journal-worktree-keeper: repair a missing origin from the canonical journal remote

The keeper's origin self-heal (jw_ensure_origin) re-added a vanished
remote.origin.url only from $GARDEN_ROOT's origin. Derive it instead from
journal_remote — the same canonical resolver every other consumer uses —
whose fallback order is $JOURNAL_REMOTE -> the worktree origin -> the
persisted per-host cache ($JOURNAL_REMOTE_CACHE, the companion job's
last-good value) -> $GARDEN_ROOT's origin. The prior root-only source missed
both an explicit $JOURNAL_REMOTE override and the cache, so it could not
recover in the window where the root origin was momentarily gone too but the
cache still held the last-good URL (the 2026-07-03 15:50-15:51Z "no origin"
cascade). A possible journal_remote die() is confined to the command
substitution so a genuinely unresolvable remote leaves the repair to the
caller's own gate rather than killing the keeper.

Adds test coverage for the missing-origin path (previously untested): origin
re-added from an explicit $JOURNAL_REMOTE and from the persisted cache, each
logging REPAIRED and reconciling without a maintainer page.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: endolinbot

scripts/jobs/journal-worktree-keeper.sh

@@ -305,33 +305,43 @@ jw_repair_gitdir() {  # jw_repair_gitdir <jw>
 }
 
 # --- origin self-heal --------------------------------------------------------
-# Re-add a MISSING remote.origin.url on the worktree from the owning root's
-# origin, the same repo/remote the worktree tracks. This closes the transient
-# window where a one-worktree config gap — $JW loses remote.origin.url while
-# $GARDEN_ROOT keeps it — otherwise sends every git op that resolves the journal
+# Re-add a MISSING remote.origin.url on the worktree from the canonical journal
+# remote. This closes the transient window where a one-worktree config gap — $JW
+# loses remote.origin.url — otherwise sends every git op that resolves the journal
 # remote down the "no origin" fatal path, the 2026-07-03 15:50-15:51Z cascade that
 # FATAL-stormed every gardener/monitor/ci-watcher on claim at once. The keeper
 # already self-heals the worktree's BRANCH (fast-forward / diverged reset); this
 # heals its REMOTE the same way. Only acts when the worktree repo opens fine
 # (gitdir resolves — a pure config gap, NOT a dangling gitdir, which is
-# jw_repair_gitdir's job), origin is actually absent on $jw, and $GARDEN_ROOT
-# itself has an origin to copy. Idempotent + best-effort; a still-missing origin
-# falls through to the caller's own gate.
+# jw_repair_gitdir's job) and origin is actually absent on $jw.
+#
+# The URL comes from journal_remote (common.sh), the SAME canonical resolver every
+# other consumer uses, whose fallback order is: an explicit $JOURNAL_REMOTE ->
+# the worktree's own origin -> the persisted per-host cache ($JOURNAL_REMOTE_CACHE,
+# the companion job's last-good value, which survives a reset/deploy) -> the owning
+# $GARDEN_ROOT's origin. Reaching only into $GARDEN_ROOT (the prior implementation)
+# missed both an explicit $JOURNAL_REMOTE override AND the cache, so it could not
+# recover in the window where the root origin was momentarily gone too but the cache
+# still held the last-good URL. journal_remote may die() when nothing resolves at
+# all; the command substitution + `|| true` confine that exit to the subshell (and
+# 2>/dev/null suppresses its FATAL log), so a genuinely unresolvable remote leaves
+# the repair to the caller's own gate rather than killing the keeper.
+# Idempotent + best-effort.
 jw_ensure_origin() {  # jw_ensure_origin <jw>
-  local jw="$1" root_url
+  local jw="$1" url
   # Only a valid, openable repo missing ONLY its origin is our case: a broken
   # gitdir is jw_repair_gitdir's, and a present origin is a no-op.
   git -C "$jw" rev-parse --git-dir >/dev/null 2>&1 || return 0
   git -C "$jw" config --get remote.origin.url >/dev/null 2>&1 && return 0
-  # The owning root shares the same repo/remote as the journal worktree, so its
-  # origin URL is the correct value to restore.
-  root_url="$(git -C "$GARDEN_ROOT" config --get remote.origin.url 2>/dev/null || true)"
-  [ -n "$root_url" ] || return 0
+  # Canonical resolution: $JOURNAL_REMOTE -> worktree origin -> persisted cache ->
+  # $GARDEN_ROOT origin (see journal_remote). Confine a possible die() to the subshell.
+  url="$(journal_remote 2>/dev/null || true)"
+  [ -n "$url" ] || return 0
   # `remote add` when the remote is wholly absent; fall back to setting the url
   # directly when an origin section exists without a url.
-  if git -C "$jw" remote add origin "$root_url" >/dev/null 2>&1 \
-     || git -C "$jw" config remote.origin.url "$root_url" >/dev/null 2>&1; then
-    log "REPAIRED: re-added missing remote.origin.url on $jw from \$GARDEN_ROOT origin ($root_url)"
+  if git -C "$jw" remote add origin "$url" >/dev/null 2>&1 \
+     || git -C "$jw" config remote.origin.url "$url" >/dev/null 2>&1; then
+    log "REPAIRED: re-added missing remote.origin.url on $jw from the canonical journal remote ($url)"
   fi
   return 0
 }

scripts/jobs/test/journal-worktree-keeper-test.sh

@@ -126,6 +126,42 @@ run_keeper
 grep -qF "fast-forwarded" <<<"$OUT" && ok "logged the fast-forward" || bad "did not log the fast-forward"
 [ "$(alert_count)" -eq 0 ] && ok "no alert on a clean fast-forward" || bad "alerted on a clean fast-forward"
 
+# ============================================================================
+hr; echo "MISSING ORIGIN (JOURNAL_REMOTE) — origin re-added, worktree reconciled"; hr
+# The 2026-07-03 15:50-15:51Z cascade: the journal worktree opens fine (gitdir
+# resolves) but remote.origin.url momentarily vanishes, so journal_fetch — and every
+# other git op resolving the journal remote — dives down the "no origin" fatal path.
+# The keeper must re-add origin (here from an explicit $JOURNAL_REMOTE) BEFORE the
+# fetch, then reconcile normally, never leaving the root cause for a later tick.
+setup_fixture; write_alert_stub
+upstream_commit b c2                          # upstream advances (so a real fetch matters)
+git -C "$JW" remote remove origin             # drop origin — the exact wedge condition
+git -C "$JW" config --get remote.origin.url >/dev/null 2>&1 \
+  && bad "fixture: origin should be absent pre-run" \
+  || ok "fixture: remote.origin.url absent before the keeper runs"
+run_keeper JOURNAL_REMOTE="$UP"
+[ "$RC" -eq 0 ] && ok "exit 0 after re-adding a missing origin" || bad "exit $RC on missing origin"
+[ "$(git -C "$JW" config --get remote.origin.url 2>/dev/null)" = "$UP" ] \
+  && ok "origin re-added to the canonical remote" || bad "origin not re-added"
+grep -qF "REPAIRED:" <<<"$OUT" && ok "logged a REPAIRED: line for the re-added origin" || bad "did not log the origin repair"
+[ "$(head_sha)" = "$(remote_sha)" ] && ok "worktree reconciled to origin/journal2 after the repair" || bad "worktree not reconciled after re-adding origin"
+[ "$(alert_count)" -eq 0 ] && ok "no maintainer page on a self-healed origin" || bad "paged despite a self-healed origin"
+
+# ============================================================================
+hr; echo "MISSING ORIGIN (persisted cache) — origin re-added from the companion cache"; hr
+# The companion job persists the last-good journal remote to $JOURNAL_REMOTE_CACHE
+# ($GARDEN_STATE/config/journal-remote). With NO $JOURNAL_REMOTE set and no root
+# origin, the keeper must still recover origin from that persisted canonical URL.
+setup_fixture; write_alert_stub
+git -C "$JW" remote remove origin
+mkdir -p "$TR/state/config"; printf '%s\n' "$UP" > "$TR/state/config/journal-remote"
+run_keeper                                    # no JOURNAL_REMOTE; forces the cache path
+[ "$RC" -eq 0 ] && ok "exit 0 re-adding origin from the cache" || bad "exit $RC on cache-based origin repair"
+[ "$(git -C "$JW" config --get remote.origin.url 2>/dev/null)" = "$UP" ] \
+  && ok "origin re-added from the persisted cache" || bad "origin not re-added from the cache"
+grep -qF "REPAIRED:" <<<"$OUT" && ok "logged the REPAIRED: line (cache path)" || bad "did not log the cache-path repair"
+[ "$(alert_count)" -eq 0 ] && ok "no page on the cache-based origin repair" || bad "paged despite recovering origin from the cache"
+
 # ============================================================================
 hr; echo "SELF-HEAL (a) — diverged+superseded, no writer: auto-healed, no page"; hr
 # The recurring real shape: a stale local-ahead commit, a dirty tracked file, and