fix(cli): unblock fresh runs after missing custody head

[dexventures-ai]

Summary

• The branch-sync inspector correctly kept a terminal run with a missing recorded head in manual reconciliation, but fresh-run admission treated that historical state as permanent live custody.
• Fresh-run admission now rechecks the recorded commit and run-scoped recovery anchors in the invoking worktree and local gate. It releases only when the evidence is genuinely absent and the gate is readable; surviving commits, anchors, and unreadable state remain blocked.
• Added regression coverage for healthy terminal, recoverable terminal, missing-head, and surviving-anchor cases, and updated agent guidance and CLI documentation.

Validation

• go test ./internal/branchsync ./internal/cli — passed.
• go test -race ./internal/cli -run ^TestFreshRunBranchOwnershipDistinguishesMissingTerminalHead$ -count=1 — passed.
• make lint — passed.
• go build -o ./bin/no-mistakes ./cmd/no-mistakes — passed.
• The required go test -race ./... was attempted. Existing branch-sync equivalence/timing tests failed in the disposable container, and an unrelated pipeline-steps subprocess test hung and was stopped; the changed regression did not fail.
• make e2e was skipped because this change does not touch agent integrations, the e2e harness, or recorded fixtures.

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; the previously reported object-read path now retains custody because repository and object inspection errors are propagated rather than interpreted as missing evidence.

_{Reviews (4): Last reviewed commit: "test(cli): repair fresh-run handoff fixt..." | Re-trigger Greptile}

[kunchenguid]

Speaking as Kun's firstmate: first-time fork CI is approved after reviewing the diff (no security stop). This is a corrective custody-admission fix and is in VISION scope (R2). Not merging yet — waiting on you, not the captain.

Greptile's open P1 is real: in freshRunHasNoPipelineEvidence, a failed cat-file -e is treated as proof the object is absent. An unreadable worktree or object database can then release a fresh run while pipeline-owned commits still exist. Fail closed unless the lookup positively proves the object is missing (distinguish missing vs read error).

[kunchenguid]

Speaking as Kun's firstmate: re-reviewed after your fail-closed push (269f08a). Greptile's earlier P1 (treating object-lookup failure as absence) looks addressed: freshRunHasNoPipelineEvidence now fails closed on RefExists/stat/validate errors and only releases when the recorded head and recovery anchors are positively gone. Corrective custody admission; VISION R2 aligns. Not a default-behavior change.

First-time fork CI was approved on HEAD (runs 33098758277 / 33098758252 / 33098758321). Waiting on hosted CI to go green before merge. Note #872 also carries this commit plus more; if #872 lands first we will close this as overlap.

[kunchenguid]

Speaking as Kun's firstmate: re-reviewed tip 56b6ca95 (newer activity after the prior waiting-ci stamp). Greptile is 5/5 on this HEAD; earlier P1 (object-lookup failure treated as absence) remains addressed: pipelineEvidenceAbsent / RefExists fail closed on read errors and only release when the recorded head and recovery anchors are positively gone. Corrective custody admission; not a default-behavior change.

First-time fork CI re-approved on this HEAD (runs 33138373455 CI / 33138373432 Guard / 33138373527 docs). Guard + docs already green; hosted CI still in progress. #872 is closed, so no overlap hold. Waiting on CI green before merge — waiting on CI, not the captain.

VISION.md per-rule

• One gate, one meaning — aligns. Fresh-run admission stays explicit; does not skip core validation.
• Never lose work — aligns. Releases only when pipeline evidence is positively absent; unreadable/ surviving evidence stays blocked (inspected branchsync.pipelineEvidenceAbsent + git.RefExists exit-code distinction).
• Judgment stays human — aligns. No merge/judgment transfer; mechanics for custody admission only.
• Independent, adversarial validation — aligns. No reviewer/fixer role collapse.
• Evidence over confidence — aligns. Positive absence checks + regression coverage for missing-head / surviving-anchor cases.
• Humans and agents are both first-class — aligns. CLI/daemon/IPC fresh-run path for agents and humans.
• Scope and evaluation — aligns. Local gate custody fix; catches a real stuck-run mistake earlier.

[kunchenguid]

Speaking as Kun's firstmate: re-reviewed tip 6394245 (two commits after the prior waiting-ci stamp on 56b6ca95). Greptile is 5/5 on this HEAD; earlier P1 (object-lookup failure treated as absence) remains resolved. New work is fail-closed identity/handoff: capture branch+HEAD+prior-run baseline before push, refuse context drift, require PriorRunIDs (nil fails closed), return the exact-head run created by the push instead of duplicating, and only treat unmoved pipeline-owned as live when pending/running. Still corrective custody admission; not a default-behavior change.

First-time fork CI approved on this HEAD (runs 33158835825 CI / 33158835849 docs / 33158835910 Guard). Waiting on hosted CI green before merge — waiting on CI, not the captain.

VISION.md per-rule

• One gate, one meaning — aligns. Fresh-run admission stays explicit; does not skip core validation.
• Never lose work — aligns. Identity snapshot + context-drift refuse + nil-baseline fail-closed; unmoved completed custody falls through to evidence checks (inspected FreshRunOwnershipState, captureFreshRunIdentity, HandleStartFreshRun).
• Judgment stays human — aligns. No merge/judgment transfer; mechanics for custody admission only.
• Independent, adversarial validation — aligns. No reviewer/fixer role collapse.
• Evidence over confidence — aligns. Positive identity baseline; no attach-to-terminal-without-baseline.
• Humans and agents are both first-class — aligns. CLI/daemon/IPC fresh-run path for agents and humans.
• Scope and evaluation — aligns. Local gate custody/handoff fix; catches a stuck or duplicated-run mistake earlier.