fix(merge-gate): tolerate re-test infra-timeout + tree-kill spawned pytest

Eliminate the false `deploy-staging -> development` rollback that fired when the merge-gate local re-test timed out (infra/resource) on a green CI + tester + staging branch (incident ORCH-109/PR #129: a 516.7s suite blew its 600s budget under CPU starvation from orphaned pytest processes -> timeout misrouted as a code fault -> developer-retry loop -> manual gate). Additive, 5 independent kill-switches, never-raise, self-hosting scope. Untouched byte-for-byte: STAGE_TRANSITIONS, the QG_CHECKS registry, check_branch_mergeable name/semantics, machine-verdict keys, the DB schema. INV-4 (never push/force-push main) and the no-prod-restart rule are preserved. - D1: new stdlib-only leaf src/proc_group.py runs the spawned re-test/coverage pytest in its own process group (start_new_session) and tree-kills the WHOLE group on timeout (os.killpg SIGTERM->grace->SIGKILL); used by merge_gate.retest_branch and coverage_gate.measure_coverage. No orphan leak. Fallback never-break: subprocess_tree_kill_enabled=False / non-POSIX -> the prior subprocess.run. - D2/D3: merge_gate.classify_retest_failure distinguishes timeout/red/lock-busy/ other; an infra timeout routes to _handle_merge_gate_infra_retry (bounded re-queue, task stays on deploy-staging, no rollback / no developer-retry); a red re-test / conflict still rolls back (BR-6). Exhaustion -> one infra alert. - D4: skip the local re-test when the pre-merge rebase was a proven no-op (HEAD already CI/tester/staging-validated); fail-safe runs the re-test on any uncertainty. Flag merge_retest_skip_when_current_enabled. - D5: merge_retest_timeout_s 600 -> 900 + _resolve_retest_timeout validation; reaper_max_running_s invariant preserved without change. - D6: in-process counters + read-only merge_gate block in GET /queue; appended ("ORCH-110","classify_retest_failure","src/merge_gate.py") to MAIN_REGRESSION_MARKERS. Docs (README/internals overview/CLAUDE/CHANGELOG/ .env.example) updated in the same PR. Tests: tests/test_orch110_*.py (TC-01..TC-12, incl. the red-before/green-after incident regression). Full suite green (1988 passed). Refs: ORCH-110 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-15 10:14:55 +03:00
parent cf602b4810
commit 651b9af7c3
24 changed files with 1816 additions and 50 deletions
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -56,7 +56,7 @@ def test_merge_gate_settings_defaults(monkeypatch):
    s = Settings()
    assert s.merge_gate_enabled is True
    assert s.merge_gate_repos == ""
-    assert s.merge_retest_timeout_s == 600
+    assert s.merge_retest_timeout_s == 900  # ORCH-110 D5: raised 600 -> 900
    assert s.merge_retest_target == "tests/"
    assert s.merge_lock_timeout_s == 300
    assert s.merge_defer_delay_s == 60
--- a/tests/test_coverage_gate.py
+++ b/tests/test_coverage_gate.py
@@ -425,12 +425,14 @@ def test_tc14_real_measurement(tmp_path, monkeypatch):


 def test_tc14_measure_timeout_returns_none(monkeypatch):
-    import subprocess
+    # ORCH-110: measure_coverage now runs via proc_group.run_in_process_group
+    # (tree-kill on timeout). A timed_out ProcResult -> None (prior contract).
+    from src.proc_group import ProcResult
    monkeypatch.setattr(cg, "ensure_worktree", lambda r, b: "/tmp")
-
-    def _timeout(*a, **k):
-        raise subprocess.TimeoutExpired(cmd="pytest", timeout=1)
-    monkeypatch.setattr(cg.subprocess, "run", _timeout)
+    monkeypatch.setattr(
+        cg, "run_in_process_group",
+        lambda *a, **k: ProcResult(returncode=None, stdout="", stderr="", timed_out=True),
+    )
    assert cg.measure_coverage(_REPO, _BRANCH) is None


--- a/tests/test_merge_gate.py
+++ b/tests/test_merge_gate.py
@@ -203,10 +203,16 @@ def fake_worktree(tmp_path, monkeypatch):
    return str(wt)


+# ORCH-110: retest_branch now runs the suite via proc_group.run_in_process_group
+# (tree-kill on timeout). The seam is mocked with a ProcResult; the RETURN contract
+# is byte-for-byte the prior one.
+from src.proc_group import ProcResult  # noqa: E402
+
+
 def test_tc07_retest_green(fake_worktree, monkeypatch):
    monkeypatch.setattr(
-        merge_gate.subprocess, "run",
-        lambda *a, **k: subprocess.CompletedProcess(a, 0, "1 passed", ""),
+        merge_gate, "run_in_process_group",
+        lambda *a, **k: ProcResult(returncode=0, stdout="1 passed", stderr="", timed_out=False),
    )
    ok, reason = merge_gate.retest_branch("orchestrator", "feature/x")
    assert ok is True
@@ -215,9 +221,11 @@ def test_tc07_retest_green(fake_worktree, monkeypatch):

 def test_tc08_retest_red_with_tail(fake_worktree, monkeypatch):
    monkeypatch.setattr(
-        merge_gate.subprocess, "run",
-        lambda *a, **k: subprocess.CompletedProcess(
-            a, 1, "FAILED tests/test_x.py::t - AssertionError\n1 failed", ""
+        merge_gate, "run_in_process_group",
+        lambda *a, **k: ProcResult(
+            returncode=1,
+            stdout="FAILED tests/test_x.py::t - AssertionError\n1 failed",
+            stderr="", timed_out=False,
        ),
    )
    ok, reason = merge_gate.retest_branch("orchestrator", "feature/x")
@@ -227,11 +235,11 @@ def test_tc08_retest_red_with_tail(fake_worktree, monkeypatch):


 def test_tc09_retest_timeout(fake_worktree, monkeypatch):
-    def _boom(*a, **k):
-        raise subprocess.TimeoutExpired(cmd="pytest", timeout=1)
-
    monkeypatch.setattr(merge_gate.settings, "merge_retest_timeout_s", 1)
-    monkeypatch.setattr(merge_gate.subprocess, "run", _boom)
+    monkeypatch.setattr(
+        merge_gate, "run_in_process_group",
+        lambda *a, **k: ProcResult(returncode=None, stdout="", stderr="", timed_out=True),
+    )
    ok, reason = merge_gate.retest_branch("orchestrator", "feature/x")
    assert ok is False
    assert "re-test timeout" in reason
--- a/tests/test_orch110_budget_invariants.py
+++ b/tests/test_orch110_budget_invariants.py
@@ -0,0 +1,82 @@
+"""ORCH-110 TC-08: re-test budget validation + cross-invariants (D5).
+
+Covers FR-3 / AC-5 / NFR-6:
+  * ``_resolve_retest_timeout`` validates the config (malformed / non-positive ->
+    safe default 900 + WARNING; never reaches subprocess);
+  * the budget was bumped 600 -> 900;
+  * the cross-invariant ``reaper_max_running_s > Σ(deploy-staging gate-work) + grace``
+    (ORCH-065/109) still holds with the new 900s re-test budget — WITHOUT raising
+    ``reaper_max_running_s``.
+"""
+import os
+import tempfile
+
+os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_orch110_budget.db"))
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+import pytest  # noqa: E402
+
+from src import merge_gate  # noqa: E402
+from src.config import Settings, settings  # noqa: E402
+
+
+# ---------------------------------------------------------------------------
+# _resolve_retest_timeout — validation (never-break).
+# ---------------------------------------------------------------------------
+def test_tc08_resolve_uses_positive_config(monkeypatch):
+    monkeypatch.setattr(merge_gate.settings, "merge_retest_timeout_s", 1234, raising=False)
+    assert merge_gate._resolve_retest_timeout() == 1234
+
+
+@pytest.mark.parametrize("bad", [0, -5, "abc", None, 3.0])
+def test_tc08_resolve_bad_config_falls_back_to_default(monkeypatch, bad):
+    monkeypatch.setattr(merge_gate.settings, "merge_retest_timeout_s", bad, raising=False)
+    # 3.0 is a valid positive int(3) -> stays 3; everything else -> 900 default.
+    out = merge_gate._resolve_retest_timeout()
+    if bad == 3.0:
+        assert out == 3
+    else:
+        assert out == 900
+
+
+def test_tc08_default_budget_bumped_to_900():
+    """D5: the shipped default budget is 900 (raised from 600)."""
+    assert Settings().merge_retest_timeout_s == 900
+
+
+# ---------------------------------------------------------------------------
+# Cross-invariant: reaper backstop covers the worst-case deploy-staging gate-work.
+# ---------------------------------------------------------------------------
+def test_tc08_reaper_covers_deploy_staging_worstcase():
+    """ORCH-065/109 invariant with the new 900s re-test budget (ADR D5 table)."""
+    s = Settings()
+    # Worst-case sum of work charged to a deploy-staging-deployer job (ADR D5).
+    security = 120
+    rebase = 120
+    image = 600
+    worst = (
+        s.agent_timeout_seconds          # deployer agent (1800)
+        + security
+        + rebase
+        + s.merge_retest_timeout_s       # re-test (900, new)
+        + s.coverage_run_timeout_s       # coverage (900)
+        + image
+        + s.agent_kill_grace_seconds     # grace (20)
+    )
+    assert worst <= 4460  # matches the ADR D5 table
+    assert s.reaper_max_running_s > worst, (
+        f"reaper_max_running_s={s.reaper_max_running_s} must exceed "
+        f"deploy-staging worst-case {worst}"
+    )
+
+
+def test_tc08_reaper_still_covers_max_agent_timeout():
+    """ORCH-065/109: reaper_max_running_s > max(agent timeout) + grace (unchanged)."""
+    s = Settings()
+    assert s.reaper_max_running_s > s.agent_timeout_developer_s + s.agent_kill_grace_seconds
+
+
+def test_tc08_reaper_max_running_s_unchanged():
+    """D5 must NOT change reaper_max_running_s (stays 5400 from ORCH-109)."""
+    assert settings.reaper_max_running_s == 5400
--- a/tests/test_orch110_false_rollback_regression.py
+++ b/tests/test_orch110_false_rollback_regression.py
@@ -0,0 +1,213 @@
+"""ORCH-110 TC-10: regression of the ORCH-109 / PR #129 incident.
+
+Incident: tester PASS + green CI + the branch not-behind, but the merge-gate local
+re-test blew its wall-clock budget under CPU starvation -> ``check_branch_mergeable``
+returned ``(False, "re-test timeout ...")`` -> the engine routed it to
+``_handle_merge_gate_rollback`` (rollback deploy-staging -> development + a developer
+retry) -> every retry timed out the same way -> "Merge-gate still failing after 3
+developer retries" -> a stuck task needing manual intervention.
+
+This drives the REAL ``check_branch_mergeable`` through ``advance_stage`` (only the
+git/test primitives are mocked) and asserts the incident can no longer happen:
+
+  * Scenario A (D4) — a not-behind branch (no-op rebase) on a green-CI HEAD: the
+    local re-test is SKIPPED entirely -> the gate passes -> advance to deploy.
+  * Scenario B (D3) — a real catch-up whose re-test times out: a bounded infra-retry
+    (task stays on deploy-staging), NEVER a rollback to development and NEVER the
+    "Merge-gate still failing after N developer retries" alert.
+
+RED-before / GREEN-after: on pre-ORCH-110 code both scenarios would roll the task
+back to development (Scenario A would even run the doomed re-test), so the
+``rolled_back_to is None`` / ``stage == deploy-staging`` assertions below would FAIL.
+"""
+import os
+import tempfile
+
+import pytest
+
+_test_db = os.path.join(tempfile.gettempdir(), "test_orch110_regression.db")
+os.environ["ORCH_DB_PATH"] = _test_db
+os.environ["ORCH_REPOS_DIR"] = tempfile.gettempdir()
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+from unittest.mock import MagicMock  # noqa: E402
+
+import src.db as _db  # noqa: E402
+from src.db import init_db, get_db  # noqa: E402
+from src import stage_engine  # noqa: E402
+from src import merge_gate  # noqa: E402
+from src.qg import checks as qg  # noqa: E402
+from src.stage_engine import advance_stage  # noqa: E402
+
+_REPO = "orchestrator"
+_WI = "ORCH-110"
+_BRANCH = "feature/ORCH-110-x"
+
+
+@pytest.fixture(autouse=True)
+def fresh_db(monkeypatch):
+    monkeypatch.setattr(_db.settings, "db_path", _test_db)
+    if os.path.exists(_test_db):
+        os.unlink(_test_db)
+    init_db()
+    yield
+
+
+@pytest.fixture(autouse=True)
+def silence(monkeypatch):
+    for name in (
+        "notify_stage_change", "notify_qg_failure", "send_telegram",
+        "plane_notify_stage", "plane_notify_qg", "plane_add_comment",
+        "set_issue_in_progress", "set_issue_blocked", "notify_approve_requested",
+        "set_issue_in_review", "set_issue_needs_input",
+    ):
+        monkeypatch.setattr(stage_engine, name, MagicMock())
+    # Keep the merge-gate the only intervening sub-gate on the edge; no Phase A.
+    monkeypatch.setattr(stage_engine.settings, "deploy_require_manual_approve", False)
+    # Real gate scope: orchestrator self-hosting.
+    monkeypatch.setattr(qg.settings, "merge_gate_enabled", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_gate_repos", "", raising=False)
+    monkeypatch.setattr(qg.settings, "premerge_rebase_always", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_retest_skip_when_current_enabled", True, raising=False)
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_tolerance_enabled", True)
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_max_retries", 2)
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_retry_delay_s", 120)
+
+
+def _pass(*a, **k):
+    return (True, "ok")
+
+
+def _patch_edge_gates_except_merge(monkeypatch):
+    """All edge gates pass EXCEPT check_branch_mergeable, which stays the REAL one."""
+    patched = {**stage_engine.QG_CHECKS}
+    patched["check_staging_status"] = _pass
+    patched["check_security_gate"] = _pass
+    patched["check_coverage_gate"] = _pass
+    patched["check_staging_image_fresh"] = _pass
+    monkeypatch.setattr(stage_engine, "QG_CHECKS", patched)
+
+
+def _mock_merge_primitives(monkeypatch, *, head_shas, retest_result, retest_calls):
+    """Mock the git/test primitives the real check_branch_mergeable composes."""
+    monkeypatch.setattr(merge_gate, "acquire_merge_lease", lambda *a, **k: (True, "lease acquired"))
+    monkeypatch.setattr(merge_gate, "release_merge_lease", lambda *a, **k: None)
+    monkeypatch.setattr(merge_gate, "branch_is_behind_main", lambda r, b: True)
+    monkeypatch.setattr(merge_gate, "auto_rebase_onto_main", lambda r, b: (True, "rebased onto origin/main"))
+
+    shas = list(head_shas)
+
+    def _head_sha(r, b):
+        return shas.pop(0) if shas else ""
+
+    monkeypatch.setattr(merge_gate, "head_sha", _head_sha)
+
+    def _retest(r, b):
+        retest_calls.append((r, b))
+        return retest_result
+
+    monkeypatch.setattr(merge_gate, "retest_branch", _retest)
+
+
+def _make_task():
+    conn = get_db()
+    cur = conn.execute(
+        "INSERT INTO tasks (plane_id, work_item_id, repo, branch, stage) VALUES (?,?,?,?,?)",
+        (f"plane-{_WI}", _WI, _REPO, _BRANCH, "deploy-staging"),
+    )
+    tid = cur.lastrowid
+    conn.commit()
+    conn.close()
+    return tid
+
+
+def _stage(task_id):
+    conn = get_db()
+    row = conn.execute("SELECT stage FROM tasks WHERE id=?", (task_id,)).fetchone()
+    conn.close()
+    return row[0]
+
+
+def _agents():
+    conn = get_db()
+    rows = conn.execute("SELECT agent FROM jobs ORDER BY id").fetchall()
+    conn.close()
+    return [r[0] for r in rows]
+
+
+def _advance(task_id):
+    return advance_stage(task_id, "deploy-staging", _REPO, _WI, _BRANCH, finished_agent="deployer")
+
+
+# ---------------------------------------------------------------------------
+# Scenario A (D4): the literal incident — not-behind branch, green CI HEAD.
+# The re-test is SKIPPED, so the timeout can never happen; advance to deploy.
+# ---------------------------------------------------------------------------
+def test_tc10_incident_noop_rebase_skips_retest_and_advances(monkeypatch):
+    _patch_edge_gates_except_merge(monkeypatch)
+    retest_calls = []
+    # Same SHA before/after rebase -> proven no-op. retest is rigged to TIME OUT if
+    # it were (wrongly) called — proving the skip is what avoids the false rollback.
+    _mock_merge_primitives(
+        monkeypatch,
+        head_shas=["abc123", "abc123"],
+        retest_result=(False, "re-test timeout after 900s"),
+        retest_calls=retest_calls,
+    )
+    task_id = _make_task()
+    res = _advance(task_id)
+
+    assert retest_calls == [], "re-test must be SKIPPED on a no-op rebase (D4)"
+    assert res.rolled_back_to is None              # the incident's false rollback is gone
+    assert res.advanced is True
+    assert res.to_stage == "deploy"
+    assert _stage(task_id) == "deploy"
+    assert "developer" not in _agents()           # no developer-retry burned
+    assert stage_engine.set_issue_blocked.called is False
+
+
+# ---------------------------------------------------------------------------
+# Scenario B (D3): a real catch-up whose re-test times out -> infra-retry, not
+# rollback, and never the "still failing after N retries" manual gate.
+# ---------------------------------------------------------------------------
+def test_tc10_real_catchup_retest_timeout_infra_retries_not_rollback(monkeypatch):
+    _patch_edge_gates_except_merge(monkeypatch)
+    retest_calls = []
+    # HEAD moved (real catch-up) -> re-test runs -> times out.
+    _mock_merge_primitives(
+        monkeypatch,
+        head_shas=["old111", "new222"],
+        retest_result=(False, "re-test timeout after 900s"),
+        retest_calls=retest_calls,
+    )
+    task_id = _make_task()
+    res = _advance(task_id)
+
+    assert retest_calls, "re-test SHOULD run on a real (HEAD-moving) catch-up"
+    assert res.rolled_back_to is None              # NOT the code-fault rollback
+    assert res.note == "merge-gate-infra-retry"
+    assert _stage(task_id) == "deploy-staging"     # stays put for a bounded retry
+    assert _agents() == ["deployer"]               # staging-deployer re-queued, NOT developer
+    assert stage_engine.set_issue_blocked.called is False
+    # The "Merge-gate still failing after N developer retries" manual gate never fires.
+    for call in stage_engine.send_telegram.call_args_list:
+        assert "developer retries" not in call[0][0]
+
+
+def test_tc10_real_catchup_red_retest_still_rolls_back(monkeypatch):
+    """Anti-over-tolerance guard inside the incident scenario: a genuinely RED
+    re-test on a real catch-up STILL rolls back (BR-6 / AC-3)."""
+    _patch_edge_gates_except_merge(monkeypatch)
+    retest_calls = []
+    _mock_merge_primitives(
+        monkeypatch,
+        head_shas=["old111", "new222"],
+        retest_result=(False, "re-test failed: ...1 failed"),
+        retest_calls=retest_calls,
+    )
+    task_id = _make_task()
+    res = _advance(task_id)
+    assert res.rolled_back_to == "development"
+    assert _stage(task_id) == "development"
+    assert _agents() == ["developer"]
--- a/tests/test_orch110_killswitch.py
+++ b/tests/test_orch110_killswitch.py
@@ -0,0 +1,103 @@
+"""ORCH-110 TC-07: kill-switches + non-self repo => byte-for-byte pre-ORCH-110.
+
+Covers NFR-2 / FR-5 / AC-7. Each ORCH-110 behaviour is an INDEPENDENT kill-switch;
+with a flag off the affected path reverts to the prior behaviour. A non-self-hosting
+repo (enduro-trails) never reaches the infra-retry / tree-kill paths at all (the
+merge-gate is N/A for it).
+"""
+import os
+import tempfile
+
+os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_orch110_killswitch.db"))
+os.environ.setdefault("ORCH_REPOS_DIR", tempfile.gettempdir())
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+import pytest  # noqa: E402
+
+from src import merge_gate  # noqa: E402
+from src.qg import checks as qg  # noqa: E402
+from src.proc_group import ProcResult  # noqa: E402
+
+_REPO = "orchestrator"
+_BRANCH = "feature/ORCH-110-x"
+_WI = "ORCH-110"
+
+
+# ---------------------------------------------------------------------------
+# D1 kill-switch: subprocess_tree_kill_enabled=False -> the fallback path.
+# ---------------------------------------------------------------------------
+def test_tc07_tree_kill_off_passes_tree_kill_false(tmp_path, monkeypatch):
+    wt = tmp_path / "wt"
+    wt.mkdir()
+    monkeypatch.setattr(merge_gate, "get_worktree_path", lambda r, b: str(wt))
+    monkeypatch.setattr(merge_gate.settings, "subprocess_tree_kill_enabled", False, raising=False)
+    captured = {}
+
+    def _fake(cmd, *, cwd, timeout, env=None, grace_s=5.0, tree_kill=True):
+        captured["tree_kill"] = tree_kill
+        return ProcResult(returncode=0, stdout="1 passed", stderr="", timed_out=False)
+
+    monkeypatch.setattr(merge_gate, "run_in_process_group", _fake)
+    ok, reason = merge_gate.retest_branch(_REPO, _BRANCH)
+    assert ok is True and reason == "re-test green"
+    assert captured["tree_kill"] is False  # -> run_in_process_group degrades to subprocess.run
+
+
+# ---------------------------------------------------------------------------
+# D4 kill-switch: merge_retest_skip_when_current_enabled=False -> always re-test
+# after a rebase (even a proven no-op).
+# ---------------------------------------------------------------------------
+@pytest.fixture
+def gate_primitives(monkeypatch):
+    calls = {"retest": 0}
+    monkeypatch.setattr(qg.settings, "merge_gate_enabled", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_gate_repos", "", raising=False)
+    monkeypatch.setattr(qg.settings, "premerge_rebase_always", True, raising=False)
+    monkeypatch.setattr(merge_gate, "acquire_merge_lease", lambda *a, **k: (True, "lease acquired"), raising=False)
+    monkeypatch.setattr(merge_gate, "branch_is_behind_main", lambda r, b: True, raising=False)
+    monkeypatch.setattr(merge_gate, "auto_rebase_onto_main", lambda r, b: (True, "rebased"), raising=False)
+    monkeypatch.setattr(merge_gate, "release_merge_lease", lambda *a, **k: None, raising=False)
+    # A PROVEN no-op rebase: HEAD is identical before/after.
+    monkeypatch.setattr(merge_gate, "head_sha", lambda r, b: "deadbeefcafe", raising=False)
+
+    def _retest(r, b):
+        calls["retest"] += 1
+        return True, "re-test green"
+
+    monkeypatch.setattr(merge_gate, "retest_branch", _retest, raising=False)
+    return calls
+
+
+def test_tc07_skip_when_current_off_always_retests(gate_primitives, monkeypatch):
+    monkeypatch.setattr(qg.settings, "merge_retest_skip_when_current_enabled", False, raising=False)
+    ok, reason = qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert ok is True
+    assert reason == "rebased onto main, re-test green"
+    assert gate_primitives["retest"] == 1  # re-test STILL runs (D4 off)
+
+
+def test_tc07_skip_when_current_on_skips_noop_retest(gate_primitives, monkeypatch):
+    """Mirror sanity: with the flag ON, the proven no-op rebase skips the re-test."""
+    monkeypatch.setattr(qg.settings, "merge_retest_skip_when_current_enabled", True, raising=False)
+    ok, reason = qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert ok is True
+    assert "re-test skipped" in reason
+    assert gate_primitives["retest"] == 0  # re-test NOT run on the no-op
+
+
+# ---------------------------------------------------------------------------
+# Non-self repo (enduro-trails): the merge-gate is N/A -> never the new paths.
+# ---------------------------------------------------------------------------
+def test_tc07_non_self_repo_is_noop(monkeypatch):
+    monkeypatch.setattr(qg.settings, "merge_gate_enabled", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_gate_repos", "", raising=False)
+    # Guard: if the gate wrongly engaged it would touch the lease -> fail loudly.
+    monkeypatch.setattr(
+        merge_gate, "acquire_merge_lease",
+        lambda *a, **k: pytest.fail("merge-gate must be N/A for enduro-trails"),
+        raising=False,
+    )
+    ok, reason = qg.check_branch_mergeable("enduro-trails", "ET-1", "feature/ET-1-x")
+    assert ok is True
+    assert "N/A" in reason
--- a/tests/test_orch110_merge_gate_classify.py
+++ b/tests/test_orch110_merge_gate_classify.py
@@ -0,0 +1,64 @@
+"""ORCH-110 TC-03: classify_retest_failure distinguishes infra-timeout from red.
+
+Covers D2 (FR-1 / AC-2): the pure predicate that lets the engine route an INFRA
+re-test timeout differently from a deterministically RED re-test, WITHOUT changing
+the name / PASS-FAIL semantics of the registered ``check_branch_mergeable``.
+
+The critical scope guard: an ``auto_rebase_onto_main`` "rebase timeout" is a
+DIFFERENT timeout (git hung) and must NOT be classified as the infra-tolerated
+re-test timeout (it stays on the rollback path).
+"""
+import os
+import tempfile
+
+os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_orch110_classify.db"))
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+import pytest  # noqa: E402
+
+from src import merge_gate  # noqa: E402
+
+classify = merge_gate.classify_retest_failure
+
+
+@pytest.mark.parametrize(
+    "reason,expected",
+    [
+        ("re-test timeout after 900s", "timeout"),
+        ("re-test timeout after 600s", "timeout"),
+        ("re-test failed after rebase: 1 failed, 5 passed", "red"),
+        ("re-test failed: ...AssertionError\n1 failed", "red"),
+        ("merge-lock busy", "lock-busy"),
+        ("rebase conflict: src/db.py", "other"),
+        # SCOPE GUARD: a git "rebase timeout" is NOT the infra-tolerated re-test
+        # timeout — it must stay on the rollback path (ADR D2).
+        ("rebase timeout", "other"),
+        ("push --force-with-lease failed: ...", "other"),
+        ("", "other"),
+    ],
+)
+def test_tc03_classify_reasons(reason, expected):
+    assert classify(reason) == expected
+
+
+def test_tc03_classify_never_raises_on_bad_input():
+    # None / non-str must degrade to the safe "other" (-> rollback), never raise.
+    assert classify(None) == "other"
+    assert classify(12345) == "other"
+
+
+def test_tc03_case_insensitive():
+    assert classify("RE-TEST TIMEOUT AFTER 900S") == "timeout"
+    assert classify("Merge-Lock Busy") == "lock-busy"
+
+
+def test_tc03_distinct_from_lock_busy_and_conflict():
+    """timeout is a distinct class from the existing defer (lock-busy) and rollback
+    (conflict) reasons — the three must never collide."""
+    classes = {
+        classify("re-test timeout after 900s"),
+        classify("merge-lock busy"),
+        classify("rebase conflict: x"),
+    }
+    assert classes == {"timeout", "lock-busy", "other"}
--- a/tests/test_orch110_merge_gate_routing.py
+++ b/tests/test_orch110_merge_gate_routing.py
@@ -0,0 +1,261 @@
+"""ORCH-110 TC-04 / TC-05 / TC-06 / TC-09: merge-gate infra-timeout routing.
+
+Drives the engine (``stage_engine.advance_stage``) on the deploy-staging -> deploy
+edge with ``check_branch_mergeable`` monkeypatched, exactly like the existing
+``test_stage_engine.TestMergeGate`` suite, and asserts the NEW routing (D3):
+
+  * TC-04 — an INFRA re-test timeout -> bounded infra-retry (re-queue the
+    staging-deployer with a delay, task STAYS on deploy-staging) — NOT a rollback to
+    development and NOT a developer-retry.
+  * TC-05 — a deterministically RED re-test STILL rolls back to development +
+    developer retry (BR-6 / AC-3 anti-over-tolerance).
+  * TC-06 — the infra-retry is bounded (anti-loop): after the budget it blocks with
+    ONE infra-alert, no infinite bounce, no new job, task NOT in development.
+  * TC-09 — never-raise: an error in the transient path is swallowed (a WARNING) and
+    never escapes into advance_stage.
+
+Offline: isolated sqlite DB; Plane/Telegram/notifications mocked at stage_engine.
+"""
+import os
+import tempfile
+
+import pytest
+
+_test_db = os.path.join(tempfile.gettempdir(), "test_orch110_routing.db")
+os.environ["ORCH_DB_PATH"] = _test_db
+os.environ["ORCH_REPOS_DIR"] = tempfile.gettempdir()
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+from unittest.mock import MagicMock  # noqa: E402
+
+import src.db as _db  # noqa: E402
+from src.db import init_db, get_db  # noqa: E402
+from src import stage_engine  # noqa: E402
+from src.stage_engine import advance_stage  # noqa: E402
+
+_REPO = "orchestrator"
+_WI = "ORCH-110"
+_BRANCH = "feature/ORCH-110-x"
+_TIMEOUT_REASON = "re-test timeout after 900s"
+
+
+@pytest.fixture(autouse=True)
+def fresh_db(monkeypatch):
+    monkeypatch.setattr(_db.settings, "db_path", _test_db)
+    if os.path.exists(_test_db):
+        os.unlink(_test_db)
+    init_db()
+    yield
+
+
+@pytest.fixture(autouse=True)
+def silence_side_effects(monkeypatch):
+    for name in (
+        "notify_stage_change", "notify_qg_failure", "send_telegram",
+        "plane_notify_stage", "plane_notify_qg", "plane_add_comment",
+        "set_issue_in_progress", "set_issue_blocked",
+    ):
+        monkeypatch.setattr(stage_engine, name, MagicMock())
+    # The merge-gate sub-gate runs only AFTER the stage QG + security + coverage pass;
+    # the self-deploy Phase A interception is irrelevant (merge-gate intervenes first).
+    monkeypatch.setattr(stage_engine.settings, "deploy_require_manual_approve", False)
+
+
+@pytest.fixture(autouse=True)
+def tolerance_on(monkeypatch):
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_tolerance_enabled", True)
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_max_retries", 2)
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_retry_delay_s", 120)
+
+
+def _pass(*a, **k):
+    return (True, "ok")
+
+
+def _fail(reason):
+    def _f(*a, **k):
+        return (False, reason)
+    return _f
+
+
+def _patch_gates(monkeypatch, merge_reason):
+    monkeypatch.setattr(
+        stage_engine, "QG_CHECKS",
+        {**stage_engine.QG_CHECKS,
+         "check_staging_status": _pass,
+         "check_security_gate": _pass,
+         "check_coverage_gate": _pass,
+         "check_branch_mergeable": _fail(merge_reason),
+         "check_staging_image_fresh": _pass},
+    )
+
+
+def _make_task(stage="deploy-staging"):
+    conn = get_db()
+    cur = conn.execute(
+        "INSERT INTO tasks (plane_id, work_item_id, repo, branch, stage) VALUES (?,?,?,?,?)",
+        (f"plane-{_WI}", _WI, _REPO, _BRANCH, stage),
+    )
+    tid = cur.lastrowid
+    conn.commit()
+    conn.close()
+    return tid
+
+
+def _stage(task_id):
+    conn = get_db()
+    row = conn.execute("SELECT stage FROM tasks WHERE id=?", (task_id,)).fetchone()
+    conn.close()
+    return row[0]
+
+
+def _jobs():
+    conn = get_db()
+    rows = conn.execute(
+        "SELECT agent, task_content, available_at FROM jobs ORDER BY id"
+    ).fetchall()
+    conn.close()
+    return [dict(r) for r in rows]
+
+
+def _seed_infra_retry_jobs(task_id, n):
+    conn = get_db()
+    for _ in range(n):
+        conn.execute(
+            "INSERT INTO jobs (agent, repo, task_id, task_content) "
+            "VALUES ('deployer','orchestrator',?, 'Note: merge-gate infra-timeout retry')",
+            (task_id,),
+        )
+    conn.commit()
+    conn.close()
+
+
+def _advance(task_id):
+    return advance_stage(
+        task_id, "deploy-staging", _REPO, _WI, _BRANCH, finished_agent="deployer"
+    )
+
+
+# ---------------------------------------------------------------------------
+# TC-04 — infra-timeout -> bounded infra-retry, NOT a rollback to development.
+# ---------------------------------------------------------------------------
+def test_tc04_infra_timeout_reschedules_not_rollback(monkeypatch):
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+    task_id = _make_task()
+    res = _advance(task_id)
+
+    assert res.advanced is False
+    assert res.rolled_back_to is None             # NOT a code-fault rollback
+    assert res.note == "merge-gate-infra-retry"
+    assert _stage(task_id) == "deploy-staging"    # stays put
+    jobs = _jobs()
+    assert len(jobs) == 1
+    assert jobs[0]["agent"] == "deployer"          # re-queued staging-deployer, NOT developer
+    assert "merge-gate infra-timeout retry" in jobs[0]["task_content"]
+    assert jobs[0]["available_at"] is not None     # delayed re-pickup
+    assert stage_engine.set_issue_blocked.called is False
+    # No developer-retry semantics: the rollback comment / in-progress is never set.
+    assert stage_engine.set_issue_in_progress.called is False
+
+
+def test_tc04_killswitch_within_routing_is_observed(monkeypatch):
+    """The infra-timeout always bumps the timeout counter (observability), even when
+    routed to the retry path."""
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+    before = stage_engine.merge_gate.merge_gate_status()["retest_timeout_total"]
+    task_id = _make_task()
+    _advance(task_id)
+    after = stage_engine.merge_gate.merge_gate_status()["retest_timeout_total"]
+    assert after == before + 1
+
+
+# ---------------------------------------------------------------------------
+# TC-05 — a deterministically RED re-test STILL rolls back (BR-6 / AC-3).
+# ---------------------------------------------------------------------------
+def test_tc05_red_retest_still_rolls_back(monkeypatch):
+    _patch_gates(monkeypatch, "re-test failed after rebase: 1 failed, 5 passed")
+    task_id = _make_task()
+    res = _advance(task_id)
+
+    assert res.advanced is False
+    assert res.rolled_back_to == "development"
+    assert _stage(task_id) == "development"
+    jobs = _jobs()
+    assert len(jobs) == 1
+    assert jobs[0]["agent"] == "developer"        # developer re-queued (retry)
+
+
+def test_tc05_conflict_still_rolls_back(monkeypatch):
+    _patch_gates(monkeypatch, "rebase conflict: src/db.py")
+    task_id = _make_task()
+    res = _advance(task_id)
+    assert res.rolled_back_to == "development"
+    assert _stage(task_id) == "development"
+    assert _jobs()[0]["agent"] == "developer"
+
+
+# ---------------------------------------------------------------------------
+# TC-06 — anti-loop: infra-retry is bounded; exhaustion -> ONE infra-alert.
+# ---------------------------------------------------------------------------
+def test_tc06_infra_retry_bounded_then_infra_alert(monkeypatch):
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_max_retries", 2)
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+    task_id = _make_task()
+    _seed_infra_retry_jobs(task_id, 2)  # budget already spent
+
+    res = _advance(task_id)
+    assert res.advanced is False
+    assert res.rolled_back_to is None                  # NOT a rollback even at exhaustion
+    assert res.note == "merge-gate-infra-retry-exhausted"
+    assert res.alerted is True
+    assert _stage(task_id) == "deploy-staging"         # NOT moved to development
+    assert stage_engine.set_issue_blocked.called
+    assert stage_engine.send_telegram.called
+    # No NEW retry job past the cap (still only the 2 we seeded).
+    assert len(_jobs()) == 2
+    # The alert is INFRA-specific, not "developer must fix".
+    msg = stage_engine.send_telegram.call_args[0][0]
+    assert "infra" in msg.lower() or "ресурс" in msg.lower()
+    assert "НЕ дефект кода" in msg
+
+
+def test_tc06_below_budget_keeps_retrying(monkeypatch):
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_max_retries", 3)
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+    task_id = _make_task()
+    _seed_infra_retry_jobs(task_id, 1)  # one retry already done, budget 3
+
+    res = _advance(task_id)
+    assert res.note == "merge-gate-infra-retry"
+    assert res.alerted is not True
+    # The seeded job + the new retry job.
+    assert len(_jobs()) == 2
+
+
+# ---------------------------------------------------------------------------
+# TC-09 — never-raise: an error in the transient path is swallowed.
+# ---------------------------------------------------------------------------
+def test_tc09_infra_retry_never_raises(monkeypatch):
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+
+    def _boom(*a, **k):
+        raise RuntimeError("enqueue exploded")
+
+    monkeypatch.setattr(stage_engine, "enqueue_job", _boom)
+    task_id = _make_task()
+    # Must NOT raise into advance_stage.
+    res = _advance(task_id)
+    assert res.note == "merge-gate-infra-retry-error"
+    assert _stage(task_id) == "deploy-staging"  # left for the reconciler/reaper
+
+
+def test_tc09_killswitch_off_falls_back_to_rollback(monkeypatch):
+    """tolerance off -> a timeout takes the prior rollback path byte-for-byte (NFR-2)."""
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_tolerance_enabled", False)
+    _patch_gates(monkeypatch, _TIMEOUT_REASON)
+    task_id = _make_task()
+    res = _advance(task_id)
+    assert res.rolled_back_to == "development"
+    assert _stage(task_id) == "development"
+    assert _jobs()[0]["agent"] == "developer"
--- a/tests/test_orch110_observability.py
+++ b/tests/test_orch110_observability.py
@@ -0,0 +1,135 @@
+"""ORCH-110 TC-12: observability of the infra-timeout path (D6 / FR-6 / AC-9).
+
+The infra-timeout state must be (a) reflected in read-only counters, (b) surfaced in
+the additive ``merge_gate`` block of ``GET /queue``, and (c) distinguishable from a
+code-fault rollback — with the exhaustion alert carrying the CLICKABLE issue number
+and an explicitly infrastructural (NOT "developer must fix") wording. No dedup/overlap
+with ORCH-111 (which only OBSERVES surviving processes; ORCH-110 prevents/tolerates).
+"""
+import asyncio
+import os
+import tempfile
+
+_test_db = os.path.join(tempfile.gettempdir(), "test_orch110_observability.db")
+os.environ["ORCH_DB_PATH"] = _test_db
+os.environ["ORCH_REPOS_DIR"] = tempfile.gettempdir()
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+from unittest.mock import MagicMock  # noqa: E402
+
+import pytest  # noqa: E402
+
+import src.db as _db  # noqa: E402
+from src.db import init_db, get_db  # noqa: E402
+from src import merge_gate  # noqa: E402
+from src import stage_engine  # noqa: E402
+from src.stage_engine import AdvanceResult  # noqa: E402
+
+
+@pytest.fixture(autouse=True)
+def fresh_db(monkeypatch):
+    monkeypatch.setattr(_db.settings, "db_path", _test_db)
+    if os.path.exists(_test_db):
+        os.unlink(_test_db)
+    init_db()
+    # Reset the in-process counters so each test starts from a known baseline.
+    merge_gate._MERGE_GATE_COUNTERS.update(
+        retest_timeout_total=0, retest_infra_retry_total=0,
+        retest_infra_exhausted_total=0, retest_skipped_current_total=0,
+        last_infra_timeout_wi=None,
+    )
+    yield
+
+
+# ---------------------------------------------------------------------------
+# merge_gate_status() snapshot + counter increments.
+# ---------------------------------------------------------------------------
+def test_tc12_status_exposes_flags_and_counters():
+    snap = merge_gate.merge_gate_status()
+    for key in (
+        "infra_tolerance_enabled", "infra_max_retries", "infra_retry_delay_s",
+        "skip_when_current_enabled", "tree_kill_enabled", "retest_timeout_s",
+        "retest_timeout_total", "retest_infra_retry_total",
+        "retest_infra_exhausted_total", "retest_skipped_current_total",
+        "last_infra_timeout_wi",
+    ):
+        assert key in snap, f"missing /queue merge_gate key: {key}"
+
+
+def test_tc12_counters_track_infra_timeout_distinctly():
+    merge_gate.note_retest_timeout("ORCH-110")
+    merge_gate.note_retest_infra_retry()
+    merge_gate.note_retest_infra_exhausted()
+    merge_gate.note_retest_skipped_current()
+    snap = merge_gate.merge_gate_status()
+    assert snap["retest_timeout_total"] == 1
+    assert snap["retest_infra_retry_total"] == 1
+    assert snap["retest_infra_exhausted_total"] == 1
+    assert snap["retest_skipped_current_total"] == 1
+    # Distinguishable from a code-fault: the last infra-timeout WI is tracked here,
+    # NOT in the merge-verify (code/merge) counters.
+    assert snap["last_infra_timeout_wi"] == "ORCH-110"
+
+
+def test_tc12_status_never_raises(monkeypatch):
+    # A broken settings attribute -> the snapshot degrades, never raises.
+    monkeypatch.delattr(merge_gate.settings, "merge_retest_infra_tolerance_enabled", raising=False)
+    snap = merge_gate.merge_gate_status()
+    assert isinstance(snap, dict)
+
+
+# ---------------------------------------------------------------------------
+# GET /queue carries the additive merge_gate block (and the legacy keys stay).
+# ---------------------------------------------------------------------------
+def test_tc12_queue_endpoint_includes_merge_gate_block():
+    from src.main import queue
+    out = asyncio.run(queue())
+    assert "merge_gate" in out
+    assert "infra_tolerance_enabled" in out["merge_gate"]
+    # The pre-existing observability keys are untouched (additive only).
+    assert "merge_verify" in out and "coverage" in out
+
+
+# ---------------------------------------------------------------------------
+# The exhaustion alert is INFRA-specific + carries the clickable issue number,
+# distinct from the code-fault "Merge-gate still failing after N developer retries".
+# ---------------------------------------------------------------------------
+def test_tc12_exhaustion_alert_is_infra_specific_and_clickable(monkeypatch):
+    sent = {}
+
+    def _tg(msg):
+        sent["msg"] = msg
+
+    monkeypatch.setattr(stage_engine, "send_telegram", _tg)
+    monkeypatch.setattr(stage_engine, "set_issue_blocked", MagicMock())
+    monkeypatch.setattr(stage_engine, "plane_add_comment", MagicMock())
+    # link_for builds the clickable number; use a recognisable sentinel.
+    monkeypatch.setattr(stage_engine, "link_for", lambda wi, **k: f"<a href='x'>{wi}</a>")
+    monkeypatch.setattr(stage_engine.settings, "merge_retest_infra_max_retries", 2)
+
+    # Seed an exhausted budget for the task.
+    conn = get_db()
+    cur = conn.execute(
+        "INSERT INTO tasks (plane_id, work_item_id, repo, branch, stage) VALUES (?,?,?,?,?)",
+        ("plane-ORCH-110", "ORCH-110", "orchestrator", "feature/ORCH-110-x", "deploy-staging"),
+    )
+    task_id = cur.lastrowid
+    for _ in range(2):
+        conn.execute(
+            "INSERT INTO jobs (agent, repo, task_id, task_content) "
+            "VALUES ('deployer','orchestrator',?, 'Note: merge-gate infra-timeout retry')",
+            (task_id,),
+        )
+    conn.commit()
+    conn.close()
+
+    res = AdvanceResult()
+    stage_engine._handle_merge_gate_infra_retry(
+        task_id, "deploy-staging", "orchestrator", "ORCH-110",
+        "feature/ORCH-110-x", "re-test timeout after 900s", res,
+    )
+    assert res.note == "merge-gate-infra-retry-exhausted"
+    assert "ORCH-110" in sent["msg"]                  # clickable issue number present
+    assert "developer retries" not in sent["msg"]     # NOT the code-fault wording
+    assert "НЕ дефект кода" in sent["msg"]             # explicitly infrastructural
--- a/tests/test_orch110_retest_contract.py
+++ b/tests/test_orch110_retest_contract.py
@@ -0,0 +1,95 @@
+"""ORCH-110 TC-11: the local re-test necessity contract (D4 / FR-4 / AC-6).
+
+The chosen contract: run the local re-test IFF the pre-merge rebase actually moved
+HEAD (``main`` had moved -> a real semantic-conflict risk). When the rebase is a
+PROVEN no-op (HEAD unchanged -> branch already at origin/main, the CI/tester/staging-
+validated commit) the re-test is SKIPPED — it would be a redundant single point of
+false failure. On ANY uncertainty (an empty SHA) the re-test runs (fail-safe -> the
+red-rollback contract BR-6/AC-3 is never weakened).
+"""
+import os
+import tempfile
+
+os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_orch110_contract.db"))
+os.environ.setdefault("ORCH_REPOS_DIR", tempfile.gettempdir())
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+import pytest  # noqa: E402
+
+from src import merge_gate  # noqa: E402
+from src.qg import checks as qg  # noqa: E402
+
+_REPO = "orchestrator"
+_BRANCH = "feature/ORCH-110-x"
+_WI = "ORCH-110"
+
+
+@pytest.fixture
+def gate(monkeypatch):
+    """Real check_branch_mergeable, mocked primitives; record control flow."""
+    state = {"retest": 0, "released": 0, "rebased": 0}
+    monkeypatch.setattr(qg.settings, "merge_gate_enabled", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_gate_repos", "", raising=False)
+    monkeypatch.setattr(qg.settings, "premerge_rebase_always", True, raising=False)
+    monkeypatch.setattr(qg.settings, "merge_retest_skip_when_current_enabled", True, raising=False)
+    monkeypatch.setattr(merge_gate, "acquire_merge_lease", lambda *a, **k: (True, "lease acquired"))
+    monkeypatch.setattr(merge_gate, "branch_is_behind_main", lambda r, b: True)
+
+    def _rebase(r, b):
+        state["rebased"] += 1
+        return True, "rebased onto origin/main"
+
+    def _release(r, b=None):
+        state["released"] += 1
+
+    def _retest(r, b):
+        state["retest"] += 1
+        return True, "re-test green"
+
+    monkeypatch.setattr(merge_gate, "auto_rebase_onto_main", _rebase)
+    monkeypatch.setattr(merge_gate, "release_merge_lease", _release)
+    monkeypatch.setattr(merge_gate, "retest_branch", _retest)
+    return state
+
+
+def _set_head_shas(monkeypatch, shas):
+    seq = list(shas)
+    monkeypatch.setattr(merge_gate, "head_sha", lambda r, b: seq.pop(0) if seq else "")
+
+
+def test_tc11_noop_rebase_skips_retest_lease_held(gate, monkeypatch):
+    """Proven no-op rebase (HEAD unchanged) -> skip re-test, PASS, lease HELD."""
+    _set_head_shas(monkeypatch, ["sha_same", "sha_same"])
+    ok, reason = qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert ok is True
+    assert "re-test skipped" in reason
+    assert gate["retest"] == 0          # re-test NOT run
+    assert gate["released"] == 0        # lease HELD until the merge
+
+
+def test_tc11_head_moved_runs_retest(gate, monkeypatch):
+    """A real catch-up (HEAD moved) -> re-test RUNS (the ORCH-043 risk is real)."""
+    _set_head_shas(monkeypatch, ["sha_old", "sha_new"])
+    ok, reason = qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert ok is True
+    assert reason == "rebased onto main, re-test green"
+    assert gate["retest"] == 1
+
+
+@pytest.mark.parametrize("shas", [["", "sha_new"], ["sha_old", ""], ["", ""]])
+def test_tc11_uncertain_sha_runs_retest_failsafe(gate, monkeypatch, shas):
+    """Cannot prove a no-op (empty SHA) -> re-test RUNS (fail-safe, never skips on
+    uncertainty)."""
+    _set_head_shas(monkeypatch, shas)
+    ok, reason = qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert ok is True
+    assert gate["retest"] == 1          # re-test still runs on uncertainty
+
+
+def test_tc11_skip_bumps_observability_counter(gate, monkeypatch):
+    """The skip increments the read-only observability counter (D6)."""
+    merge_gate._MERGE_GATE_COUNTERS["retest_skipped_current_total"] = 0
+    _set_head_shas(monkeypatch, ["sha_same", "sha_same"])
+    qg.check_branch_mergeable(_REPO, _WI, _BRANCH)
+    assert merge_gate._MERGE_GATE_COUNTERS["retest_skipped_current_total"] == 1
--- a/tests/test_orch110_retest_lifecycle.py
+++ b/tests/test_orch110_retest_lifecycle.py
@@ -0,0 +1,185 @@
+"""ORCH-110 TC-01 / TC-02: process-group tree-kill of orchestrator-spawned pytest.
+
+Covers D1 (FR-2 / BR-3 / AC-4): a timeout in ``merge_gate.retest_branch`` /
+``coverage_gate.measure_coverage`` must tree-kill the WHOLE subprocess subtree
+(children + grandchildren) — the orphan-leak root cause of the ORCH-109 incident —
+not just the direct child.
+
+Fully deterministic and offline:
+  * TC-01 runs a REAL throwaway process that spawns a long-sleeping grandchild via
+    ``sys.executable`` (always present), then asserts the grandchild is dead after a
+    ``run_in_process_group`` timeout — the concrete "no orphan survives" proof.
+  * TC-01b / TC-02 assert the two call sites delegate to ``run_in_process_group``
+    with the right tree-kill kwargs and map a timed-out ProcResult to their existing
+    contract (``(False, "re-test timeout after <T>s")`` / ``None``).
+No network, no Plane/Gitea, no Claude CLI.
+"""
+import os
+import tempfile
+import time
+
+os.environ.setdefault("ORCH_DB_PATH", os.path.join(tempfile.gettempdir(), "test_orch110_lifecycle.db"))
+os.environ.setdefault("ORCH_REPOS_DIR", tempfile.gettempdir())
+os.environ.setdefault("ORCH_GITEA_TOKEN", "test-token")
+os.environ.setdefault("ORCH_PLANE_API_TOKEN", "test-token")
+
+import sys  # noqa: E402
+
+import pytest  # noqa: E402
+
+from src import coverage_gate as cg  # noqa: E402
+from src import merge_gate  # noqa: E402
+from src import proc_group  # noqa: E402
+from src.proc_group import ProcResult, run_in_process_group  # noqa: E402
+
+_POSIX = hasattr(os, "killpg") and hasattr(os, "setsid")
+
+
+def _alive(pid: int) -> bool:
+    """True iff ``pid`` is a live (non-reaped) process."""
+    try:
+        os.kill(pid, 0)
+        return True
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True
+
+
+# ---------------------------------------------------------------------------
+# TC-01: real grandchild is tree-killed on timeout (the FR-2 / AC-4 proof).
+# ---------------------------------------------------------------------------
+@pytest.mark.skipif(not _POSIX, reason="process-group tree-kill is POSIX-only")
+def test_tc01_grandchild_orphan_is_tree_killed_on_timeout(tmp_path):
+    pidfile = tmp_path / "grandchild.pid"
+    script = tmp_path / "spawner.py"
+    # The leader spawns a long-sleeping grandchild, records its pid, then sleeps far
+    # past the timeout. A naive subprocess.run(timeout=) would kill ONLY the leader
+    # and leak the grandchild (the ORCH-109 bug). The process-group tree-kill must
+    # reap the grandchild too.
+    script.write_text(
+        "import subprocess, sys, time\n"
+        "gc = subprocess.Popen([sys.executable, '-c', 'import time; time.sleep(120)'])\n"
+        "open(sys.argv[1], 'w').write(str(gc.pid))\n"
+        "time.sleep(120)\n",
+        encoding="utf-8",
+    )
+
+    res = run_in_process_group(
+        [sys.executable, str(script), str(pidfile)],
+        cwd=str(tmp_path), timeout=2, grace_s=1, tree_kill=True,
+    )
+    assert res.timed_out is True
+
+    # Wait for the leader to actually have written the grandchild pid.
+    deadline = time.time() + 5
+    while time.time() < deadline and not pidfile.exists():
+        time.sleep(0.05)
+    assert pidfile.exists(), "spawner never recorded the grandchild pid"
+    gc_pid = int(pidfile.read_text().strip())
+
+    # The grandchild must die (be reaped) within a short window after the tree-kill.
+    deadline = time.time() + 8
+    while time.time() < deadline and _alive(gc_pid):
+        time.sleep(0.1)
+    assert not _alive(gc_pid), "grandchild orphan survived the timeout tree-kill (FR-2/AC-4)"
+
+
+@pytest.mark.skipif(not _POSIX, reason="process-group runner is POSIX-only")
+def test_tc01_green_and_red_returncodes_passthrough(tmp_path):
+    """The runner returns the real exit code on a normal (non-timeout) completion."""
+    ok = run_in_process_group(
+        [sys.executable, "-c", "import sys; sys.exit(0)"],
+        cwd=str(tmp_path), timeout=30, tree_kill=True,
+    )
+    assert ok.timed_out is False and ok.returncode == 0
+    red = run_in_process_group(
+        [sys.executable, "-c", "import sys; sys.exit(3)"],
+        cwd=str(tmp_path), timeout=30, tree_kill=True,
+    )
+    assert red.timed_out is False and red.returncode == 3
+
+
+def test_tc01_fallback_when_tree_kill_disabled(tmp_path, monkeypatch):
+    """tree_kill=False -> degrades to subprocess.run (never-break); still times out."""
+    res = run_in_process_group(
+        [sys.executable, "-c", "import time; time.sleep(30)"],
+        cwd=str(tmp_path), timeout=1, tree_kill=False,
+    )
+    assert res.timed_out is True
+
+
+def test_tc01_fallback_on_non_posix(tmp_path, monkeypatch):
+    """No os.killpg/setsid (non-POSIX) -> the plain subprocess.run fallback runs."""
+    monkeypatch.setattr(proc_group, "_tree_kill_supported", lambda: False)
+    res = run_in_process_group(
+        [sys.executable, "-c", "import sys; sys.exit(0)"],
+        cwd=str(tmp_path), timeout=30,
+    )
+    assert res.timed_out is False and res.returncode == 0
+
+
+# ---------------------------------------------------------------------------
+# TC-01b: retest_branch delegates to the process-group runner with the right
+# kwargs and maps a timeout to its existing contract.
+# ---------------------------------------------------------------------------
+def test_tc01b_retest_branch_uses_process_group_and_maps_timeout(tmp_path, monkeypatch):
+    wt = tmp_path / "wt"
+    wt.mkdir()
+    monkeypatch.setattr(merge_gate, "get_worktree_path", lambda repo, branch: str(wt))
+    monkeypatch.setattr(merge_gate.settings, "merge_retest_timeout_s", 900, raising=False)
+    monkeypatch.setattr(merge_gate.settings, "subprocess_tree_kill_enabled", True, raising=False)
+    monkeypatch.setattr(merge_gate.settings, "agent_kill_grace_seconds", 7, raising=False)
+
+    captured = {}
+
+    def _fake(cmd, *, cwd, timeout, env=None, grace_s=5.0, tree_kill=True):
+        captured.update(cmd=cmd, cwd=cwd, timeout=timeout, grace_s=grace_s, tree_kill=tree_kill)
+        return ProcResult(returncode=None, stdout="", stderr="", timed_out=True)
+
+    monkeypatch.setattr(merge_gate, "run_in_process_group", _fake)
+    ok, reason = merge_gate.retest_branch("orchestrator", "feature/x")
+    assert ok is False
+    assert reason == "re-test timeout after 900s"
+    # FR-2: spawned via the process-group runner with tree-kill + the agent grace.
+    assert captured["tree_kill"] is True
+    assert captured["grace_s"] == 7
+    assert captured["cmd"][:3] == ["python", "-m", "pytest"]
+
+
+# ---------------------------------------------------------------------------
+# TC-02: coverage_gate.measure_coverage — sibling orphan source (BR-3). Timeout
+# tree-kills + returns None; uses the same runner with tree-kill from settings.
+# ---------------------------------------------------------------------------
+def test_tc02_measure_coverage_timeout_tree_kill_returns_none(tmp_path, monkeypatch):
+    monkeypatch.setattr(cg, "ensure_worktree", lambda r, b: str(tmp_path))
+    monkeypatch.setattr(cg.settings, "subprocess_tree_kill_enabled", True, raising=False)
+    monkeypatch.setattr(cg.settings, "agent_kill_grace_seconds", 5, raising=False)
+    monkeypatch.setattr(cg.settings, "coverage_run_timeout_s", 900, raising=False)
+
+    captured = {}
+
+    def _fake(cmd, *, cwd, timeout, env=None, grace_s=5.0, tree_kill=True):
+        captured.update(tree_kill=tree_kill, grace_s=grace_s, timeout=timeout)
+        return ProcResult(returncode=None, stdout="", stderr="", timed_out=True)
+
+    monkeypatch.setattr(cg, "run_in_process_group", _fake)
+    assert cg.measure_coverage("orchestrator", "feature/x") is None
+    assert captured["tree_kill"] is True
+    assert captured["grace_s"] == 5
+    assert captured["timeout"] == 900
+
+
+def test_tc02_measure_coverage_respects_tree_kill_killswitch(tmp_path, monkeypatch):
+    """With the tree-kill kill-switch off, the runner is asked for the fallback path."""
+    monkeypatch.setattr(cg, "ensure_worktree", lambda r, b: str(tmp_path))
+    monkeypatch.setattr(cg.settings, "subprocess_tree_kill_enabled", False, raising=False)
+    captured = {}
+
+    def _fake(cmd, *, cwd, timeout, env=None, grace_s=5.0, tree_kill=True):
+        captured.update(tree_kill=tree_kill)
+        return ProcResult(returncode=None, stdout="", stderr="", timed_out=True)
+
+    monkeypatch.setattr(cg, "run_in_process_group", _fake)
+    assert cg.measure_coverage("orchestrator", "feature/x") is None
+    assert captured["tree_kill"] is False