dsh-tower 2.0.2 → 2.0.4

package/lib/tower.js

@@ -16,6 +16,7 @@ import {
   isClean,
   isAncestor,
   tryGit,
+  setGitTimeout,
 } from './git.js'
 import { validateCreate as validateBatchCreate, validateClose as validateBatchClose, summarize as summarizeBatch } from './batch.js'
 import { assertOwnership, canonicalPath } from './worktreeOwnership.js'
@@ -32,6 +33,7 @@ import {
   shortHash,
 } from './store.js'
 import { runtimeConfig, resolveRepoConfig } from './config.js'
+import { TowerToolError } from './errors.js'
 
 export const SCHEMA_VERSION = 1
 export const MISSION_STATUSES = [
@@ -108,7 +110,7 @@ async function commitParents(cwd, sha) {
  * the concrete evidence that a mission's work already landed in the base.
  */
 async function findLandedMerge(cwd, baseTip, tips) {
-  const revs = (await tryGit(cwd, ['rev-list', '--merges', '-n', '100', baseTip])) ?? ''
+  const revs = (await tryGit(cwd, ['rev-list', '--merges', baseTip])) ?? ''
   for (const sha of revs.split('\n').filter(Boolean)) {
     const parents = await commitParents(cwd, sha)
     if (parents.length >= 2 && tips.has(parents[1])) return { commit: sha, parents }
@@ -116,16 +118,32 @@ async function findLandedMerge(cwd, baseTip, tips) {
   return null
 }
 
+function clearStale(entry) {
+  delete entry.stale
+  delete entry.staleAt
+}
+
 function describeGitFailure(error) {
   const prefix = error?.timedOut ? 'timed out: ' : error?.bufferOverflow ? 'output buffer overflow: ' : ''
   return `${prefix}${String(error?.message ?? error)}`
 }
 
-/** A killed git process can leave lock files behind; only used after a failed merge. */
-async function removeStaleGitLocks(commonDir) {
+/** Remove only lock files that are provably old. A fresh lock may belong to a
+ * concurrent Git process; deleting it would let two writers into the index. */
+async function removeStaleGitLocks(commonDir, maxAgeMs = 60000) {
+  const removed = []
   for (const name of ['index.lock', 'HEAD.lock', 'MERGE_HEAD.lock', 'ORIG_HEAD.lock']) {
-    await fsp.unlink(path.join(commonDir, name)).catch(() => {})
+    const file = path.join(commonDir, name)
+    try {
+      const stat = await fsp.stat(file)
+      if (Date.now() - stat.mtimeMs < maxAgeMs) continue
+      await fsp.unlink(file)
+      removed.push(name)
+    } catch {
+      // absent or in use; never force it
+    }
   }
+  return removed
 }
 
 function globToRegExp(pattern) {
@@ -388,13 +406,16 @@ export function validateState(state, statePath) {
     const names = new Set()
     const agents = new Set()
     for (const entry of state.roster) {
-      if (!entry || typeof entry.name !== 'string' || typeof entry.agentId !== 'string') {
+      const reserved = entry?.state === 'reserved'
+      if (!entry || typeof entry.name !== 'string' || (!reserved && typeof entry.agentId !== 'string')) {
         fail(`invalid roster entry${where}`)
       }
       if (names.has(entry.name)) fail(`duplicate roster name ${entry.name}${where}`)
-      if (agents.has(entry.agentId)) fail(`duplicate roster agent ${entry.agentId}${where}`)
+      if (typeof entry.agentId === 'string') {
+        if (agents.has(entry.agentId)) fail(`duplicate roster agent ${entry.agentId}${where}`)
+        agents.add(entry.agentId)
+      }
       names.add(entry.name)
-      agents.add(entry.agentId)
     }
   }
   if (state.messages !== undefined) {
@@ -529,7 +550,9 @@ function workerEntries(state, missionId) {
 }
 
 function countLiveWorkers(state) {
-  return (state.roster ?? []).filter((entry) => entry.role === 'worker' && !ROSTER_INACTIVE.has(entry.state)).length
+  return (state.roster ?? []).filter(
+    (entry) => entry.role === 'worker' && !ROSTER_INACTIVE.has(entry.state) && entry.state !== 'reserved',
+  ).length
 }
 
 function normalizePauseCause(value) {
@@ -566,6 +589,7 @@ export class Tower {
     // Effective config for this repository: code defaults < profile config <
     // repo config file. Per-call tool arguments are applied by the caller.
     this.config = config ?? { ...runtimeConfig(), configPath: null, repoConfigPresent: false }
+    setGitTimeout(this.config.git?.timeoutMs)
   }
 
   static async open(repoRoot) {
@@ -607,6 +631,19 @@ export class Tower {
 
       if (await exists(this.paths.state)) {
         const state = await this.load()
+        const owner = state.towerAgentId ? String(state.towerAgentId) : null
+        const caller = input.towerAgentId ? String(input.towerAgentId) : null
+        if (owner && caller && owner !== caller) {
+          fail(`tower state is owned by another agent; ${caller} is not the tower`)
+        }
+        if (!owner && caller) {
+          state.towerAgentId = caller
+          state.revision += 1
+          state.updatedAt = now
+          validateState(state, this.paths.state)
+          await writeJsonAtomic(this.paths.state, state)
+          await appendJsonl(this.paths.activity, { at: now, type: 'init', text: `tower owner claimed by ${caller}` })
+        }
         let reanchored = false
         if (input.reanchor === true) {
           const active = state.missions.filter((mission) => !TERMINAL.has(mission.status))
@@ -668,6 +705,7 @@ export class Tower {
         createdAt: now,
         updatedAt: now,
         dirtyBase: dirty,
+        ...(input.towerAgentId ? { towerAgentId: String(input.towerAgentId) } : {}),
         ...(snapshotCommit ? { snapshotCommit, snapshotRef } : {}),
         missions: [],
       }
@@ -923,6 +961,7 @@ export class Tower {
       entry.state = input.state ?? 'failed'
       entry.outcome = input.detail ? String(input.detail).slice(0, 1000) : null
       entry.outcomeAt = now
+      clearStale(entry)
       state.revision += 1
       state.updatedAt = now
       validateState(state, this.paths.state)
@@ -951,6 +990,7 @@ export class Tower {
       entry.state = 'interrupted'
       entry.outcome = String(input.reason ?? 'interrupted by tower').slice(0, 1000)
       entry.outcomeAt = now
+      clearStale(entry)
       state.revision += 1
       state.updatedAt = now
       validateState(state, this.paths.state)
@@ -1010,14 +1050,22 @@ export class Tower {
       state.revision += 1
       state.updatedAt = now
 
-      validateState(state, this.paths.state)
-      await writeJsonAtomic(this.paths.state, state)
+      try {
+        validateState(state, this.paths.state)
+        await writeJsonAtomic(this.paths.state, state)
+      } catch (error) {
+        // Roll back Git resources if state persistence failed, otherwise the
+        // mission is wedged forever with an untracked worktree/branch.
+        await git(this.root, ['worktree', 'remove', '--force', wtPath]).catch(() => {})
+        await git(this.root, ['branch', '-D', branch]).catch(() => {})
+        throw error
+      }
       await appendJsonl(this.paths.activity, {
         at: now,
         type: 'worktree',
         missionId,
         text: `${branch} at ${wtPath}`,
-      })
+      }).catch(() => {})
       return { mission, worktree, created: true }
     })
   }
@@ -1065,16 +1113,55 @@ export class Tower {
     }
   }
 
+  /** Reserve a roster name before activation so a failed spawn is recoverable. */
+  async reserveRoster(input) {
+    return withLock(this.paths, async () => {
+      const state = await this.load()
+      const mission = state.missions.find((entry) => entry.id === input.missionId)
+      if (!mission) fail(`unknown mission "${input.missionId}"`)
+      if (!Array.isArray(state.roster)) state.roster = []
+      if (state.roster.some((entry) => entry.name === input.name)) fail(`roster name already used: ${input.name}`)
+      const now = Date.now()
+      const entry = {
+        name: input.name,
+        role: input.role,
+        agentId: null,
+        sessionId: null,
+        parentSessionId: input.parentSessionId,
+        missionId: input.missionId,
+        cwd: input.cwd ?? null,
+        branch: input.branch ?? null,
+        spawnTip: null,
+        state: 'reserved',
+        reservedAt: now,
+        spawnedAt: now,
+      }
+      state.roster.push(entry)
+      state.revision += 1
+      state.updatedAt = now
+      validateState(state, this.paths.state)
+      await writeJsonAtomic(this.paths.state, state)
+      await appendJsonl(this.paths.activity, {
+        at: now,
+        type: 'spawn',
+        missionId: input.missionId,
+        text: `reserved ${input.role} ${input.name}`,
+      })
+      return entry
+    })
+  }
+
   async recordSpawn(input) {
     return withLock(this.paths, async () => {
       const state = await this.load()
       const mission = state.missions.find((entry) => entry.id === input.missionId)
       if (!mission) fail(`unknown mission "${input.missionId}"`)
       if (!Array.isArray(state.roster)) state.roster = []
-      if (state.roster.some((entry) => entry.name === input.name)) {
+      const reserved = state.roster.find((entry) => entry.name === input.name && entry.state === 'reserved' && !entry.agentId)
+      if (!reserved && state.roster.some((entry) => entry.name === input.name)) {
         fail(`roster name already used: ${input.name}`)
       }
-      if (state.roster.some((entry) => entry.agentId === input.agentId)) {
+      if (state.roster.some((entry) => entry.agentId && entry.agentId === input.agentId)) {
         fail(`agent ${input.agentId} is already in the roster`)
       }
       const now = Date.now()
@@ -1094,7 +1181,7 @@ export class Tower {
       }
       if (input.role === 'worker') {
         const previous = workerEntries(state, mission.id)
-        const live = previous.find((entry) => !ROSTER_INACTIVE.has(entry.state))
+        const live = previous.find((entry) => !ROSTER_INACTIVE.has(entry.state) && entry.state !== 'reserved')
         if (live && !input.takeover) {
           fail(
             `mission ${mission.id} already has a live worker "${live.name}"; stop it with tower_interrupt, or pass takeover:true after it is no longer running`,
@@ -1104,10 +1191,11 @@ export class Tower {
         // idle `inactive` ones; otherwise the next spawn would see several entries
         // for the same mission and the old idle worker would block forever.
         for (const old of previous) {
-          if (old.state === 'retired') continue
+          if (old.state === 'retired' || old.state === 'reserved') continue
           old.state = 'retired'
           old.outcome = `replaced by ${input.name}${input.takeover ? ' (takeover)' : ''}`
           old.outcomeAt = now
+          clearStale(old)
         }
         const liveCount = countLiveWorkers(state)
         const max = Number(this.config.spawn.maxLiveWorkers) || 4
@@ -1120,7 +1208,8 @@ export class Tower {
         mission.owner = input.name
         if (mission.status === 'planned') mission.status = 'active'
       }
-      state.roster.push(entry)
+      if (reserved) Object.assign(reserved, entry)
+      else state.roster.push(entry)
       mission.updatedAt = now
       state.revision += 1
       state.updatedAt = now
@@ -1133,7 +1222,7 @@ export class Tower {
         missionId: input.missionId,
         text: `${input.role} ${input.name} (${input.agentId})`,
       })
-      return entry
+      return reserved ?? entry
     })
   }
 
@@ -1163,9 +1252,18 @@ export class Tower {
       const mission = state.missions.find((entry) => entry.id === input.missionId)
       if (!mission) fail(`unknown mission "${input.missionId}"`)
       if (!mission.testRuns) mission.testRuns = []
-      const receipt = { ...input.receipt, recordedAt: Date.now() }
+      const rawReceipt = { ...input.receipt, recordedAt: Date.now() }
+      // Keep state bounded even when a repository reports a huge suite.
+      const tests = Array.isArray(rawReceipt.tests) ? rawReceipt.tests : []
+      const receipt = tests.length > 100
+        ? { ...rawReceipt, tests: tests.slice(0, 100), testsTotal: rawReceipt.count ?? tests.length, testsTruncated: true }
+        : rawReceipt
       mission.testRuns.push(receipt)
       if (mission.testRuns.length > 50) mission.testRuns = mission.testRuns.slice(-50)
+      const MAX_RUNS_BYTES = 512 * 1024
+      while (mission.testRuns.length > 1 && Buffer.byteLength(JSON.stringify(mission.testRuns), 'utf8') > MAX_RUNS_BYTES) {
+        mission.testRuns.shift()
+      }
       state.revision += 1
       state.updatedAt = Date.now()
       validateState(state, this.paths.state)
@@ -1300,8 +1398,41 @@ export class Tower {
     }
   }
 
-  async markRetired(agentIds) {
-    if (!Array.isArray(agentIds) || agentIds.length === 0) return { retired: [] }
+  /** Track repeated absence observations before declaring a roster row gone. */
+  async recordRosterObservations({ present = [], absent = [], confirmations = 2 }) {
+    const presentIds = new Set(present)
+    const absentIds = new Set(absent)
+    return withLock(this.paths, async () => {
+      const state = await this.load()
+      const candidates = []
+      const now = Date.now()
+      let changed = false
+      for (const entry of state.roster ?? []) {
+        if (presentIds.has(entry.agentId)) {
+          if (entry.absentObservations !== undefined) {
+            delete entry.absentObservations
+            delete entry.absentSince
+            changed = true
+          }
+          continue
+        }
+        if (!absentIds.has(entry.agentId)) continue
+        entry.absentObservations = (entry.absentObservations ?? 0) + 1
+        entry.absentSince ??= now
+        changed = true
+        if (entry.absentObservations >= Math.max(2, Number(confirmations) || 2)) candidates.push(entry.agentId)
+      }
+      if (changed) {
+        state.revision += 1
+        state.updatedAt = now
+        validateState(state, this.paths.state)
+        await writeJsonAtomic(this.paths.state, state)
+      }
+      return { candidates }
+    })
+  }
+
+  async markRetired(agentIds) {    if (!Array.isArray(agentIds) || agentIds.length === 0) return { retired: [] }
     return withLock(this.paths, async () => {
       const state = await this.load()
       const retired = []
@@ -1310,6 +1441,7 @@ export class Tower {
         if (entry.state !== 'retired' && agentIds.includes(entry.agentId)) {
           entry.state = 'retired'
           entry.retiredAt = now
+          clearStale(entry)
           retired.push(entry.agentId)
         }
       }
@@ -1338,6 +1470,7 @@ export class Tower {
         if (!ROSTER_INACTIVE.has(entry.state) && agentIds.includes(entry.agentId)) {
           entry.state = 'missing'
           entry.missingSince = now
+          clearStale(entry)
           missing.push(entry.agentId)
         }
       }
@@ -1548,6 +1681,16 @@ export class Tower {
     if (commits < 1) {
       fail(`mission branch has no commits since ${String(mission.worktree.baseCommit).slice(0, 12)}`)
     }
+    if (!(await isClean(mission.worktree.path))) {
+      const dirty = (await git(mission.worktree.path, ['status', '--porcelain']))
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => line.slice(3).trim())
+      throw new TowerToolError(
+        'worktree-dirty',
+        `mission ${mission.id} worktree has uncommitted changes (${dirty.slice(0, 8).join(', ')}${dirty.length > 8 ? ', …' : ''}); commit, remove, or record them before tower_complete`,
+      )
+    }
     const unread = this.unreadFor(state, worker.name)
     if (unread.length > 0) {
       fail(
@@ -1753,9 +1896,16 @@ export class Tower {
       if (!mission.worktree) fail(`mission ${mission.id} has no worktree to review`)
 
       const caller = (state.roster ?? []).find((entry) => entry.agentId === input.agentId)
+      const actorRole = input.actor?.role
       let reviewerName
       let reviewerRole
-      if (caller) {
+      if (actorRole === 'tower') {
+        if (typeof input.breakGlassReason !== 'string' || input.breakGlassReason.trim().length === 0) {
+          fail('a tower-submitted review is break-glass and requires a non-empty breakGlassReason')
+        }
+        reviewerName = 'tower'
+        reviewerRole = 'tower'
+      } else if (caller) {
         if (caller.role !== 'reviewer') {
           fail(`agent ${caller.name} is a ${caller.role}; only an assigned reviewer or the tower (break-glass) may review`)
         }
@@ -1766,15 +1916,13 @@ export class Tower {
         reviewerName = caller.name
         reviewerRole = 'reviewer'
       } else {
-        if (typeof input.breakGlassReason !== 'string' || input.breakGlassReason.trim().length === 0) {
-          fail('a tower-submitted review is break-glass and requires a non-empty breakGlassReason')
-        }
-        reviewerName = 'tower'
-        reviewerRole = 'tower'
+        // Fail closed: an unknown caller is not the tower, and a missing
+        // roster row is not evidence of tower identity.
+        fail(`agent ${input.agentId ?? '(unknown)'} is not a registered reviewer or the tower`)
       }
 
       if (mission.status !== 'completed') {
-        fail(`mission ${mission.id} is ${mission.status}; only a completed mission (awaiting review) can be reviewed`)
+        fail(`mission ${mission.id} is ${mission.status}; only a completed mission can be reviewed`)
       }
       if (!REVIEW_STATUS_RE.test(String(input.status ?? ''))) {
         fail('status must be "clean", "p1-Nitems", or "p2-Nitems"')
@@ -1801,9 +1949,12 @@ export class Tower {
       await this.assertWorktree(mission.worktree)
       const tip = await revParse(mission.worktree.path, 'HEAD')
       const branch = mission.worktree.branch
-      if (caller && caller.role === 'reviewer' && caller.spawnTip && caller.spawnTip !== tip) {
+      if (caller && caller.role === 'reviewer' && !String(caller.spawnTip ?? '').trim()) {
+        fail(`reviewer ${caller.name} has no recorded spawn tip; re-spawn the reviewer before reviewing`)
+      }
+      if (caller && caller.role === 'reviewer' && caller.spawnTip !== tip) {
         fail(
-          `reviewer ${caller.name} modified the mission branch after it was spawned (${caller.spawnTip.slice(0, 7)} -> ${tip.slice(0, 7)}); reviewers must be read-only — spawn a fresh reviewer`,
+          `reviewer ${caller.name} modified the mission branch after it was spawned (${String(caller.spawnTip).slice(0, 7)} -> ${tip.slice(0, 7)}); reviewers must be read-only — spawn a fresh reviewer`,
         )
       }
       const prior = (state.reviews ?? []).filter((review) => review.branch === branch)
@@ -2032,7 +2183,7 @@ export class Tower {
       )
     }
     if (mission.status !== 'completed') {
-      push('mission-not-completed', `mission ${mission.id} is ${mission.status}; completion (awaiting review) is required`)
+      push('mission-not-completed', `mission ${mission.id} is ${mission.status}; completion is required`)
     }
     const openTasks = mission.tasks.filter((task) => task.status === 'open')
     if (openTasks.length > 0) push('tasks-open', `${openTasks.length} open task(s): ${openTasks.map((task) => task.text).join('; ')}`)
@@ -2103,16 +2254,18 @@ export class Tower {
     const branch = worktree ? worktree.branch : null
     const reviews = branch ? (state.reviews ?? []).filter((review) => review.branch === branch) : []
     const latest = reviews.length > 0 ? reviews.reduce((a, b) => (a.round >= b.round ? a : b)) : null
+    const requireReview = this.config.review?.requireReview !== false
     const exempt =
-      mission.reviewPolicy === 'none' &&
-      this.config.gates.allowReviewExemption === true &&
-      String(mission.reviewExemptionReason ?? '').trim().length > 0
-    if (mission.reviewPolicy === 'none' && this.config.gates.allowReviewExemption !== true) {
+      !requireReview ||
+      (mission.reviewPolicy === 'none' &&
+        this.config.gates.allowReviewExemption === true &&
+        String(mission.reviewExemptionReason ?? '').trim().length > 0)
+    if (requireReview && mission.reviewPolicy === 'none' && this.config.gates.allowReviewExemption !== true) {
       push('review-exemption-invalid', `mission ${mission.id} requests no review but gates.allowReviewExemption is disabled`)
     }
-    if (!exempt && !latest) {
-      push('no-review', `branch ${branch ?? '(none)'} has no review; assign a reviewer first`)
-    } else if (!exempt) {
+    if (requireReview && !exempt && !latest) {
+      push('no-review', `branch ${branch ?? '(none)'} has no review; assign a reviewer first (or set review.requireReview:false)`)
+    } else if (requireReview && !exempt) {
       const waived = this.rebaseWaived(mission, latest)
       if (latest.missionId !== mission.id) {
         push('review-mission-mismatch', `latest review belongs to mission ${latest.missionId}`)
@@ -2138,7 +2291,9 @@ export class Tower {
       }
     }
     const staleWorkers = (state.roster ?? []).filter(
-      (row) => row.missionId === mission.id && (row.state === 'stale' || row.stale === true),
+      (row) =>
+        row.missionId === mission.id &&
+        (row.state === 'stale' || (row.stale === true && !ROSTER_INACTIVE.has(row.state))),
     )
     if (staleWorkers.length > 0) {
       push('worker-stale', `stale worker(s) for ${mission.id}: ${staleWorkers.map((row) => row.name).join(', ')}; adopt or interrupt before merge`)
@@ -2252,9 +2407,10 @@ export class Tower {
     const branch = mission.worktree.branch
     const reviews = (state.reviews ?? []).filter((review) => review.branch === branch)
     const exempt =
-      mission.reviewPolicy === 'none' &&
-      this.config.gates.allowReviewExemption === true &&
-      String(mission.reviewExemptionReason ?? '').trim().length > 0
+      this.config.review?.requireReview === false ||
+      (mission.reviewPolicy === 'none' &&
+        this.config.gates.allowReviewExemption === true &&
+        String(mission.reviewExemptionReason ?? '').trim().length > 0)
     if (reviews.length === 0 && !exempt) return null
     const latest = reviews.length > 0 ? reviews.reduce((a, b) => (a.round >= b.round ? a : b)) : null
     if (latest && !exempt && (latest.status !== 'clean' || latest.mergeVerdict !== 'merge')) return null
@@ -2270,10 +2426,24 @@ export class Tower {
     const reviewedTip = latest?.reviewedCommit ?? null
     const branchLanded = await isAncestor(this.root, branchTip, baseTip)
     const reviewedLanded = reviewedTip ? await isAncestor(this.root, reviewedTip, baseTip) : false
-    if (!branchLanded && !reviewedLanded) return null
+    if (!branchLanded) {
+      if (reviewedLanded) {
+        return {
+          ok: false,
+          missionId: mission.id,
+          blockers: [
+            {
+              code: 'review-stale',
+              detail: `reviewed commit ${reviewedTip.slice(0, 7)} is contained in ${state.base}, but branch tip ${branchTip.slice(0, 7)} is not; the branch was partially landed or moved — re-review or repair manually`,
+            },
+          ],
+        }
+      }
+      return null
+    }
     const tips = new Set([branchTip, reviewedTip].filter(Boolean))
     const found = await findLandedMerge(this.root, baseTip, tips)
-    const mergedCommit = found ? found.commit : reviewedLanded ? reviewedTip : branchTip
+    const mergedCommit = found ? found.commit : branchTip
     const now = Date.now()
     if (state.mergeIntent?.missionId === mission.id) delete state.mergeIntent
     mission.status = 'merged'
@@ -2336,6 +2506,20 @@ export class Tower {
       const worktree = mission.worktree
       const baseTipBefore = await revParse(this.root, 'HEAD')
       const branchTip = await revParse(worktree.path, 'HEAD')
+      if (gate.baseTip && gate.baseTip !== baseTipBefore) {
+        return {
+          ok: false,
+          missionId: mission.id,
+          blockers: [{ code: 'stale-base', detail: `base moved after gate (${gate.baseTip.slice(0, 7)} -> ${baseTipBefore.slice(0, 7)}); re-run preflight` }],
+        }
+      }
+      if (gate.branchTip && gate.branchTip !== branchTip) {
+        return {
+          ok: false,
+          missionId: mission.id,
+          blockers: [{ code: 'tip-moved', detail: `branch moved after gate (${gate.branchTip.slice(0, 7)} -> ${branchTip.slice(0, 7)}); re-run preflight` }],
+        }
+      }
       // Record the intent before touching Git; a crash between merge and state
       // write can be reconciled by the next tower_merge/preflight instead of
       // leaving an unexplained base tip.
@@ -2343,6 +2527,7 @@ export class Tower {
         missionId: mission.id,
         baseTip: baseTipBefore,
         branchTip,
+        gateTip: gate.branchTip ?? branchTip,
         startedAt: Date.now(),
       }
       state.revision += 1
@@ -2351,9 +2536,11 @@ export class Tower {
       const timeoutMs = mergeTimeoutMs(input.timeoutMs, this.config)
       let failure = null
       try {
+        // Merge the exact reviewed commit, never a mutable branch name. A
+        // branch move after the gate must not smuggle extra commits into base.
         await git(
           this.root,
-          ['merge', '--no-ff', worktree.branch, '-m', `tower: merge ${mission.id} — ${mission.title}`],
+          ['merge', '--no-ff', branchTip, '-m', `tower: merge ${mission.id} — ${mission.title}`],
           { timeoutMs, maxBuffer: this.config.merge.maxBufferBytes || MERGE_MAX_BUFFER },
         )
       } catch (error) {
@@ -2402,9 +2589,11 @@ export class Tower {
             }
           }
         } else if (newTip !== baseTipBefore) {
-          await removeStaleGitLocks(this.commonDir)
-          await git(this.root, ['reset', '--hard', baseTipBefore]).catch(() => {})
-          cleanup = 'reset'
+          // HEAD moved without Tower's expected merge shape. This may be a
+          // concurrent commit; never hard-reset it away. Leave a visible
+          // manual-recovery state instead.
+          cleanup = 'manual-required'
+          warnings.push('HEAD moved unexpectedly during a failed merge; left in place for manual recovery')
         }
         // A killed git process can leave the index staged even without
         // MERGE_HEAD. Restore only when every dirty path belongs to this merge.
@@ -2414,12 +2603,12 @@ export class Tower {
           .map((line) => line.slice(3).trim())
         if (dirtyAfter.length > 0) {
           const changed = new Set(gate.changedFiles ?? [])
-          if (dirtyAfter.every((file) => changed.has(file))) {
+          if (newTip === baseTipBefore && dirtyAfter.every((file) => changed.has(file))) {
             await removeStaleGitLocks(this.commonDir)
             await git(this.root, ['reset', '--hard', baseTipBefore]).catch(() => {})
             cleanup = cleanup === 'none' ? 'reset' : `${cleanup}+reset`
           } else {
-            warnings.push(`cleanup left unrelated changes untouched: ${dirtyAfter.slice(0, 5).join(', ')}`)
+            warnings.push(`cleanup left changes for manual review: ${dirtyAfter.slice(0, 5).join(', ')}`)
           }
         }
         const detail = describeGitFailure(failure).slice(0, 2000)
@@ -2452,18 +2641,33 @@ export class Tower {
       }
 
       if (!expectedShape) {
-        delete state.mergeIntent
+        // Keep the intent and the observed tip. A shape mismatch means Tower
+        // cannot prove what landed; deleting the intent here would make the
+        // moved base unreconcilable and could discard a real commit.
+        const detail = `unexpected merge parents [${parents.join(', ')}], expected [${baseTipBefore}, ${branchTip}]`
+        state.mergeIntent.problem = { code: 'merge-shape', newTip, parents, at: Date.now() }
         state.revision += 1
         state.updatedAt = Date.now()
-        await writeJsonAtomic(this.paths.state, state).catch(() => {})
+        await writeJsonAtomic(this.paths.state, state)
+        await appendJsonl(this.paths.activity, {
+          at: state.updatedAt,
+          type: 'merge',
+          missionId: mission.id,
+          text: `shape-mismatch newTip=${newTip.slice(0, 12)} parents=${parents.length}`,
+        })
         return {
           ok: false,
+          missionId: mission.id,
           blockers: [
             {
               code: 'merge-shape',
-              detail: `unexpected merge parents [${parents.join(', ')}], expected [${baseTipBefore}, ${branchTip}]`,
+              detail,
+              cleanup: 'manual-required',
             },
           ],
+          newTip,
+          parents,
+          intentRetained: true,
         }
       }
 
@@ -2591,6 +2795,16 @@ export class Tower {
           decisions.push({ missionId: mission.id, action: 'keep', reason: `mission is ${mission.status}` })
           continue
         }
+        try {
+          await this.assertWorktree(mission.worktree)
+        } catch (error) {
+          decisions.push({
+            missionId: mission.id,
+            action: 'keep',
+            reason: `worktree ownership/registration unverified: ${String(error?.message ?? error).slice(0, 240)}`,
+          })
+          continue
+        }
         let dirty = true
         try {
           dirty = !(await isClean(mission.worktree.path))
@@ -2611,16 +2825,28 @@ export class Tower {
           decisions.push({ missionId: mission.id, action: 'keep', reason: `remove failed: ${String(error?.message ?? error)}` })
           continue
         }
-        await git(this.root, ['branch', '-d', mission.worktree.branch]).catch(() => {})
+        let branchDeleteError = null
+        try {
+          await git(this.root, ['branch', '-d', mission.worktree.branch])
+        } catch (error) {
+          branchDeleteError = String(error?.message ?? error).slice(0, 240)
+        }
         mission.worktreeRemovedAt = now
         mission.updatedAt = now
+        if (branchDeleteError) mission.branchDeleteError = branchDeleteError
+        else delete mission.branchDeleteError
         removed.push(mission.id)
-        decisions.push({ missionId: mission.id, action: 'removed', branch: mission.worktree.branch })
+        decisions.push({
+          missionId: mission.id,
+          action: 'removed',
+          branch: mission.worktree.branch,
+          ...(branchDeleteError ? { branchRetained: true, branchDeleteError } : {}),
+        })
         await appendJsonl(this.paths.activity, {
           at: now,
           type: 'teardown',
           missionId: mission.id,
-          text: mission.worktree.branch,
+          text: `${mission.worktree.branch}${branchDeleteError ? ' (branch retained)' : ''}`,
         })
       }