hand a reviewed public PR back to its opener, or land it ourselves when the branch is writable

[atomantic]

Summary

pr-reviewer stage 3 posts its review and, when everything lines up, merges. A PR that came back with blockers — or that was approved but not merge-ready (red CI, a conflict, a rebase the forge refused) — was left with nobody holding it: the contributor got a review notification, PortOS kept re-polling, and the PR appeared in no one's assigned queue.

Stage 3 now resolves an owner for every PR it does not merge:

• PortOS can push to the head branch (same-repo, or a fork with maintainerCanModify) and the review is a concrete work order → queue an agent to implement the review, get the PR green, and merge it.
• Otherwise → assign the opener; the next move is theirs.

A deferred verdict, or findings the coordinator could not anchor to a diff line, never becomes an agent work order — there is nothing concrete to implement, so those go to the opener.

Applied at the four points where a PR stops being watched: a blocking review posted, an approved PR with red CI, the poller's CI failure, and the poller's tick exhaustion.

Design notes

Fails closed on both axes. An unknown head-repository relationship counts as no write access (an older gh, a partial read, a non-GitHub shape must not be optimistically treated as writable). A per-PR ledger caps remediation at 3 attempts and stops a scheduled sweep re-dispatching for a revision it already handed back.

No contributor prose reaches the remediation prompt. It points the agent at the PR to read the review PortOS already posted, so screened titles, bodies, and diffs stay behind the Stage 1 model-abuse boundary. The only contributor-derived values in the prompt are the PR number, URL, head branch name, and author login.

buildCiMergeGateSteps gains a deleteBranch option, and the remediation prompt asks for false: push rights on a fork are not permission to delete a contributor's branch. Existing callers keep the default and still emit --delete-branch.

The remediation task's worktree is the agent's own. createWorktree's existing-branch path resolves origin/<branch> only, so PortOS cannot attach one to a fork head — the prompt has the agent create a throwaway worktree via gh pr checkout. #6064 fixes that gap at the worktree layer for every caller (it also breaks /resolve and spawnReviewLoopFollowUp on fork PRs today); once it lands, this task becomes useWorktree: true and that step goes away.

Review findings addressed

• The prompt claimed "@<login> left the head branch writable by maintainers" unconditionally — false for a same-repo head, where no contributor did that. Both halves are now conditional on the resolved access, each branch covered by a test.
• The ledger was written wholesale from a pre-queue snapshot, but two passes own entries in it and can be in flight together (cos.js fires the perpetual refill before the completing output hook settles) — one pass erased the other's entry, dropping the dedup and re-spawning an agent for a PR one was already working. persistState now accepts a patch function evaluated against fresh state inside its serialized queue; a pass applies only its own entries, merged by PR number.
• spawnPrRemediationFollowUp returned null both for a duplicate (an agent already owns the PR) and for a failed write, so the caller assigned the opener on top of a running agent. It now returns a discriminated status; only a real failure falls back, and an already-queued observation no longer burns an attempt.

Test plan

• npm test -w server — 1904 files, 38,445 tests, 0 failures.
• New: server/lib/prHandbackPolicy.test.js (the pure disposition matrix, incl. fail-closed write access), server/services/prRemediationFollowUp.test.js (task shape, both prompt branches, untrusted-content containment, no --delete-branch, queued vs already-queued vs failed), and a handback block in server/services/issueWatcher.test.js (remediate-vs-assign per write access, unanchorable and deferred reviews, red CI, per-revision dedup, attempt budget, poller tick exhaustion, ledger merge, in-flight-agent double-ownership).
• The two regression tests for the review findings were bypass-probed: both fail against the pre-fix code and pass against the fix.