fix(kanban): close the 4 P1 FleetReview recorded on #848's head 0757be86

[Kyzcreig]

Close-out for the four unresolved P1 a trusted 5-member FleetReview record reported on #848's head 0757be86 (recorded 15:06:04Z), one hour before #848 merged as squash 8300bd7513. New branch off main; #848 is not reopened.

Two of the four re-opened the exact hole #848 was written to close.

What changed

1 — a MENTION no longer satisfies the completion path (_verified_explicit)

A title/body match was marked unbound and still returned as an explicit survivor. _reusable guards the recorded row on the cleanup=True pass only, and _external takes its explicit arm before the cleanup arm — so _reusable structurally never saw it. "follow-up to t_…; does not address it" authorised a completion, and preserve treats a verified explicit survivor as authority over unpushed work. A mention now takes the same refusal an unrelated live claim takes, behind the same documented override. Completion and reclamation now answer the question identically.

2 — --survivor-unbound is per-claim

It was one parameter applied uniformly (mined_for=None if unbound else task_id), so an operator overriding one repository's claim silently accepted every sibling with no check that it names the card — and stamped unbound=True on all of them, costing the correctly-bound ones their reclamation authority. New _unbound_keys normalises to (bare, keys): a bare flag covers a single-claim invocation, is refused on a multi-claim one, and an override naming no claim is refused. CLI flag is now append/nargs="?".

3 — verify_ref refuses an ambiguous SHA instead of picking a tip

matches was keyed by oid, so later ls-remote lines overwrote earlier ones. A commit that is the tip of both a topic branch and main (an ordinary fast-forward with the branch left alive), or that carries a tag, collapsed to whichever refname was emitted last — and refname order puts refs/heads/main and refs/tags/* after refs/heads/kanban/<tid>-*. Now: keep every tip, narrow by the binding, refuse if still >1. branch is persisted provenance; a guess there is a false recovery-index entry.

4 — _reusable restores the isinstance(ref, dict) guard

Every other previous["refs"] reader applies it (_unshrunk, the cleanup carry-forward, _merge_refs, _vouched_repositories). AttributeError is in neither preserve()'s nor remove_workspace_dir()'s except tuple, so a non-dict entry escaped past _hold() and skipped the fail-closed contract entirely. Hoisted into _bound() so the two paths cannot diverge again. A malformed entry is treated as UNBOUND rather than skipped: fail closed on junk.

Verification

tests/hermes_cli/test_kanban_survivor_848_findings.py (new, 17 tests) — 17 passed.

Re-run with hermes_cli/ stashed back to 8300bd7513: 11 failed, 4 passed. The 4 are the anti-vacuity controls, green in both directions by design. Every substantive test is RED on the merged head.

Each expectation is computed independently of the function under test: the remote is a subprocess.run fixture fixed by construction, consequences are bytes written and read back in the test, and finding 3's core test asserts an order-invariance (both ls-remote orderings must agree) rather than a snapshot of the current answer.

5 pre-existing tests in test_kanban_survivor_binding.py encoded the mention-completes-the-card behaviour finding 1 declares wrong; rewritten to the new contract, with the operator-override arm kept as anti-vacuity.

Inherited-red proof. Full kanban selection, env-scrubbed:

	failed	passed	errors
this branch	18	1241	40
clean-room worktree at base a309b9d8f1	18	1222	40

The 58 FAILED/ERROR test names diff empty between the two. Every red is inherited from main; this branch adds +19 passing and zero new failures.

Note for whoever lands it

#875 and #845 are dirty against main after #842/#848; they rebase before review. #866 is still stacked on t_1bcd8aec's branch.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[Kyzcreig]

🤖 merged-by: apollo · lane: fr-pause-0922 · gate: BYPASS: FR PAUSED by Ace ruling 2026-09-22 (state/fleetreview-pause-20260922.md); t_99d93499 approved · why: argus APPROVED r2 EXECUTION (close the 4 P1 FleetReview record findings); CI green; Apollo merge pass 2026-09-22