so shortening this one does not shorten that one. The rule
-# is net_budget's, in net.sh.
-ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
-ls_rc=0
-remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
-if [ "$ls_rc" -ne 0 ]; then
-  # A killed lookup and a refused one are different facts and get different
-  # words. Both leave the same verdict — the answer is unknown, so nothing is
-  # released — but only one of them names a cause this script observed.
-  if net_stalled "$ls_rc"; then
-    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
-  fi
-  die "git ls-remote failed, so whether $branch was pushed is unknown"
-fi
-[ -z "$remote" ] || block "branch $branch exists on origin"
-
 # `-d`, because a directory that is not there holds no uncommitted work. Deleted
 # by hand, a worktree leaves its admin files registered, so `worktree list
 # --porcelain` keeps listing the entry and the status below ran against a path
@@ -1197,10 +1237,52 @@ if [ -n "$wt" ]; then
   fi
 fi
 
-# Report the blockers before asking GitHub anything. The answer cannot change —
-# every artefact stays put either way — and reaching for the tracker first turns
-# an offline blocked claim into an unanswerable one, burying the finding the
-# caller actually needs. "label":null says it was never read.
+# The one pushed branch that releases: every PR of this repository whose head
+# is $branch reads CLOSED, and there is at least one. Read live, and failing
+# closed — a PR list that cannot be read is an unknown answer, as the lookup
+# above is. Any other pushed branch blocks, as it always did.
+#
+# Asked only once every local check has had its say and none blocked, for the
+# reason the report below gives: a claim already blocked is answered, and a
+# tracker that cannot be reached must not turn it into an exit 2 with no
+# receipt. Such a claim names its pushed branch as one more blocker instead,
+# without the PR states nothing asked for.
+closed_pr=false
+pr_seen=
+if [ -n "$remote" ] && [ -n "$blockers" ]; then
+  block "branch $branch exists on origin"
+elif [ -n "$remote" ]; then
+  # One `number:state` token per PR, so the loop below needs no JSON parser.
+  # --limit 1000: gh's default page of 30 would hide a later OPEN PR.
+  # `--head` matches a head branch NAME, from any fork, so a fork's PR whose
+  # branch shares this one's name is dropped before it is counted — the filter
+  # delete-merged-branch.sh applies to its own `--head` lookup. Without it, a
+  # fork's closed PR would read as this branch's and release a branch no PR of
+  # ours names.
+  prs=$(gh pr list --state all --head "$branch" --limit 1000 --json number,state,isCrossRepository \
+    --jq '.[] | select(.isCrossRepository | not) | "\(.number):\(.state)"') ||
+    die "gh pr list failed for $branch, so whether its PR closed unmerged is unknown"
+  pr_bad=
+  for pr in $prs; do
+    pr_seen="$pr_seen #${pr%%:*} ${pr#*:};"
+    case ${pr#*:} in
+      CLOSED) ;;
+      *) pr_bad="$pr_bad #${pr%%:*} ${pr#*:};" ;;
+    esac
+  done
+  if [ -z "$pr_seen" ]; then
+    block "branch $branch exists on origin and no PR names it"
+  elif [ -n "$pr_bad" ]; then
+    block "branch $branch exists on origin and its PR(s) are not closed unmerged:$pr_bad"
+  else
+    closed_pr=true
+  fi
+fi
+
+# Report the blockers before asking GitHub anything more. The answer cannot
+# change — every artefact stays put either way — and reaching for the tracker
+# first turns an offline blocked claim into an unanswerable one, burying the
+# finding the caller actually needs. "label":null says it was never read.
 if [ -n "$blockers" ]; then
   echo "$NAME: #$issue NOT released — nothing was touched" >&2
   printf '{"issue":%s,"branch":"%s","branchRewritten":%s,"worktree":"%s","worktreeRewritten":%s,"label":null,"released":false,"applied":%s,"blockers":[%s]}\n' \
@@ -1242,6 +1324,10 @@ if [ "$apply" = false ]; then
   [ "$has_label" = true ] && echo "    would: gh issue edit $issue --remove-label in-progress" >&2
   [ -n "$wt" ] && printf '    would: git worktree remove %s\n' "$wt" >&2
   [ "$has_branch" = true ] && echo "    would: git update-ref -d refs/heads/$branch <its current tip>" >&2
+  if [ "$closed_pr" = true ]; then
+    echo "    PR states on $branch:$pr_seen" >&2
+    echo "    would: git push origin --delete refs/heads/$branch (origin read at $remote_sha)" >&2
+  fi
 else
   # Label LAST. The two local deletes are the ones that refuse — that refusal is
   # the dirty check recomputed by git at the moment of the delete, so it is
@@ -1249,7 +1335,10 @@ else
   # left in-progress already gone: with the worktree still standing the ticket
   # read free to candidates.mjs while re-claiming failed on the existing branch.
   # Run them first and a refusal leaves the claim exactly as it was, label and
-  # all, which reads as still taken — the direction that costs nothing.
+  # all, which reads as still taken — the direction that costs nothing. Closed
+  # mode's remote delete runs after them, and ahead of the label for the same
+  # reason.
+
   if [ -n "$wt" ]; then
     # No --force, ever. A refusal is a finding to report, never something to
     # force past. Quote git's own reason: this fires precisely when something
@@ -1294,8 +1383,16 @@ else
       halt "cannot read $branch's tip at the delete"
     n=$(git rev-list --count "$base_rev..$tip") ||
       halt "cannot recount commits on $branch against $base at the delete"
-    [ "$n" -eq 0 ] ||
-      halt "$branch gained $n commit(s) since the checks — not deleted"
+    if [ "$closed_pr" != true ]; then
+      [ "$n" -eq 0 ] ||
+        halt "$branch gained $n commit(s) since the checks — not deleted"
+    else
+      # A closed PR's commits are the whole content of the branch, so the
+      # recount above refuses every one of them. What holds instead: the local
+      # tip has not moved off the tip origin held when the checks read it.
+      [ "$tip" = "$remote_sha" ] ||
+        halt "$branch is no longer at the tip origin holds — not deleted"
+    fi
 
     # What the CAS does not give back: `git update-ref` is ref-only plumbing
     # and, unlike `-D`, consults no worktree at all — so the one guard the CAS
@@ -1371,6 +1468,47 @@ else
     done_branch=true
   fi
 
+  # Closed mode only: the remote branch goes after the local one and before the
+  # label drops, for the same reason as the local deletes above.
+  #
+  # Origin is read again first, so a push that landed since the checks halts
+  # the release here rather than going with the branch. Here, beside the remote
+  # delete, and not inside the local branch delete: a closed-PR claim whose
+  # local branch is already gone releases from the remote alone, and has no
+  # local delete to hang the re-read on. The delete itself is a plain one: a
+  # push landing in the gap between that re-read and this call is deleted with
+  # the branch. A lease would close that gap, but this file spells no form of
+  # force, so the gap stays.
+  #
+  # A non-zero rc does not say the delete failed to land: the watchdog can kill
+  # the push after origin applied it. So a failed push is followed by a read of
+  # origin, as delete-merged-branch.sh does, and the halt names what origin
+  # holds rather than calling every non-zero rc a refusal. A branch already gone
+  # from origin is the outcome this step exists for, whoever removed it.
+  if [ "$closed_pr" = true ]; then
+    recheck=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+      halt "cannot re-read origin's $branch before the delete — not deleted"
+    [ "${recheck%%"$tab"*}" = "$remote_sha" ] ||
+      halt "origin's $branch moved since the checks — not deleted"
+
+    # $ls_budget: a ref-only `push --delete` moves no objects either, so it
+    # shares the lookup's budget, as delete-merged-branch.sh's own push does.
+    echo "\$ git push origin --delete refs/heads/$branch" >&2
+    push_rc=0
+    net_git "" "$ls_budget" push origin --delete "refs/heads/$branch" >&2 || push_rc=$?
+    if [ "$push_rc" -ne 0 ]; then
+      echo "\$ git ls-remote --heads origin refs/heads/$branch" >&2
+      back=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+        halt "git push --delete exited $push_rc and origin could not be read back, so whether origin still holds $branch is unknown"
+      if [ -n "$back" ] && net_stalled "$push_rc"; then
+        halt "git push --delete did not finish within ${ls_budget}s and was killed — origin still holds $branch"
+      elif [ -n "$back" ]; then
+        halt "git push --delete refused $branch on origin (rc $push_rc) — origin still holds it"
+      fi
+    fi
+    done_branch=true
+  fi
+
   if [ "$has_label" = true ]; then
     echo "\$ gh issue edit $issue --remove-label in-progress" >&2
     gh issue edit "$issue" --remove-label in-progress >/dev/null ||

package/skills/run-team/references/reaping.md

@@ -22,11 +22,14 @@ Every precondition recomputed **inside** same command as delete:
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
 - **A branch with no upstream is reported `kept`, never selected.** `%(upstream)` is empty for it, so `%(upstream:track)` has no `[gone]` to match. The sweep reports it with reason `no upstream — never selected` and runs no other guard on it. Its upstream arrives with the first `-u` push, or when the controller settles the implementer's report.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
-- **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
+- **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. A `+` line is a commit with no patch-equivalent upstream, which is usually a commit that exists nowhere else but not always: a claim the merge bot rebased server-side onto a `main` that had changed its context lines carries a different patch id, so its original tip reads `+` although everything on it merged. That keep is safe but leaky, and the second proof below is what closes it.
 - **The delete is `git update-ref -d`'s compare-and-swap on a tip read once, authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D`, the delete this replaced. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
 - **A branch any worktree holds is a KEEP, checked right before the delete.** `update-ref` consults no worktree; `-D` did. So listing is re-read and worktree.sh's `wt_holding` asks: held by a `branch` line, or by detached worktree stopped mid `rebase -i` / mid `bisect` on it (admin dir's `head-name` / `BISECT_START`) — both routes `-D` refused on. Worktree it cannot resolve, or listing that will not re-read, is a KEEP. `--apply` only, like the delete: dry run cannot predict this refusal — not the same limitation `-D`'s dry run had, since an unrelated worktree elsewhere in the listing that this check cannot resolve keeps every `[gone]` branch in the pass (see below), a repo-wide case `-D` never produced.
 - **A worktree that checked the branch out while the delete ran is caught after it, and the branch is put back.** git has no lock that stops `git worktree add <p> <b>` between that holder check and the delete, and such an add writes only the new worktree's `HEAD` — the ref does not move, so the compare-and-swap succeeds and leaves the worktree on a branch that no longer exists (measured, git 2.50.1). So worktree.sh's `wt_recheck_delete` re-reads the listing right after the delete — and again, up to 20 times 0.1s apart, while an add in progress is listed `locked initializing` — and when a worktree holds the branch, or the wait runs out, recreates it at the tip with a create-only `git update-ref`. The branch is a KEEP naming the worktree or the entry, and its config section stays. A restore that fails is a KEEP naming the tip, git's error and the command that restores it by hand — or, when something recreated the branch since the delete, the commit it now sits at, left as it is, since the create-only restore never overwrites it. The branch's reflog does not come back.
 - **A cherry that cannot answer is a KEEP.** Capture git's output; never pipe git itself: `cmd | grep -q` takes grep's exit status, never cmd's, so a `git cherry` that dies (rc 128 — one unreadable loose object is enough) prints nothing, grep exits 1, and a dead probe reads identical to "nothing unmerged" (verified, git 2.50.1). Unanswerable probe authorizes no delete — same fail-closed shape as `worktree remove` below. Read the `+` anchored, too: the capture folds stderr in, so an unanchored match reads a `+` in a diagnostic as a commit. Pinned by a test.
+- **A branch `git cherry` keeps gets a second proof, from GitHub's record of the PR's heads.** A stranded tip is a head the PR's remote branch once held: a member's `HEAD:<branch>` push from a detached worktree, or the merge bot's server-side rebase, replaced the remote branch and never moved the local ref. GitHub records those heads — the PR's `headRefOid` and the `beforeCommit` of every force-push on it. A tip that **equals** a recorded head, or is an **ancestor** of one this clone has, was pushed and then replaced by its owner's force-push, so nothing on it was ever local-only. Equality or ancestry is enough: no `git range-diff` pairing, which reaped none of the measured tips (every branch has a `!` pair, context drift again) and, if it accepted `!`, would also reap a local amend that was never pushed. The tie is computed on the same tip the delete's compare-and-swap uses, and everything after it — worktree guards, holder re-check, `wt_recheck_delete`, `worktree remove` without `--force` — runs unchanged. There is no name filter.
+- **The second proof is a KEEP with a reason unless every check holds.** One lookup by head name, merged PRs only. Exactly one PR matches — none, or several (a reused name), keeps. Its base is the branch `BASE_REF` names. It is not cross-repository. Its `headRefOid` is a commit present locally and an ancestor of `origin/main`, asked of git and never trusted from the API — a squash merge's head is not on `origin/main`, so it stays kept. Its timeline has no next page of force-pushes, since the tie would be read off a partial list. A tip that is none of the recorded heads, or an ancestor of none present locally, is kept.
+- **The second proof fails closed, per branch and per cause.** One aliased `gh api graphql` lookup per run covers every `[gone]` branch, at most 500 branches per call (GitHub refused 1000 aliases in one query as over its resource limits, measured), and is issued the first time a branch needs it; a run with no `+` branch never calls `gh`. The host is always the one `origin` names, passed as `--hostname`, so `GH_HOST` cannot redirect it. Branch names go in as GraphQL variables, never spliced into the query. Output is captured, never piped, and the call runs under a bounded timeout. `gh` missing, a non-zero exit with no complete body, a stall past the budget, output that does not parse, and a next page each keep every affected branch with its own reason after `unmerged commits —`, and the run carries on; a non-zero exit that did print a complete body is read, and a branch missing from it keeps with gh's exit status and stderr in its reason. Nothing is cached: an untied branch is asked about again on every pass. Where `origin` has no `host/owner/repo` URL (a local path) or `BASE_REF` is not an `origin` ref there is nobody to ask, and the reason stays the bare `unmerged commits`. An `origin` whose host is an ssh alias (`git@github-work:owner/repo`) or an `insteadOf` shorthand (`gh:owner/repo`) is read as written, so `gh` is asked about a host it cannot reach and every affected branch keeps with `gh failed`. Only the `git fetch` failure still aborts the run.
 - **A worktree registry that cannot be read is a KEEP, for every `[gone]` branch in that pass.** The lookup decides whether the dirty, ignored-files and removal checks run at all; an unread registry reads identical to "no worktree", and `-D`, the delete then, needed no answer from the registry to delete a branch that has none — so failing open force-deleted merged branches blind. The holder check before the delete asks only whether a worktree holds the branch, never those other questions, so the lookup still fails closed on its own. The listing is re-read per branch, so one repo-level failure keeps every `[gone]` branch in the pass, each with git's own cause. Reap runs after every merge pass, so the next one retries: nothing is lost, nothing is reaped blind.
 - **A registry the listing does not match is a KEEP for the whole pass, not just one branch — if the fault is standing.** Eight real admin-directory faults leave `git worktree list` at rc 0 while the held entry loses its `branch` line (admin `HEAD` garbage, empty, missing or chmod 000) or leaves the listing (`gitdir` missing or chmod 000, admin dir chmod 000, `.git/worktrees` replaced by a file) — and git's own "used by worktree" `-D` refusal read the same admin state, so it deleted the branch a live worktree held (measured, git 2.50.1). The holder check that replaced that refusal reads the same listing and answers "not held" for seven of the eight (measured; "cannot tell" only for `HEAD` missing), so it is no backstop either. So before the lookup is trusted, linked entries listed are counted against entries under `<git-common-dir>/worktrees/` (worktree.sh's `wt_counts`, recount-before-refuse included), and any linked entry with a null `HEAD` and no `branch` line fails it too — the HEAD faults keep the counts equal. A dropped or nameless entry says nothing about which branch it held. The check re-reads the listing per branch, so a standing fault — one still there on every branch's own read — keeps every `[gone]` branch in the pass, the healthy ones included; a transient one, healed before the next branch's read, keeps only the branches whose listing it touched. Either way nothing is reaped blind, and the next pass retries once the registry reads consistent again.
 - **`worktree remove` without `--force`.** Refuses on modifications *and* untracked files, so double-covers dirty check. Refusal is finding to report, never something to force past.
@@ -40,7 +43,7 @@ Above walk finds branch's worktree by `branch refs/heads/<name>` line `git workt
 So `reap.sh` enumerates worktrees git lists with **no `branch` line at all** and decides each on own state:
 
 - **Bounded to `*/.worktrees/*` — fleet's own worktree home — and everything outside it is a `kept` entry.** Branch sweep authorizes its branch delete on evidence PR merged (`%(upstream:track)` reads exactly `[gone]`). This sweep has none to read: branchless + clean + patch-equivalent also describes human's `git worktree add --detach` scratch checkout that was never ticket. Unbounded, `--apply` deleted it (measured in review). Bound is ownership, never contents.
-- **`git cherry` against `origin/main`, never `merge-base --is-ancestor`.** Branch was rebased before it merged, so tip fully upstream is patch-equivalent, not ancestor — ancestry answers no for exactly work that is safe. Subject is full object id off porcelain, so no refname shadows it.
+- **`git cherry` against `origin/main`, never `merge-base --is-ancestor`.** Branch was rebased before it merged, so tip fully upstream is patch-equivalent, not ancestor — ancestry answers no for exactly work that is safe. A `+` can also be context drift rather than missing work, so its keep is safe but leaky; this sweep's code is unchanged, and it has no branch name to look a PR up by. Subject is full object id off porcelain, so no refname shadows it.
 - **Absent `branch` line is not by itself detached HEAD.** git prints none for worktree whose HEAD it cannot resolve either, reporting null object id instead — four measured corruption routes for admin `HEAD`. Nothing about such worktree decidable, so report and leave. Null id alone is not the test: unborn branch is legitimate null id and DOES carry `branch` line.
 - **A git operation in progress is a keep, and git is no backstop for it.** Measured, git 2.50.1 (Apple Git-155): `worktree remove` *without* `--force` removes worktree holding interrupted rebase, and one holding bisect, at rc 0. Both detach, both leave `status --porcelain` empty — so every other check passes them and sequencer state, todo list and original head go with directory. Interrupted rebase is exactly how fleet worktree wanders off its branch (see `release-ticket.sh`'s own stray guard).
 - **Every decline is a `kept` entry, `branch` null.** No branch to name. Gap was invisible precisely because nothing was reported.
@@ -58,10 +61,12 @@ So nothing in the run cleans it up. Next run, the in-flight probe's local-worktr
 
 - **`ahead` + dirty catch a member that did work.** `ahead` against `origin/main`. Not redundant with `git cherry`: commit already cherry-picked upstream is upstream-equivalent (`-` line, not `+`), and only `ahead` still sees it. Pinned by a test.
 - **`git cherry` catches commits that exist only locally.** Against `origin/main`, never a local main — same trap reap has.
-- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server.
+- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server. A pushed branch blocks unless it is the closed-unmerged shape below.
 - **Label read first, `gh` failure fatal.** Worktree and branch gone with `in-progress` left behind hides the ticket from `candidates.mjs` entirely — worse than not releasing. All three artefacts or none.
 
-**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
+**One pushed branch releases: a claim whose PR closed unmerged.** Every PR of this repository whose head is the branch reads CLOSED — none OPEN, none MERGED, at least one present. Read with `gh pr list` only once no local check blocks, so a blocked claim still reports without asking GitHub; a list that cannot be read, or names no PR, blocks. `ahead` and `git cherry` do not apply — a closed PR's commits are the branch's whole content — so the local branch must sit at the tip origin holds instead, re-checked at the local delete. The remote branch is a fourth artefact: `--apply` deletes it after the local deletes and before the label drops, re-reading origin's tip first and halting if it moved. A plain delete, not leased on that tip, so a push landing between the re-read and the delete goes with the branch. A delete whose `git push` fails is read back from origin: gone counts as done.
+
+**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. In the closed-unmerged shape the tip-at-origin check and its re-check at the delete stand in for `ahead`, `git cherry` and the recount; the worktree check stays. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
 
 **A checkout that lands between that fresh check and the delete halts the release after it.** `git worktree add` of an existing branch does not move the ref, so the compare-and-swap succeeds under it. The same `wt_recheck_delete` reap uses then finds the worktree, recreates the branch at the tip, and the release halts with exit 2, `released:false` and a blocker naming that worktree — the shape of a holder caught before the delete. A restore that fails halts the same way, with the tip and the repair command in the blocker.