fix(revert): never close an Onto-branch (mode=stacked) PR — not harness-created

Codex review (#159, P1): an `Onto branch` (#54) contribution records mode="stacked" against a PRE-EXISTING PR the harness only appended a commit to. The OPEN path called _withdraw -> `gh pr close --delete-branch`, which would close AND delete that collaborator's whole PR branch. Gate withdraw to harness-created PRs (new-pr / stacked-pr); for mode=stacked, refuse and tell the human to revert the specific commit by hand. The merged path is unaffected (it opens a NEW revert PR). Adds a regression test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: eduralph

template/src/pdca_harness/revert.py

@@ -48,6 +48,15 @@ def revert(cfg: Config, issue_id: str, *, dry_run: bool = False, by: str = "",
     if pr_state == "MERGED":
         return _revert_merged(cfg, d, issue_id, rec, pr_url, dry_run=dry_run, by=by, today=today)
     if pr_state == "OPEN":
+        # ``mode: "stacked"`` (Onto branch, #54) means the harness appended a commit to a
+        # PRE-EXISTING PR it did NOT create. Withdrawing it would `gh pr close
+        # --delete-branch` that collaborator's whole PR branch — never do that. (The merged
+        # path is still safe: it opens a *new* revert PR, leaving the original alone.)
+        if rec.get("mode") == "stacked":
+            print(f"revert: {d.name} was published as a commit onto an existing PR "
+                  f"({pr_url}, mode=stacked) the harness did not create — refusing to close "
+                  "it. Revert just that commit on the PR branch by hand.", file=sys.stderr)
+            return 1
         return _withdraw(cfg, d, pr_url, dry_run=dry_run, by=by, today=today)
     print(f"revert: {d.name}'s PR is {pr_state} — nothing to revert ({pr_url}).")
     return 0

template/tests/test_revert.py

@@ -111,6 +111,21 @@ def fake_run(cmd, **kw):
         self.assertEqual(rec["action"], "withdraw")
         self.assertEqual(rec["reverts"], "https://gh/pr/1")
 
+    def test_open_stacked_pr_is_refused(self) -> None:
+        # mode="stacked" (Onto branch #54) = a commit on a PRE-EXISTING PR the harness did
+        # not create — revert must NOT close/delete it.
+        d = self._bundle("S")
+        pj = json.loads((d / "publish.json").read_text(encoding="utf-8"))
+        pj["mode"] = "stacked"
+        (d / "publish.json").write_text(json.dumps(pj), encoding="utf-8")
+        with mock.patch.object(revert, "_pr_state", return_value="OPEN"), \
+                mock.patch.object(revert.subprocess, "run") as run, \
+                redirect_stderr(io.StringIO()) as err:
+            rc = revert.revert(self.cfg, "S")
+        self.assertEqual(rc, 1)
+        run.assert_not_called()                  # never touched the collaborator's PR
+        self.assertIn("refusing to close", err.getvalue())
+
 
 if __name__ == "__main__":
     unittest.main()