@feigi/fleet-ctl 3.80.0 → 3.80.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.80.0",
+  "version": "3.80.2",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/reap.sh

@@ -434,11 +434,15 @@ keep() {
 # subshell before `gp_rc=$?` or the printf below ever run, and `gp_raw` comes
 # back empty — silently, at the one moment this function exists to not be
 # silent (measured on this exact shape).
+#
+# The capture is `probe`, over any command; `git_probe` is `probe git`.
+# pr_load's gh call below is the one other caller: its stdout fields are
+# refnames, numbers, object ids and fixed words, none of which can hold 0x02.
 gp_sep=$(printf '\002')
-git_probe() {
+probe() {
   gp_raw=$(
     {
-      if gp_o=$(git "$@" 2>&3); then gp_rc=0; else gp_rc=$?; fi
+      if gp_o=$("$@" 2>&3); then gp_rc=0; else gp_rc=$?; fi
       printf '%s' "$gp_sep$gp_o$gp_sep$gp_rc"
     } 3>&1
   )
@@ -448,6 +452,7 @@ git_probe() {
   gp_rc=${gp_raw#*"$gp_sep"}
   return "$gp_rc"
 }
+git_probe() { probe git "$@"; }
 
 # True when git's stderr says the directory walk was CUT SHORT — entries are
 # missing from $gp_out — as opposed to git merely having said something.
@@ -669,6 +674,296 @@ null_head_why() {
   return 0
 }
 
+# THE SECOND MERGE PROOF. `git cherry` answers one question — is each of this
+# branch's commits patch-equivalent to something on $base — and answers it
+# wrongly for a claim the merge bot rebased server-side onto a `main` that had
+# changed the claim's own context lines: the rebased commit carries different
+# context, so a different patch id, and the original reads `+` although
+# everything on it was merged. (A `+` is therefore not always "a commit that
+# exists nowhere else"; the keep it produces is safe but leaky.) Measured on
+# this repository's own [gone] branches, most of the stranded tips are not the
+# bot's doing at all: a member that pushes `HEAD:<branch>` from a detached
+# worktree replaces the remote branch and never moves the local ref, so the
+# local tip is a head the PR's remote branch once held.
+#
+# That is the fact this proof reads, and only GitHub records it: the PR's
+# `headRefOid` and the `beforeCommit` of every force-push on it are the heads
+# its branch held. A tip that equals one, or is an ancestor of one this clone
+# has, was pushed to the PR's remote branch and then replaced by its owner's
+# force-push — nothing on it was ever local-only. Equality or ancestry is
+# enough; no range-diff pairing, which was measured to reap none of the
+# stranded tips (every branch has a `!` pair, context drift again) and which,
+# if it accepted `!`, would also reap a local amend that was never pushed.
+#
+# It is additive. It runs only for a branch `git cherry` already keeps, after
+# that verdict, and only ever turns that keep into a reap: the cherry proof,
+# the worktree guards, the holder re-check, the compare-and-swap on the tip
+# read once and `wt_recheck_delete` are all unchanged, and the tie is computed
+# on that same frozen tip. There is no name filter.
+#
+# One lookup per branch, by head name, MERGED PRs only, and a KEEP with its
+# reason unless ALL of: exactly one PR matches (a reused name can match
+# several); its timeline of force-pushes has no next page, because the tie
+# would then be read off a partial list; its base is the branch BASE_REF
+# names; it is not cross-repository; its `headRefOid` is a commit present
+# here and an ancestor of $base_rev — the ancestry is asked of git, not
+# trusted from the API; and the tip equals one of the PR's recorded heads or
+# is an ancestor of one present here. A squash merge's head is not on $base,
+# so it stays kept.
+#
+# One aliased `gh api graphql` lookup per run, one call per $pr_chunk branches
+# and issued the first time a branch needs it, covers every [gone] branch (a
+# superset of the ones waiting: which will need it is only known branch by
+# branch). Branch names go in as GraphQL VARIABLES, never spliced into the
+# query text — `"` is legal in a refname.
+# Output is captured, never piped, and the call runs under a watchdog. Each of
+# these keeps every affected branch with its own reason and the run carries on:
+# gh missing, a non-zero exit with no complete body (a non-zero exit that DID
+# print a complete body — gh does so when the response also carries an
+# `errors` array — is read, and any alias without an entry keeps, with gh's
+# exit status and stderr in its reason), output that is not the shape the
+# script's own `--jq` produces, and a timeline with a next page. Nothing is
+# cached between runs, so an untied branch is asked about again on every pass.
+#
+# It does not apply — and the reason stays the bare `unmerged commits` — where
+# the repository has no GitHub identity to ask about: $base is not a
+# remote-tracking ref of `origin`, or `remote.origin.url` is not a
+# `host/owner/repo` URL (a local path, say). That is not a failure of the
+# proof, there is simply nobody to put the question to. `git config`, never
+# `git remote get-url`: the latter applies `insteadOf` rewrites, which would
+# name the transport rather than the repository.
+#
+# No `[a-z]`-style range anywhere in this block, and no tool whose result
+# depends on the locale: the pin above is a global, and its inventory is
+# enforced by a test.
+case "$base" in
+  origin/*) pr_base=${base#origin/} ;;
+  refs/remotes/origin/*) pr_base=${base#refs/remotes/origin/} ;;
+  *) pr_base= ;;
+esac
+pr_loaded=false
+pr_off=false
+pr_all_why=
+pr_rows=
+pr_why=
+pr_part_why=
+pr_us=$(printf '\037')
+
+# Reads `remote.origin.url` into $pr_owner, $pr_name and $pr_host. Returns 1
+# where it names no `host/owner/repo` — a local path, or a shape with no owner.
+pr_identity() {
+  pi_url=$(git config --get remote.origin.url 2>/dev/null) || return 1
+  case "$pi_url" in
+    /* | ./* | ../* | file://*) return 1 ;;
+    *://*)
+      pi_rest=${pi_url#*://}
+      pi_host=${pi_rest%%/*}
+      pi_path=${pi_rest#*/}
+      ;;
+    *:*)
+      pi_host=${pi_url%%:*}
+      pi_path=${pi_url#*:}
+      ;;
+    *) return 1 ;;
+  esac
+  pi_host=${pi_host##*@}
+  pi_host=${pi_host%%:*}
+  pi_path=${pi_path%/}
+  pi_path=${pi_path%.git}
+  pr_owner=${pi_path%%/*}
+  pr_name=${pi_path#*/}
+  pr_host=$pi_host
+  [ -n "$pr_host" ] && [ -n "$pr_owner" ] && [ "$pr_name" != "$pi_path" ] && [ -n "$pr_name" ] || return 1
+  case "$pr_name" in */*) return 1 ;; esac
+  return 0
+}
+
+# `gh "$@"`, neither prompting nor outliving <budget> seconds: the bounded-call
+# shape net_git has for git, over the same kill walk. It lives here and not in
+# net.sh because this is the one gh call in the fleet that is bounded; net.sh
+# records why the others are not. stdout is gh's, stderr is gh's, and the
+# status is gh's own — 143 or 137 when the watchdog fired (net_stalled). The
+# watchdog closes fd 3, pr_load's stderr capture: where net_kill_tree cannot
+# read `ps`, its sleep outlives the call, and holding that pipe open would
+# stall even a fast answer for the whole budget.
+gh_bounded() {
+  (
+  gb_budget=$1
+  shift
+  GH_PROMPT_DISABLED=1 GH_NO_UPDATE_NOTIFIER=1 gh "$@" </dev/null &
+  gb_pid=$!
+  { sleep "$gb_budget"; net_kill_tree "$gb_pid"; } >/dev/null 2>&1 3>&- &
+  gb_wd=$!
+  gb_status=0
+  wait "$gb_pid" 2>/dev/null || gb_status=$?
+  net_kill_tree "$gb_wd"
+  exit "$gb_status"
+  )
+}
+
+# One run's lookup. Sets $pr_off (the proof does not apply here), $pr_all_why
+# (it could not be read, for every branch) or $pr_rows (the answer).
+#
+# At most $pr_chunk aliases per call: GitHub refuses the whole query with
+# `Resource limits for this query exceeded` somewhere between 850 aliases
+# (answered) and 1000 (refused), measured against this repository, which would
+# keep every `+` branch on every run once the [gone] backlog grew that far.
+# Alias numbers stay global across calls, so pr_tie reads `b<N>` the same way
+# however many calls the answer took; any call that fails fails them all.
+pr_chunk=500
+pr_load() {
+  pr_loaded=true
+  [ -n "$pr_base" ] || { pr_off=true; return 0; }
+  pr_identity || { pr_off=true; return 0; }
+  if ! command -v gh >/dev/null 2>&1; then
+    pr_all_why="gh is not installed, so GitHub's record of this tip could not be read"
+    return 0
+  fi
+  # One line per alias, `\037`-joined and closed by a lone `.`, so a short or
+  # long row cannot be mistaken for a whole one: the same separator, and the
+  # same reason for it, as delete-merged-branch.sh's `gh pr view` read.
+  pl_jq='.data.repository | to_entries[] | .key as $k | (.value.nodes // []) as $n
+    | [$k, (if .value == null then "null" else ($n | length | tostring) end),
+       ($n[0] // {} | ((.number // "" | tostring), (.baseRefName // ""), (.isCrossRepository | tostring), (.headRefOid // ""),
+                      (.timelineItems.pageInfo.hasNextPage | tostring), ([.timelineItems.nodes[]? | .beforeCommit.oid? // empty] | join(",")))),
+       "."] | join("\u001f")'
+  pl_budget=$(net_budget 60 "${FLEET_NET_TIMEOUT:-}")
+  pl_n=0
+  for pl_b in $gone_branches; do pl_n=$((pl_n + 1)); done
+  pl_lo=0
+  while [ "$pl_lo" -lt "$pl_n" ]; do
+    pl_hi=$((pl_lo + pr_chunk))
+    pl_decl='$owner:String!,$name:String!'
+    pl_sel=
+    set -- -f "owner=$pr_owner" -f "name=$pr_name"
+    pl_i=0
+    for pl_b in $gone_branches; do
+      if [ "$pl_i" -ge "$pl_lo" ] && [ "$pl_i" -lt "$pl_hi" ]; then
+        pl_decl="$pl_decl,\$h$pl_i:String!"
+        pl_sel="${pl_sel}b$pl_i:pullRequests(headRefName:\$h$pl_i,states:MERGED,first:2){nodes{number baseRefName isCrossRepository headRefOid timelineItems(itemTypes:[HEAD_REF_FORCE_PUSHED_EVENT],first:100){pageInfo{hasNextPage} nodes{... on HeadRefForcePushedEvent{beforeCommit{oid}}}}}} "
+        set -- "$@" -f "h$pl_i=$pl_b"
+      fi
+      pl_i=$((pl_i + 1))
+    done
+    pl_query="query($pl_decl){repository(owner:\$owner,name:\$name){$pl_sel}}"
+    # `--hostname` always, github.com included: without it gh asks GH_HOST, or
+    # its own default, rather than the host origin names.
+    set -- api graphql --hostname "$pr_host" -f "query=$pl_query" "$@" --jq "$pl_jq"
+    pl_to=$pl_hi
+    [ "$pl_to" -le "$pl_n" ] || pl_to=$pl_n
+    echo "\$ gh api graphql (merged PRs by head branch, [gone] branches $((pl_lo + 1))-$pl_to of $pl_n)" >&2
+    if probe gh_bounded "$pl_budget" "$@"; then pl_rc=0; else pl_rc=$?; fi
+    pl_o=$gp_out
+    pl_err=$gp_err
+    # Every line must be a whole row; one that is not makes the body unusable.
+    pl_ok=false
+    if [ -n "$pl_o" ]; then
+      pl_ok=true
+      while IFS=$pr_us read -r pk pcnt pnum pbase pcross poid phn pbef pend; do
+        case "${pk#b}" in '' | *[!0123456789]*) pl_ok=false ;; esac
+        [ "$pk" != "${pk#b}" ] || pl_ok=false
+        [ "$pend" = . ] || pl_ok=false
+      done <<EOF
+$pl_o
+EOF
+    fi
+    if [ "$pl_ok" = true ]; then
+      pr_rows=${pr_rows:+$pr_rows
+}$pl_o
+      [ "$pl_rc" = 0 ] || pr_part_why="$pr_part_why (gh exited $pl_rc$(gp_why "$pl_err"))"
+    else
+      if [ "$pl_rc" = 0 ]; then
+        pr_all_why="gh answered with unparseable output, so GitHub's record of this tip could not be read"
+      elif net_stalled "$pl_rc"; then
+        pr_all_why="gh did not finish within ${pl_budget}s and was killed, so GitHub's record of this tip could not be read"
+      else
+        pr_all_why="gh failed (exit $pl_rc)$(gp_why "$pl_err"), so GitHub's record of this tip could not be read"
+      fi
+      pr_rows=
+      return 0
+    fi
+    pl_lo=$pl_hi
+  done
+  return 0
+}
+
+# Does GitHub's record tie branch $1, at frozen tip $2, to a head its merged PR
+# held? Returns 0 when it does; otherwise 1, with the reason in $pr_why.
+pr_tie() {
+  pt_b=$1
+  pt_tip=$2
+  pt_i=0
+  for pt_x in $gone_branches; do
+    [ "$pt_x" != "$pt_b" ] || break
+    pt_i=$((pt_i + 1))
+  done
+  pt_row=false
+  while IFS=$pr_us read -r pk pcnt pnum pbase pcross poid phn pbef pend; do
+    if [ "$pk" = "b$pt_i" ]; then pt_row=true; break; fi
+  done <<EOF
+$pr_rows
+EOF
+  if [ "$pt_row" != true ]; then
+    pr_why="GitHub's answer has no entry for $pt_b$pr_part_why"
+    return 1
+  fi
+  case "$pcnt" in
+    0) pr_why="no merged PR has the head branch $pt_b"; return 1 ;;
+    1) ;;
+    '' | null | *[!0123456789]*) pr_why="GitHub returned no usable PR list for $pt_b$pr_part_why"; return 1 ;;
+    *) pr_why="several merged PRs have the head branch $pt_b"; return 1 ;;
+  esac
+  case "$pnum" in '' | *[!0123456789]*) pnum="?" ;; esac
+  if [ "$phn" != false ]; then
+    pr_why="PR #$pnum has more force-pushes than one page of its timeline returned, so its recorded heads are incomplete"
+    return 1
+  fi
+  if [ "$pbase" != "$pr_base" ]; then
+    pr_why="PR #$pnum is based on $pbase, not $pr_base"
+    return 1
+  fi
+  if [ "$pcross" != false ]; then
+    pr_why="PR #$pnum comes from another repository"
+    return 1
+  fi
+  case "$poid" in '' | *[!0123456789abcdef]*)
+    pr_why="PR #$pnum has a headRefOid that is not a commit id: '$poid'"
+    return 1
+    ;;
+  esac
+  if ! git_probe cat-file -e "$poid^{commit}"; then
+    pr_why="PR #$pnum's headRefOid $poid is not a commit present locally"
+    return 1
+  fi
+  if git_probe merge-base --is-ancestor "$poid" "$base_rev"; then :; else
+    if [ "$?" -eq 1 ]; then
+      pr_why="PR #$pnum's headRefOid $poid is not an ancestor of $base, so it did not merge by a rebase or a merge commit onto it"
+    else
+      pr_why="cannot tell whether PR #$pnum's headRefOid $poid is an ancestor of $base$(gp_why)"
+    fi
+    return 1
+  fi
+  # The recorded heads: the head the PR ended on, then every force-pushed-over one.
+  pt_unsure=false
+  pt_unsure_why=
+  pt_rest="$poid,$pbef"
+  while [ -n "$pt_rest" ]; do
+    pt_h=${pt_rest%%,*}
+    case "$pt_rest" in *,*) pt_rest=${pt_rest#*,} ;; *) pt_rest= ;; esac
+    case "$pt_h" in '' | *[!0123456789abcdef]*) continue ;; esac
+    if [ "$pt_h" = "$pt_tip" ]; then return 0; fi
+    git_probe cat-file -e "$pt_h^{commit}" || continue
+    if git_probe merge-base --is-ancestor "$pt_tip" "$pt_h"; then return 0; else pt_rc=$?; fi
+    if [ "$pt_rc" -ne 1 ]; then pt_unsure=true; pt_unsure_why=$(gp_why); fi
+  done
+  if [ "$pt_unsure" = true ]; then
+    pr_why="cannot tell whether the tip is an ancestor of a head the PR recorded$pt_unsure_why"
+    return 1
+  fi
+  pr_why="the tip $pt_tip is not a head the PR recorded, nor an ancestor of one present locally"
+  return 1
+}
+
 # %(upstream:track) emits exactly [gone] as its own field — nothing to
 # pattern-match, and no -v/-vv trap.
 #
@@ -769,8 +1064,9 @@ for b in $gone_branches; do
   tip=$gp_out
 
   # git cherry against origin/main, not a local main: a local main never
-  # fast-forwarded reads every merged branch as unmerged. Any + line is a commit
-  # that exists nowhere else.
+  # fast-forwarded reads every merged branch as unmerged. A + line is a commit
+  # with no patch-equivalent upstream: usually one that exists nowhere else, but
+  # not always — see the second merge proof above the loop.
   #
   # Captured, not piped: `cmd | grep -q` takes grep's exit status, never cmd's,
   # so a `git cherry` that dies (exit 128 — one unreadable loose object is
@@ -833,8 +1129,22 @@ for b in $gone_branches; do
     keep "$b" "cherry scan failed — cannot tell if merged$(gp_why "$gq_err")"
     continue
   elif [ "$gq_rc" -eq 0 ]; then
-    keep "$b" "unmerged commits"
-    continue
+    # `+` is a keep unless the second proof (its header is above the loop)
+    # ties this very `$tip` to a head the branch's merged PR held. Everything
+    # after this block — the worktree guards, the holder re-check, the
+    # compare-and-swap on `$tip` — runs exactly as it does for a branch the
+    # cherry cleared.
+    [ "$pr_loaded" = true ] || pr_load
+    if [ "$pr_off" = true ]; then
+      keep "$b" "unmerged commits"
+      continue
+    elif [ -n "$pr_all_why" ]; then
+      keep "$b" "unmerged commits — $pr_all_why"
+      continue
+    elif ! pr_tie "$b" "$tip"; then
+      keep "$b" "unmerged commits — $pr_why"
+      continue
+    fi
   fi
 
   # The listing is read per branch, through worktree.sh's `wt_counts`, which

package/skills/run-team/references/reaping.md

@@ -22,11 +22,14 @@ Every precondition recomputed **inside** same command as delete:
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
 - **A branch with no upstream is reported `kept`, never selected.** `%(upstream)` is empty for it, so `%(upstream:track)` has no `[gone]` to match. The sweep reports it with reason `no upstream — never selected` and runs no other guard on it. Its upstream arrives with the first `-u` push, or when the controller settles the implementer's report.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
-- **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
+- **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. A `+` line is a commit with no patch-equivalent upstream, which is usually a commit that exists nowhere else but not always: a claim the merge bot rebased server-side onto a `main` that had changed its context lines carries a different patch id, so its original tip reads `+` although everything on it merged. That keep is safe but leaky, and the second proof below is what closes it.
 - **The delete is `git update-ref -d`'s compare-and-swap on a tip read once, authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D`, the delete this replaced. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
 - **A branch any worktree holds is a KEEP, checked right before the delete.** `update-ref` consults no worktree; `-D` did. So listing is re-read and worktree.sh's `wt_holding` asks: held by a `branch` line, or by detached worktree stopped mid `rebase -i` / mid `bisect` on it (admin dir's `head-name` / `BISECT_START`) — both routes `-D` refused on. Worktree it cannot resolve, or listing that will not re-read, is a KEEP. `--apply` only, like the delete: dry run cannot predict this refusal — not the same limitation `-D`'s dry run had, since an unrelated worktree elsewhere in the listing that this check cannot resolve keeps every `[gone]` branch in the pass (see below), a repo-wide case `-D` never produced.
 - **A worktree that checked the branch out while the delete ran is caught after it, and the branch is put back.** git has no lock that stops `git worktree add <p> <b>` between that holder check and the delete, and such an add writes only the new worktree's `HEAD` — the ref does not move, so the compare-and-swap succeeds and leaves the worktree on a branch that no longer exists (measured, git 2.50.1). So worktree.sh's `wt_recheck_delete` re-reads the listing right after the delete — and again, up to 20 times 0.1s apart, while an add in progress is listed `locked initializing` — and when a worktree holds the branch, or the wait runs out, recreates it at the tip with a create-only `git update-ref`. The branch is a KEEP naming the worktree or the entry, and its config section stays. A restore that fails is a KEEP naming the tip, git's error and the command that restores it by hand — or, when something recreated the branch since the delete, the commit it now sits at, left as it is, since the create-only restore never overwrites it. The branch's reflog does not come back.
 - **A cherry that cannot answer is a KEEP.** Capture git's output; never pipe git itself: `cmd | grep -q` takes grep's exit status, never cmd's, so a `git cherry` that dies (rc 128 — one unreadable loose object is enough) prints nothing, grep exits 1, and a dead probe reads identical to "nothing unmerged" (verified, git 2.50.1). Unanswerable probe authorizes no delete — same fail-closed shape as `worktree remove` below. Read the `+` anchored, too: the capture folds stderr in, so an unanchored match reads a `+` in a diagnostic as a commit. Pinned by a test.
+- **A branch `git cherry` keeps gets a second proof, from GitHub's record of the PR's heads.** A stranded tip is a head the PR's remote branch once held: a member's `HEAD:<branch>` push from a detached worktree, or the merge bot's server-side rebase, replaced the remote branch and never moved the local ref. GitHub records those heads — the PR's `headRefOid` and the `beforeCommit` of every force-push on it. A tip that **equals** a recorded head, or is an **ancestor** of one this clone has, was pushed and then replaced by its owner's force-push, so nothing on it was ever local-only. Equality or ancestry is enough: no `git range-diff` pairing, which reaped none of the measured tips (every branch has a `!` pair, context drift again) and, if it accepted `!`, would also reap a local amend that was never pushed. The tie is computed on the same tip the delete's compare-and-swap uses, and everything after it — worktree guards, holder re-check, `wt_recheck_delete`, `worktree remove` without `--force` — runs unchanged. There is no name filter.
+- **The second proof is a KEEP with a reason unless every check holds.** One lookup by head name, merged PRs only. Exactly one PR matches — none, or several (a reused name), keeps. Its base is the branch `BASE_REF` names. It is not cross-repository. Its `headRefOid` is a commit present locally and an ancestor of `origin/main`, asked of git and never trusted from the API — a squash merge's head is not on `origin/main`, so it stays kept. Its timeline has no next page of force-pushes, since the tie would be read off a partial list. A tip that is none of the recorded heads, or an ancestor of none present locally, is kept.
+- **The second proof fails closed, per branch and per cause.** One aliased `gh api graphql` lookup per run covers every `[gone]` branch, at most 500 branches per call (GitHub refused 1000 aliases in one query as over its resource limits, measured), and is issued the first time a branch needs it; a run with no `+` branch never calls `gh`. The host is always the one `origin` names, passed as `--hostname`, so `GH_HOST` cannot redirect it. Branch names go in as GraphQL variables, never spliced into the query. Output is captured, never piped, and the call runs under a bounded timeout. `gh` missing, a non-zero exit with no complete body, a stall past the budget, output that does not parse, and a next page each keep every affected branch with its own reason after `unmerged commits —`, and the run carries on; a non-zero exit that did print a complete body is read, and a branch missing from it keeps with gh's exit status and stderr in its reason. Nothing is cached: an untied branch is asked about again on every pass. Where `origin` has no `host/owner/repo` URL (a local path) or `BASE_REF` is not an `origin` ref there is nobody to ask, and the reason stays the bare `unmerged commits`. An `origin` whose host is an ssh alias (`git@github-work:owner/repo`) or an `insteadOf` shorthand (`gh:owner/repo`) is read as written, so `gh` is asked about a host it cannot reach and every affected branch keeps with `gh failed`. Only the `git fetch` failure still aborts the run.
 - **A worktree registry that cannot be read is a KEEP, for every `[gone]` branch in that pass.** The lookup decides whether the dirty, ignored-files and removal checks run at all; an unread registry reads identical to "no worktree", and `-D`, the delete then, needed no answer from the registry to delete a branch that has none — so failing open force-deleted merged branches blind. The holder check before the delete asks only whether a worktree holds the branch, never those other questions, so the lookup still fails closed on its own. The listing is re-read per branch, so one repo-level failure keeps every `[gone]` branch in the pass, each with git's own cause. Reap runs after every merge pass, so the next one retries: nothing is lost, nothing is reaped blind.
 - **A registry the listing does not match is a KEEP for the whole pass, not just one branch — if the fault is standing.** Eight real admin-directory faults leave `git worktree list` at rc 0 while the held entry loses its `branch` line (admin `HEAD` garbage, empty, missing or chmod 000) or leaves the listing (`gitdir` missing or chmod 000, admin dir chmod 000, `.git/worktrees` replaced by a file) — and git's own "used by worktree" `-D` refusal read the same admin state, so it deleted the branch a live worktree held (measured, git 2.50.1). The holder check that replaced that refusal reads the same listing and answers "not held" for seven of the eight (measured; "cannot tell" only for `HEAD` missing), so it is no backstop either. So before the lookup is trusted, linked entries listed are counted against entries under `<git-common-dir>/worktrees/` (worktree.sh's `wt_counts`, recount-before-refuse included), and any linked entry with a null `HEAD` and no `branch` line fails it too — the HEAD faults keep the counts equal. A dropped or nameless entry says nothing about which branch it held. The check re-reads the listing per branch, so a standing fault — one still there on every branch's own read — keeps every `[gone]` branch in the pass, the healthy ones included; a transient one, healed before the next branch's read, keeps only the branches whose listing it touched. Either way nothing is reaped blind, and the next pass retries once the registry reads consistent again.
 - **`worktree remove` without `--force`.** Refuses on modifications *and* untracked files, so double-covers dirty check. Refusal is finding to report, never something to force past.
@@ -40,7 +43,7 @@ Above walk finds branch's worktree by `branch refs/heads/<name>` line `git workt
 So `reap.sh` enumerates worktrees git lists with **no `branch` line at all** and decides each on own state:
 
 - **Bounded to `*/.worktrees/*` — fleet's own worktree home — and everything outside it is a `kept` entry.** Branch sweep authorizes its branch delete on evidence PR merged (`%(upstream:track)` reads exactly `[gone]`). This sweep has none to read: branchless + clean + patch-equivalent also describes human's `git worktree add --detach` scratch checkout that was never ticket. Unbounded, `--apply` deleted it (measured in review). Bound is ownership, never contents.
-- **`git cherry` against `origin/main`, never `merge-base --is-ancestor`.** Branch was rebased before it merged, so tip fully upstream is patch-equivalent, not ancestor — ancestry answers no for exactly work that is safe. Subject is full object id off porcelain, so no refname shadows it.
+- **`git cherry` against `origin/main`, never `merge-base --is-ancestor`.** Branch was rebased before it merged, so tip fully upstream is patch-equivalent, not ancestor — ancestry answers no for exactly work that is safe. A `+` can also be context drift rather than missing work, so its keep is safe but leaky; this sweep's code is unchanged, and it has no branch name to look a PR up by. Subject is full object id off porcelain, so no refname shadows it.
 - **Absent `branch` line is not by itself detached HEAD.** git prints none for worktree whose HEAD it cannot resolve either, reporting null object id instead — four measured corruption routes for admin `HEAD`. Nothing about such worktree decidable, so report and leave. Null id alone is not the test: unborn branch is legitimate null id and DOES carry `branch` line.
 - **A git operation in progress is a keep, and git is no backstop for it.** Measured, git 2.50.1 (Apple Git-155): `worktree remove` *without* `--force` removes worktree holding interrupted rebase, and one holding bisect, at rc 0. Both detach, both leave `status --porcelain` empty — so every other check passes them and sequencer state, todo list and original head go with directory. Interrupted rebase is exactly how fleet worktree wanders off its branch (see `release-ticket.sh`'s own stray guard).
 - **Every decline is a `kept` entry, `branch` null.** No branch to name. Gap was invisible precisely because nothing was reported.