Fix different project same PR number collision problem

Fix (two layers):
1. Root cause — pr_merge and rebase_pr_for_task now take a required project_id and scope the lookup where(pr_number == X AND project_id == Y). Required so no caller can forget — the bug class can't recur. All 4 call sites updated (choreographer cell_pm_complete, the rebase-retry, the superseded close_pull_request now passes project_id, and _verb_runner._do_pr_merge).
2. Crash guard — _finalize_cell_complete None-checks the complete() return and returns a clean invalid_state envelope (with a remediate hint) instead of dereffing None → 500 → respawn loop.

tests/unit/gateway/test_choreographer_pm.py

@@ -318,10 +318,62 @@ async def test_cell_pm_complete_merges_then_completes() -> None:
     assert env.error is None
     assert env.status == "completed"
     git_svc.pr_merge.assert_awaited_once_with(
-        8, target="feature/main_pm/abc", actor_agent_id=pm_id
+        8,
+        target="feature/main_pm/abc",
+        project_id=t.project_id,
+        actor_agent_id=pm_id,
     )
 
 
+@pytest.mark.asyncio
+async def test_cell_pm_complete_does_not_500_when_complete_returns_none() -> None:
+    """`complete()` returns None when its PR-merged guard fails — which is
+    exactly what happened live when the merge recorded against the WRONG
+    task's work session (the cross-repo pr_number collision) left this
+    task's `pr_status="open"`. `_finalize_cell_complete` used to deref
+    `t.status` on the None and 500, leaving the cell PM thrashing
+    escalate<->blocked until the CEO intervened. It must fail closed into a
+    clean invalid_state envelope, never a 500.
+    """
+    pm_id = uuid4()
+    task_id = uuid4()
+    parent_id = uuid4()
+    t = MagicMock(
+        id=task_id,
+        status="awaiting_pm_review",
+        assigned_to=pm_id,
+        pr_number=8,
+        branch_name="feature/backend/abc--def",
+        parent_task_id=parent_id,
+        team="backend",
+    )
+    parent = MagicMock(
+        id=parent_id, branch_name="feature/main_pm/abc", parent_task_id=None
+    )
+    task_svc = AsyncMock()
+    task_svc.get.side_effect = lambda tid: parent if tid == parent_id else t
+    task_svc.all_subtasks_terminal.return_value = True
+    task_svc.cell_pm_complete.return_value = None  # complete() rejected
+    git_svc = AsyncMock()
+    git_svc.pr_merge.return_value = {"merge_commit_sha": "merge-abc"}
+    journal_svc = AsyncMock()
+    journal_svc.has_decision_for_task.return_value = True
+    journal_svc.latest_decision_at.return_value = datetime.now(UTC)
+    journal_svc.has_reflect_for_task.return_value = True
+    deps = _make_deps(task=task_svc, git=git_svc, journal=journal_svc)
+    c = Choreographer(deps)
+
+    env = await c.cell_pm_complete(pm_id, task_id, notes="reviewed and approved")
+    body = env.as_dict()
+    assert body["error"] == "invalid_state"
+    assert (
+        "merged" in body.get("message", "").lower()
+        or "complete" in body.get("message", "").lower()
+    )
+    # No AttributeError 500 — the verb completed cleanly with a remediation.
+    assert body.get("remediate")
+
+
 @pytest.mark.asyncio
 async def test_cell_pm_complete_blocks_if_subtasks_unfinished() -> None:
     pm_id = uuid4()

tests/unit/gateway/test_merge_conflict_resolver.py

@@ -62,7 +62,9 @@ async def test_superseded_closes_pr_and_completes_without_merge(
         return_value=MagicMock(status="completed", parent_task_id=None, team="frontend")
     )
     choreo = _choreo(task, git, monkeypatch)
-    t = MagicMock(pr_number=159, parent_task_id=None, team="frontend")
+    t = MagicMock(
+        pr_number=159, project_id=uuid4(), parent_task_id=None, team="frontend"
+    )
 
     env = await choreo._resolve_merge_conflict_on_complete(
         uuid4(), uuid4(), t, "feature/frontend/root--cell", "notes", _EXC
@@ -93,7 +95,9 @@ async def test_rebased_retries_merge_and_completes(
         return_value=MagicMock(status="completed", parent_task_id=None, team="frontend")
     )
     choreo = _choreo(task, git, monkeypatch)
-    t = MagicMock(pr_number=160, parent_task_id=None, team="backend")
+    t = MagicMock(
+        pr_number=160, project_id=uuid4(), parent_task_id=None, team="backend"
+    )
 
     await choreo._resolve_merge_conflict_on_complete(
         uuid4(), uuid4(), t, "feature/backend/root--cell", "notes", _EXC
@@ -124,7 +128,9 @@ async def test_genuine_conflict_escalates_to_ceo_and_does_not_loop(
     notify = AsyncMock()
     monkeypatch.setattr(choreo, "_notify_ceo_merge_conflict", notify)
     tid = uuid4()
-    t = MagicMock(pr_number=160, parent_task_id=None, team="backend")
+    t = MagicMock(
+        pr_number=160, project_id=uuid4(), parent_task_id=None, team="backend"
+    )
 
     env = await choreo._resolve_merge_conflict_on_complete(
         uuid4(), tid, t, "feature/backend/root--cell", "notes", _EXC
@@ -155,7 +161,9 @@ async def test_unknown_rebase_outcome_escalates_rather_than_completing(
     task.admin_set_status = AsyncMock()
     task.get = AsyncMock(return_value=MagicMock(status="awaiting_ceo_approval"))
     choreo = _choreo(task, git, monkeypatch)
-    t = MagicMock(pr_number=160, parent_task_id=None, team="backend")
+    t = MagicMock(
+        pr_number=160, project_id=uuid4(), parent_task_id=None, team="backend"
+    )
 
     await choreo._resolve_merge_conflict_on_complete(
         uuid4(), uuid4(), t, "feature/backend/root--cell", "notes", _EXC

tests/unit/services/test_git.py

@@ -549,14 +549,19 @@ async def test_pr_merge_returns_merge_commit_dict() -> None:
     # Merges flow UP the chain (cell -> Main-PM branch), never into master via
     # this agent path — target is the integration branch, not the default branch.
     with _patch_project_service(fake_project):
-        out = await svc.pr_merge(11, target="feature/main_pm/root1234")
+        out = await svc.pr_merge(
+            11, target="feature/main_pm/root1234", project_id=project_id
+        )
     assert out == {"merge_commit_sha": "abc123sha"}
 
 
 @pytest.mark.asyncio
 async def test_pr_merge_into_default_branch_is_ceo_only() -> None:
     """The agent merge path refuses to merge into a repo's default branch."""
-    fake_task = MagicMock(project_id=uuid4(), parent_task_id=None, assigned_to=uuid4())
+    project_id = uuid4()
+    fake_task = MagicMock(
+        project_id=project_id, parent_task_id=None, assigned_to=uuid4()
+    )
     fake_project = MagicMock(slug="roboco")
     result = MagicMock()
     result.scalar_one_or_none.return_value = fake_task
@@ -573,7 +578,7 @@ async def test_pr_merge_into_default_branch_is_ceo_only() -> None:
         _patch_project_service(fake_project),
         pytest.raises(UnauthorizedError, match="CEO_ONLY"),
     ):
-        await svc.pr_merge(11, target="master")
+        await svc.pr_merge(11, target="master", project_id=project_id)
     # Guard fires before any GitHub merge call.
     merge_api.assert_not_called()
 

tests/unit/services/test_pr_merge_concurrency.py

@@ -110,7 +110,9 @@ async def test_pr_merge_retries_once_on_409_conflict() -> None:
     _bind(svc, "_sync_target_branch", sync_branch)
 
     with _patch_project_service(fake_project):
-        out = await svc.pr_merge(11, target="feature/backend/parent")
+        out = await svc.pr_merge(
+            11, target="feature/backend/parent", project_id=project_id
+        )
 
     assert out == {"merge_commit_sha": "merged-sha"}
     # _call_merge_api invoked twice — once 409, once 200.
@@ -151,7 +153,7 @@ async def test_pr_merge_raises_after_second_409() -> None:
     _bind(svc, "_sync_target_branch", AsyncMock(return_value="abc"))
 
     with _patch_project_service(fake_project), pytest.raises(GitError) as exc_info:
-        await svc.pr_merge(11, target="feature/backend/parent")
+        await svc.pr_merge(11, target="feature/backend/parent", project_id=project_id)
 
     assert "409" in str(exc_info.value)
     # No infinite retries — exactly two attempts.
@@ -188,7 +190,7 @@ async def test_pr_merge_does_not_retry_on_non_409_error() -> None:
     _bind(svc, "_sync_target_branch", AsyncMock(return_value="abc"))
 
     with _patch_project_service(fake_project), pytest.raises(GitError):
-        await svc.pr_merge(11, target="feature/backend/parent")
+        await svc.pr_merge(11, target="feature/backend/parent", project_id=project_id)
 
     # Only one merge attempt — non-409 error path skips retry.
     assert call_seq.await_count == 1
@@ -224,7 +226,7 @@ async def test_pr_merge_locks_parent_task_with_for_update() -> None:
     _bind(svc, "_sync_target_branch", AsyncMock(return_value="abc"))
 
     with _patch_project_service(fake_project):
-        await svc.pr_merge(11, target="feature/backend/parent")
+        await svc.pr_merge(11, target="feature/backend/parent", project_id=project_id)
 
     # Two SELECTs: PR lookup (no lock) + parent lock (FOR UPDATE).
     assert session.execute.await_count == _EXPECTED_SELECT_CALLS
@@ -272,8 +274,60 @@ async def test_pr_merge_skips_parent_lock_for_root_task() -> None:
     _bind(svc, "_sync_target_branch", AsyncMock(return_value="abc"))
 
     with _patch_project_service(fake_project):
-        out = await svc.pr_merge(11, target="master")
+        out = await svc.pr_merge(11, target="master", project_id=project_id)
 
     assert out == {"merge_commit_sha": "abc"}
     # Only the PR-lookup SELECT runs — no second SELECT for parent lock.
     assert session.execute.await_count == 1
+
+
+# ---------------------------------------------------------------------------
+# Regression: PR numbers are per-repo on GitHub but stored globally in
+# tasks.pr_number with no uniqueness/repo scoping. Two tasks on different
+# projects/repos can share a pr_number, so a bare `where(pr_number ==
+# X).limit(1)` resolves non-deterministically — it merged the wrong repo's
+# PR and marked the WRONG task's work session merged, leaving the real
+# task's session `pr_status="open"` so `complete()` rejected (returned
+# None) and the cell PM 500'd on `t.status` and thrashed. The task lookup
+# MUST be scoped by the caller's project_id (mirrors close_pull_request).
+# ---------------------------------------------------------------------------
+
+
+@pytest.mark.asyncio
+async def test_pr_merge_scopes_task_lookup_by_project_id() -> None:
+    project_id = uuid4()
+    fake_task = MagicMock(
+        id=uuid4(),
+        project_id=project_id,
+        parent_task_id=None,  # root — no parent lock SELECT
+        assigned_to=uuid4(),
+        work_session_id=None,
+    )
+    fake_project = MagicMock(slug="roboco")
+
+    session = MagicMock()
+    pr_result = MagicMock()
+    pr_result.scalar_one_or_none.return_value = fake_task
+    session.execute = AsyncMock(return_value=pr_result)
+    session.commit = AsyncMock()
+    session.rollback = AsyncMock()
+    session.flush = AsyncMock()
+
+    svc = GitService(session)
+    _bind(svc, "get_workspace", AsyncMock(return_value=Path("/tmp/ws")))
+    _bind(svc, "_get_project_token_or_raise", AsyncMock(return_value="tok"))
+    _bind(svc, "_parse_github_remote", MagicMock(return_value=("acme", "repo")))
+    _bind(svc, "_call_merge_api", AsyncMock(return_value=_fake_response(200)))
+    _bind(svc, "_delete_pr_branch_best_effort", AsyncMock())
+    _bind(svc, "_sync_target_branch", AsyncMock(return_value="sha"))
+
+    with _patch_project_service(fake_project):
+        await svc.pr_merge(11, target="feature/x", project_id=project_id)
+
+    lookup_stmt = session.execute.await_args_list[0].args[0]
+    sql = str(lookup_stmt.compile(compile_kwargs={"literal_binds": True}))
+    assert "pr_number" in sql
+    assert "project_id" in sql
+    # The scoped project_id value is bound into the WHERE (Postgres renders
+    # UUID literals without hyphens), not just the column name.
+    assert project_id.hex in sql