claude-dev-env 8.98.6 → 8.98.8

package/scripts/Sync-RepoMain.ps1

@@ -8,9 +8,11 @@
   a remote, such as a read-only mirror kept current by a scheduled task.
 
   Safety rules:
-  - Only runs when the checked-out branch is the named branch
+  - Only runs when the checked-out branch is the named branch, unless
+    -Mirror is passed
   - Only runs when there are no tracked changes (untracked files are fine),
-    unless -StashDirty is passed
+    unless -StashDirty is passed. A -Mirror return stashes the tree the old
+    checkout left whatever -StashDirty says
   - Uses merge --ff-only (never force, never hard reset, never clean)
   - When the fast-forward fails because the files were already copied in,
     moves HEAD with a mixed reset, which writes no files. It keeps that move
@@ -42,6 +44,20 @@
   missing; when that pop also fails, the log names the stash entry so the
   operator can recover it by hand.
 
+.PARAMETER Mirror
+  Marks the tree as a mirror that must always sit on the named branch. With
+  the switch, a checkout found on another branch or a detached HEAD is moved
+  back: HEAD points at the local named branch again and a mixed reset moves
+  the index there. Every path that still holds the old checkout's content,
+  including files only the old checkout tracked, is stashed as "mirror
+  return <yyyy-MM-dd>: tree of <checkout> at <tip>", which puts the named
+  branch's files back. This stash runs with or without -StashDirty, because
+  a mirror's tree belongs to the named branch. The log names the checkout
+  and tip it left. A checkout with staged changes is skipped, so no staged
+  content is lost. When a step of the return fails, HEAD and the index go
+  back to the old checkout and the run exits 1. Without the switch, any
+  other checkout is skipped.
+
 .PARAMETER LogPath
   Absolute path to the run log (default: $HOME\.claude\logs\sync-repo-main.log).
 #>
@@ -52,6 +68,7 @@ param(
     [string]$Remote = 'origin',
     [string]$Branch = 'main',
     [switch]$StashDirty,
+    [switch]$Mirror,
     [string]$LogPath = (Join-Path $HOME '.claude\logs\sync-repo-main.log')
 )
 
@@ -131,6 +148,84 @@ function Invoke-GitOrExit {
     return $result.Output
 }
 
+function Invoke-MirrorReturn {
+    <#
+      Moves a mirror found on another branch or a detached HEAD back to the
+      named branch. HEAD and the index move first, then every path where the
+      tree still holds the old checkout's content is stashed, including files
+      only the old checkout tracked. Any failure puts HEAD and the index back
+      on the old checkout, so the next run meets the same state and tries again.
+    #>
+    param(
+        [Parameter(Mandatory)]
+        [AllowEmptyString()]
+        [string]$LeftBranch
+    )
+    $leftCheckoutName = if ($LeftBranch) { "branch '$LeftBranch'" } else { 'detached HEAD' }
+    $stagedResult = Invoke-Git -Arguments @('diff', '--cached', '--quiet')
+    if ($stagedResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'SKIP' -Message "mirror return refused: $leftCheckoutName has staged changes"
+        exit 3
+    }
+    $leftTip = Invoke-GitOrExit -Arguments @('rev-parse', 'HEAD') `
+        -FailureMessage 'cannot read the tip of the checkout being left' -FailureExitCode 2
+    $null = Invoke-GitOrExit -Arguments @('rev-parse', '--verify', '-q', "refs/heads/$Branch") `
+        -FailureMessage "mirror has no local $Branch branch to return to" -FailureExitCode 2
+    $leftOnlyResult = Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z', '--diff-filter=A', "refs/heads/$Branch", $leftTip)
+    if ($leftOnlyResult.ExitCode -ne 0) {
+        Write-SyncLog -Level 'ERROR' -Message "mirror return skipped: cannot list files only $leftCheckoutName tracks: $($leftOnlyResult.Output)"
+        exit 1
+    }
+    $null = Invoke-GitOrExit -Arguments @('symbolic-ref', 'HEAD', "refs/heads/$Branch") `
+        -FailureMessage "cannot point HEAD at $Branch" -FailureExitCode 1
+
+    $resetResult = Invoke-Git -Arguments @('reset', '-q')
+    $changedResult = if ($resetResult.ExitCode -eq 0) { Invoke-Git -Arguments @('diff', '--name-only', '--no-renames', '-z') } else { $resetResult }
+    $failure = if ($resetResult.ExitCode -ne 0) { "mixed reset onto $Branch failed: $($resetResult.Output)" }
+               elseif ($changedResult.ExitCode -ne 0) { "cannot list the tree left by $leftCheckoutName`: $($changedResult.Output)" }
+    $leftTreeNote = 'the tree already matched'
+    if (-not $failure) {
+        $allLeftPaths = [System.Collections.Generic.List[string]]::new()
+        foreach ($changedPath in Get-NulSeparatedPaths -Output $changedResult.Output) { $allLeftPaths.Add($changedPath) }
+        foreach ($leftOnlyPath in Get-NulSeparatedPaths -Output $leftOnlyResult.Output) {
+            if (Test-Path -LiteralPath (Join-Path $RepoPath $leftOnlyPath)) { $allLeftPaths.Add($leftOnlyPath) }
+        }
+        if ($allLeftPaths.Count -gt 0) {
+            $leftTreeStashMessage = 'mirror return {0}: tree of {1} at {2}' -f (Get-Date -Format 'yyyy-MM-dd'), $leftCheckoutName, $leftTip
+            $pathspecFile = $null
+            try {
+                $pathspecFile = New-TemporaryFile
+                $pathspecText = (($allLeftPaths | Select-Object -Unique | ForEach-Object { ":(literal)$_" }) -join "`0") + "`0"
+                [System.IO.File]::WriteAllText($pathspecFile.FullName, $pathspecText, [System.Text.UTF8Encoding]::new($false))
+                $stashResult = Invoke-Git -Arguments @('stash', 'push', '--all', '-m', $leftTreeStashMessage, "--pathspec-from-file=$($pathspecFile.FullName)", '--pathspec-file-nul')
+            }
+            catch {
+                $stashResult = [pscustomobject]@{ ExitCode = 1; Output = $_.Exception.Message }
+            }
+            finally {
+                if ($pathspecFile) {
+                    Remove-Item -LiteralPath $pathspecFile.FullName -Force -ErrorAction SilentlyContinue
+                }
+            }
+            if ($stashResult.ExitCode -ne 0) {
+                $failure = "stashing the tree of $leftCheckoutName failed: $($stashResult.Output)"
+            }
+            else {
+                $leftTreeNote = "its tree is stashed as '$leftTreeStashMessage'"
+            }
+        }
+    }
+    if ($failure) {
+        $restoreArguments = if ($LeftBranch) { @('symbolic-ref', 'HEAD', "refs/heads/$LeftBranch") } else { @('update-ref', '--no-deref', 'HEAD', $leftTip) }
+        $restoreResult = Invoke-Git -Arguments $restoreArguments
+        $indexResult = if ($resetResult.ExitCode -eq 0) { Invoke-Git -Arguments @('reset', '-q') } else { $restoreResult }
+        $restoreNote = if ($restoreResult.ExitCode -eq 0 -and $indexResult.ExitCode -eq 0) { "HEAD and index are back on $leftCheckoutName at $leftTip" } else { "putting HEAD back on $leftCheckoutName at $leftTip also failed: $($restoreResult.Output) $($indexResult.Output)" }
+        Write-SyncLog -Level 'ERROR' -Message "mirror return failed, $failure; $restoreNote"
+        exit 1
+    }
+    Write-SyncLog -Level 'MIRROR' -Message "left $leftCheckoutName at $leftTip; HEAD is on $Branch and $leftTreeNote"
+}
+
 function Get-NulSeparatedPaths {
     param(
         [Parameter(Mandatory)]
@@ -229,8 +324,11 @@ try {
     $currentBranch = Invoke-GitOrExit -Arguments @('branch', '--show-current') `
         -FailureMessage 'cannot read current branch' -FailureExitCode 2
     if ($currentBranch -ne $Branch) {
-        Write-SyncLog -Level 'SKIP' -Message "checkout is '$currentBranch', not '$Branch' (remote=$Remote)"
-        exit 3
+        if (-not $Mirror) {
+            Write-SyncLog -Level 'SKIP' -Message "checkout is '$currentBranch', not '$Branch' (remote=$Remote)"
+            exit 3
+        }
+        Invoke-MirrorReturn -LeftBranch $currentBranch
     }
 
     $statusOutput = Invoke-GitOrExit -Arguments @('status', '--porcelain') `

package/scripts/account_broker.py

@@ -168,6 +168,11 @@ def _mark_spent(all_state: dict[str, object], reading: Reading, now: datetime) -
     return until
 
 
+def _is_no_roster_name_beside_a_roster(product: Product, name: str, all_readings: Sequence[Reading]) -> bool:
+    all_roster_names = {each_reading.account.name for each_reading in all_readings}
+    return product is Product.CODEX and bool(all_roster_names) and name == NO_ROSTER_ACCOUNT_NAME and name not in all_roster_names
+
+
 def _outside_roster_resets(product: Product, all_readings: Sequence[Reading], all_state: Mapping[str, object], now: datetime) -> dict[str, datetime]:
     marks = all_state.get("spent") if isinstance(all_state.get("spent"), dict) else {}
     all_roster_names = {each_reading.account.name for each_reading in all_readings}
@@ -178,7 +183,7 @@ def _outside_roster_resets(product: Product, all_readings: Sequence[Reading], al
             continue
         name = each_key[len(prefix):-len(placeholder_suffix)]
         reset = _stored_reset(each_raw, now)
-        if name not in all_roster_names and reset is not None:
+        if name not in all_roster_names and reset is not None and not _is_no_roster_name_beside_a_roster(product, name, all_readings):
             all_resets_by_name[name] = reset
     return all_resets_by_name
 
@@ -395,13 +400,16 @@ def _save_spent_arguments(all_marks: Sequence[str], all_readings: Sequence[Readi
     all_accounts_by_profile = {each_reading.account.profile: each_reading for each_reading in all_readings if each_reading.account.profile}
     all_accounts_by_name = all_accounts_by_profile | {each_reading.account.name: each_reading for each_reading in all_readings}
     all_parsed_marks = [_parse_spent_mark(all_accounts_by_name, each_mark, product) for each_mark in all_marks]
-    for each_reading, each_reset in all_parsed_marks:
+    all_saved_marks = [each_mark for each_mark in all_parsed_marks if not _is_no_roster_name_beside_a_roster(product, each_mark[0].account.name, all_readings)]
+    for each_reading, each_reset in all_saved_marks:
         _record_spent(all_state, each_reading, now, each_reset)
-    if all_parsed_marks:
+    if all_saved_marks:
         _save_state(broker_state_path(), all_state)
     for each_reading, _ in all_parsed_marks:
         name = each_reading.account.name
-        if name not in all_accounts_by_name and (all_accounts_by_name or name != NO_ROSTER_ACCOUNT_NAME):
+        if _is_no_roster_name_beside_a_roster(product, name, all_readings):
+            print(f"warning: spent mark names {name}, the home used only with no roster, so it is outside the roster; choose ignores it", file=sys.stderr)
+        elif name not in all_accounts_by_name and (all_accounts_by_name or name != NO_ROSTER_ACCOUNT_NAME):
             print(f"warning: spent mark names {name}, an account outside the roster; choose waits until its reset", file=sys.stderr)
 
 

package/scripts/durable_post_lint.py

@@ -18,6 +18,7 @@ from dev_env_scripts_constants.private_term_constants import (
     PRIVATE_TERM_MESSAGE_TEMPLATE,
 )
 from durable_post_lint_config.config.constants import (
+    ACTION_GITHUB_MCP_COMMENT,
     ACTION_PR_CREATE,
     ACTION_PR_EDIT,
     ALL_BARE_VOLATILE_PATH_MARKERS,
@@ -33,6 +34,7 @@ from durable_post_lint_config.config.constants import (
     BODY_MUST_NOT_BE_EMPTY_MESSAGE,
     BODY_REQUIRED_MESSAGE,
     CLEAN_EXIT_CODE,
+    COMMENT_LENGTH_FINDING_CODE,
     CONTENT_FINDING_EXIT_CODE,
     CONVENTIONAL_TITLE_PATTERN,
     EDIT_INPUT_REQUIRED_MESSAGE,
@@ -45,6 +47,8 @@ from durable_post_lint_config.config.constants import (
     MISSING_HEADING_MESSAGE_TEMPLATE,
     PATH_ANCHOR_CHARACTER,
     PATH_SEGMENT_START_CHARACTERS,
+    PROOF_GATE_CREATE_TOOL_NAME,
+    PULL_REQUEST_PROOF_FINDING_CODE,
     RELEASE_BRANCH_PREFIX,
     REPOSITORY_OWNER_SEPARATOR,
     REWRITTEN_RELEASE_BODY_CODE,
@@ -56,6 +60,17 @@ from durable_post_lint_config.config.constants import (
 )
 from private_terms import private_term_line_numbers
 
+_hooks_directory = str(Path(__file__).resolve().parents[1] / "hooks")
+if _hooks_directory not in sys.path:
+    sys.path.insert(0, _hooks_directory)
+
+from blocking.pull_request_proof import (
+    missing_eval_section_reason,
+    missing_existing_work_reason,
+    missing_proof_reason,
+)
+from blocking.reply_length_gate import comment_length_violation
+
 
 class DurablePostUsageError(ValueError):
     """Report an invalid GitHub post request shape."""
@@ -145,6 +160,32 @@ def _description_heading_findings(body_text: str) -> list[DurablePostFinding]:
     ]
 
 
+def _pull_request_proof_findings(
+    title: str | None, body_text: str
+) -> list[DurablePostFinding]:
+    create_payload = {
+        "tool_name": PROOF_GATE_CREATE_TOOL_NAME,
+        "tool_input": {"title": title, "body": body_text},
+    }
+    all_reasons = (
+        missing_proof_reason(create_payload),
+        missing_existing_work_reason(create_payload),
+        missing_eval_section_reason(create_payload),
+    )
+    return [
+        DurablePostFinding(code=PULL_REQUEST_PROOF_FINDING_CODE, message=each_reason)
+        for each_reason in all_reasons
+        if each_reason is not None
+    ]
+
+
+def _comment_length_findings(body_text: str) -> list[DurablePostFinding]:
+    violation = comment_length_violation(body_text)
+    if violation is None:
+        return []
+    return [DurablePostFinding(code=COMMENT_LENGTH_FINDING_CODE, message=violation)]
+
+
 def _contrast_framing_findings(text: str) -> list[DurablePostFinding]:
     all_lines = text.splitlines()
     return [
@@ -210,6 +251,7 @@ def _body_findings(
     action: str,
     body_text: str | None,
     head_branch: str | None = None,
+    title: str | None = None,
 ) -> list[DurablePostFinding]:
     if body_text is None:
         return []
@@ -226,6 +268,10 @@ def _body_findings(
     else:
         if action in ALL_PR_DESCRIPTION_ACTIONS:
             all_findings.extend(_description_heading_findings(body_text))
+        if action == ACTION_PR_CREATE:
+            all_findings.extend(_pull_request_proof_findings(title, body_text))
+        if action == ACTION_GITHUB_MCP_COMMENT:
+            all_findings.extend(_comment_length_findings(body_text))
         all_findings.extend(_contrast_framing_findings(body_text))
     if find_volatile_path_marker(body_text) is not None:
         all_findings.append(
@@ -263,7 +309,7 @@ def lint_durable_post(
     return (
         *_title_findings(title),
         *_private_term_findings(title, repository),
-        *_body_findings(action, body_text, head_branch),
+        *_body_findings(action, body_text, head_branch, title),
         *_private_term_findings(body_text, repository),
     )
 

package/scripts/durable_post_lint_config/config/constants.py

@@ -2,6 +2,7 @@
 
 import re
 
+ACTION_GITHUB_MCP_COMMENT = "github-mcp-comment"
 ACTION_GITHUB_MCP_POST = "github-mcp-post"
 ACTION_ISSUE_COMMENT = "issue-comment"
 ACTION_ISSUE_CREATE = "issue-create"
@@ -13,6 +14,7 @@ ACTION_PR_REVIEW = "pr-review"
 
 ALL_POST_ACTIONS: frozenset[str] = frozenset(
     {
+        ACTION_GITHUB_MCP_COMMENT,
         ACTION_GITHUB_MCP_POST,
         ACTION_ISSUE_COMMENT,
         ACTION_ISSUE_CREATE,
@@ -25,6 +27,7 @@ ALL_POST_ACTIONS: frozenset[str] = frozenset(
 )
 ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
     {
+        ACTION_GITHUB_MCP_COMMENT,
         ACTION_GITHUB_MCP_POST,
         ACTION_ISSUE_COMMENT,
         ACTION_ISSUE_CREATE,
@@ -102,3 +105,6 @@ REWRITTEN_RELEASE_BODY_MESSAGE = (
     "keep the generated text whole"
 )
 REPOSITORY_OWNER_SEPARATOR = "/"
+PROOF_GATE_CREATE_TOOL_NAME = "mcp__github__create_pull_request"
+PULL_REQUEST_PROOF_FINDING_CODE = "pull-request-proof-section"
+COMMENT_LENGTH_FINDING_CODE = "github-comment-length"

package/scripts/durable_post_lint_config/config/test_constants.py

@@ -12,6 +12,7 @@ from durable_post_lint_config.config.constants import (
 
 def test_action_inventory_covers_pull_request_issue_and_tool_posts() -> None:
     assert ALL_POST_ACTIONS == {
+        "github-mcp-comment",
         "github-mcp-post",
         "issue-comment",
         "issue-create",

package/scripts/policy_lint/adapter_configuration.py

@@ -144,6 +144,7 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
         hooks/blocking/open_tasks_stop_gate.py           -> exempt
         hooks/blocking/owned_pr_merge_stop_gate.py       -> exempt
         hooks/blocking/session_title_turn_gate.py        -> exempt
+        hooks/blocking/resolve_thread_reply_gate.py      -> exempt
         hooks/blocking/some_new_blocker.py               -> flagged
 
     The Bash PreToolUse dispatcher sits under ``blocking/`` for layout reasons
@@ -202,6 +203,10 @@ def _names_exempt_registration_path(registered_string: str) -> bool:
     closing reply names no ``Blocked:`` line for it. It decides when a turn may
     end and no code or safety policy.
 
+    The resolve reply gate denies a review thread resolve until a reply on the
+    thread has posted. It decides the order of two review calls and no code or
+    safety policy.
+
     Args:
         registered_string: One command, path, script, or entrypoint string.
     """

package/scripts/policy_lint/config/constants.py

@@ -83,6 +83,7 @@ ALL_ACTION_BOUNDARY_EXEMPT_REGISTRATION_PATHS = (
     "blocking/open_tasks_stop_gate.py",
     "blocking/owned_pr_merge_stop_gate.py",
     "blocking/session_title_turn_gate.py",
+    "blocking/resolve_thread_reply_gate.py",
 )
 ALL_TEST_DIRECTORY_NAMES = frozenset({"tests"})
 ALL_TEST_FILE_PREFIXES = ("test_",)

package/scripts/test_account_broker.py

@@ -947,6 +947,41 @@ def test_should_wait_for_spent_default_home_until_the_mark_passes(
     assert running_decision["home"] == str(home.resolve())
 
 
+def test_should_run_on_a_roster_account_while_a_no_roster_default_mark_is_live(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("personal")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"personal": _meters(99, 99)}))
+    _freeze_clock(monkeypatch, NOW)
+    no_roster_account = Account(Product.CODEX, "default", Path(), False)
+    account_broker._save_state(
+        account_broker.broker_state_path(),
+        {"meters": {}, "spent": {account_broker._state_key(no_roster_account): (NOW + timedelta(hours=1)).timestamp()}, "affinity": {}},
+    )
+
+    code = account_broker.main(("choose", "--product", "codex"))
+
+    decision = json.loads(capsys.readouterr().out)["decision"]
+    assert code == 0
+    assert decision["action"] == "run"
+    assert decision["account"] == "personal"
+
+
+def test_should_not_save_a_default_spent_mark_while_a_roster_exists(
+    monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
+) -> None:
+    account = _account("personal")
+    monkeypatch.setitem(account_broker.all_product_adapters, Product.CODEX, _adapter((account,), {"personal": _meters(99, 99)}))
+    _freeze_clock(monkeypatch, NOW)
+
+    code = account_broker.main(("choose", "--product", "codex", "--spent", "default"))
+
+    decision = json.loads(capsys.readouterr().out)["decision"]
+    assert code == 0
+    assert decision["account"] == "personal"
+    assert account_broker._load_state(account_broker.broker_state_path())["spent"] == {}
+
+
 def test_should_keep_a_spent_mark_without_a_reset_for_one_hour(
     monkeypatch: pytest.MonkeyPatch, capsys: pytest.CaptureFixture[str]
 ) -> None:

package/scripts/test_durable_post_lint.py

@@ -11,6 +11,11 @@ import pytest
 
 import durable_post_lint
 from dev_env_scripts_constants.private_term_constants import PrivateTermDigest
+from hooks_constants.pull_request_proof_constants import (
+    MISSING_EVAL_SECTION_REASON,
+    MISSING_EXISTING_WORK_REASON,
+    TEST_ONLY_PROOF_REASON,
+)
 
 SCRIPT_PATH = Path(__file__).resolve().parent / "durable_post_lint.py"
 VALID_PR_BODY = """## Why
@@ -32,7 +37,25 @@ Blast radius text.
 ## Verification
 
 Verification text.
+
+## Existing work
+
+`scripts/durable_post_lint.py:1` holds the post checks.
+
+## Proof in practice
+
+Ran `python scripts/durable_post_lint.py --action pr-create --body-file body.md` on the new body.
+
+## Eval
+
+`python scripts/durable_post_lint.py --action pr-create --body-file eval_body.md`
 """
+OVER_LONG_REPLY_BODY = (
+    "Fixed in `abc1234`.\n\n"
+    "The parser now rejects an empty header.\n\n"
+    "The test covers both cases.\n\n"
+    "---\nPosted by the review agent."
+)
 MINIMAL_PR_BODY = """## Why
 
 Why text.
@@ -54,6 +77,7 @@ Verification text.
         ("issue-edit", None, "Updated issue body."),
         ("issue-comment", None, "Issue comment."),
         ("github-mcp-post", None, "MCP body."),
+        ("github-mcp-comment", None, "Reply body."),
     ],
 )
 def test_all_actions_accept_valid_inputs(
@@ -112,6 +136,7 @@ def test_pr_edit_requires_one_edit_field() -> None:
         "issue-edit",
         "issue-comment",
         "github-mcp-post",
+        "github-mcp-comment",
     ],
 )
 def test_body_actions_require_body(action: str) -> None:
@@ -176,10 +201,9 @@ def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     ]
 
 
-@pytest.mark.parametrize("action", ["pr-create", "pr-edit"])
-def should_accept_a_body_carrying_only_the_two_required_headings(action: str) -> None:
+def should_accept_an_edit_body_carrying_only_the_two_required_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
-        action=action,
+        action="pr-edit",
         title="fix(cli): tighten input handling",
         body_text=MINIMAL_PR_BODY,
     )
@@ -201,6 +225,155 @@ def should_still_accept_a_body_published_under_the_superseded_heading_set() -> N
     assert all_findings == ()
 
 
+def should_report_a_create_body_with_no_existing_work_section() -> None:
+    body_text = VALID_PR_BODY.replace(
+        "## Existing work\n\n`scripts/durable_post_lint.py:1` holds the post checks.\n\n", ""
+    )
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="feat: add durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        MISSING_EXISTING_WORK_REASON
+    ]
+
+
+def should_report_a_create_body_whose_proof_runs_only_tests() -> None:
+    body_text = VALID_PR_BODY.replace(
+        "Ran `python scripts/durable_post_lint.py --action pr-create --body-file body.md` on the new body.",
+        "Ran `python -m pytest scripts`.",
+    )
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="fix: tighten durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        TEST_ONLY_PROOF_REASON
+    ]
+
+
+def should_report_a_feature_create_body_with_no_eval_section() -> None:
+    body_text = VALID_PR_BODY.split("## Eval")[0]
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-create",
+        title="feat: add durable post linting",
+        body_text=body_text,
+    )
+    assert [each_finding.message for each_finding in all_findings] == [
+        MISSING_EVAL_SECTION_REASON
+    ]
+
+
+def should_leave_an_edit_body_with_no_existing_work_section_clean() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="pr-edit",
+        title=None,
+        body_text=MINIMAL_PR_BODY,
+    )
+    assert all_findings == ()
+
+
+def should_exit_with_findings_for_a_create_body_with_no_existing_work_section(
+    tmp_path: Path,
+) -> None:
+    body_file = tmp_path / "body.md"
+    body_file.write_text(
+        VALID_PR_BODY.replace("## Existing work", "## Prior art"), encoding="utf-8"
+    )
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "pr-create",
+            "--title",
+            "feat: add durable post linting",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 1
+    assert completed_process.stderr == f"{MISSING_EXISTING_WORK_REASON}\n"
+
+
+def should_report_a_review_reply_over_three_sentences() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text=OVER_LONG_REPLY_BODY,
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "github-comment-length"
+    ]
+
+
+def should_report_a_review_reply_sentence_over_fifteen_words() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text=(
+            "This change moves the parser into its own module and keeps every"
+            " caller on the same import path."
+        ),
+    )
+    assert [each_finding.code for each_finding in all_findings] == [
+        "github-comment-length"
+    ]
+
+
+def should_accept_a_short_review_reply() -> None:
+    all_findings = durable_post_lint.lint_durable_post(
+        action="github-mcp-comment",
+        title=None,
+        body_text="Fixed in `abc1234`.\n\nThe parser now rejects an empty header.",
+    )
+    assert all_findings == ()
+
+
+def should_exit_with_findings_for_an_over_long_review_reply(tmp_path: Path) -> None:
+    body_file = tmp_path / "reply.md"
+    body_file.write_text(OVER_LONG_REPLY_BODY, encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "github-mcp-comment",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 1
+    assert "at most three short sentences" in completed_process.stderr
+
+
+def should_exit_clean_for_a_short_review_reply(tmp_path: Path) -> None:
+    body_file = tmp_path / "reply.md"
+    body_file.write_text("Fixed in `abc1234`.\n", encoding="utf-8")
+    completed_process = subprocess.run(
+        [
+            sys.executable,
+            str(SCRIPT_PATH),
+            "--action",
+            "github-mcp-comment",
+            "--body-file",
+            str(body_file),
+        ],
+        check=False,
+        capture_output=True,
+        text=True,
+    )
+    assert completed_process.returncode == 0
+
+
 def test_non_pr_body_needs_no_pr_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
         action="issue-comment",

package/scripts/tests/Sync-RepoMain.Tests.ps1

@@ -68,9 +68,52 @@ BeforeAll {
         & pwsh -NoProfile -File $scriptUnderTest -RepoPath $Fixture.MirrorPath -StashDirty -LogPath $Fixture.LogPath | Out-Null
         return $LASTEXITCODE
     }
+
+    function Invoke-MirrorSyncScript {
+        param([pscustomobject]$Fixture)
+        & pwsh -NoProfile -File $scriptUnderTest -RepoPath $Fixture.MirrorPath -StashDirty -Mirror -LogPath $Fixture.LogPath | Out-Null
+        return $LASTEXITCODE
+    }
+
+    function Switch-MirrorToFeatureBranch {
+        <#
+          Leaves the mirror on a feature branch whose commit edits tracked.txt,
+          the way a session that checked out a pull request in the mirror does.
+        #>
+        param([pscustomobject]$Fixture)
+        Invoke-TestGit -RepoPath $Fixture.MirrorPath -Arguments @('switch', '-q', '-c', 'feature') | Out-Null
+        Write-TestFile -RepoPath $Fixture.MirrorPath -RelativePath 'tracked.txt' -Content "feature`n"
+        Invoke-TestGit -RepoPath $Fixture.MirrorPath -Arguments @('commit', '-q', '-am', 'feature edit') | Out-Null
+        return Invoke-TestGit -RepoPath $Fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')
+    }
 }
 
 Describe 'Sync-RepoMain' {
+    It 'skips a mirror left on another branch when -Mirror is absent' {
+        $fixture = New-MirrorBehindRemote -Name 'feature-no-mirror'
+        $featureTip = Switch-MirrorToFeatureBranch -Fixture $fixture
+
+        $exitCode = Invoke-SyncScript -Fixture $fixture
+
+        $exitCode | Should -Be 3
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')) | Should -Be $featureTip
+    }
+
+    It 'returns a mirror left on another branch to main and fast-forwards it with -Mirror' {
+        $fixture = New-MirrorBehindRemote -Name 'feature-mirror'
+        $featureTip = Switch-MirrorToFeatureBranch -Fixture $fixture
+
+        $exitCode = Invoke-MirrorSyncScript -Fixture $fixture
+
+        $exitCode | Should -Be 0
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('branch', '--show-current')) | Should -Be 'main'
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'HEAD')) | Should -Be $fixture.RemoteTip
+        [System.IO.File]::ReadAllText((Join-Path $fixture.MirrorPath 'tracked.txt')) | Should -Be "new`n"
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('status', '--porcelain')) | Should -BeNullOrEmpty
+        (Invoke-TestGit -RepoPath $fixture.MirrorPath -Arguments @('rev-parse', 'feature')) | Should -Be $featureTip
+        (Get-Content -LiteralPath $fixture.LogPath -Raw) | Should -Match "left branch 'feature' at $featureTip"
+    }
+
     It 'fast-forwards a clean mirror that is behind the remote' {
         $fixture = New-MirrorBehindRemote -Name 'clean-behind'