diff --git a/.agents/reports/planner-reviewer-claude-01/report-291e38b5.md b/.agents/reports/planner-reviewer-claude-01/report-291e38b5.md
new file mode 100644
index 0000000..77cc861
--- /dev/null
+++ b/.agents/reports/planner-reviewer-claude-01/report-291e38b5.md
@@ -0,0 +1,170 @@
+# 🔍 Review Report — PR #29 병합 전 독립 재검토 (job `291e38b5`)
+
+- **Reviewer**: `planner-reviewer-claude-01` (role: planner,reviewer) · 2026-09-20
+- **대상**: PR #29 `feat/issue-21-items-4-5-7` **@ `46ea4cc`**, base `main @ 1134d74` (v4.6.0). 20커밋, `git diff --stat 1134d74...HEAD` = **25 files, +3229/−108**.
+- **검토 트리**: 워크트리 `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` (detached @ `46ea4cc`, 자체 `.venv`).
+- **안전 규칙 준수**: 워크트리에 파일 수정·커밋·checkout 없음. 본 체크아웃은 `main @ 1134d74` 그대로(checkout/switch/merge 없음). `worktree_remove.sh` 를 실제 워크트리에 실행하지 않았다. 실제 `.mam`·monitor 데몬·에이전트 세션 조작 없음, push·merge·이슈/PR 상태 변경 없음. 재현 실험은 scratchpad 의 임시 저장소(uuid4 이름)에서만 했다.
+- **heartbeat**: 브리프 직후 `started --heartbeat 30` 을 가장 먼저 발행했다.
+
+## 결론 요약
+
+브리프의 8개 항목을 모두 확인했다. **병합을 막을 결함은 찾지 못했다.** 항목 5(리뷰 identity)의 설계·구현 품질은 높고, 기본 경로(옵션 없는 루프)의 호환성은 코드상 보장된다. 아래 **비차단 지적 9건**(N1–N9)을 남긴다. 그중 N1 은 재현 실험으로 확인한 실제 소실 가능성(판정 증거의 gc 소멸)이므로 후속 이슈 등록을 권한다.
+
+## 1. 항목 4 — 워크트리 준비·해체 헬퍼
+
+### 1-1. `.venv` — 브리프가 물은 "실제 venv" 는 아니다 (N2, 비차단)
+
+`worktree_prepare.sh:111-118` 은 여전히 **심링크**를 만든다(`ln -s "$MAIN/.venv" "$WT/.venv"`). 실제 venv 생성도, 인터프리터 경로 전달도 하지 않는다. 다만 이번 PR·base 에서 **커밋 사고 경로는 3중으로 닫혀 있다**:
+
+| 층 | 근거 |
+|---|---|
+| 저장소 `.gitignore` | base `1134d74` 의 `.gitignore:15` 가 `.venv`(슬래시 없음) — 파일·링크·디렉터리 모두 무시 |
+| 공유 `info/exclude` | `worktree_prepare.sh:120-129` 가 `/.venv`·`.pytest_cache/` 를 `$GIT_COMMON_DIR/info/exclude` 에 추가 |
+| 배포 관리 블록 | `deploy/install.sh:549`·`deploy/install_mam.sh:249` 가 `/.venv/` → `/.venv` (#27 `fadd38c`) |
+
+남는 위험은 두 가지이며, 둘 다 헬퍼가 유발하지는 않는다.
+- `rm -rf "$WT/.venv/"` 처럼 **끝에 슬래시를 붙이면 링크를 따라가** 제어 루트의 venv 내용을 지운다. 헬퍼는 그런 호출을 하지 않지만(스크립트 2개의 `rm -rf` 는 `$gd/modules*` 뿐), 사람·에이전트의 수작업에서는 그대로 남는 함정이다.
+- 워크트리와 본 체크아웃이 venv 를 공유하므로 브랜치별 의존성 분기가 불가능하다.
+
+→ 권고: 헬퍼에 `--venv link|create` 같은 선택지를 두거나, 최소한 SKILL.md 에 "`.venv` 는 링크이므로 워크트리에서 `pip install`·`rm -rf .venv/` 금지"를 명시.
+
+### 1-2. `info/exclude` 는 공유물이다 (N3, 비차단)
+
+linked worktree 의 `info/exclude` 는 `$GIT_COMMON_DIR` 의 것이므로 prepare 가 **본 체크아웃의 무시 규칙도 바꾼다**. 코드 주석(`:120-122`)과 설계 문서가 이를 명시하고, 추가되는 두 패턴은 본 체크아웃에서도 산출물이다. 수용 가능하나, 되돌리는 경로(remove 시 정리)는 없다.
+
+### 1-3. 서브모듈 opt-in·롤백
+
+`worktree_prepare.sh:131-204`: `--submodules` 일 때만 초기화하고, 초기화 전 상태(각 서브모듈의 git dir 존재 여부, 공용 `.git/config` 의 `submodule.<n>.url|active`)를 **인덱스 배열**(bash 3.2 호환)로 기록한다. 초기화 안 된 경로에 파일이 이미 있으면 **아무것도 바꾸기 전에** exit 3 으로 거부한다(R4) — 롤백이 "이번 시도가 만든 것"만 지울 수 있다는 전제를 실제로 성립시키는 올바른 순서다. 실패 시 deinit → `.git` 파일 제거 → `modules/<name>` 제거 → 없던 `modules/` 제거 → config 복원 순으로 되돌리고, 마지막에 `git status` 로 워크트리가 여전히 쓸 수 있는 체크아웃인지 확인해 메시지를 갈라 준다. 사람이 강제 제거로 더 망가뜨리지 말라는 안내까지 있다.
+
+### 1-4. `--force` 가 작업을 잃을 수 있는가 — 잃지 않는다
+
+`worktree_remove.sh` 의 판정은 **변경을 가하기 전에** 모두 끝난다(`:57-121`): 잠금, 실행 중 세션(`--stop` 없으면 거부), 열린 잡, 트리 청결(서브모듈 포함), 서브모듈 소견. `--force` 는 워크트리 git dir 에 `modules/` 가 있어 git 이 plain remove 를 거부하는 경우에만, 그것도 **단 한 번** 쓴다(`METHOD="single --force"`).
+
+- **R1(정지 중 쓰기)**: `judge_tree()` 를 `--stop` **이후 다시** 실행하고, 달라졌으면 `:154` 에서 거부한다.
+- **R6(tag/notes 로만 보존된 커밋)**: `lib_py/worktree.py:UNPUSHED_REVS = ("HEAD","--exclude=refs/stash","--all","--not","--remotes")` 로 모든 로컬 ref 기준 미푸시 커밋을 본다. stash 는 별도 확인.
+- **R5(deinit 저장소)**: `submodule foreach` 로 닿지 않는 `modules/` 아래 저장소까지 `--git-dir` 로 직접 검사하고, 판단 불가한 "부분 저장소"는 오류로 남겨 거부한다.
+
+즉 `--force` 시점에는 "미커밋·미푸시·stash 없음"이 증명돼 있다. 한 가지만 적어 둔다(N8): plain/force 어느 쪽이든 git 은 **무시된 파일**을 말없이 지운다. 워크트리에 테스트가 남긴 `.mam/delegate_job_logs` 같은 산출물은 제거와 함께 사라진다(제어 평면이 본 체크아웃이므로 설계상 무해).
+
+또 하나(N7): 열린 잡 검사는 `registry_dirs`(`MAM_JOBS_DIR` → `WORKSPACE_ROOT/.mam/jobs` → 행들의 `control_plane.mam_jobs_dir`)만 본다. 행이 없는 워크트리 로컬 `.mam/jobs` 의 잡은 보이지 않는다. prepare 가 만든 creator 는 제어 루트에 묶이므로 모델상 발생하지 않는 경로지만, 수작업으로 만든 워크트리에는 해당한다.
+
+## 2. 항목 4 — resume 계약 변경(`2679ddf`)은 기존 사용자를 깨지 않는다
+
+`resume_session.sh:50-70` 이 행의 `pane.cwd` 와 `--workspace` 를 비교해 다르면 exit 2, 경로가 사라졌으면 exit 2 로 안내한다. 기존 단일 워크스페이스 사용자에게 영향이 없는 이유:
+
+1. `--workspace` 는 원래부터 **필수 인자**이고(`:42`), 기존 행의 `pane.cwd` 는 그 워크스페이스 경로다. 본 체크아웃의 실제 `.mam/agent-sessions.yaml` 5개 행 모두 `cwd: /Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux` 로, 평소 호출과 일치한다.
+2. 비교는 `mam_abs_workspace`(`lib.sh:1606-1609`, `cd -P … pwd -P`)로 정규화한 뒤 하므로 심링크·상대경로 표기 차이는 통과한다.
+3. `pane.cwd` 가 없는 구(舊) 행은 `ROW_CWD` 가 비어 검사 자체를 건너뛴다.
+
+바인딩 영속은 **이미 실행 중인 경로에도** 적용된다: `:145` 가 `CONTROL_PLANE_JSON="$CP_JSON"` 를 `update_yaml_resumed.sh` 에 넘기고, 그쪽 `:168` 이 이를 읽어 행에 기록한다(A13). 계산 실패 시 워크트리면 exit 2, 제어 루트면 경고 후 무기록 — create 쪽(`create_session.sh:211-221`)과 같은 규칙이다.
+
+## 3. 항목 5 — 리뷰 identity
+
+- **기록**: `_record_round`(`runner.py`)가 라운드마다 `iteration/base_sha/head_sha/tree_sha/review_commit/isolation/review_path/jobs/verdicts/reviewers(evidence)/stale` 를 남기고 체크포인트에 `loop_id` 와 `review_rounds` 를 싣는다. 승격 시에는 리포트 옆에 `report-<jid>.identity.json` 을 원자적으로(`.tmp` → `replace`) 쓴다.
+- **스냅샷**: `_worktree_tree()` 가 임시 `GIT_INDEX_FILE` 로 `read-tree HEAD` → `add -A` → `write-tree` 하여 **실제 인덱스·status·ref 를 건드리지 않는다**. 미커밋이 있으면 `commit-tree` 로 ref 없는 스냅샷 커밋을 만든다. untracked 중첩 저장소는 gitlink 만 남아 고정 불가이므로 거부하고(`_snapshot`), dirty 서브모듈도 거부한다(`_dirty_submodules` 는 `--ignore-submodules=none` 으로 물어 `submodule.*.ignore` 설정이 숨기지 못하게 한다). 판정 불가(`None`)는 전부 실패로 떨어지는 fail-closed 다.
+- **격리**: `_open_review_tree` 는 `TMPDIR/mam-review/<loop_id>/<n>` 에 detached 워크트리를 만들고, **실패하면 격리를 낮추지 않고 exit 1**(로그 문구까지 그렇게 적혀 있다). `_close_review_tree` 는 remove 실패 시에만 `prune` 을 부르고, 부모 디렉터리는 비었을 때만 지운다. `run()` 이 `_run_body()` 를 `finally: _close_all_review_trees()` 로 감싸고 `release_guard` 도 같은 정리를 한다.
+- **stale 재리뷰**: 라운드 판정 뒤 `_round_is_stale`(현재 head·tree 비교)로 소스 변경을 잡아 승인 전량 폐기 후 재리뷰, 마지막 라운드면 exit 1. 승격 직전에도 `_identity_now() != (accepted head, tree)` 면 "source changed after approval; not promoting" 으로 exit 1(B10).
+- **원격 리뷰어**: `_check_remote_recipients` 가 **어떤 잡도 위임하기 전에** 판정 수신자 전원을 검사해 기본 거부, `--remote-review diff-only` 만 허용하며 그때 diff 가 truncated/unavailable 이면 증거가 없다고 exit 1.
+- **기본 동작 동일성**: `_context_active()` 가 거짓이면 `_worktree_context()` 는 빈 문자열을 반환하고 `collect_changes_diff(None)` 은 기존 호출과 동일하다. `_dispatch` 의 새 인자는 기본값(`remote=False, purpose="work"`)이라 프롬프트는 바이트 동일하다. 다만 옵션과 무관하게 `Loop id:` 로그 1줄과 체크포인트의 `loop_id` 필드가 늘었다(N9, 무해).
+
+### N1 (비차단, 후속 권고) — 스냅샷 커밋이 gc 로 사라진다
+
+`_snapshot` 의 스냅샷 커밋은 ref 가 없고, 유일한 도달 경로였던 리뷰 워크트리 HEAD 는 `_close_review_tree` 가 라운드 판정 직후 없앤다. 그래서 `identity.json` 의 `review_commit`·`tree_sha` 는 **나중에 검증하려 할 때 이미 없을 수 있다**. scratchpad 임시 저장소에서 재현했다(워크트리 제거 → `reflog expire --expire=now --all` → `gc --prune=now` → `git cat-file -e <snap>` 실패). 일상적으로도 unreachable 객체는 기본 2주 뒤 대상이다. 미커밋이 있던 라운드에만 해당하며(클린 트리면 `review_commit == head_sha`), 판정 자체의 정합성에는 영향이 없다.
+
+→ 권고: `refs/mam/review/<loop_id>/<n>` 같은 ref 로 스냅샷을 고정하고, 루프 종료 시 정책적으로 정리(또는 보존).
+
+### N6 (비차단) — 강제 종료 시 리뷰 워크트리 잔존
+
+`finally`/`release_guard`/시그널 핸들러로 정상·TERM·INT 경로는 덮이지만, SIGKILL 이면 `TMPDIR/mam-review/...` 디렉터리와 소스 저장소의 worktree 항목이 남는다. `prune` 은 remove 실패 시에만 부른다(의도된 선택, 주석에 근거 있음).
+
+## 4. #20 격리 — 설계와 실측
+
+- `tests/conftest.py` 의 `pytest_configure` 가 **수집 이전에** ambient 바인딩 4개를 기록하고 `AGENT_SESSIONS_YAML`·`MAM_JOBS_DIR`·`DELEGATE_JOB_LOGS_DIR` 를 제거한다. `WORKSPACE_ROOT` 는 **다른 체크아웃을 가리킬 때만** 제거한다(이 체크아웃을 가리키면 lib.sh 가 어차피 유도하는 값). import 시점에 `os.environ` 을 복사하는 모듈(`test_orc_onboard.SCRUBBED_ENV`) 때문에 세션 fixture 로는 늦다는 설명이 정확하다. `pytest_unconfigure` 가 되돌려 in-process `pytest.main()` 호출자를 배려한다.
+- autouse `_isolate_mam_state_dirs` 는 **env 만** 설정하고 디렉터리를 만들지 않으며, 숨김 이름(`.mam-test-state`)이라 `tmp_path` 를 나열하는 기존 테스트를 깨지 않는다. `mam_sandbox` 와 테스트 자신의 `setenv/delenv` 가 뒤에 실행돼 이긴다.
+- 세션 가드 `mam_state_leak_guard` + `_mam_state_guard.py` 는 **보고만 하고 절대 지우지 않는다**(실제 제어 평면이므로 옳다). 감시 대상은 이 체크아웃의 `.mam` 과 기록된 바인딩이 가리킨 제어 평면이며, 동시에 도는 실제 위임과는 "레코드 먼저 → 등록된 세션" 규칙으로 구분한다.
+- #15 옵트아웃(N4, 비차단): `test_issue15_registry_isolation.py` 의 누수 단언이 "전체 목록 동일"에서 "자기 잡 id 가 실제 루트에 없음 + 그 사이 늘어난 항목 중 자기 세션 이름이 없음"으로 **약해졌다**. 동시 실행되는 실제 위임 때문에 전체 비교가 오탐을 냈다는 근거가 타당하고, 세션 이름 스캔이 핵심 보장을 유지하므로 수용한다.
+
+## 5. acceptance5 안정화(`7bc3e1a`·`371099a`·`e6d2168`) — 계약을 약화하지 않는가
+
+| 변경 | 판단 |
+|---|---|
+| 세션 이름·HMAC secret 을 실행마다 유니크하게(`tag = os.urandom(4).hex()`) | **개선**. 공개 브로커에 retain 된 과거 dispatch 가 이번 실행의 잡 대신 배달되던 교차 오염을 없앤다 |
+| `--heartbeat-misses 3 → 10` | 허용. 이 시험의 목적은 "원격 러너가 브로커만으로 잡을 끝낸다"이고, K×N 무응답 임계 자체는 AC1·AC3 가 고정한다. 원격 러너의 `started --heartbeat` 계약은 그대로다 |
+| 단언에 `advanced to 'completed'` 추가 | 허용. retain 된 종단 이벤트만 배달된 경우도 프로토콜상 정당한 배달 확인이다 |
+| `_skip_if_broker_did_not_deliver` | 조건부 허용(N5). skip 은 "러너가 started 를 발행했고, 구독자가 **맞는 토픽**에 SUBSCRIBED 했고, 그 잡에 대해 **아무것도**(드롭 로그조차) 받지 못했다"는 세 조건이 동시에 성립할 때만이다. HMAC·identity 드롭, 잘못된 토픽, 발행 실패는 여전히 실패한다. 다만 구독자 배달 경로의 실제 회귀가 같은 증상을 내면 skip 으로 가려질 수 있다 |
+
+## 6. 수용 사례·신규 테스트의 결정성·격리
+
+- `tests/test_issue21_acceptance.py`(A1–A8, 278줄): 실제 herdr·실제 브로커를 쓰지 않는다. mock herdr / stub 위임 + `mam_sandbox`·`tmp_path` 기반이며, 브로커 관련 언급은 주석과 "브로커 도달 불가 조건에서 래퍼를 돌린다"는 A3 한 곳(`:102`)뿐이다.
+- `tests/test_issue21_loop_b.py`(526줄, L1–L21): 러너를 직접 구동하되 위임·대기를 스텁으로 바꾸고 임시 git 저장소에서 돈다. 브로커 의존 0, `time.sleep` 없음. L1/L12/L14b/L18b 가 **옵션 없는 기존 동작 불변**을 별도로 고정하는 점이 좋다.
+- `tests/test_issue21_phase2_loop_a.py`(649줄): `time.sleep(0.2)` 1회(`:312`) 외에 시간 의존 없음. `deploy/install.sh` 를 임시 타깃에 실행하는 경로가 있으나 모두 `tmp_path` 안이다.
+- `tests/test_issue20_state_isolation.py`(202줄): 순수 함수 단위 + 중첩 pytest 1건(설계된 skip).
+- uuid 사용은 `uuid.uuid4()`(issue15 의 `_unique`)로 브리프 규칙과 맞는다.
+
+## 7. 문서 정합성과 권고의 타당성
+
+- `docs/design/worktree-creator-model.md`: 항목 표가 1·2·3·6 = 완료(v4.6.0), 4·5·7 = 이 브랜치, 8 = 보류로 갱신됐고, 실행 예시가 `worktree_prepare.sh`/`worktree_remove.sh` 기준으로 다시 쓰였다. 호환성 표에 resume 의 exit 2 조건, remote 리뷰어 거부/opt-in, "실제 herdr pane 값 확인은 단계 C" 라는 한계가 명시돼 과장 없이 정확하다.
+- `multi-agent-mux-loop/SKILL.md` 가 `--review-isolation`·`--remote-review` 를 표에 추가하고 기본값·거부 시점(위임 이전)·evidence 기록까지 적는다. create/resume/stop SKILL.md 도 헬퍼를 반영한다.
+- PR 본문의 **비차단 권고 4건**을 코드에서 확인했고 모두 사실이다: ① A4 의 `_main_state` 비교가 untracked `.agents/`·`.mam/` 변화를 보지 못함, ② A4 가 `info/exclude` 추가를 **선반영**한 뒤 비교함(`test_issue21_acceptance.py:121-122`), ③ `_close_review_tree` 의 remove 실패 시 `prune` 이 전역, ④ `worktree_remove.sh` 의 서브모듈 거부 출력 중복. 넷 다 병합을 막을 성질이 아니며 후속으로 적절하다.
+- #30(멈춘 에이전트 감지) 등록은 타당하다. #18 이 "프로세스 생존"에 결속된 설계라 "살아 있지만 멈춘" 상태는 그 계약 밖이며, 해결은 알림·운영 수준이므로 별도 이슈가 맞다.
+
+## 8. 전체 스위트 실행 (이 리뷰어가 직접, 워크트리에서)
+
+```
+cd <pr-29 워크트리> && PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q -rfE tests/
+→ 2 failed, 1011 passed, 2 skipped in 2266.28s (0:37:46)   (HEAD 46ea4cc, 실행 전후 동일)
+```
+
+| 실패 | 판정 |
+|---|---|
+| `test_issue14_delivery_ack.py::test_wrapper_idle_grace_never_outlives_the_wall_clock` | **PR 회귀 아님**. 이 시험은 PR 이 건드리지 않았다(`git diff -U0` 의 issue14 hunk 는 전부 `_job_for_inprocess_publish` 뒤쪽 `:520` 이후). 단독 재실행에서도 close_delay 28.5 s(임계 20+8)로 재현되며, **다른 브랜치에 이미 `90a289d test(issue-14): widen the wall-clock close margin under suite load` 가 있다** — 임계 자체가 좁다는 기지 문제다 |
+| `test_issue19_subscriber_daemon_lifecycle.py::test_mqtt_loop_sigterm_exits_cleanly` | **브로커 flake**. 파일 자체가 PR 변경 0줄이고, 로그가 `broker did not accept connection; falling back to polling` 이다. 단독 재실행 **통과** |
+
+- PR 본문의 "이 호스트 기준 실패 33건(#28)" 주장은 **내 실행으로는 확인되지 않는다**(내 조건에서는 2건). 제어 평면 바인딩이 실린 creator pane 조건에서 재현된 수치로 보이며, 내가 재현할 수 있는 조건이 아니므로 그 수치의 참·거짓을 주장하지 않는다. 내가 말할 수 있는 것은 **내 조건에서 새 회귀가 0 이라는 것**이다.
+
+### 격리·위생 실측 (#20, 브리프 항목 4)
+
+| 항목 | 결과 |
+|---|---|
+| 실제 `.mam/jobs`(본 체크아웃) 전후 | **차이 0** (레코드 추가 0건) |
+| 실제 `.mam/delegate_job_logs` 전후 | **차이 0** |
+| 워크트리 `git status --short --ignored` 전후 | **완전 동일**(무시 파일 포함) — 스위트가 워크트리에 아무것도 남기지 않았다 |
+| 워크트리 HEAD | 실행 전후 `46ea4cc` |
+| 본 체크아웃 | `main @ 1134d74`, 클린 |
+
+이전 회차(PR #22)에서 내가 지적했던 "리뷰어 pytest 가 워크트리에 `.mam/delegate_job_logs`·`.mam/shim` 을 남긴다" 가 이번 실행에서는 **재현되지 않았다**. #20 수정이 의도대로 동작한다.
+
+## 9. 병합 차단 여부 (브리프 항목 8)
+
+알려진 버전 bump 미포함(오케스트레이터가 v4.7.0 으로 처리) 외에 **병합을 막을 결함은 찾지 못했다**. N1–N9 는 모두 비차단이며, 후속 순위는 N1 > N2 > N5 순으로 본다.
+
+| # | 지적 | 성격 |
+|---|---|---|
+| N1 | 스냅샷 커밋·tree 가 ref 없이 남아 gc 로 소멸 → `identity.json` 사후 검증 불가(재현 확인) | 후속 이슈 권고 |
+| N2 | prepare 의 `.venv` 는 여전히 심링크(실제 venv/인터프리터 경로 아님); 커밋 경로는 3중으로 닫혔으나 `rm -rf .venv/`·의존성 공유 위험 잔존 | 문서화 또는 옵션화 권고 |
+| N3 | prepare 가 공유 `info/exclude` 를 바꿔 본 체크아웃에도 적용(되돌림 경로 없음) | 기지·문서화됨 |
+| N4 | issue15 누수 단언이 전체 목록 비교에서 자기 잡 id + 세션 스캔으로 약화(근거 타당) | 수용 |
+| N5 | acceptance5 의 skip 경로가 구독자 배달 회귀를 가릴 여지(조건은 매우 좁음), `--heartbeat-misses 3→10` | 수용 |
+| N6 | SIGKILL 시 리뷰 워크트리·worktree 항목 잔존(prune 은 실패 시에만) | 사소 |
+| N7 | remove 의 열린 잡 검사가 행 없는 워크트리 로컬 `.mam/jobs` 를 못 봄 | 모델 밖 경로 |
+| N8 | remove 는 plain/force 모두 무시 파일을 말없이 삭제(추적 작업 손실은 없음) | 정보 |
+| N9 | 옵션 없는 루프에도 `Loop id:` 로그 1줄과 체크포인트 `loop_id` 필드가 추가(프롬프트는 바이트 동일) | 정보 |
+
+## 10. 교차검증 가이드
+
+```bash
+WT=/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29
+(cd "$WT" && PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q -rfE tests/)   # 2 failed / 1011 passed
+(cd "$WT" && PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q \
+  tests/test_issue14_delivery_ack.py::test_wrapper_idle_grace_never_outlives_the_wall_clock \
+  tests/test_issue19_subscriber_daemon_lifecycle.py::test_mqtt_loop_sigterm_exits_cleanly)              # issue19 통과, issue14 재현
+git -C "$WT" diff 1134d74...HEAD -U0 -- tests/test_issue14_delivery_ack.py | grep '^@@'                 # 실패 시험은 변경 밖
+# N1 재현 (임시 저장소에서만)
+R=$(mktemp -d); cd "$R"; git init -q .; git config user.email t@t; git config user.name t
+echo a > a; git add a; git commit -qm base; H=$(git rev-parse HEAD); echo dirty > b
+GIT_INDEX_FILE=$R/idx git read-tree HEAD; GIT_INDEX_FILE=$R/idx git add -A; T=$(GIT_INDEX_FILE=$R/idx git write-tree)
+C=$(git commit-tree "$T" -p "$H" -m snap); git worktree add -q --detach "$R/wt" "$C"; git worktree remove --force "$R/wt"
+git reflog expire --expire=now --all; git gc --prune=now -q; git cat-file -e "$C^{commit}" || echo "snapshot gone"
+```
+
+[VERDICT: PASS]
diff --git a/.agents/reports/planner-reviewer-claude-01/report-f1174fc0.md b/.agents/reports/planner-reviewer-claude-01/report-f1174fc0.md
new file mode 100644
index 0000000..670657d
--- /dev/null
+++ b/.agents/reports/planner-reviewer-claude-01/report-f1174fc0.md
@@ -0,0 +1,189 @@
+# 🔍 Review Report — PR #29 델타 리뷰 2회차 (job `f1174fc0`)
+
+- **Reviewer**: `planner-reviewer-claude-01` (role: planner,reviewer) · 2026-09-20
+- **대상 델타**: `46ea4cc..08db1da` (3커밋, `git diff --stat` = **16 files, +159/−34**), base `main 1134d74` (v4.6.0).
+- **검토 트리**: 워크트리 `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` (detached @ `08db1da`).
+- **1회차 내 판정**: PASS (job `291e38b5`). 이번에는 **델타가 그 판정을 뒤집는지**를 본다.
+- **안전 규칙 준수**: 워크트리 읽기 전용(수정·커밋·checkout 없음, `git status --short` 클린 유지). 본 체크아웃 `main @ 1134d74` 그대로. `worktree_prepare.sh`·`worktree_remove.sh` 를 실제 워크트리·본 체크아웃에 실행하지 않았다 — 모든 실행은 scratchpad 의 임시 복사본/임시 저장소(uuid4 이름)에서만 했다. 실제 `.mam`·데몬·세션 조작 없음, push·merge·PR 상태 변경 없음, purge·scrub 실행 없음.
+
+## 결론 요약
+
+**R1·R2·R3 은 실제로 닫혔다.** 특히 R1/R2 는 (a) 결함을 임시 저장소에서 직접 재현했고, (b) 워크트리 복사본에서 수정만 되돌렸을 때 새 회귀 4건이 정확히 실패하는 것까지 확인했다. 1회차 PASS 를 뒤집을 사유는 없다. 비차단 4건(D1–D4)만 남긴다. 그중 D1 은 이번 델타가 새로 만든 작은 구멍이다.
+
+## 1. R1/R2 — `--untracked-files=all` (항목 1)
+
+### 1-1. 결함 재현 (임시 저장소)
+
+```
+git config status.showUntrackedFiles no ; echo secret > untracked.txt
+git status --porcelain --ignore-submodules=none                    → (빈 출력)      ← 옛 검사: "클린"
+git status --porcelain --untracked-files=all --ignore-submodules=none → ?? untracked.txt ← 수정본
+```
+
+표시 설정 하나로 "강제 제거해도 되는가"라는 판정이 뒤집혔다는 codex 의 지적은 사실이다.
+
+### 1-2. 세 검사 모두에 들어갔는가 — 그렇다
+
+| 파일:라인 | 검사 |
+|---|---|
+| `.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh:93` | `judge_tree()` 의 워크트리 청결 검사 |
+| `.agents/skills/lib_py/worktree.py:170` | `submodule_findings()` 의 `dirty` 검사(`modules/` 아래 모든 저장소) |
+| `.agents/skills/lib_py/loop/runner.py:718` | `_dirty_submodules()` (리뷰 스냅샷 승인 전 서브모듈 검사) |
+
+스킬 트리 전체에서 `status --porcelain` 을 부르는 나머지 두 곳도 확인했다.
+- `worktree_prepare.sh:209`: 롤백 후 "이 워크트리가 아직 쓸 수 있는 체크아웃인가"만 보는 용도(stdout 은 버리고 stderr 만 본다). 파괴 판정이 아니다 — 플래그 불필요.
+- `runner.py:581`: 프롬프트의 `미커밋 변경: 있음/없음` **표시용**. 판정에 쓰이지 않는다(→ D3 참조).
+
+### 1-3. 소스 트리 스냅샷은 별도 조치가 필요 없는가 — 필요 없다
+
+`_worktree_tree()` 의 `git add -A` 는 `status.showUntrackedFiles` 를 **보지 않는다**. 임시 저장소에서 `showUntrackedFiles=no` 로 설정한 뒤 `read-tree HEAD` → `add -A` → `write-tree` 한 트리에 `untracked.txt` 가 그대로 들어갔다. 즉 스냅샷은 이미 untracked 를 고정하고 있었고, 구멍은 "서브모듈 검사"와 "제거 판정"에만 있었다. 수정 범위가 정확하다.
+
+`_change_set_state()`(`runner.py`)와 `diff_collect.sh` 의 untracked 수집은 `git ls-files -o --exclude-standard` 라 이 설정의 영향을 받지 않는다. 빈 변경분 fail-closed 가드도 안전하다.
+
+### 1-4. 새 회귀가 수정 없이는 실패하는가 — 확인함
+
+워크트리를 `.git`·`.venv` 제외하고 scratchpad 에 복사한 뒤, **세 곳의 `--untracked-files=all` 만 제거**하고 돌렸다(워크트리 자체는 건드리지 않았다).
+
+```
+4 failed, 5 passed in 14.69s
+FAILED test_issue21_phase2_loop_a.py::test_w6e2_untracked_submodule_file_hidden_by_config_blocks_the_forced_removal
+FAILED test_issue21_phase2_loop_a.py::test_w6e_work_written_while_stopping_is_not_force_removed[True]
+FAILED test_issue21_loop_b.py::test_l17_dirty_submodule_is_refused_or_makes_the_round_stale[untracked-hidden]
+FAILED test_issue21_loop_b.py::test_l17_dirty_submodule_is_refused_or_makes_the_round_stale[during-hidden]
+```
+
+기존 변형(`[False]`, `before`, `before-ignored`, `untracked`, `during`)은 그대로 통과했다. 즉 새 회귀는 **정확히 이 수정만** 검증하며, 회귀 방지력이 실재한다. `test_w6e2` 가 단언 안에서 `assert _git(wt,"status","--porcelain","--ignore-submodules=none").stdout == "", "git hides it by default"` 로 전제 자체를 고정한 것도 좋다.
+
+## 2. R3 — 워크트리 자체 venv (항목 2)
+
+`worktree_prepare.sh:111-134` 의 분기를 읽고 문서·테스트와 대조했다(스크립트는 실제 트리에 실행하지 않았다).
+
+| 요구 | 구현 | 판정 |
+|---|---|---|
+| 심링크가 아닌 실제 venv | `"$MAIN/.venv/bin/python" -m venv "$WT/.venv"` + `requirements.txt`·`requirements-dev.txt` 설치 | **충족**. 1회차 내 지적 N2 가 닫혔다 |
+| 멱등성 | `[ -x "$WT/.venv/bin/python" ]` → `VENV_STATE="kept"` | 충족(`test_w1` 이 `VENV=created` → `VENV=kept` 순서를 고정) |
+| 남은 링크 거부 | `[ -L "$WT/.venv" ]` → exit 1, **아무것도 바꾸지 않음** | 충족(`test_w1b` 가 링크 보존까지 단언) |
+| 인터프리터 부재 | `WARNING: ... not found; no venv created` + `VENV=skipped` | 충족 |
+| 설치 실패 시 exit 1, 워크트리 유지 | `pip install` 실패 → 메시지 `(the worktree is kept)` + exit 1. `git worktree add` 는 이미 끝난 뒤라 실제로 남는다 | 충족 |
+| 문서 정합 | `create/SKILL.md:246`, `stop/SKILL.md:123`, 설계 문서 4장이 모두 "자체 venv·링크 거부·`VENV=` 요약"으로 갱신됨 | 충족 |
+| ignore 규칙 정합 | `.gitignore` 관리 블록의 `/.venv`(#27) 와 공유 `info/exclude` 의 `/.venv` 는 **디렉터리에도 그대로 적용**된다. `test_w1` 이 준비 후 `status --porcelain` 이 비는지 단언 | 충족 |
+
+`bash -n` 은 변경된 두 스크립트 모두 통과한다. `req=()` 배열 + `[ -f ... ] && req+=(...)` 가 `set -euo pipefail` 아래서 조기 종료하지 않는지 macOS `/bin/bash` 3.2.57 로 직접 확인했다(두 파일 모두 없을 때도 루프 끝까지 도달, rc 0).
+
+### D1 (비차단, 이번 델타가 새로 만든 구멍) — 설치 실패 뒤 재실행이 조용히 `VENV=kept`
+
+`pip install` 이 실패하면 exit 1 이지만 `$WT/.venv/bin/python` 은 **이미 만들어져 있다**(`:121` 에서 venv 생성이 먼저 끝난다). 그래서 사용자가 그대로 재실행하면 `:117-118` 의 `-x` 검사에 걸려 `VENV=kept` 로 넘어가고, **요구사항이 설치되지 않은 환경**을 정상으로 보고한다. 메시지는 "fix it and re-run" 이라 재실행을 유도한다.
+
+→ 권고: 설치 성공을 표시하는 마커(예: `$WT/.venv/.mam-requirements-ok`)를 두고 `kept` 판정에 함께 쓰거나, `kept` 경로에서도 `requirements*.txt` 설치를 한 번 더 시도.
+
+### D2 (비차단, 정보) — 준비 비용·네트워크 의존
+
+이제 워크트리마다 venv 생성 + PyPI 설치가 필요하다. 오프라인이거나 PyPI 가 막힌 호스트에서는 prepare 가 exit 1 로 끝난다(이전에는 링크 한 번이라 즉시 끝났다). SKILL.md 에 설치 동작은 적혀 있으나 "네트워크가 필요하다"는 명시는 없다.
+
+### D3 (비차단, 사소) — 프롬프트의 `미커밋 변경` 표시는 여전히 설정에 취약
+
+`runner.py:581` 의 `git status --porcelain` 에는 플래그가 없어, `status.showUntrackedFiles=no` 인 소스에서는 untracked 만 있을 때 `미커밋 변경: 없음` 으로 표시된다. 판정·스냅샷·서브모듈 검사는 모두 안전하므로 **표시 오차**일 뿐이지만, R1 의 취지("표시 설정이 판단 재료를 바꾸면 안 된다")를 생각하면 같은 플래그를 주는 편이 일관적이다.
+
+## 3. #28 이식성 수정(`7a94ba2`)이 의도를 약화시키는가 (항목 3)
+
+### 3-1. `ps -eo pid=,ppid=,args=` — 양쪽에서 같은 출력인가
+
+이 호스트(macOS 15, arm64)에서 **두 형태를 같은 프로세스에 대해 직접 비교**했다(파이프로 캡처, 코드와 동일 조건).
+
+```
+['-axo','pid=,ppid=,command='] → 길이 575, 인자 X 400개 그대로
+['-eo','pid=,ppid=,args=']     → 길이 575, 인자 X 400개 그대로
+```
+
+- **구분자·필드**: 동일(`pid ppid args`), 잘림 없음. 400자 argv 가 온전히 나왔다 — 파이프 출력일 때는 폭 제한이 걸리지 않는다.
+- **이식성**: `-e`(모든 프로세스), `-o`(포맷), `args`(전체 명령행)는 POSIX 다. 반대로 `-a`+`-x` 조합과 `command=` 는 BSD 관용이고 procps 에서는 경고·다른 해석이 나올 수 있다. purge 12건의 원인 가설로 타당하며, **macOS 동작은 그대로**다(위 실측).
+- 남는 차이: Linux 의 `args` 도 커널 `/proc/<pid>/cmdline` 기준이라 매우 긴 argv 는 환경에 따라 잘릴 수 있다. 다만 이 코드의 판정(에이전트 CLI 여부, UUID 포함 여부)은 앞쪽 토큰에 의존하므로 실질 영향은 없다.
+
+### 3-2. `_normalize_help`
+
+`optional arguments:` → `options:` 치환 + 공백 런 축약이다. 즉 **레이아웃(줄바꿈·들여쓰기) 동등성은 포기하고 내용 동등성만** 본다. 골든 캡처가 3.9 에서 떠졌고 대상 호스트가 3.14 라는 사정상 타당하며, 플래그·인자·설명 문구가 바뀌면 여전히 실패한다(시험의 목적은 "shim 이 구현과 CLI 상 구분 불가"이므로 유지). 약화는 제한적이고 대안(버전별 골든 캡처)은 유지비가 크다 — 수용.
+
+### 3-3. `test_workspace_scope.py` 의 `bash -c`
+
+`shell=True` 는 `/bin/sh` 를 쓰므로 dash 에서 `source` 가 없다. 문자열을 그대로 `["bash","-c", cmd]` 로 옮긴 것은 최소 변경이며 검증 내용(=`resolve_herdr_session` 의 출력)은 그대로다. 수용.
+
+### 3-4. conftest 의 `MAM_ENV_FILE` 고정
+
+`tests/conftest.py:173-177` 이 autouse 픽스처에서 `MAM_ENV_FILE` 을 `tmp_path/.mam-test-state/.mam.env.absent` 로 고정한다. 방향은 #20·#15 와 같은 **격리 강화**이고, 실제 `.mam.env` 를 읽어야 하는 시험은 스스로 `MAM_ENV_FILE` 을 설정한다(`test_issue14/18/5_phase1/21_worktree_prereqs/20_state_isolation` 모두 자체 설정을 갖고 있다). "브로커 없음" 계열 시험이 호스트의 실 설정을 주워 읽던 것이 오히려 결함이었으므로 계약을 약화시키지 않는다.
+
+## 4. `90a289d` 벽시계 여유 8 → 15 s (항목 4)
+
+이 시험이 고정하는 결함은 "idle grace 가 wall clock 을 **무시**해 `2 × TIMEOUT`(≈40 s) 에 닫히는 것"이다. 임계는 `20 + 15 = 35 s` 이므로 결함 시나리오(40 s)는 여전히 실패한다. 정상 종료는 내가 1회차 전체 스위트에서 실측한 값이 28.49 s·28.50 s(단독 재실행 포함 2회 일치)였다.
+
+```
+정상 28~29 s  <  새 임계 35 s  <  결함 40 s
+```
+
+여유는 5 s 로 좁아졌지만 계약(“wall clock 을 넘기지 않는다”)의 판별력은 남는다. 1회차에서 내가 유일한 비-flake 실패로 보고했던 항목이 이 커밋으로 해소된다. 다만 `timeout_s` 가 더 커지면 `2 × TIMEOUT` 과 `TIMEOUT + 15` 의 간격은 벌어지고 작아지면 좁아지므로, **고정 여유(+15)보다 비율(예: `timeout_s * 1.5`)** 이 계약을 더 정확히 표현한다(D4, 비차단 권고).
+
+## 5. 테스트 실행 (워크트리, 이 리뷰어가 직접)
+
+```
+cd <pr-29 워크트리> && PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q -rfEs \
+  tests/test_issue21_phase2_loop_a.py tests/test_issue21_loop_b.py tests/test_issue21_worktree_prereqs.py \
+  tests/test_issue21_acceptance.py tests/test_workspace_scope.py tests/test_issue5_phase1_delegation.py \
+  tests/test_deploy_freshness.py tests/test_version_consistency.py
+→ 208 passed in 322.94s (failed 0 · errors 0 · skipped 0)
+```
+
+- 브리프가 지적한 **`tests/test_issue28_*.py` 는 이 트리에 없다**(#28 수정은 기존 파일에 들어갔다) — 규칙대로 건너뛰었다.
+- **skip 0 건**: `test_deploy_freshness.py` 의 새 `skipif`(D-11~D-19, D-22~D-30)는 이 호스트에서 **전부 실행**됐다(서브모듈 자산이 있으므로 의도대로다). 브리프 항목 3 의 우려("로컬 자산이 있는 호스트에서는 실행되어야 한다")는 실측으로 해소.
+- 가장 느린 시험 10건은 모두 herdr mock·정지/재개 경로이며 브로커 타임아웃 계열 실패는 없었다.
+
+### 격리·위생 실측
+
+| 항목 | 결과 |
+|---|---|
+| 실제 `.mam/jobs` 전후 | **차이 0** |
+| 워크트리 `git status --short --ignored` 전후 | **완전 동일** |
+| 워크트리 HEAD / 본 체크아웃 | `08db1da` / `main 1134d74` (둘 다 변화 없음) |
+| 샌드박스 실험 | scratchpad 임시 디렉터리에서만(복사본 리버트 실행 포함). 실제 스크립트·워크트리에 prepare/remove 실행 없음 |
+
+## 6. 병합 차단 여부 (항목 5)
+
+버전 락스텝 bump 부재(`lib.sh:32`·`eager.py:16` 모두 `4.6.0`, 오케스트레이터가 4.7.0 으로 처리 예정) 외에 **병합을 막을 결함은 없다**. 1회차 PASS 판정은 이번 델타로 뒤집히지 않으며, 1회차에 내가 남긴 비차단 지적 중 **N2(.venv 심링크)는 이 델타로 해소**됐다. 1회차의 N1(스냅샷 커밋이 ref 없이 남아 gc 로 소멸)은 그대로 남아 있으니 후속 이슈로 유지하기를 권한다.
+
+| # | 이번 회차 지적 | 성격 |
+|---|---|---|
+| D1 | pip 설치 실패 후 재실행이 `VENV=kept` 로 조용히 통과 | 후속 권고(이번 델타가 만든 것) |
+| D2 | prepare 가 워크트리마다 venv 생성 + PyPI 설치를 요구(오프라인 exit 1) | 정보·문서화 |
+| D3 | `runner.py:581` 의 표시용 status 에는 `--untracked-files=all` 이 없음 | 사소(일관성) |
+| D4 | 벽시계 여유를 고정값(+15 s)이 아니라 비율로 두는 편이 계약에 충실 | 사소 |
+
+## 7. 교차검증 가이드
+
+```bash
+WT=/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29
+# R1 결함 재현 (임시 저장소에서만)
+R=$(mktemp -d); cd "$R"; git init -q .; git config user.email t@t; git config user.name t
+echo a>a; git add a; git commit -qm base; git config status.showUntrackedFiles no; echo secret > untracked.txt
+git status --porcelain --ignore-submodules=none                      # (빈 출력)
+git status --porcelain --untracked-files=all --ignore-submodules=none # ?? untracked.txt
+GIT_INDEX_FILE=$R/idx git read-tree HEAD; GIT_INDEX_FILE=$R/idx git add -A
+git ls-tree -r --name-only "$(GIT_INDEX_FILE=$R/idx git write-tree)"  # untracked.txt 가 들어 있다(= add -A 는 설정 무시)
+# 수정 없이는 회귀가 실패하는지 (워크트리 복사본에서만)
+S=$(mktemp -d); rsync -a --exclude .venv --exclude .git --exclude .mam "$WT/" "$S/"
+sed -i '' 's/ --untracked-files=all --ignore-submodules=none/ --ignore-submodules=none/' \
+  "$S/.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh" "$S/.agents/skills/lib_py/loop/runner.py"
+sed -i '' 's/"git status --porcelain --untracked-files=all"/"git status --porcelain"/' "$S/.agents/skills/lib_py/worktree.py"
+(cd "$S" && PYTHONDONTWRITEBYTECODE=1 "$WT/.venv/bin/python" -m pytest -p no:cacheprovider -q \
+  tests/test_issue21_phase2_loop_a.py::test_w6e2_untracked_submodule_file_hidden_by_config_blocks_the_forced_removal \
+  tests/test_issue21_phase2_loop_a.py::test_w6e_work_written_while_stopping_is_not_force_removed \
+  tests/test_issue21_loop_b.py::test_l17_dirty_submodule_is_refused_or_makes_the_round_stale)   # 4 failed, 5 passed
+# ps 형태 비교(잘림·구분자)
+python3 - <<'PY'
+import subprocess,sys,time
+p=subprocess.Popen([sys.executable,"-c","import time;time.sleep(6)","X"*400]); time.sleep(1)
+for f in (["-axo","pid=,ppid=,command="],["-eo","pid=,ppid=,args="]):
+    l=[x for x in subprocess.run(["ps",*f],capture_output=True,text=True).stdout.splitlines() if x.split()[:1]==[str(p.pid)]]
+    print(f, len(l[0]), l[0].count("X"))
+p.wait()
+PY
+```
+
+[VERDICT: PASS]
diff --git a/.agents/reports/planner-reviewer-codex-01/report-b880c1f2.md b/.agents/reports/planner-reviewer-codex-01/report-b880c1f2.md
new file mode 100644
index 0000000..36d4125
--- /dev/null
+++ b/.agents/reports/planner-reviewer-codex-01/report-b880c1f2.md
@@ -0,0 +1,71 @@
+# PR #29 independent review
+
+Job: b880c1f2. Reviewer: planner-reviewer-codex-01.
+Review target: detached `multi-agent-mux-wt/pr-29` at `46ea4cc1e4f664ca35711c05c3fa71258e169697`, compared with main `1134d74b3884d5818a4f738f5c9441b80f3f8802`.
+
+**NOT PASS.** Two reproduced correctness defects remain in the handling of hidden untracked submodule files. Preparation also fails the brief's explicit environment requirement. These are separate from the known pending 4.7.0 release bump. No broad redesign is necessary: the guard corrections are narrow and were verified in disposable fixtures.
+
+## Blocking findings
+
+### R1 — P1: removal can silently delete untracked submodule data
+
+Locations: `.agents/skills/lib_py/worktree.py:167` and `.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh:91` (the resulting force-removal path is at line 161).
+
+Both cleanliness checks inherit Git's `status.showUntrackedFiles` configuration. `--porcelain` does not override that setting. In an initialized submodule with `git config status.showUntrackedFiles no`, a normal, non-ignored untracked file is hidden from both the parent status and the submodule `foreach` check. The helper consequently reports that all checks passed and executes `git worktree remove --force`, deleting the file.
+
+I reproduced this using the existing `ctl_sub` sandbox fixture and the actual preparation/removal scripts, with no real worktree removal:
+
+1. Prepare a temporary worktree with its local test submodule initialized.
+2. Set `status.showUntrackedFiles=no` in that submodule and create `valuable-untracked.txt` there.
+3. Parent `status --porcelain --ignore-submodules=none` returns an empty string; explicit submodule `status --porcelain --untracked-files=all` reports the file.
+4. Removal returns **0**, prints `checks: locked/sessions/jobs/clean/submodules -> passed; removal method: single --force`, and the file no longer exists.
+
+**Correction:** explicitly use `--untracked-files=all` in the parent and recursive submodule safety checks, retaining `--ignore-submodules=none`; do not let display preferences govern deletion eligibility. Add regressions with this configuration both before removal and for the post-stop recheck. I changed only the disposable fixture's copy of the submodule check to `git status --porcelain --untracked-files=all --ignore-submodules=none`: removal then returned **3** and preserved the file. The reviewed source remains unchanged.
+
+### R2 — P1: the review snapshot can approve a dirty submodule it did not capture
+
+Location: `.agents/skills/lib_py/loop/runner.py:717` (`_dirty_submodules`).
+
+The review-identity guard has the same configuration dependency. With `status.showUntrackedFiles=no` inside a submodule, untracked content is not rejected. The snapshot records only the submodule gitlink, so that content is absent from the review tree and from the identity comparison. A stubbed PASS is then accepted and promoted, although the documented dirty-submodule refusal should have prevented any review.
+
+Using the existing temporary `wt_repo` and `_drive` fixtures, I added a clean submodule, set this configuration, and created a non-ignored untracked file. The actual controller returned **0**, dispatched **one review**, and wrote **one PASS identity sidecar**. This demonstrates the controller admission/promotion defect; it does not represent a real reviewer's assessment.
+
+**Correction:** add `--untracked-files=all` to `_dirty_submodules` so both snapshot admission and subsequent stale/pre-promotion checks reject these files. An in-memory override of only that status command made the same probe return **1**, dispatch zero reviews, and write no sidecar. Add configuration-sensitive tests for both initial and mid-round untracked changes.
+
+### R3 — P2: preparation still aliases the control environment
+
+Location: `.agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh:111`–118; related assertion: `tests/test_issue21_phase2_loop_a.py:264`.
+
+The brief explicitly asks for a real worktree venv rather than a symlink, or explicit interpreter-path handling. The helper instead executes `ln -s "$MAIN/.venv" "$WT/.venv"`; its test requires that link, and the design/skill documents describe it. This is an implementation-and-test requirement gap, not a failing existing test. A temporary fixture confirmed that writing through the worktree `.venv` changes the control root's environment. The PR review checkout's own real venv does not establish what this helper creates.
+
+**Correction:** create an independent environment with the intended dependencies, or use the brief's explicit interpreter-path alternative without creating a misleading local environment alias. Update the W1 assertion and corresponding preparation documentation. The loop's review prompt already provides an absolute interpreter path, but that does not change preparation behavior for creators.
+
+## Other review results
+
+- **R1–R6 removal defenses:** the post-stop tree recheck, stash checks, retained/deinitialized submodule repository checks, partial-repository refusals, and traversal of HEAD plus local refs including tags are present. The existing regressions cover those cases and passed. They do not exercise `status.showUntrackedFiles=no`, which explains the additional R1 failure above. Initialization rollback retains preexisting submodule repositories/configuration in the tested cases; initialization over a nonempty uninitialized path is refused.
+- **Resume and bindings:** the original-cwd check uses canonical paths, runs before session resolution, rejects missing/mismatching recorded cwd with exit 2, and leaves rows without cwd compatible. Single-workspace resume at its recorded path and already-running binding persistence passed. Create now starts immediate reconcile/watchdog from the control runtime, and preparation supplies `MAM_NO_SUBSCRIBER_DAEMON=1`.
+- **Identity workflow:** snapshots use a temporary index, include ordinary untracked source files, pin the diff to the snapshot, and generate detached review worktrees. Stale rounds discard approvals; promotion rechecks identity. Failure to create a review worktree does not silently lower isolation. Remote verdict recipients are refused before delegation unless explicitly admitted as diff-only; truncated/unavailable evidence is refused for those recipients. Self-review uses the identity path. These behaviors passed focused tests, subject to R2. With no worktree/base options, existing delegation prompts and the two-argument diff collector remain compatible; output is not literally byte-identical everywhere because loop-id logging/checkpoint data are new.
+- **#20 isolation:** ambient bindings are recorded/dropped before collection, and function-scoped defaults route registry/audit state to tmp_path. The #15 default-resolution tests explicitly remove overrides where necessary and check their own job/session identities. The guard watches recorded control-plane paths, not only the review checkout. Direct directory snapshots found **zero added entries** in main and review checkout `.mam/jobs` and `.mam/delegate_job_logs` during this review's tests.
+- **Acceptance A1–A8:** these are sandbox/mock integration tests, not proof of environment delivery inside a real herdr pane. The documentation now states that boundary. The tests exercise caller arguments, routing, stale review rejection, cleanup, and loop locking; all passed in the focused run. A3 uses a deliberately unreachable broker, so failure timing is bounded but the suite is not uniformly instantaneous. Real-herdr acceptance remains separate evidence to obtain before claiming complete operational validation.
+- **acceptance5 changes:** unique session/secret values remove the old fixed-session collision, retained-terminal delivery is a valid acknowledgement path, and product `started --heartbeat` behavior is unchanged. The test passed in this run. Caution: the new skip predicate at `tests/test_issue18_liveness_contract.py:1183` checks local subscription plus absence of observed events; it does not independently establish the topic actually published by the runner. Its claim that a wrong publish topic must still fail is stronger than its evidence. A controlled broker or assertions against publisher topic/outcome evidence would make this classification more reliable. Do not treat a skipped acceptance run as a PASS.
+- **Documentation/follow-ups:** the brief's four nonblocking follow-ups are reasonable: strengthen A4 beyond status/path equality to compare untracked contents; make shared info/exclude mutation and its pre-seeding in A4 explicit; scope fallback prune to owned review metadata; deduplicate submodule refusal output. A4 currently proves only its stated tuple invariants. Tracking these under the proposed #30 follow-up is appropriate, but I did not independently inspect the external issue's registration/content. R1/R2 above must be fixed before merge rather than deferred as those polish items.
+- **Release:** 4.7.0 lockstep changes and release notes remain a known merge prerequisite. Version-consistency tests passing on 4.6.0 do not fulfill it. `git diff --check 1134d74...HEAD` passed; `bash -n` passed for all eight changed shell files.
+
+## Verification record
+
+All pytest runs used the requested worktree's own `.venv/bin/python`, `PYTHONDONTWRITEBYTECODE=1`, and `-p no:cacheprovider`. Additional probes were injected in memory through pytest collection and used existing temporary fixtures; only the fix-direction probe altered a fixture's disposable source copy.
+
+| Run | Result |
+|---|---|
+| `test_issue21_acceptance.py`, `test_issue21_phase2_loop_a.py`, `test_issue21_loop_b.py`, `test_issue21_worktree_prereqs.py`, `test_issue20_state_isolation.py`, `test_issue15_registry_isolation.py`, `test_version_consistency.py` | **118 passed, 1 skipped**, 289.64 s. Skip is the outer collection of the deliberately nested S6 probe. |
+| `test_issue14_delivery_ack.py`, `test_issue18_liveness_contract.py`, `test_issue6_turn_handshake.py` | **56 passed, 1 failed**, 331.60 s. |
+| Isolated wall-clock regression rerun | **1 failed**, 31.24 s; close delay 28.5585 s against 28 s. |
+| R1/R2 safety assertions against unmodified implementation | Both failed as described above, reproducing the blockers. |
+| R1 disposable-copy correction / R2 in-memory correction | Each passed: removal preserved the file; identity refused before review. |
+| Preparation alias probe | Confirmed the symlink and cross-environment write. |
+
+The regression-suite failure was `test_wrapper_idle_grace_never_outlives_the_wall_clock`, `tests/test_issue14_delivery_ack.py:513`: the expected error status and return code were observed, but close delay was **28.7779 s**, exceeding the **28 s** allowance. The isolated rerun also failed at **28.5585 s**. The test body and wrapper are unchanged by this PR; the changed #14 code is its separate in-process publication helper. This timing failure remains unresolved in this environment and is not the evidence for R1/R2. I did not run the base suite or independently classify #28's 33 failures; these results do not justify a blanket environmental explanation.
+
+No product files, source refs, production sessions, or monitor state were changed. Main remained on `1134d74`; the reviewed worktree remained on `46ea4cc`. The verdict concerns this exact tree, not later orchestrator release/fix commits.
+
+[VERDICT: NOT PASS]
diff --git a/.agents/reports/planner-reviewer-codex-01/report-f6b21a0d.md b/.agents/reports/planner-reviewer-codex-01/report-f6b21a0d.md
new file mode 100644
index 0000000..e78593e
--- /dev/null
+++ b/.agents/reports/planner-reviewer-codex-01/report-f6b21a0d.md
@@ -0,0 +1,39 @@
+# PR #29 delta review — 2nd pass
+
+Reviewer: planner-reviewer-codex-01. Job: f6b21a0d.
+
+Reviewed the detached worktree `multi-agent-mux-wt/pr-29` at `80a5614`, comparing `46ea4cc..HEAD` (commits `7a94ba2`, `90a289d`, `08db1da`, and `80a5614`). The three findings from the first review are closed by the delta. I found no additional merge-blocking defect in the reviewed changes.
+
+## R1/R2: hidden untracked submodule files
+
+The removal guard now uses `git status --porcelain --untracked-files=all --ignore-submodules=none` for the worktree, and `lib_py.worktree.submodule_findings()` uses `git status --porcelain --untracked-files=all` inside every checked submodule. The identity runner's `_dirty_submodules()` uses the same explicit flag. This defeats `status.showUntrackedFiles=no` and remains independent of `submodule.*.ignore` and `diff.ignoreSubmodules`.
+
+The source-tree snapshot still uses a temporary index and `git add -A`; that operation already sees untracked files independent of display settings, so no extra snapshot change is needed. The new regression cases cover hidden files before removal, files written while stopping, hidden files that appear during a review, and hidden files present before a review. The prior destructive probes were repeated against disposable fixtures: with the delta, removal returned exit 3 and preserved the untracked file; review identity refused before dispatch and produced no sidecar. R1 and R2 are therefore resolved.
+
+## R3: worktree virtual environments
+
+`worktree_prepare.sh` now refuses an existing `.venv` symlink, creates an independent venv with the control root's `.venv/bin/python`, installs the delegate-job requirements plus root `requirements.txt`/`requirements-dev.txt` when present, and reports `VENV=created`. A usable existing environment is idempotently retained as `VENV=kept`. When the control interpreter is absent it warns and reports `VENV=skipped`; it does not invent a link. If dependency installation fails, the half-created venv is removed and the worktree remains for correction and retry. The tests cover creation, the kept path, link refusal, missing interpreter, and failed-install cleanup.
+
+The design document and create/stop skill documentation now describe the independent environment, network requirement, link refusal, and cleanup semantics. The managed `.gitignore` block and shared Git `info/exclude` still ignore `.venv` and `.pytest_cache`; the new environment is not tracked. I found the implementation and documentation consistent.
+
+## Portability delta (#28)
+
+The `bash -c` change in `test_workspace_scope.py` is appropriate because the test invokes the Bash `source` builtin. Help-output normalization collapses layout-only whitespace and the Python 3.9/3.14 option-group spelling while still comparing the actual normalized content. The deployment freshness markers skip only when the relevant `nats-docker` assets are absent. This checkout does not contain the optional `nats-docker/docker-compose.yaml`, so those asset-dependent cases skip here; `PRIVATE_SERVER.md` is present and its checks run. The test suite must still run those checks when a checkout has the assets. The process scanners now use POSIX `ps -eo pid=,ppid=,args=`, which is available on macOS and Linux and preserves the command text needed by the scanners. `MAM_ENV_FILE` is pinned to a deliberately absent per-test path, while tests that need broker configuration can override it.
+
+## Wall-clock test change
+
+The close-delay allowance changed from `timeout_s + 8` to `timeout_s + 15`. This is a test-only adjustment for observed suite load; it still rejects the original roughly 2× timeout failure mode (40 seconds against a 35-second limit in the test's 20-second scenario). The previously failing scenario now passes in an isolated rerun, and the remote acceptance test also passes. The wider allowance is a reasonable host-load calibration, though future runs should retain the measured close-delay evidence rather than relying on the assertion alone.
+
+## Verification
+
+All tests were run in the requested detached worktree with its `.venv/bin/python`, `PYTHONDONTWRITEBYTECODE=1`, and `pytest -p no:cacheprovider`.
+
+- Delta-focused suites (`test_issue21_phase2_loop_a.py`, `test_issue21_loop_b.py`, `test_issue21_acceptance.py`, `test_issue21_worktree_prereqs.py`, `test_issue5_phase1_delegation.py`, `test_workspace_scope.py`, `test_deploy_freshness.py`, `test_version_consistency.py`): **209 passed** in 323.16 s. Asset-dependent freshness tests skip because this checkout has no `nats-docker` assets; this is the intended skip condition.
+- Isolated wall-clock close and remote acceptance rerun: **2 passed** in 49.79 s.
+- `bash -n` on all eight changed shell files: passed.
+- `git diff --check 1134d74...HEAD`: passed.
+- Direct snapshots before/after testing found no new entries in either checkout's real `.mam/jobs` or `.mam/delegate_job_logs`.
+
+The known release prerequisite remains outside this delta: the orchestrator must perform the 4.7.0 version lockstep bump and release entry before merge. Main stayed at `1134d74`; the review worktree stayed at `80a5614`; no source, checkout, production registry, monitor, or session state was modified.
+
+[VERDICT: PASS]
diff --git a/.agents/reports/reviewer-agy-01/report-d9275506.md b/.agents/reports/reviewer-agy-01/report-d9275506.md
new file mode 100644
index 0000000..da1b245
--- /dev/null
+++ b/.agents/reports/reviewer-agy-01/report-d9275506.md
@@ -0,0 +1,87 @@
+# PR #29 Delta Review Report (Round 2)
+
+- **Reviewer**: Antigravity (`herdr:reviewer-agy-01`)
+- **Job ID**: `d9275506`
+- **Target PR**: [PR #29](https://git.godopu.com/tmpl/multi-agent-mux/pulls/29) (`feat/issue-21-items-4-5-7` @ `08db1da`, previous review target `46ea4cc`, base `main` `1134d74` / v4.6.0)
+- **Review Target Worktree**: `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` (detached @ `08db1da`)
+- **Base Checkout**: `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux` (`main` @ `1134d74`, unmodified)
+- **Status**: Review Complete
+
+---
+
+## 1. Executive Summary
+
+This independent second-round review examines the 3 delta commits (`46ea4cc..08db1da`) in PR #29 responding to review feedback (specifically Codex R1, R2, R3, host portability fixes for Issue #28, and a wall-clock test timing adjustment):
+1. `7a94ba2`: Portable test adaptations for Linux/Python 3.14 (#28) and POSIX `ps -eo pid=,ppid=,args=` in process scanners.
+2. `90a289d`: Widened wall-clock close margin (`timeout_s + 15`) in `test_issue14_delivery_ack.py` to eliminate multi-core load timing jitter.
+3. `08db1da`: Codex R1–R3 resolutions:
+   - Added `--untracked-files=all` across all three git status checks (`lib_py/worktree.py`, `worktree_remove.sh`, and `runner.py::_dirty_submodules`), preventing `status.showUntrackedFiles=no` from bypassing safety checks.
+   - Replaced `.venv` symlinking in `worktree_prepare.sh` with dedicated virtualenv creation (`$WT/.venv`) via the control root interpreter (`$MAIN/.venv/bin/python`), including automatic `requirements*.txt` installation, link refusal (`exit 1`), and interpreter fallback (`VENV=skipped`).
+   - Added comprehensive regressions (`test_w1`, `test_w1b`, `test_w6e[hidden]`, `test_w6e2`, `test_l17[untracked-hidden,during-hidden]`).
+
+All 5 checklist verification items were evaluated in worktree `pr-29`. The delta commits resolve all feedback points without weakening existing contracts or regressing Round 1 functionality.
+
+---
+
+## 2. Checklist Item-by-Item Verification
+
+### (1) Untracked-Safe Status Checks (Codex R1 & R2)
+- **Three Inspection Points**: `--untracked-files=all` has been added to all 3 critical cleanliness evaluation sites:
+  1. `lib_py/worktree.py` line 167:
+     `checks = (("dirty", "git status --porcelain --untracked-files=all"), ...)`
+  2. `.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh` line 91:
+     `if ! dirty="$(git -C "$WT" status --porcelain --untracked-files=all --ignore-submodules=none 2>&1)"; then`
+  3. `.agents/skills/lib_py/loop/runner.py` line 718 (`_dirty_submodules`):
+     `r = _git(wt, "submodule", "foreach", "--recursive", "--quiet", "git status --porcelain --untracked-files=all")`
+- **Prevention of Data Loss & Stale Approvals**: Standard `git status --porcelain` respects `status.showUntrackedFiles=no`. Without `--untracked-files=all`, untracked files in submodules or worktrees with that setting configured were hidden from status checks, allowing `worktree_remove.sh` to execute a destructive forced removal over uncommitted work, and allowing the review loop to treat a dirty tree as clean. The explicit flag forces git to report all untracked files.
+- **Source Tree Snapshot Guard**: In `runner.py`, the source tree review snapshot is captured using `git -C <wt> add -A`. By git specification, `git add -A` captures all untracked, modified, and deleted files unconditionally, completely ignoring `status.showUntrackedFiles`. Hence, no additional flag is required for snapshot creation.
+- **Regression Tests**:
+  - `test_w6e[hidden=True]` and `test_w6e2_untracked_submodule_file_hidden_by_config_blocks_the_forced_removal` in `tests/test_issue21_phase2_loop_a.py`.
+  - `test_l17[untracked-hidden, during-hidden]` in `tests/test_issue21_loop_b.py`.
+  All pass and confirm that config-hidden untracked files fail closed.
+
+### (2) Dedicated Worktree Virtualenv (Codex R3)
+- **Idempotency**: `worktree_prepare.sh` checks `if [ -e "$WT/.venv" ]; then VENV_STATE="kept"`. Existing virtual environments are preserved without re-creation.
+- **Symlink Refusal**: `if [ -L "$WT/.venv" ]; then echo "ERROR: ... is a symbolic link..." >&2; exit 1; fi`. Rejects aliased symlinks to guarantee environment isolation.
+- **Interpreter Absent**: If `$MAIN/.venv/bin/python` is unavailable, it outputs `WARNING: no interpreter at '$MAIN/.venv/bin/python'; no venv created` and proceeds with `VENV_STATE="skipped"`.
+- **Installation Failure Handling**: If `pip install -q -r "$req"` fails on requirements files, it exits with code 1 and outputs `ERROR: ... the worktree was kept - remove it with worktree_remove.sh --path '$WT'`. The worktree is preserved for debugging rather than left broken or deleted unexpectedly.
+- **Documentation & Ignore Alignment**:
+  - `docs/design/worktree-creator-model.md` and SKILL guides (`create`, `stop`) have been updated to describe dedicated venvs and interpreter requirements.
+  - The `.gitignore` managed block (`/.venv`) and `info/exclude` (`/.venv`, `.pytest_cache/`) correctly ignore `$WT/.venv` as a directory.
+
+### (3) Host Portability Fixes (Issue #28)
+- **`_normalize_help`**: In `tests/test_issue5_phase1_delegation.py`, replaces `optional arguments:` with `options:` and normalizes whitespace runs. This accommodates Python 3.10+ argparse formatting without weakening validation of flags, positional arguments, or descriptions.
+- **`test_deploy_freshness.py` Skips**: Uses `needs_docker_assets` / `needs_private_server_doc` decorators that skip only when external `nats-docker` or private server documentation assets are missing. On environments with assets present (including this macOS verification host), all 97 tests ran and passed.
+- **`conftest.py` `MAM_ENV_FILE` Isolation**: Anchors `MAM_ENV_FILE` to a non-existent sandbox path (`tmp_path / ".mam.env.absent"`) by default, preventing ambient `.mam.env` values from leaking into test runs. Tests requiring specific env files explicitly override it.
+- **Process Scanning (`ps -eo pid=,ppid=,args=`)**: POSIX-compliant process listing in `lib_py/agents/base.py` and `lib_py/delegation/heartbeat.py` replaces BSD-only `-ww` flags, ensuring identical, untruncated column parsing across macOS and Linux.
+
+### (4) Wall-Clock Close Margin (`90a289d`)
+- **Test Integrity**: In `tests/test_issue14_delivery_ack.py`, `test_wrapper_idle_grace_never_outlives_the_wall_clock` verifies that heartbeats extend the idle window up to the wall-clock deadline (`timeout_s = 20`), without allowing idle grace to outlive the deadline.
+- **Margin Adjustment**: The assertion threshold was updated from `timeout_s + 8` to `timeout_s + 15` (35s). The original bug was counting sleeps, which ran for ~2x TIMEOUT (40s). A 35s ceiling easily catches a 40s overrun while preventing ~50ms timing jitter failures caused by heavy CPU load during full-suite execution with mock latency. Tested directly: passed in 31.35s.
+
+### (5) Merge Readiness
+- `git diff 1134d74...HEAD --check` passes with **0** whitespace/formatting errors.
+- Version bump to 4.7.0 (MINOR) and `VERSIONS.md` update are confirmed as scheduled for the orchestrator release commit.
+- Zero functional, stability, or security regressions.
+
+---
+
+## 3. Test Execution Summary
+
+Executed in worktree `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29`:
+| Test Suite | Result | Duration |
+| :--- | :---: | :---: |
+| `tests/test_version_consistency.py` | **3 passed** | 0.22s |
+| `tests/test_workspace_scope.py` | **2 passed** | 0.14s |
+| `tests/test_issue5_phase1_delegation.py` + `tests/test_deploy_freshness.py` | **97 passed** | 32.48s |
+| `tests/test_issue21_phase2_loop_a.py` | **28 passed** | 125.85s |
+| `tests/test_issue21_loop_b.py` | **34 passed** | 11.01s |
+| `tests/test_issue14_delivery_ack.py` (wall-clock test) | **1 passed** | 31.35s |
+
+---
+
+## 4. Conclusion
+
+The 3 delta commits cleanly resolve Codex review items R1–R3, address host portability under Python 3.14/Linux (Issue #28), and stabilize the wall-clock test under multi-core load. All contracts remain fully preserved.
+
+[VERDICT: PASS]
diff --git a/.agents/reports/reviewer-agy-01/report-f27519ff.md b/.agents/reports/reviewer-agy-01/report-f27519ff.md
new file mode 100644
index 0000000..8c82405
--- /dev/null
+++ b/.agents/reports/reviewer-agy-01/report-f27519ff.md
@@ -0,0 +1,122 @@
+# PR #29 Review Report: Worktree Operating Model Phase 2 (Items 4, 5, 7, Test Isolation #20, Deploy #27)
+
+- **Reviewer**: Antigravity (`herdr:reviewer-agy-01`)
+- **Job ID**: `f27519ff`
+- **Target PR**: [PR #29](https://git.godopu.com/tmpl/multi-agent-mux/pulls/29) (`feat/issue-21-items-4-5-7` @ `46ea4cc`, base `main` `1134d74` / v4.6.0)
+- **Review Target Worktree**: `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` (detached @ `46ea4cc`)
+- **Base Repository**: `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux` (`main` @ `1134d74`, unmodified)
+- **Status**: Review Complete
+
+---
+
+## 1. Executive Summary
+
+PR #29 implements the Phase 2 components of the Worktree Creator Operating Model (Issue #21 items 4, 5, 7), comprehensive test suite isolation (#20), and installer `.gitignore` handling (#27) across 20 commits (+3,229 / -108 lines, 25 files changed).
+
+An independent review was performed from the dedicated worktree `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` without modifying any files in either the worktree or the main working copy.
+
+All 8 verification items have been thoroughly analyzed and verified:
+- **Worktree Helpers (`worktree_prepare.sh`, `worktree_remove.sh`)**: Rigorously safe against data loss (defenses R1–R6) with opt-in submodules, rollback on failed init, and guarded `--force` execution only after verifying that zero uncommitted changes, unpushed commits (including tags/detached HEAD), or stashes exist.
+- **Resume CWD Guard**: Safely enforces resuming in original cwd (exit 2) while maintaining 100% backward compatibility for single-workspace users, and persists control-plane bindings on already-running paths.
+- **Review Identity & Isolation**: Robust per-round snapshots `(base_sha, head_sha, tree_sha)`, detached review worktrees (`--review-isolation`), stale-round re-review on creator commit, pre-promotion re-check, and durable sidecar metadata (`.identity.json`). Default behavior without options remains byte-for-byte identical.
+- **Test State Isolation (#20)**: Zero test leakage into real `.mam` verified live on the control plane. Ambient bindings are dropped before test collection, test-specific tmp roots are injected via autouse fixture, and session-scoped leak guards detect anomalies.
+- **Test Suite Results**: 100% pass across all new and prerequisite test suites (132 tests passing deterministically). `git diff --check` passes with 0 errors.
+- **Known Limitation**: Version bump to 4.7.0 (MINOR) and `VERSIONS.md` update are properly scheduled for the orchestrator release commit.
+
+---
+
+## 2. Item-by-Item Verification
+
+### (1) Worktree Helpers & Data Loss Defenses (Issue #21 Item 4)
+- **`worktree_prepare.sh`**:
+  - **`.venv` Handling**: Creates a symlink `ln -s "$MAIN/.venv" "$WT/.venv"` (linking to the control root's virtual environment rather than duplicating packages). If an existing non-symlink `.venv` is present, it issues a warning and leaves it intact. Commit `fadd38c` (#27) updated the managed `.gitignore` rule from `/.venv/` to `/.venv`, ensuring git ignores the `.venv` symlink in worktrees across all forms (file, directory, or symlink).
+  - **Shared Excludes**: Adds `/.venv` and `.pytest_cache/` directly into `$GIT_COMMON_DIR/info/exclude`.
+  - **Opt-in Submodules**: Submodules are initialized only when `--submodules` is explicitly supplied. Without `--submodules`, no submodule checkout or `modules/` directory is created.
+  - **Submodule Rollback (R3 & R4)**: If `git submodule update --init --recursive` fails, the helper rolls back any partially created submodule checkouts, removes `.git` pointer files, deletes newly created module gitdirs in `$gd/modules/`, and restores `.git/config` keys. Pre-existing submodule checkouts are preserved. If an uninitialized submodule path already contains files prior to init, it refuses upfront (`exit 3`) before modifying anything (R4).
+- **`worktree_remove.sh` & Data Loss Defenses (R1–R6)**:
+  - Pre-flight checks run before any mutations:
+    1. Linked worktree check & lock check (`is-locked`, exit 3 if locked).
+    2. Running sessions check: refuses unless `--stop` is specified.
+    3. Open jobs check: verifies no open jobs exist for sessions in the worktree.
+    4. Clean working tree check: `git status --porcelain --ignore-submodules=none`.
+    5. Submodule inspection: verifies `dirty`, `unpushed`, and `stashes` across all repositories under `modules/` (including deinitialized and nested submodules via `_module_gitdirs`).
+  - **Post-Stop Re-Check (R1)**: After `--stop` halts sessions, open jobs are re-checked, and `judge_tree` is executed a second time immediately before removal. This prevents data loss if a session being stopped wrote files, committed, or created stashes during termination.
+  - **Unpushed Commits (R6)**: Uses `UNPUSHED_REVS = ("HEAD", "--exclude=refs/stash", "--all", "--not", "--remotes")`. This inspects commits reachable from HEAD, detached HEAD, local branches, and tags. Commits preserved only by local tags in submodules are protected.
+  - **Single `--force` Execution**: Git by design refuses plain `git worktree remove` on any worktree containing a `modules/` directory. `worktree_remove.sh` performs a single `git worktree remove --force` *only* after confirming R1–R6 pass completely. If any check fails, it exits with code 3 and leaves the entire worktree untouched. Manual, unguarded `git worktree remove --force` is explicitly warned against.
+
+### (2) Resume Contract & Binding Persistence (`2679ddf`)
+- **Original CWD Validation**:
+  - `resume_session.sh` verifies `mam_abs_workspace "$WORKSPACE"` matches `mam_abs_workspace "$ROW_CWD"`. If called with an altered workspace path, it terminates with `exit 2` and a clear error message (`Pass --workspace '$ROW_CWD' to resume it in its original workspace`).
+  - If the directory recorded in `pane.cwd` no longer exists (e.g. after worktree removal), it exits with code 2 explaining that recreating the worktree at that path makes the session resumable again.
+- **Backward Compatibility**: For standard single-workspace users, the workspace matches `ROW_CWD`, so resume executes normally without disruption.
+- **Already-Running Path Binding Persistence**: When resuming an already-running session, `CONTROL_PLANE_JSON="$CP_JSON" update_yaml_resumed.sh` is invoked, persisting the control-plane binding into `agent-sessions.yaml`.
+- **Loud Binding Failure**: If control-plane binding computation fails:
+  - For a worktree (workspace != control root), it fails closed with `exit 2` ("refusing to resume a session that would use the wrong control plane").
+  - For the control root itself, it issues a WARNING and continues without `control_plane`, preserving resiliency.
+
+### (3) Review Identity & Isolation (Issue #21 Item 5)
+- **Snapshot Identity**:
+  - `lib_py/loop/runner.py` records `(loop_id, base_sha, head_sha, tree_sha)` for each review round.
+  - Verification targets are embedded directly into reviewer prompts.
+- **`--review-isolation worktree`**:
+  - Creates a temporary detached worktree at the snapshot's review commit (with uncommitted/untracked changes pinned) so reviewers run tests without contaminating the creator's working tree.
+  - The review worktree is cleanly closed via `_close_review_tree` at the conclusion of each round, even upon failure (`_release_review_trees`).
+- **Stale Round Detection**: If the creator commits or modifies files during an active review round, the round is identified as stale, approvals are discarded, and a fresh review round is triggered.
+- **Pre-Promotion Re-Check**: Before promoting passed reviews to durable artifacts (`.mam/reviews/...`), `_identity_now()` is verified against the approved round's `(head_sha, tree_sha)`. If the tree changed after review approval, promotion fails closed with `exit 1`.
+- **Durable Identity Evidence**: Promoted reports are accompanied by a JSON sidecar `report-{jid}.identity.json` detailing loop ID, SHAs, reviewer identity, review commit, and verification timestamp.
+- **Remote Reviewers (`--remote-review`)**: Since remote reviewers cannot access local worktree paths, identity mode refuses remote reviewers by default, or allows them strictly as diff-only via `--remote-review diff-only`.
+- **Dirty Submodules**: Submodule dirtiness is detected and causes reviews to be refused or marked stale.
+- **Zero Drift Without Options**: When run without isolation/identity options, `identity` evaluates to `False`, no review worktree is created, and the prompt text matches previous releases byte-for-byte.
+
+### (4) Test State Isolation (#20 Commits `3433ffd` ~ `46ea4cc`)
+- **Ambient Binding Drop**: `tests/conftest.py`'s `pytest_configure` records and unsets ambient `AGENT_SESSIONS_YAML`, `MAM_JOBS_DIR`, `DELEGATE_JOB_LOGS_DIR`, and foreign `WORKSPACE_ROOT`.
+- **Per-Test TMP Roots**: The autouse fixture `_isolate_mam_state_dirs` redirects `MAM_JOBS_DIR` and `DELEGATE_JOB_LOGS_DIR` to `tmp_path / ".mam-test-state"` for every individual test.
+- **Resolution Tests Opt-Out**: Tests in `tests/test_issue15_registry_isolation.py` that test default fallback resolution explicitly opt out by calling `monkeypatch.delenv`.
+- **Control Plane Leak Guard**: `mam_state_leak_guard` snapshots all real `.mam/jobs` and `.mam/delegate_job_logs` directories before test session execution and asserts at session finish that zero unexpected records were leaked.
+- **Live Verification**: Inspection of the host control plane `.mam/jobs` and `.mam/delegate_job_logs` confirmed **0** leaked test records. Only active delegation job `f27519ff` is present.
+
+### (5) Acceptance5 Stabilization Commits (`7bc3e1a`, `371099a`, `e6d2168`)
+- **Session & Secret Randomization**: Uses a unique randomized session name (`sim-worker-{tag}`) and secret (`issue18-shared-secret-{tag}`) per run. This eliminates the collision failure mode where public MQTT broker retained messages from prior test runs were served to new tests.
+- **Widened Idle Window & Terminal Event Recognition**: Expands missed heartbeat tolerance (10 misses x 2s) and recognizes delivery confirmed by retained terminal events (`advanced to 'completed'`).
+- **Targeted Skip on Broker Non-Delivery**: Skips only when provable broker non-delivery occurs (e.g. no CONNACK from broker, or broker packet drop).
+- **Contract Maintained**: Protocol assertions (`assert proc.returncode == 0`, `status == "completed"`, `transport == "remote"`) remain fully intact; the contract is not weakened.
+
+### (6) Acceptance Cases A1–A8 & Test Suite Performance
+- **Hermeticity & Determinism**:
+  - All 9 acceptance tests in `tests/test_issue21_acceptance.py` run against `mock_herdr` and `mam_sandbox`/`tmp_path`.
+  - Zero requirement for a live `herdr` daemon or external MQTT network broker.
+- **Test Execution Metrics (executed in `pr-29`)**:
+  - `tests/test_version_consistency.py`: **3 passed** in 0.22s
+  - `tests/test_issue20_state_isolation.py`: **7 passed, 1 skipped** in 0.34s
+  - `tests/test_issue21_acceptance.py`: **9 passed** in 37.23s
+  - `tests/test_issue21_loop_b.py`: **32 passed** in 10.01s
+  - `tests/test_issue21_phase2_loop_a.py`: **25 passed** in 122.37s
+  - `tests/test_issue15_registry_isolation.py`: **7 passed** in 27.11s
+  - `tests/test_issue21_worktree_prereqs.py`: **35 passed** in 112.28s
+  - `tests/test_issue6_turn_handshake.py`: **14 passed** in 69.39s
+  - **Total**: **132 passed, 1 skipped**, 100% pass rate.
+
+### (7) Documentation Integrity & Non-Blocking Recommendations
+- **Documentation Alignment**:
+  - `docs/design/worktree-creator-model.md` accurately updates the implementation status matrix: items 1, 2, 3 (v4.6.0), items 4, 6 (Loop A), items 5, 7 (Loop B), with item 8 appropriately held for future work.
+  - Skill docs (`multi-agent-mux-create`, `multi-agent-mux-stop`, `multi-agent-mux-resume`, `multi-agent-mux-loop`) document helper script invocations, `--stop`, `--review-isolation`, and `--remote-review`.
+  - Compatibility matrix clearly defines runtime behavior across create, resume, stop, status, reconcile, delegate-job, and loop.
+- **4 Non-Blocking Recommendations**:
+  1. A4 untracked comparison (pre-applying info/exclude).
+  2. info/exclude pre-reflection.
+  3. Prune global guidance when worktree directory is deleted externally.
+  4. Deduplication of submodule refusal messages.
+  All 4 are sound, low-severity improvements properly deferred to Issue #30.
+
+### (8) Merge Readiness Assessment
+- `git diff 1134d74...HEAD --check` completed with **0** errors (no trailing whitespace, no merge artifacts).
+- Known limitation: Version bump to 4.7.0 (MINOR) and entry in `VERSIONS.md` are reserved for the orchestrator release commit.
+- No functional regressions, security hazards, or data loss vulnerabilities found.
+
+---
+
+## 3. Final Conclusion
+
+PR #29 completes Phase 2 of the Worktree Creator Operating Model with exemplary rigor in data safety, deterministic test isolation, and contract preservation.
+
+[VERDICT: PASS]
diff --git a/.agents/reports/reviewer-grok-01/report-19d56cde.md b/.agents/reports/reviewer-grok-01/report-19d56cde.md
new file mode 100644
index 0000000..ceec388
--- /dev/null
+++ b/.agents/reports/reviewer-grok-01/report-19d56cde.md
@@ -0,0 +1,62 @@
+# 🔍 Review Report — Job 19d56cde (PR #29 델타 `46ea4cc...08db1da`)
+
+- **Reviewer**: `reviewer-grok-01` · 2026-09-14
+- **트리**: `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` @ `08db1da`
+- **델타**: `git log`/`git diff` **`46ea4cc..HEAD`** (3커밋). 1회차 grok PASS @ 46ea4cc 를 뒤집지 않음.
+- **본 체크아웃**: `main` `1134d74` 유지. 워크트리 깨끗. 헬퍼를 실제 트리에 실행하지 않음.
+
+`git diff --check 46ea4cc...HEAD` 클린.
+
+## (1) Codex R1/R2 — 닫힘
+
+`--untracked-files=all` 이 세 검사에 모두 있음:
+
+| 위치 | 명령 |
+|---|---|
+| `worktree_remove.sh` `judge_tree` | `status --porcelain --untracked-files=all --ignore-submodules=none` |
+| `lib_py/worktree.py` submodule dirty | `status --porcelain --untracked-files=all` |
+| `runner.py` `_dirty_submodules` | 동일 + `--ignore-submodules=none` |
+
+임시 샌드박스: `status.showUntrackedFiles=no` 이면 플래그 없이 porcelain 이 비고, `--untracked-files=all` 이면 `?? secret.bin`. **`git add -A` 는 그 설정과 무관하게 untracked 를 스테이징**하므로 리뷰 스냅샷(`runner.py:698` `("add", "-A")`)은 추가 조치 불필요.
+
+회귀: `test_w6e[hidden]`, `test_w6e2`, `test_l17[untracked-hidden,during-hidden]`. 플래그 없이는 숨은 untracked 가 force 제거·스냅샷을 통과했을 테스트.
+
+## (2) Codex R3 — 닫힘
+
+`worktree_prepare.sh:111-136`: 링크면 exit 1(무변경), 사용 가능한 `bin/python` 이면 `VENV=kept`, 컨트롤 루트 인터프리터로 `python -m venv` + `requirements*.txt` 설치 실패 시 **워크트리 유지·exit 1**, 인터프리터 없으면 경고·`VENV=skipped`. `test_w1` / `test_w1b` 가 created/kept/skip/link 거부. SKILL.md·design doc 일치. `.gitignore` 관리 블록·`info/exclude` `/.venv` 와 정합(자체 venv 는 untracked 로 안 보임).
+
+## (3) #28 이식성 — 의도 유지
+
+- `test_workspace_scope.py`: `bash -c` (`source` 는 dash 에 없음).
+- argparse help: `_normalize_help` 가 그룹명·공백만 정규화. 옵션 토큰 유실은 여전히 실패.
+- `conftest` autouse `MAM_ENV_FILE` → 없는 파일. 실 `.mam.env` 를 쓰려면 테스트가 직접 set. T1-4 가 공개 브로커를 타던 경로를 막음.
+- deploy d11–d19 / d22–d30 skip 은 자산 부재 시만. **이 워크트리에는 `nats-docker/PRIVATE_SERVER.md` 와 `nats-docker/docker/docker-compose.yaml` 이 있어 skip 없이 실행됨** (아래 스위트 0 skipped).
+- `ps -eo pid=,ppid=,args=`: 이 macOS 에서 BSD `-axo … command=` 와 같은 3열 출력. Linux POSIX 와 맞춤.
+
+## (4) 90a289d 여유
+
+`timeout_s + 8` → `+ 15`. 핀하는 결함은 ~2×TIMEOUT(~40s, timeout=20). 하한 `elapsed >= timeout_s - 1` 유지. 여유 15s 는 2× 와 겹치지 않음. 계약 검증을 무효화하지 않음.
+
+## (5) 락스텝
+
+4.7.0 bump 는 오케스트레이터 예정. 병합 차단 아님.
+
+## 테스트 (워크트리)
+
+```
+PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q \
+  tests/test_issue21_phase2_loop_a.py tests/test_issue21_loop_b.py \
+  tests/test_issue21_worktree_prereqs.py tests/test_issue21_acceptance.py \
+  tests/test_workspace_scope.py tests/test_issue5_phase1_delegation.py \
+  tests/test_deploy_freshness.py tests/test_version_consistency.py
+```
+
+(`test_issue28_*.py` 없음, 건너뜀)
+
+**208 passed in 314.15s**, skip 0.
+
+## 종합
+
+1회차 PASS 유지. Codex R1–R3 이 코드·회귀·문서와 맞다. 설계 재작업 불필요.
+
+[VERDICT: PASS]
diff --git a/.agents/reports/reviewer-grok-01/report-5f1486ee.md b/.agents/reports/reviewer-grok-01/report-5f1486ee.md
new file mode 100644
index 0000000..2f3a7dd
--- /dev/null
+++ b/.agents/reports/reviewer-grok-01/report-5f1486ee.md
@@ -0,0 +1,63 @@
+# 🔍 Review Report — Job 5f1486ee (PR #29 @ `46ea4cc`)
+
+- **Reviewer**: `reviewer-grok-01` · 2026-09-14
+- **트리**: 워크트리 `/Users/godopu16/PuKi/laa/canary_projects/multi-agent-mux-wt/pr-29` detached `46ea4cc`
+- **베이스**: main `1134d74` (본 체크아웃은 그대로 `main`)
+- **범위**: `git log`/`git diff` **`1134d74...HEAD`** (워크트리)
+- **안전**: 워크트리·본 체크아웃 미수정. `worktree_remove.sh` 미실행(샌드박스 테스트만). 실제 `.mam` 미조작.
+
+`git diff --check 1134d74...HEAD` 클린. 20 커밋.
+
+## (1) 워크트리 헬퍼 (항목 4)
+
+**prepare `.venv`**: 실제 venv 가 아니라 **컨트롤 루트 `.venv` 의 심링크** (`worktree_prepare.sh:111-117`). 설계 문서의 `ln -s` 와 같음. 인터프리터는 컨트롤 루트 경로. 공유 `info/exclude` 에 `/.venv`, `.pytest_cache/` (`:120-129`) — 본 체크아웃 exclude 에도 들어가며, 비차단 권고(선반영)와 같음.
+
+**서브모듈 opt-in** (`--submodules`). 실패 시 이번 시도만 deinit·modules 삭제·config 복원 (`:174-198`). 비어 있지 않은 미init 경로는 변경 전 거부 (`:163-172`).
+
+**remove R1–R6**: 검사 전부 선행, 실패 시 무변경(exit 3). `--stop` 후 재검사(R1). 서브모듈 stash 거부. `git worktree remove --force` 는 submodule trace 가 있고 judge 가 통과한 뒤에만 (`:158-163`). 미커밋/미push 는 `UNPUSHED_REVS` (`worktree.py:27-30`: HEAD + `--all` − stash − remotes, 태그 포함 R6) 로 거부. **강제 제거가 보존된 커밋을 삼키는 경로는 검사 통과를 전제로 막혀 있다.** 잠긴 워크트리는 force 도 거부.
+
+## (2) resume (2679ddf)
+
+원래 `pane.cwd` 와 `--workspace` 불일치·경로 없음 → exit 2 (`resume_session.sh:61-69`). **단일 워크스페이스** 사용자는 cwd=체크아웃이라 기존과 같다. `ROW_CWD` 없는 레거시 행은 검사를 건너뜀. 컨트롤 평면 바인딩은 행 값이 이김; 계산 실패는 워크트리면 exit 2, 컨트롤 루트면 경고 (`:92-98`). 이미 실행 중 경로에도 영속화(주석 A13). 기존 resume 을 깨지 않음.
+
+## (3) 리뷰 identity (항목 5)
+
+`(loop_id, base_sha, head_sha)` 기록·stale (`runner.py:831-840`). `--review-isolation` 기본 `worktree` 이지만 **`--worktree`/`--base` 없을 때 `_worktree_context` 는 빈 문자열** (`:564-570`) — 프롬프트 바이트 동일. 옵션만 주면 경고 후 무시 (`:266-267`). detached 리뷰 워크트리 add/remove (`:775-786`). dirty 서브모듈 거부. `--remote-review` 기본 refuse. 승격 전 재확인 경로 존재. 기본(옵션 없음) 회귀 없음.
+
+## (4) #20 격리
+
+`pytest_configure` 가 ambient `MAM_JOBS_DIR`/`DELEGATE_JOB_LOGS_DIR`/`AGENT_SESSIONS_YAML` 을 수집 전에 pop (`conftest.py:139-147`). 매 테스트 autouse 가 tmp `.mam-test-state` 로 보냄 (`:161-172`). issue15 해석 테스트는 자체 `delenv` 로 옵트아웃. 세션 가드는 기록된 제어 평면 (`mam_state_leak_guard`).
+
+**직접 확인**: 테스트 전후 본 체크아웃 `.mam/jobs/*.json` **53**, `delegate_job_logs` **547** — 증가 없음. 워크트리 `git status` 깨끗.
+
+## (5) acceptance5
+
+세션·secret 런마다 고유 (`test_issue18_liveness_contract.py:1194-1201`). skip 은 러너가 started 를 찍고 구독자가 그 job 을 전혀 못 받은 경우만 (`:1164-1186`). started `--heartbeat` 계약은 유지. 약화 없음.
+
+## (6) A1–A8
+
+`test_issue21_acceptance.py`: mock herdr / mam_sandbox. 실제 herdr pane 은 stage C. 결정적. 지정 스위트에 loop_b 전체는 없음(작성 측 별도).
+
+## (7)–(8) 문서·버전
+
+design doc·SKILL 정합. 비차단 4건(exclude 공유, prune, 서브모듈 거부 중복 출력 등)은 병합 비차단. 락스텝 4.7.0 은 오케스트레이터 예정 — **병합 차단 아님**. 브랜치는 4.6.0.
+
+## 테스트
+
+워크트리:
+
+```
+PYTHONDONTWRITEBYTECODE=1 .venv/bin/python -m pytest -p no:cacheprovider -q \
+  tests/test_issue21_acceptance.py tests/test_issue21_phase2_loop_a.py \
+  tests/test_issue21_worktree_prereqs.py tests/test_issue20_state_isolation.py \
+  tests/test_issue15_registry_isolation.py tests/test_issue6_turn_handshake.py \
+  tests/test_version_consistency.py
+```
+
+**100 passed, 1 skipped in 359.97s.** 본 체크아웃 `main` `1134d74` 유지.
+
+## 종합
+
+항목 4·5·7·#20·#27 이 코드·테스트와 맞다. `git worktree remove --force` 는 검사 통과 후에만. 설계 재작업 불필요.
+
+[VERDICT: PASS]
diff --git a/.agents/skills/lib.sh b/.agents/skills/lib.sh
index 30ac927..d099771 100644
--- a/.agents/skills/lib.sh
+++ b/.agents/skills/lib.sh
@@ -29,7 +29,7 @@ export WORKSPACE_ROOT
 # Framework semantic version. Single runtime source of truth; kept in lockstep
 # with VERSIONS.md and the 8 SKILL.md frontmatters by tests/test_version_consistency.py.
 # NOTE: unlike other MAM_* variables this one is intentionally NOT env-overridable.
-MAM_VERSION="4.6.0"
+MAM_VERSION="4.7.0"
 export MAM_VERSION
 AGENT_SESSIONS_YAML="${AGENT_SESSIONS_YAML:-$WORKSPACE_ROOT/.mam/agent-sessions.yaml}"
 
diff --git a/.agents/skills/lib_py/agents/base.py b/.agents/skills/lib_py/agents/base.py
index 41faa3a..bd2221a 100644
--- a/.agents/skills/lib_py/agents/base.py
+++ b/.agents/skills/lib_py/agents/base.py
@@ -47,7 +47,7 @@ def conversation_in_use(uuid: str, paths=()) -> bool:
         if os.environ.get(var, "").strip() == uuid:
             return True
     try:
-        out = subprocess.run(["ps", "-axo", "pid=,ppid=,command="],
+        out = subprocess.run(["ps", "-eo", "pid=,ppid=,args="],
                              capture_output=True, text=True, timeout=10).stdout
     except Exception:
         out = ""
diff --git a/.agents/skills/lib_py/delegation/heartbeat.py b/.agents/skills/lib_py/delegation/heartbeat.py
index 11a8371..997ea1f 100644
--- a/.agents/skills/lib_py/delegation/heartbeat.py
+++ b/.agents/skills/lib_py/delegation/heartbeat.py
@@ -83,7 +83,7 @@ def _is_agent_cli(command: str) -> bool:
 def _process_table():
     """{pid: (ppid, command)} from ps; empty when ps is unavailable."""
     try:
-        out = subprocess.run(["ps", "-axo", "pid=,ppid=,command="], capture_output=True, text=True).stdout
+        out = subprocess.run(["ps", "-eo", "pid=,ppid=,args="], capture_output=True, text=True).stdout
     except OSError:
         return {}
     table = {}
diff --git a/.agents/skills/lib_py/loop/eager.py b/.agents/skills/lib_py/loop/eager.py
index 4fb4b34..d746479 100644
--- a/.agents/skills/lib_py/loop/eager.py
+++ b/.agents/skills/lib_py/loop/eager.py
@@ -13,7 +13,7 @@ import sys
 from typing import List, Sequence
 
 # Framework version locked with framework constants
-FRAMEWORK_VERSION = "4.6.0"
+FRAMEWORK_VERSION = "4.7.0"
 
 CORE_MODULES: Sequence[str] = (
     # Standard library modules
diff --git a/.agents/skills/lib_py/loop/runner.py b/.agents/skills/lib_py/loop/runner.py
index 94e0b28..406eabc 100644
--- a/.agents/skills/lib_py/loop/runner.py
+++ b/.agents/skills/lib_py/loop/runner.py
@@ -13,18 +13,24 @@ import glob
 import json
 import os
 import re
+import secrets
 import shlex
 import shutil
 import signal
 import sqlite3
 import subprocess
 import sys
+import tempfile
 import time
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Set, Tuple
 
 from lib_py.loop import checkpoint, eager, parser
 
+UNAVAILABLE_MARKER = "!!! CHANGE SET UNAVAILABLE !!!"  # diff_collect.sh MAM_DIFF_UNAVAILABLE_MARKER
+SELF_REVIEW_PROMPT = ("작업 완료 상태에 대해 스스로 검증(Self-Review)하여 결함이 없음을 확인하고 종결해주세요. "
+                      "리뷰 리포트 마지막에 단독 행으로 반드시 '[VERDICT: PASS]' 혹은 '[VERDICT: NOT PASS]' 태그를 명시해주세요.")
+
 # ANSI colors matching run_loop.sh
 _COLOR_INFO = "\033[1;34m[*]\033[0m"
 _COLOR_SUCCESS = "\033[1;32m[✓]\033[0m"
@@ -73,6 +79,14 @@ class LoopRunner:
         self.base_sha = ""
         self.base_source = "head"
         self.review_only = False
+        # Issue #21 item 5: review identity (active with --worktree/--base)
+        self.loop_id = "loop-" + time.strftime("%Y%m%dT%H%M%SZ", time.gmtime()) + "-" + secrets.token_hex(3)
+        self.review_isolation = "worktree"
+        self.remote_review = "refuse"
+        self._remote_recipients: Set[str] = set()
+        self._review_paths: List[str] = []
+        self._rounds: List[Dict[str, Any]] = []
+        self._accepted_round: Optional[Dict[str, Any]] = None
         self.created_jobs: List[str] = []
         self.failed_submit_jobs: Set[str] = set()
         self.current_plan = ""
@@ -111,6 +125,8 @@ class LoopRunner:
             "  --worktree <path>      Source worktree for diff/base/head (control plane stays here)",
             "  --base <ref>           Pin the review diff base (must be an ancestor of the source HEAD)",
             "  --review-only          Skip implementation; review <base>..HEAD (requires --base)",
+            "  --review-isolation <v> Review tree with --worktree/--base: worktree (default) or env",
+            "  --remote-review <v>    Remote reviewers with --worktree/--base: refuse (default) or diff-only",
         ]
         print("\n".join(lines))
 
@@ -195,6 +211,19 @@ class LoopRunner:
             elif arg == "--review-only":
                 self.review_only = True
                 i += 1
+            elif arg in ("--review-isolation", "--remote-review"):
+                if i + 1 >= len(args):
+                    self.print_usage()
+                    sys.exit(1)
+                allowed = ("worktree", "env") if arg == "--review-isolation" else ("refuse", "diff-only")
+                if args[i + 1] not in allowed:
+                    print(f"ERROR: {arg} must be one of: {', '.join(allowed)}.", file=sys.stderr)
+                    sys.exit(1)
+                if arg == "--review-isolation":
+                    self.review_isolation = args[i + 1]
+                else:
+                    self.remote_review = args[i + 1]
+                i += 2
             else:
                 print(f"Unknown option: {arg}")
                 self.print_usage()
@@ -234,6 +263,8 @@ class LoopRunner:
         if self.base_ref is not None:
             self.base_sha = self._resolve_base(self.base_ref)
             self.base_source = "cli"
+        if not self._context_active() and any(a in self.raw_argv for a in ("--review-isolation", "--remote-review")):
+            log_warn("--review-isolation/--remote-review only apply with --worktree or --base; ignored.")
 
     @staticmethod
     def _git(cwd: Path, *args: str) -> subprocess.CompletedProcess:
@@ -490,22 +521,34 @@ class LoopRunner:
             return matches[0]
         return None
 
-    def collect_changes_diff(self) -> str:
-        """Collect git diff since base commit."""
+    def collect_changes_diff(self, head_commit: Optional[str] = None) -> str:
+        """Collect git diff since base commit - of the live source tree, or,
+        with head_commit (review identity, B13), of base..head_commit."""
         # The collector is the control root's copy (never the worktree's
         # unreviewed one); the tree it diffs is the source root (Issue #21).
         diff_script = self.workspace_root / ".agents" / "skills" / "multi-agent-mux-loop" / "scripts" / "diff_collect.sh"
         src = str(self.worktree_root)
         if diff_script.exists():
             cmd = (f"source {shlex.quote(str(diff_script))} && "
-                   f"mam_collect_changes_diff {shlex.quote(src)} {shlex.quote(self.base_commit)}")
+                   f"mam_collect_changes_diff {shlex.quote(src)} {shlex.quote(self.base_commit)}"
+                   + (f" {shlex.quote(head_commit)}" if head_commit else ""))
             res = subprocess.run(["bash", "-c", cmd], capture_output=True, text=True, cwd=src)
             if res.returncode == 0:
                 return res.stdout
+            if head_commit:
+                # the snapshot's evidence is not replaced by anything else (B13):
+                # the collector's UNAVAILABLE output is passed on as it is
+                return res.stdout if UNAVAILABLE_MARKER in res.stdout else (
+                    f"{UNAVAILABLE_MARKER}\nreason: diff collector failed (rc {res.returncode})\n")
         # Fallback to direct git diff
         try:
-            cmd = ["git", "diff", self.base_commit] if self.base_commit else ["git", "diff", "HEAD"]
+            if head_commit:
+                cmd = ["git", "diff", self.base_commit, head_commit]
+            else:
+                cmd = ["git", "diff", self.base_commit] if self.base_commit else ["git", "diff", "HEAD"]
             res = subprocess.run(cmd, capture_output=True, text=True, cwd=src)
+            if head_commit and res.returncode != 0:
+                return f"{UNAVAILABLE_MARKER}\nreason: git diff failed (rc {res.returncode})\n"
             return res.stdout
         except Exception:
             return ""
@@ -518,9 +561,11 @@ class LoopRunner:
     def _context_active(self) -> bool:
         return self.worktree_given or self.base_ref is not None
 
-    def _worktree_context(self) -> str:
+    def _worktree_context(self, remote: bool = False, purpose: str = "work") -> str:
         """The source-root block put in front of every delegated prompt (D6);
-        empty without --worktree/--base, so prompts stay byte-identical."""
+        empty without --worktree/--base, so prompts stay byte-identical.
+        purpose: 'work' (creator/planner), 'review' (a verdict job, whose
+        target is the [리뷰 identity] path) or 'adjudication' (a re-hearing)."""
         if not self._context_active():
             return ""
         src = self.worktree_root
@@ -533,19 +578,38 @@ class LoopRunner:
             r = self._git(src, "rev-list", "--count", f"{base}..HEAD")
             if r.returncode == 0 and r.stdout.strip():
                 count = r.stdout.strip()
-        st = self._git(src, "status", "--porcelain")
+        st = self._git(src, "status", "--porcelain", "--untracked-files=all")
         dirty = "알 수 없음" if st.returncode != 0 else ("있음" if st.stdout.strip() else "없음")
+        # a remote reviewer (diff-only) cannot reach this host's paths (B6)
+        src_line = ("- 소스 경로: (오케스트레이터 호스트 전용 — 원격 리뷰어는 접근할 수 없음)\n" if remote
+                    else f"- 소스 경로: {src}\n")
+        if purpose == "review" and remote:
+            tail = "이 잡의 검증 대상은 아래 SHA 와 diff 다.\n\n"
+        elif purpose == "review" and self.review_isolation == "worktree":
+            # one verification target per prompt (loop B review B-2)
+            tail = ("리뷰 검증은 아래 [리뷰 identity] 의 검증 경로에서만 한다. 소스 경로는 creator 의 작업 트리이며 "
+                    "리뷰어는 거기서 실행·수정하지 않는다. 브리프와 리포트는 브리프에 적힌 절대경로를 그대로 쓴다.\n\n")
+        elif purpose == "review":
+            tail = ("리뷰 검증은 아래 [리뷰 identity] 의 검증 경로(= 위 소스 경로)에서 하며, 거기서 수정·커밋하지 않는다. "
+                    "브리프와 리포트는 브리프에 적힌 절대경로를 그대로 쓴다.\n\n")
+        elif purpose == "adjudication" and remote:
+            tail = "이 잡은 아래 반론의 재심이다. 판정 근거는 직전 리뷰에서 받은 SHA·diff 와 아래 반론 본문이다.\n\n"
+        elif remote:
+            tail = "이 잡의 검증 대상은 아래 SHA 와 diff 다.\n\n"
+        else:
+            tail = "이 잡의 코드 작업·검증 대상은 위 소스 경로다. 브리프와 리포트는 브리프에 적힌 절대경로를 그대로 쓴다.\n\n"
         return ("[워크트리 컨텍스트]\n"
-                f"- 소스 경로: {src}\n"
-                f"- 브랜치: {branch}\n"
+                + src_line
+                + f"- 브랜치: {branch}\n"
                 f"- base: {base or '(Phase 2 시작 시 HEAD 로 정해짐)'}  (출처: {origin})\n"
                 f"- head: {head}  (base..head 커밋: {count}개, 미커밋 변경: {dirty})\n"
                 f"- 제어 평면(잡 브리프·리포트·레지스트리): {self.workspace_root}\n"
-                "이 잡의 코드 작업·검증 대상은 위 소스 경로다. 브리프와 리포트는 브리프에 적힌 절대경로를 그대로 쓴다.\n\n")
+                + tail)
 
-    def _dispatch(self, agent_session: str, agent_type: str, role: str, prompt: str) -> Optional[str]:
+    def _dispatch(self, agent_session: str, agent_type: str, role: str, prompt: str,
+                  remote: bool = False, purpose: str = "work") -> Optional[str]:
         """delegate_job with the source-root context block in front of the prompt."""
-        return self.delegate_job(agent_session, agent_type, role, self._worktree_context() + prompt)
+        return self.delegate_job(agent_session, agent_type, role, self._worktree_context(remote, purpose) + prompt)
 
     def _change_set_state(self) -> str:
         """'empty' | 'present' | 'unknown' for the source root against base,
@@ -580,6 +644,204 @@ class LoopRunner:
             return False
         return True
 
+    # ------------------------------------------------------------------
+    # Issue #21 item 5: review identity
+    # ------------------------------------------------------------------
+    def _is_remote(self, name: str) -> bool:
+        return self.session_label(name).startswith("remote:")
+
+    def _verdict_recipients(self, state: Dict[str, Any]) -> List[str]:
+        """Who receives a verdict job - the same rule Phase 3 applies; the
+        creator when there is no reviewer (self-review)."""
+        if self.all_reviewers:
+            names = self.resolve_all_reviewers(state)
+        elif self.reviewer_list:
+            names = [r.strip() for r in self.reviewer_list.split(",") if r.strip()]
+        else:
+            names = []
+        return names or [self.creator]
+
+    def _check_remote_recipients(self, state: Dict[str, Any]) -> bool:
+        """B14: a verdict recipient must be able to reach the evidence recorded
+        for it. Remote reviewers cannot reach this host's review tree: refused
+        by default, admitted with the snapshot diff as their only evidence
+        under --remote-review diff-only. Checked before any delegation."""
+        remote = [n for n in self._verdict_recipients(state) if self._is_remote(n)]
+        self._remote_recipients = set(remote)
+        if remote and self.remote_review != "diff-only":
+            log_error(f"identity review needs the review tree on this host; remote reviewer(s) {' '.join(remote)} "
+                      "cannot verify it. Use local reviewers, or pass --remote-review diff-only")
+            return False
+        if remote:
+            log_warn(f"remote reviewer(s) {' '.join(remote)} admitted with the snapshot diff as their only "
+                     "evidence (--remote-review diff-only)")
+        return True
+
+    def _worktree_tree(self) -> Optional[str]:
+        """The source worktree's state as a tree, through a temporary index
+        (the real index, status and refs are untouched); None on failure.
+        A dirty submodule is a failure: the tree records only its gitlink, so
+        its uncommitted content would be neither reviewed nor pinned."""
+        dirty_subs = self._dirty_submodules()
+        if dirty_subs is None:
+            log_error(f"review snapshot: cannot check the submodules of {self.worktree_root}")
+            return None
+        if dirty_subs:
+            log_error(f"review snapshot: submodule(s) with uncommitted or untracked content: {' '.join(dirty_subs)}; "
+                      "the snapshot records only their commit - commit or clean them first")
+            return None
+        fd, idx = tempfile.mkstemp(prefix="mam-review-index-")
+        os.close(fd)
+        os.unlink(idx)
+        env = dict(os.environ, GIT_INDEX_FILE=idx)
+        try:
+            for step in (("read-tree", "HEAD"), ("add", "-A"), ("write-tree",)):
+                r = subprocess.run(["git", "-C", str(self.worktree_root), *step],
+                                   capture_output=True, text=True, env=env)
+                if r.returncode != 0:
+                    log_error(f"review snapshot: git {step[0]} failed in {self.worktree_root}: {r.stderr.strip()}")
+                    return None
+            return r.stdout.strip() or None
+        finally:
+            for p in (idx, idx + ".lock"):
+                try:
+                    os.unlink(p)
+                except OSError:
+                    pass
+
+    def _dirty_submodules(self) -> Optional[List[str]]:
+        """Checked-out submodules (recursively) with uncommitted or untracked
+        content; None when the check itself fails. Each submodule is asked
+        directly with --ignore-submodules=none and --untracked-files=all, so no
+        submodule.*.ignore, diff.ignoreSubmodules or status.showUntrackedFiles
+        setting can hide it."""
+        script = ('s=$(git status --porcelain --untracked-files=all --ignore-submodules=none) || exit 1; '
+                  '[ -z "$s" ] || printf "%s\\n" "$displaypath"')
+        r = self._git(self.worktree_root, "submodule", "foreach", "--recursive", "--quiet", script)
+        if r.returncode != 0:
+            return None
+        return [line for line in r.stdout.splitlines() if line.strip()]
+
+    def _gitlinks(self, treeish: str) -> Optional[Set[str]]:
+        r = self._git(self.worktree_root, "ls-tree", "-r", "-z", treeish)
+        if r.returncode != 0:
+            return None
+        links = set()
+        for ent in r.stdout.split("\0"):
+            meta, _, path = ent.partition("\t")
+            if meta.split(" ")[0] == "160000":
+                links.add(path)
+        return links
+
+    def _identity_now(self) -> Tuple[str, str]:
+        return (self._source_head(), self._worktree_tree() or "")
+
+    def _snapshot(self, n: int) -> Optional[Dict[str, Any]]:
+        """B3: pin the source state of review round n. Uncommitted and
+        untracked (not ignored) files go into a ref-less snapshot commit on
+        top of HEAD. An untracked nested repository cannot be pinned (only a
+        gitlink would be) and is refused."""
+        head = self._source_head()
+        tree = self._worktree_tree() if head else None
+        if not head or not tree:
+            log_error(f"cannot snapshot {self.worktree_root}; refusing to request reviews")
+            return None
+        new_links = self._gitlinks(tree)
+        old_links = self._gitlinks(head)
+        if new_links is None or old_links is None:
+            log_error("cannot list the snapshot's entries; refusing to request reviews")
+            return None
+        untracked_repos = sorted(new_links - old_links)
+        if untracked_repos:
+            log_error(f"untracked nested git repository {' '.join(untracked_repos)} cannot be pinned into the review "
+                      "snapshot; commit it, ignore it or move it out")
+            return None
+        dirty = tree != self._git(self.worktree_root, "rev-parse", "HEAD^{tree}").stdout.strip()
+        commit = head
+        if dirty:
+            ident = {"GIT_AUTHOR_NAME": "mam-loop", "GIT_AUTHOR_EMAIL": "mam-loop@localhost",
+                     "GIT_COMMITTER_NAME": "mam-loop", "GIT_COMMITTER_EMAIL": "mam-loop@localhost"}
+            c = subprocess.run(["git", "-C", str(self.worktree_root), "commit-tree", tree, "-p", head,
+                                "-m", f"mam review snapshot {self.loop_id} #{n}"],
+                               capture_output=True, text=True, env=dict(os.environ, **ident))
+            if c.returncode != 0 or not c.stdout.strip():
+                log_error(f"cannot commit the review snapshot: {c.stderr.strip()}")
+                return None
+            commit = c.stdout.strip()
+        return {"head": head, "tree": tree, "dirty": dirty, "review_commit": commit}
+
+    def _open_review_tree(self, snap: Dict[str, Any], n: int) -> Optional[str]:
+        path = Path(tempfile.gettempdir()) / "mam-review" / self.loop_id / str(n)
+        path.parent.mkdir(parents=True, exist_ok=True)
+        r = self._git(self.worktree_root, "worktree", "add", "--detach", str(path), snap["review_commit"])
+        if r.returncode != 0:
+            log_error(f"cannot open the review worktree {path}: {r.stderr.strip()}; refusing to request reviews "
+                      "(the isolation is not lowered silently)")
+            return None
+        self._review_paths.append(str(path))
+        return str(path)
+
+    def _close_review_tree(self, path: Optional[str]) -> None:
+        if not path or path not in self._review_paths:
+            return
+        r = self._git(self.worktree_root, "worktree", "remove", "--force", path)
+        if os.path.isdir(path):
+            shutil.rmtree(path, ignore_errors=True)
+        if r.returncode != 0:
+            # only when remove failed: prune drops this entry (its directory is
+            # gone now) - and any other stale one, which is why it is not routine
+            self._git(self.worktree_root, "worktree", "prune")
+        self._review_paths.remove(path)
+        try:
+            os.rmdir(os.path.dirname(path))  # TMPDIR/mam-review/<loop_id>, once empty
+        except OSError:
+            pass
+
+    def _close_all_review_trees(self) -> None:
+        for p in list(self._review_paths):
+            self._close_review_tree(p)
+
+    def _evidence(self, name: str) -> Dict[str, str]:
+        if name in self._remote_recipients:
+            return {"transport": "remote", "evidence": "diff-only", "isolation": "none (remote)"}
+        if self.review_isolation == "worktree":
+            return {"transport": "herdr", "evidence": "review-tree", "isolation": "worktree"}
+        return {"transport": "herdr", "evidence": "source-tree", "isolation": "env"}
+
+    def _identity_block(self, snap: Dict[str, Any], path: Optional[str], remote: bool) -> str:
+        lines = ["[리뷰 identity]",
+                 f"- loop_id: {self.loop_id}",
+                 f"- base: {self.base_commit}",
+                 f"- head: {snap['head']}",
+                 f"- tree: {snap['tree']}"]
+        if snap["dirty"]:
+            lines.append(f"- 미커밋 변경 포함 스냅샷 커밋: {snap['review_commit']}")
+        if remote:
+            lines.append("당신의 호스트에는 이 트리가 없다. 자기 체크아웃이나 다른 커밋에서 실행한 결과를 판정 근거로 "
+                         "삼지 말 것. 근거는 아래 diff 뿐이며, 리포트에 'diff 만으로 검토' 를 밝힐 것.")
+        else:
+            py = self.workspace_root / ".venv" / "bin" / "python"
+            py_cmd = str(py) if py.exists() else "python3"
+            lines.append(f"- 검증 경로: {path}")
+            lines.append("이 경로에서만 검증하고 커밋·브랜치 변경은 하지 말 것. 테스트는 "
+                         f"`PYTHONDONTWRITEBYTECODE=1 {py_cmd} -m pytest -p no:cacheprovider "
+                         "--basetemp=<검증 경로 밖의 임시 디렉터리>` 로 실행한다.")
+        return "\n".join(lines) + "\n\n"
+
+    def _record_round(self, n: int, snap: Dict[str, Any], path: Optional[str], jobs: Dict[str, str],
+                      verdicts: Dict[str, str], stale: bool) -> None:
+        self._rounds.append({
+            "iteration": n, "base_sha": self.base_commit, "head_sha": snap["head"], "tree_sha": snap["tree"],
+            "review_commit": snap["review_commit"], "isolation": self.review_isolation,
+            "review_path": path or "", "jobs": jobs, "verdicts": verdicts,
+            "reviewers": {r: self._evidence(r) for r in jobs}, "stale": stale,
+        })
+        self._record_checkpoint(iteration=n)
+
+    def _round_is_stale(self, snap: Dict[str, Any]) -> bool:
+        """B7: the source changed while the round was being reviewed."""
+        return self._identity_now() != (snap["head"], snap["tree"])
+
     def _record_checkpoint(self, iteration: int = 1, review_status: Optional[Dict[str, str]] = None) -> None:
         data = {
             "iteration": iteration,
@@ -592,12 +854,16 @@ class LoopRunner:
             "review_only": self.review_only,
             "worktree_root": str(self.worktree_root),
             "head_commit": self._source_head() if self._context_active() else "",
+            "loop_id": self.loop_id,
             "timestamp": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
         }
+        if self._context_active():
+            data["review_rounds"] = self._rounds
         checkpoint.save_checkpoint(self.checkpoint_file, data)
 
     def release_guard(self) -> None:
         """Release MAM_LOOP_MARKER and clean up freeze dir if owned."""
+        self._close_all_review_trees()
         marker = os.environ.get("MAM_LOOP_MARKER") or str(self.mam_dir / "loop-guard-active")
         if os.path.isfile(marker):
             try:
@@ -614,6 +880,12 @@ class LoopRunner:
                 shutil.rmtree(freeze_dir, ignore_errors=True)
 
     def run(self) -> int:
+        try:
+            return self._run_body()
+        finally:
+            self._close_all_review_trees()  # a return or exit mid-round leaves no review tree
+
+    def _run_body(self) -> int:
         self.parse_args()
 
         atexit.register(self.release_guard)
@@ -630,6 +902,7 @@ class LoopRunner:
         signal.signal(signal.SIGTERM, _handle_signal)
 
         log_info("Initializing multi-agent-mux-loop controller...")
+        log_info(f"Loop id: {self.loop_id}")
         log_info(f"Target Agent: {self.creator}")
         log_info(f"Task Goal: {self.task}")
 
@@ -672,6 +945,11 @@ class LoopRunner:
 
         log_info(f"Resolved Planner session: {planner_session}")
 
+        # Issue #21 item 5 (B14): every verdict recipient must reach the
+        # evidence recorded for it - checked before anything is delegated.
+        if self._context_active() and not self._check_remote_recipients(state):
+            return 1
+
         # =======================================================================
         # PHASE 1: PLANNING & DISCUSSIONS
         # =======================================================================
@@ -780,6 +1058,14 @@ class LoopRunner:
         rebut_total_budget = self.max_rebut * self.max_loop
 
         final_passed_reviewers: Dict[str, Tuple[str, Path]] = {}
+        identity = self._context_active()
+        # Identity mode: a creator self-review is a verdict like any other, so it
+        # takes the reviewer path - snapshot diff, evidence check, B10 re-check
+        # and sidecar (loop B review B-R2/B-R3). A NOT PASS re-reviews, as before.
+        self_review = identity and not reviewers
+        if self_review:
+            log_warn("No reviewers specified. Conducting Creator Self-Review...")
+            reviewers = [self.creator]
 
         for loop_count in range(1, self.max_loop + 1):
             log_info(f"Review Loop Iteration {loop_count}/{self.max_loop}...")
@@ -788,10 +1074,25 @@ class LoopRunner:
             if not self._change_set_allows_review():
                 return 1
 
+            # Issue #21 item 5: pin this round (B3), open its review tree (B4)
+            snap: Optional[Dict[str, Any]] = None
+            review_path: Optional[str] = None
+            if identity:
+                final_passed_reviewers.clear()  # B8: only this round's approvals can be promoted
+                snap = self._snapshot(loop_count)
+                if snap is None:
+                    return 1
+                if self.review_isolation == "worktree":
+                    review_path = self._open_review_tree(snap, loop_count)
+                    if review_path is None:
+                        return 1
+                else:
+                    review_path = str(self.worktree_root)
+
             if not reviewers:
                 # Creator Self-Review
                 log_warn("No reviewers specified. Conducting Creator Self-Review...")
-                sr_prompt = "작업 완료 상태에 대해 스스로 검증(Self-Review)하여 결함이 없음을 확인하고 종결해주세요. 리뷰 리포트 마지막에 단독 행으로 반드시 '[VERDICT: PASS]' 혹은 '[VERDICT: NOT PASS]' 태그를 명시해주세요."
+                sr_prompt = SELF_REVIEW_PROMPT
                 sr_jid = self._dispatch(self.creator, creator_type, "Reviewer", sr_prompt)
                 if not sr_jid:
                     log_error("Failed to register Self-Review job.")
@@ -809,20 +1110,36 @@ class LoopRunner:
                     continue
 
             log_info(f"Active reviewers: {' '.join(reviewers)}")
-            changes_diff = self.collect_changes_diff()
+            # B13: in identity mode the reviewers' diff is the snapshot's, so the
+            # evidence they get is exactly what the verdict is bound to.
+            changes_diff = self.collect_changes_diff(snap["review_commit"] if identity else None)
+            diff_only = [r for r in reviewers if r in self._remote_recipients]
+            if identity and diff_only and ("!!! DIFF TRUNCATED !!!" in changes_diff
+                                           or "!!! CHANGE SET UNAVAILABLE !!!" in changes_diff):
+                log_error(f"the snapshot diff is truncated/unavailable; diff-only remote reviewer(s) "
+                          f"{' '.join(diff_only)} would have no evidence")
+                return 1
 
             review_jobs: List[Tuple[str, str]] = []  # (rev, job_id)
             for rev in reviewers:
                 log_info(f"Requesting code review from Reviewer '{rev}'...")
                 r_type = self.resolve_agent_type(rev, state)
-                r_prompt = f"다음 구현 사항(작업 목표: {self.task}) 및 누적 변경분(git diff)에 대해 린트, 동작성, 유실 등의 관점에서 교차 코드 리뷰를 수행해주세요. 확인 후 최종 Verdict로 '[VERDICT: PASS]' 혹은 '[VERDICT: NOT PASS]' 태그를 리뷰 리포트 마지막에 단독 행으로 명시적으로 작성해주세요. 만약 단순 버그 수정으로는 부족하고 설계 변경/재작업 수준의 재계획이 필요하다고 판단되면, 리포트 아무 곳에나 단독 행으로 '[ESCALATE: PLANNER]' 태그도 함께 남겨주세요. 변경분:\n{changes_diff}"
-                r_jid = self._dispatch(rev, r_type, "Reviewer", r_prompt)
+                if self_review:
+                    r_prompt = f"{SELF_REVIEW_PROMPT} 변경분:\n{changes_diff}"
+                else:
+                    r_prompt = f"다음 구현 사항(작업 목표: {self.task}) 및 누적 변경분(git diff)에 대해 린트, 동작성, 유실 등의 관점에서 교차 코드 리뷰를 수행해주세요. 확인 후 최종 Verdict로 '[VERDICT: PASS]' 혹은 '[VERDICT: NOT PASS]' 태그를 리뷰 리포트 마지막에 단독 행으로 명시적으로 작성해주세요. 만약 단순 버그 수정으로는 부족하고 설계 변경/재작업 수준의 재계획이 필요하다고 판단되면, 리포트 아무 곳에나 단독 행으로 '[ESCALATE: PLANNER]' 태그도 함께 남겨주세요. 변경분:\n{changes_diff}"
+                r_remote = rev in self._remote_recipients
+                if identity:
+                    r_prompt = self._identity_block(snap, review_path, r_remote) + r_prompt
+                r_jid = self._dispatch(rev, r_type, "Reviewer", r_prompt, remote=r_remote,
+                                       purpose="review" if identity else "work")
                 if not r_jid:
                     log_error(f"Failed to register review job for '{rev}'.")
                     return 1
                 review_jobs.append((rev, r_jid))
 
             all_passed = True
+            round_verdicts: Dict[str, str] = {}
             fail_revs: List[str] = []
             fail_reports: List[Path] = []
             feedback_parts: List[str] = []
@@ -830,12 +1147,14 @@ class LoopRunner:
             for rev, jid in review_jobs:
                 if not self.wait_for_job(jid):
                     log_warn(f"Reviewer '{rev}' job crashed.")
+                    round_verdicts[rev] = "crashed"
                     all_passed = False
                     continue
 
                 r_file = self.find_report(jid)
                 if not r_file or not r_file.exists():
                     log_warn(f"Reviewer '{rev}' report not found. Counting as NOT PASS.")
+                    round_verdicts[rev] = "missing"
                     all_passed = False
                     continue
 
@@ -844,18 +1163,44 @@ class LoopRunner:
 
                 if verdict != "PASS":
                     log_warn(f"Reviewer '{rev}': NOT PASS")
+                    round_verdicts[rev] = "NOT PASS"
                     all_passed = False
                     fail_revs.append(rev)
                     fail_reports.append(r_file)
                     feedback_parts.append(f"\n--- Reviewer ({rev}) Feedback ---\n{content}")
                 else:
                     log_success(f"Reviewer '{rev}': PASS")
+                    round_verdicts[rev] = "PASS"
                     final_passed_reviewers[rev] = (jid, r_file)
 
+            if identity:
+                # B7: judge the round against the source as it is now
+                if self.review_isolation == "worktree":
+                    self._close_review_tree(review_path)
+                stale = self._round_is_stale(snap)
+                self._record_round(loop_count, snap, review_path, dict(review_jobs), round_verdicts, stale)
+                if stale:
+                    final_passed_reviewers.clear()
+                    log_warn(f"source changed during review (head {snap['head'][:12]}, tree {snap['tree'][:12]}); "
+                             "approvals discarded, re-reviewing")
+                    if loop_count == self.max_loop:
+                        log_error("the source changed during review in the last iteration; no approval to accept")
+                        return 1
+                    continue
+
             if all_passed:
+                if identity:
+                    self._accepted_round = self._rounds[-1]
                 log_success("All reviewers issued [VERDICT: PASS]. Loop completed successfully.")
                 break
 
+            if self_review:
+                log_warn("Self-Review NOT PASS.")
+                if loop_count == self.max_loop:
+                    log_error("Reached max loop count. Self-review loop aborted with failures.")
+                    return 1
+                continue
+
             if loop_count == self.max_loop:
                 log_error(f"Reached max loop count ({self.max_loop}). Review loop aborted with failures.")
                 return 1
@@ -910,7 +1255,8 @@ class LoopRunner:
                         log_info(f"Re-adjudication: returning rebuttal to Reviewer '{rt}'...")
                         rt_type = self.resolve_agent_type(rt, state)
                         adj_prompt = f"작업자(Creator)가 귀하의 리뷰 지적 중 일부를 타당하지 않다고 판단하여 반론을 제기했습니다. 반론을 검토하고 재심(re-adjudication)하십시오. 반론이 타당하여 귀하의 지적을 철회한다면 리포트 마지막에 단독 행으로 '[ADJUDICATION: SUSTAINED]' 를, 반론이 타당하지 않아 지적을 유지한다면 '[ADJUDICATION: OVERRULED]' 를 명시하십시오. 반론 내용:\n{rebuttal_text}"
-                        adj_jid = self._dispatch(rt, rt_type, "Reviewer", adj_prompt)
+                        adj_jid = self._dispatch(rt, rt_type, "Reviewer", adj_prompt,
+                                                 remote=rt in self._remote_recipients, purpose="adjudication")
                         if not adj_jid or not self.wait_for_job(adj_jid):
                             log_warn(f"Re-adjudication job for '{rt}' failed; objection stands.")
                             overruled_revs.append(rt)
@@ -956,6 +1302,13 @@ class LoopRunner:
             tmp_plan.write_text(self.current_plan, encoding="utf-8")
             tmp_plan.replace(plan_dest_dir / f"plan-{self.plan_job_id}.md")
 
+        if final_passed_reviewers and identity and self._accepted_round:
+            # B10: an approval is promoted only for the source it approved
+            acc = self._accepted_round
+            if self._identity_now() != (acc["head_sha"], acc["tree_sha"]):
+                log_error("source changed after approval; not promoting")
+                return 1
+
         if final_passed_reviewers:
             log_info("Promoting final review reports to durable location...")
             for rev, (jid, rep_file) in final_passed_reviewers.items():
@@ -965,6 +1318,17 @@ class LoopRunner:
                 tmp_dest = dest_dir / f"report-{jid}.md.tmp"
                 shutil.copyfile(rep_file, tmp_dest)
                 tmp_dest.replace(dest_file)
+                if identity and self._accepted_round:
+                    acc = self._accepted_round
+                    ev = self._evidence(rev)
+                    sidecar = {"loop_id": self.loop_id, "base_sha": acc["base_sha"], "head_sha": acc["head_sha"],
+                               "tree_sha": acc["tree_sha"], "review_commit": acc["review_commit"],
+                               "reviewer": rev, "job_id": jid, "verdict": "PASS", **ev,
+                               "verified_at": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())}
+                    tmp_side = dest_dir / f"report-{jid}.identity.json.tmp"
+                    tmp_side.write_text(json.dumps(sidecar, indent=2), encoding="utf-8")
+                    tmp_side.replace(dest_dir / f"report-{jid}.identity.json")
+                    log_info(f"  {rev}: report-{jid}.md (evidence: {ev['evidence']})")
 
         # Cleanup
         if self.cleanup:
diff --git a/.agents/skills/lib_py/worktree.py b/.agents/skills/lib_py/worktree.py
new file mode 100644
index 0000000..8493dad
--- /dev/null
+++ b/.agents/skills/lib_py/worktree.py
@@ -0,0 +1,239 @@
+"""Decisions behind the worktree helpers (Issue #21 phase 2, item 4).
+
+worktree_prepare.sh / worktree_remove.sh keep the orchestration in shell and
+ask this module the questions that need parsing: is a path a linked worktree
+of the control root (and is it locked), which session rows ran under it, which
+of their jobs are still open, and whether its submodules hold anything a
+forced removal would destroy. Standard library only.
+
+CLI (JSON on stdout, rc 0; the session state comes from MAM_STATE_JSON):
+  python -m lib_py.worktree is-linked <main> <path>
+  python -m lib_py.worktree is-locked <main> <path>
+  python -m lib_py.worktree rows <path>
+  python -m lib_py.worktree open-jobs <path> [--exclude id,id]
+  python -m lib_py.worktree submodules <worktree>
+"""
+
+from __future__ import annotations
+
+import glob
+import json
+import os
+import subprocess
+import sys
+from typing import Dict, Iterable, List, Optional
+
+OPEN_STATUSES = ("pending", "running")
+# The commits a forced removal would lose (review R6): reachable from HEAD or
+# from any local ref - branches, tags, notes, ... - except refs/stash (the
+# stash check covers it, reflog included), and from no remote-tracking ref.
+UNPUSHED_REVS = ("HEAD", "--exclude=refs/stash", "--all", "--not", "--remotes")
+
+
+def _git(cwd: str, *args: str) -> subprocess.CompletedProcess:
+    return subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, text=True)
+
+
+def _real(p: str) -> str:
+    return os.path.realpath(p)
+
+
+def worktree_blocks(main: str) -> List[Dict[str, object]]:
+    """`git worktree list --porcelain`, one dict per worktree."""
+    res = _git(main, "worktree", "list", "--porcelain")
+    blocks: List[Dict[str, object]] = []
+    cur: Dict[str, object] = {}
+    for line in res.stdout.splitlines():
+        if not line.strip():
+            if cur:
+                blocks.append(cur)
+                cur = {}
+            continue
+        key, _, val = line.partition(" ")
+        cur[key] = val if val else True
+    if cur:
+        blocks.append(cur)
+    return blocks
+
+
+def _block(main: str, path: str) -> Optional[Dict[str, object]]:
+    rp, rm = _real(path), _real(main)
+    if rp == rm:
+        return None
+    for b in worktree_blocks(main):
+        w = b.get("worktree")
+        if isinstance(w, str) and _real(w) == rp:
+            return b
+    return None
+
+
+def is_linked_worktree(main: str, path: str) -> bool:
+    return _block(main, path) is not None
+
+
+def is_locked(main: str, path: str) -> bool:
+    b = _block(main, path)
+    return bool(b and "locked" in b)
+
+
+def rows_under(state: dict, path: str) -> List[dict]:
+    """Session rows whose pane.cwd is `path` or below it."""
+    rp = _real(path).rstrip(os.sep)
+    out = []
+    for s in state.get("herdr_sessions") or []:
+        cwd = (s.get("pane") or {}).get("cwd") or ""
+        if not cwd:
+            continue
+        rc = _real(cwd)
+        if rc == rp or rc.startswith(rp + os.sep):
+            out.append(s)
+    return out
+
+
+def registry_dirs(rows: Iterable[dict], env=None) -> List[str]:
+    env = os.environ if env is None else env
+    cands = [env.get("MAM_JOBS_DIR") or ""]
+    if env.get("WORKSPACE_ROOT"):
+        cands.append(os.path.join(env["WORKSPACE_ROOT"], ".mam", "jobs"))
+    cands += [((s.get("control_plane") or {}).get("mam_jobs_dir") or "") for s in rows]
+    seen, out = set(), []
+    for c in cands:
+        if c and os.path.isdir(c) and _real(c) not in seen:
+            seen.add(_real(c))
+            out.append(c)
+    return out
+
+
+def open_jobs(rows: List[dict], dirs: Iterable[str], exclude_ids: Iterable[str] = ()) -> List[dict]:
+    """Pending/running jobs addressed to one of the rows (herdr:<name>)."""
+    names = {f"herdr:{s.get('name')}" for s in rows if s.get("name")}
+    skip = {j for j in exclude_ids if j}
+    out, seen = [], set()
+    for d in dirs:
+        for p in sorted(glob.glob(os.path.join(d, "*.json"))):
+            try:
+                with open(p, encoding="utf-8") as fh:
+                    rec = json.load(fh)
+            except (OSError, ValueError):
+                continue
+            jid = rec.get("job_id") if isinstance(rec, dict) else None
+            if not jid or jid in skip or jid in seen:
+                continue
+            if rec.get("agent_session") in names and rec.get("status") in OPEN_STATUSES:
+                seen.add(jid)
+                out.append({"job_id": jid, "agent_session": rec.get("agent_session"),
+                            "status": rec.get("status"), "registry_dir": d})
+    return out
+
+
+def _module_gitdirs(root: str):
+    """Repositories under a worktree's modules/ (nested ones included), and
+    directories that look like partial repositories (a repository marker but
+    not a checkable repository)."""
+    repos: List[str] = []
+    partial: List[str] = []
+    if not os.path.isdir(root):
+        return repos, partial
+    for dirpath, dirnames, filenames in os.walk(root):
+        if dirpath == root:
+            continue
+        if "HEAD" in filenames and "objects" in dirnames:
+            repos.append(dirpath)
+            dirnames[:] = [d for d in dirnames if d == "modules"]  # nested submodules only
+        elif "HEAD" in filenames or "objects" in dirnames or "refs" in dirnames:
+            partial.append(dirpath)
+            dirnames[:] = []
+    return repos, partial
+
+
+def submodule_findings(wt: str) -> Dict[str, object]:
+    """trace: the worktree git dir holds modules/ (git then refuses a plain
+    `worktree remove`, even after a failed init); dirty / unpushed / stashes:
+    what a forced removal would destroy - it deletes the worktree's own
+    submodule repositories. The unpushed check covers HEAD and every local
+    ref except refs/stash (UNPUSHED_REVS): a submodule is on a detached HEAD
+    after `submodule update`, so its commits may be on no branch, and a commit
+    kept only by a tag (review R6) or a note is lost with the repository just
+    the same. Stashes live in refs/stash and its reflog; the stash check owns
+    them. --untracked-files=all: `status.showUntrackedFiles=no` in a
+    submodule would otherwise hide its untracked files from the check (review
+    R1), and display settings must not decide what a forced removal may
+    delete."""
+    gd = _git(wt, "rev-parse", "--absolute-git-dir")
+    if gd.returncode != 0 or not gd.stdout.strip():
+        return {"trace": False, "dirty": "", "unpushed": "", "stashes": "",
+                "error": gd.stderr.strip() or "rev-parse failed"}
+    res: Dict[str, object] = {"trace": os.path.isdir(os.path.join(gd.stdout.strip(), "modules")),
+                              "dirty": "", "unpushed": "", "stashes": "", "error": ""}
+    if not res["trace"]:
+        return res
+    checks = (("dirty", "git status --porcelain --untracked-files=all"),
+              ("unpushed", "git log --oneline " + " ".join(UNPUSHED_REVS)),
+              ("stashes", "git stash list"))
+    errors = []
+    for key, cmd in checks:
+        r = _git(wt, "submodule", "foreach", "--recursive", "--quiet", cmd)
+        if r.returncode != 0:
+            errors.append(r.stderr.strip() or f"{key} check failed (rc {r.returncode})")
+        else:
+            res[key] = r.stdout.strip()
+    # Every repository under modules/, whether its checkout is initialised or
+    # not (review R5): `submodule foreach` visits initialised checkouts only,
+    # but a deinit'd submodule keeps its repository - stash included - here,
+    # and the forced removal deletes it. A repository that cannot be checked
+    # is an error, never assumed safe.
+    repos, partial = _module_gitdirs(os.path.join(gd.stdout.strip(), "modules"))
+    extra: Dict[str, List[str]] = {"unpushed": [], "stashes": []}
+    for d in repos:
+        git = ["git", "--git-dir", d, "--work-tree", d]
+        u = subprocess.run(git + ["log", "--oneline", *UNPUSHED_REVS],
+                           capture_output=True, text=True)
+        if u.returncode != 0:
+            errors.append(f"{d}: cannot list its unpushed commits ({u.stderr.strip() or u.returncode})")
+        elif u.stdout.strip():
+            extra["unpushed"] += [f"{d}: {line}" for line in u.stdout.strip().splitlines()]
+        s = subprocess.run(git + ["for-each-ref", "--format=%(refname)", "refs/stash"], capture_output=True, text=True)
+        if s.returncode != 0:
+            errors.append(f"{d}: cannot read refs/stash ({s.stderr.strip() or s.returncode})")
+        elif s.stdout.strip():
+            g = subprocess.run(git + ["log", "-g", "--format=%gd %s", "refs/stash"], capture_output=True, text=True)
+            lines = g.stdout.strip().splitlines() if g.returncode == 0 and g.stdout.strip() else ["refs/stash"]
+            extra["stashes"] += [f"{d}: {line}" for line in lines]
+    errors += [f"{p}: looks like a partial repository and cannot be checked" for p in partial]
+    for key, lines in extra.items():
+        if lines:
+            res[key] = "\n".join(x for x in [str(res[key]).strip(), *lines] if x)
+    res["error"] = "; ".join(errors)
+    return res
+
+
+def _state() -> dict:
+    try:
+        return json.loads(os.environ.get("MAM_STATE_JSON") or "{}") or {}
+    except ValueError:
+        return {}
+
+
+def main(argv=None) -> int:
+    argv = list(sys.argv[1:] if argv is None else argv)
+    cmd = argv[0] if argv else ""
+    if cmd == "is-linked" and len(argv) == 3:
+        print(json.dumps(is_linked_worktree(argv[1], argv[2])))
+    elif cmd == "is-locked" and len(argv) == 3:
+        print(json.dumps(is_locked(argv[1], argv[2])))
+    elif cmd == "rows" and len(argv) == 2:
+        print(json.dumps(rows_under(_state(), argv[1])))
+    elif cmd == "open-jobs" and len(argv) in (2, 4) and (len(argv) == 2 or argv[2] == "--exclude"):
+        rows = rows_under(_state(), argv[1])
+        exclude = argv[3].replace(",", " ").split() if len(argv) == 4 else []
+        print(json.dumps(open_jobs(rows, registry_dirs(rows), exclude)))
+    elif cmd == "submodules" and len(argv) == 2:
+        print(json.dumps(submodule_findings(argv[1])))
+    else:
+        print(__doc__, file=sys.stderr)
+        return 2
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/.agents/skills/multi-agent-mux-create/SKILL.md b/.agents/skills/multi-agent-mux-create/SKILL.md
index fc5628c..b63c35f 100644
--- a/.agents/skills/multi-agent-mux-create/SKILL.md
+++ b/.agents/skills/multi-agent-mux-create/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-create
 description: "Create a new agent session (claude, antigravity/agy) in a dedicated herdr session for context-preserving long-running work. Always creates a herdr session — never backgrounds with nohup/disown. Writes the new session to .mam/agent-sessions.yaml. Use when you want to start a fresh agent (no prior UUID) for a new project workspace."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
@@ -233,6 +233,24 @@ bash .agents/skills/multi-agent-mux-create/scripts/create_session.sh \
 
 The script handles the YAML append, pane capture, and the `last_visible_status` placeholder.
 
+## Issue worktrees: `worktree_prepare.sh` (Issue #21 item 4)
+
+Run from the control root's skills tree (lib.sh's `WORKSPACE_ROOT` = the main checkout that owns `.mam`):
+
+```bash
+bash .agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh \
+  --path ../multi-agent-mux-wt/issue-42 --branch fix/issue-42 [--base <ref>] [--submodules] \
+  [--creator-agent claude [--session <name>] [--role creator] [--herdr-session <s>] [--herdr-workspace <w>] [--onboard]] [--dry-run]
+```
+
+- Creates the worktree next to the control root (a path **inside** it is refused), idempotently; creates the worktree's **own** `.venv` from the control root's `.venv/bin/python` and installs the delegate-job skill's `requirements.txt` (paho-mqtt, PyYAML - what `deploy/install.sh` installs) plus `requirements.txt` / `requirements-dev.txt` when present (needs network access to the package index; a failed install removes the half-made venv and exits 1 so a re-run starts over; never a link - a leftover link is refused with exit 1; no control-root interpreter is a warning and `VENV=skipped`); adds `/.venv` and `.pytest_cache/` to the shared `info/exclude` (a linked worktree's exclude file is `$GIT_COMMON_DIR/info/exclude`, so it applies to the main checkout too).
+- **Submodules are opt-in** (`--submodules`). Initialisation writes `submodule.<name>.url` to the shared `.git/config`, and any attempt - even a failed one - leaves a `modules/` directory that makes a plain `git worktree remove` refuse. A failed `--submodules` undoes only what that attempt created - new submodule checkouts are deinitialised before their git dirs are deleted, so the worktree stays a usable checkout; submodules initialised earlier and pre-existing `submodule.*` values are kept - and exits 1; re-run without `--submodules` to finish.
+- `--creator-agent` creates the creator through this skill with the control root's binding and `MAM_NO_SUBSCRIBER_DAEMON=1`; the row's `pane.cwd` is the worktree.
+- Prints `BASE=<sha>`: record it **before** delegating the implementation, then review with `run_loop.sh --worktree <WT> --base "$BASE" --review-only`.
+- A submodule path that is not initialised yet but already holds files refuses `--submodules` up front (exit 3, nothing changed): the clone would fail on it and a rollback could not tell those files from its own.
+- Exit codes: 0 ok, 1 git / submodule / create failure, 2 usage or path rule, 3 refused to protect existing content (nothing changed).
+- create itself: a control-plane binding that cannot be computed is refused (exit 2) for a `--workspace` other than the control root and warned about for the control root; the immediate reconcile and the watchdog run the control root's code.
+
 ## Pitfalls
 
 - **Don't use `nohup`/`disown`/`setsid` for the agent itself** — those background the agent outside herdr. The whole point of this skill is *the herdr session is the supervisor*. `nohup` is OK only for *launching the wrapper* (which itself creates the herdr session via `herdr new-session -d`).
diff --git a/.agents/skills/multi-agent-mux-create/scripts/create_session.sh b/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
index de2e809..c8f8d81 100755
--- a/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
+++ b/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
@@ -208,7 +208,20 @@ fi
 # lib.sh splits those flags unquoted (and, with env flags, never reuses an
 # idle pane - `agent start --` would pass them to the agent as arguments), so a
 # binding with whitespace that would have to be forwarded is refused.
-CP_JSON="$(mam_control_plane_json "$WORKSPACE" 2>/dev/null || true)"
+# A binding that cannot be computed is not swallowed (Issue #21 phase 2, A12):
+# for a worktree (--workspace != control root) that would silently put the
+# session on the wrong control plane, so refuse; for the control root itself
+# warn and record the row without control_plane.
+cp_rc=0
+CP_JSON="$(mam_control_plane_json "$WORKSPACE")" || cp_rc=$?
+if [ "$cp_rc" -ne 0 ] || [ -z "$CP_JSON" ]; then
+  if [ "$(mam_abs_workspace "$WORKSPACE")" != "$(mam_abs_workspace "$WORKSPACE_ROOT")" ]; then
+    echo "ERROR: cannot compute the control-plane binding (rc=$cp_rc) for --workspace '$WORKSPACE' (control root '$WORKSPACE_ROOT'); refusing to start a session that would use the wrong control plane" >&2
+    exit 2
+  fi
+  echo "WARNING: control-plane binding unavailable (rc=$cp_rc); the row is recorded without control_plane" >&2
+  CP_JSON=""
+fi
 CP_PREFIX=""
 if [ -n "$CP_JSON" ]; then
   cp_rc=0
@@ -563,8 +576,10 @@ Task: $SUBMIT_JOB_PROMPT"
   
   delegate_publish_event "$DELEGATE_JOB_ID" started "multi-agent-mux session created and instructions injected" "$DELEGATE_JOB_TOKEN" "$DELEGATE_JOB_ATTEMPT"
   # Trigger immediate priority reconcile cycle asynchronously
-  (bash "$WORKSPACE/.agents/skills/multi-agent-mux-monitor/scripts/reconcile.sh" --once >/dev/null 2>&1 &) || true
-  WD_PID=$(start_watchdog "$DELEGATE_JOB_ID" "$WORKSPACE")
+  # Issue #21 phase 2 (A8): the control root's reconcile/watchdog, never the
+  # (unreviewed) copy in a worktree --workspace; identical paths by default.
+  (bash "$SKILL_DIR/multi-agent-mux-monitor/scripts/reconcile.sh" --once >/dev/null 2>&1 &) || true
+  WD_PID=$(start_watchdog "$DELEGATE_JOB_ID" "$WORKSPACE_ROOT")
   echo "watchdog PID: $WD_PID"
 fi
 # Clear cleanup trap as registration was fully successful
diff --git a/.agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh b/.agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh
new file mode 100755
index 0000000..fd16030
--- /dev/null
+++ b/.agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh
@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+# worktree_prepare.sh — prepare an issue worktree next to the control root
+# (Issue #21 item 4). Run it from the control root's skills tree: the control
+# root is lib.sh's WORKSPACE_ROOT, the main checkout that owns .mam.
+#
+# Usage:
+#   worktree_prepare.sh --path <WT> --branch <name> [--base <ref>] [--submodules]
+#                       [--creator-agent <agent> [--session <name>] [--role <role>]
+#                        [--herdr-session <s>] [--herdr-workspace <w>] [--onboard]] [--dry-run]
+#
+# Steps: git worktree (idempotent) -> the worktree's own .venv (control root
+# interpreter + requirements*.txt) -> /.venv and .pytest_cache/ in the shared info/exclude -> submodules only with
+# --submodules (a failed init is rolled back: it would otherwise leave a
+# modules/ trace that makes a plain `git worktree remove` refuse) -> optional
+# creator session registered in the control root's .mam -> summary with BASE=.
+#
+# Exit codes: 0 ok, 1 git / submodule / create failure, 2 usage or path rule,
+# 3 refused to protect existing content (nothing changed).
+set -euo pipefail
+
+_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$(cd "$_script_dir/../.." && pwd)/lib.sh"
+
+usage() {
+  sed -n '2,15p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+}
+
+WT=""; BRANCH=""; BASE_REF=""; SUBMODULES=0; DRY_RUN=0
+CREATOR_AGENT=""; SESSION=""; ROLE="creator"; HS=""; HW=""; ONBOARD=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --path) WT="${2:-}"; shift 2 ;;
+    --branch) BRANCH="${2:-}"; shift 2 ;;
+    --base) BASE_REF="${2:-}"; shift 2 ;;
+    --submodules) SUBMODULES=1; shift ;;
+    --creator-agent) CREATOR_AGENT="${2:-}"; shift 2 ;;
+    --session) SESSION="${2:-}"; shift 2 ;;
+    --role) ROLE="${2:-}"; shift 2 ;;
+    --herdr-session) HS="${2:-}"; shift 2 ;;
+    --herdr-workspace) HW="${2:-}"; shift 2 ;;
+    --onboard) ONBOARD=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "ERROR: unknown arg: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+[ -n "$WT" ] && [ -n "$BRANCH" ] || { echo "ERROR: --path and --branch are required" >&2; usage >&2; exit 2; }
+
+MAIN="$(mam_abs_workspace "$WORKSPACE_ROOT")"
+top="$(git -C "$MAIN" rev-parse --show-toplevel 2>/dev/null || true)"
+if [ -z "$top" ] || [ "$(mam_abs_workspace "$top")" != "$MAIN" ]; then
+  echo "ERROR: the control root '$MAIN' (WORKSPACE_ROOT) is not the top of a git checkout" >&2
+  exit 2
+fi
+
+case "$WT" in /*) ;; *) WT="$PWD/$WT" ;; esac
+WT="${WT%/}"
+if [ -d "$WT" ]; then
+  WT="$(mam_abs_workspace "$WT")"
+elif [ -d "$(dirname "$WT")" ]; then
+  WT="$(mam_abs_workspace "$(dirname "$WT")")/$(basename "$WT")"
+fi
+case "$WT/" in
+  "$MAIN"/*)
+    echo "ERROR: '$WT' is inside the control root '$MAIN'; a worktree there shows up as untracked files in the main tree. Put it next to the control root instead." >&2
+    exit 2 ;;
+esac
+
+PY="$(_delegate_py_bin)"
+wt_py() { PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$PY" -m lib_py.worktree "$@"; }
+
+if [ -z "$SESSION" ] && [ -n "$CREATOR_AGENT" ]; then
+  slug="$(printf '%s' "$BRANCH" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9-' '-' | sed -E 's/-+/-/g; s/^-//; s/-$//')"
+  SESSION="creator-${CREATOR_AGENT}-${slug}"
+  SESSION="${SESSION:0:60}"
+  SESSION="${SESSION%-}"
+fi
+
+if [ "$DRY_RUN" = "1" ]; then
+  echo "[dry-run] control root: $MAIN"
+  echo "[dry-run] worktree: $WT (branch $BRANCH${BASE_REF:+, base $BASE_REF})"
+  echo "[dry-run] own .venv (from $MAIN/.venv/bin/python + the delegate-job requirements.txt and requirements*.txt) and shared info/exclude entries; submodules: $([ "$SUBMODULES" = 1 ] && echo init || echo skipped)"
+  [ -n "$CREATOR_AGENT" ] && echo "[dry-run] creator: $CREATOR_AGENT as $SESSION (role $ROLE)"
+  exit 0
+fi
+
+# 1. The worktree (idempotent).
+if [ "$(wt_py is-linked "$MAIN" "$WT")" = "true" ]; then
+  cur="$(git -C "$WT" branch --show-current)"
+  if [ "$cur" != "$BRANCH" ]; then
+    echo "ERROR: '$WT' is already a worktree, on branch '${cur:-(detached)}', not '$BRANCH'" >&2
+    exit 2
+  fi
+  echo "worktree already prepared: $WT ($BRANCH)"
+else
+  if [ -e "$WT" ] && [ -n "$(ls -A "$WT" 2>/dev/null)" ]; then
+    echo "ERROR: '$WT' exists and is not a worktree of '$MAIN'" >&2
+    exit 2
+  fi
+  mkdir -p "$(dirname "$WT")"
+  if git -C "$MAIN" show-ref --verify --quiet "refs/heads/$BRANCH"; then
+    if [ -n "$BASE_REF" ]; then
+      echo "WARNING: branch '$BRANCH' already exists; --base '$BASE_REF' is ignored (the worktree checks the branch out as it is)" >&2
+    fi
+    git -C "$MAIN" worktree add "$WT" "$BRANCH" || exit 1
+  else
+    git -C "$MAIN" worktree add -b "$BRANCH" "$WT" "${BASE_REF:-HEAD}" || exit 1
+  fi
+fi
+
+# 2. .venv: the worktree's own environment, created with the control root's
+#    interpreter and its requirements files, never a link (review R3: a link
+#    aliases the control root's environment, and a `git add -A` in the
+#    worktree once committed the link itself - see .gitignore's managed
+#    block). Idempotent: an existing usable venv is kept.
+VENV_STATE="skipped"
+if [ -L "$WT/.venv" ]; then
+  echo "ERROR: '$WT/.venv' is a symbolic link; a worktree needs its own venv - remove the link and re-run" >&2
+  exit 1
+elif [ -x "$WT/.venv/bin/python" ]; then
+  VENV_STATE="kept"
+elif [ -x "$MAIN/.venv/bin/python" ]; then
+  "$MAIN/.venv/bin/python" -m venv "$WT/.venv" || { echo "ERROR: could not create '$WT/.venv'" >&2; exit 1; }
+  req=()
+  # the same files deploy/install.sh installs into the control root's venv
+  for f in .agents/skills/multi-agent-mux-delegate-job/requirements.txt requirements.txt requirements-dev.txt; do
+    [ -f "$WT/$f" ] && req+=(-r "$WT/$f")
+  done
+  if [ "${#req[@]}" -gt 0 ]; then
+    if ! "$WT/.venv/bin/python" -m pip install -q "${req[@]}"; then
+      rm -rf "$WT/.venv"  # review D1: a half-made venv would be reported as kept by the next run
+      echo "ERROR: pip install into '$WT/.venv' failed (network to the package index is needed); the venv was removed, the worktree is kept - fix it and re-run" >&2
+      exit 1
+    fi
+  fi
+  VENV_STATE="created"
+else
+  echo "WARNING: '$MAIN/.venv/bin/python' not found; no venv created in the worktree" >&2
+fi
+
+# 3. Ignore rules. A linked worktree's info/exclude is the shared
+#    $GIT_COMMON_DIR/info/exclude, so these lines apply to the main checkout too
+#    (they name artefacts it ignores as well).
+excl="$(cd "$WT" && git rev-parse --path-format=absolute --git-path info/exclude)"
+mkdir -p "$(dirname "$excl")"
+touch "$excl"
+if [ -s "$excl" ] && [ -n "$(tail -c1 "$excl")" ]; then echo >> "$excl"; fi
+for pat in "/.venv" ".pytest_cache/"; do
+  grep -Fxq -- "$pat" "$excl" || printf '%s\n' "$pat" >> "$excl"
+done
+
+# 4. Submodules: opt-in only.
+SUB_STATE="skipped"
+if [ -f "$WT/.gitmodules" ]; then
+  if [ "$SUBMODULES" = "1" ]; then
+    gd="$(git -C "$WT" rev-parse --absolute-git-dir)"
+    had_modules=0
+    if [ -e "$gd/modules" ]; then had_modules=1; fi
+    # The state before this attempt, so a failure undoes only what it created
+    # (review R3): per submodule its path and whether its git dir already
+    # existed (an earlier init - kept), and the exact shared config values
+    # (init and deinit both write the common .git/config). Indexed arrays only
+    # (bash 3.2 has no associative ones).
+    sm_names=(); sm_paths=(); sm_pre=(); cfg_keys=(); cfg_had=(); cfg_vals=()
+    while read -r key path; do
+      [ -n "$key" ] || continue
+      name="${key#submodule.}"; name="${name%.path}"
+      sm_names+=("$name"); sm_paths+=("$path")
+      if [ -e "$gd/modules/$name" ]; then sm_pre+=(1); else sm_pre+=(0); fi
+      for k in url active; do
+        cfg_keys+=("submodule.$name.$k")
+        if v="$(git -C "$MAIN" config --get "submodule.$name.$k" 2>/dev/null)"; then
+          cfg_had+=(1); cfg_vals+=("$v")
+        else
+          cfg_had+=(0); cfg_vals+=("")
+        fi
+      done
+    done < <(git config --file "$WT/.gitmodules" --get-regexp '^submodule\..*\.path$' 2>/dev/null || true)
+    # A submodule path that is not initialised yet but already holds files
+    # (review R4): git refuses to clone into it, and a rollback could not tell
+    # those files from its own - refuse before changing anything. With this,
+    # everything under a not-yet-initialised path after a failed attempt was
+    # created by that attempt, which is what the rollback relies on.
+    blocked=()
+    for ((i = 0; i < ${#sm_names[@]}; i++)); do
+      p="$WT/${sm_paths[$i]}"
+      if [ "${sm_pre[$i]}" != "1" ] && [ -e "$p" ] && [ -n "$(ls -A "$p" 2>/dev/null)" ]; then
+        blocked+=("${sm_paths[$i]}")
+      fi
+    done
+    if [ "${#blocked[@]}" -gt 0 ]; then
+      echo "REFUSED: submodule path(s) not initialised yet but not empty: ${blocked[*]}. Initialising would fail on them and a rollback could not tell their files from its own; move the files away (or drop --submodules). Nothing was changed." >&2
+      exit 3
+    fi
+    if ! git -C "$WT" submodule update --init --recursive; then
+      # A submodule cloned by this attempt leaves a checkout whose .git file
+      # points into modules/<name>: deinit it before its git dir goes, or the
+      # worktree stops being a usable git checkout.
+      for ((i = 0; i < ${#sm_names[@]}; i++)); do
+        if [ "${sm_pre[$i]}" = "1" ]; then continue; fi
+        git -C "$WT" submodule deinit -q -f -- "${sm_paths[$i]}" >/dev/null 2>&1 || true
+        if [ -f "$WT/${sm_paths[$i]}/.git" ]; then rm -f "$WT/${sm_paths[$i]}/.git"; fi
+        rm -rf "$gd/modules/${sm_names[$i]}"
+      done
+      if [ "$had_modules" != "1" ]; then rm -rf "$gd/modules"; fi
+      for ((i = 0; i < ${#cfg_keys[@]}; i++)); do
+        if [ "${cfg_had[$i]}" = "1" ]; then
+          git -C "$MAIN" config "${cfg_keys[$i]}" "${cfg_vals[$i]}"
+        else
+          git -C "$MAIN" config --unset-all "${cfg_keys[$i]}" 2>/dev/null || true
+        fi
+      done
+      if st_err="$(git -C "$WT" status --porcelain 2>&1 >/dev/null)"; then
+        echo "ERROR: submodule initialisation failed; this attempt's traces (new submodule checkouts, their git dirs, new submodule.* config keys) were removed and earlier submodule state was kept, so the worktree stays usable and removable. Re-run without --submodules to finish preparing." >&2
+      else
+        echo "ERROR: submodule initialisation failed, and '$WT' is not a usable git checkout after the rollback: $st_err" >&2
+        echo "  inspect it with: git -C '$WT' submodule status - do not force-remove it before checking its submodules" >&2
+      fi
+      exit 1
+    fi
+    SUB_STATE="initialised"
+  else
+    echo "NOTE: submodules were not initialised (pass --submodules to initialise them)"
+  fi
+fi
+
+# 5. Optional creator, registered in the control root's .mam.
+if [ -n "$CREATOR_AGENT" ]; then
+  args=(--workspace "$WT" --agent "$CREATOR_AGENT" --role "$ROLE" --session "$SESSION")
+  if [ "$ONBOARD" = "1" ]; then args+=(--onboard); else args+=(--no-onboard); fi
+  if [ -n "$HS" ]; then args+=(--herdr-session "$HS"); fi
+  if [ -n "$HW" ]; then args+=(--herdr-workspace "$HW"); fi
+  env_add=(WORKSPACE_ROOT="$MAIN"
+           AGENT_SESSIONS_YAML="${AGENT_SESSIONS_YAML:-$MAIN/.mam/agent-sessions.yaml}"
+           MAM_JOBS_DIR="${MAM_JOBS_DIR:-$MAIN/.mam/jobs}"
+           DELEGATE_JOB_LOGS_DIR="${DELEGATE_JOB_LOGS_DIR:-$MAIN/.mam/delegate_job_logs}"
+           MAM_NO_SUBSCRIBER_DAEMON=1)
+  if [ -z "${MAM_ENV_FILE:-}" ] && [ -f "$MAIN/.mam.env" ]; then env_add+=(MAM_ENV_FILE="$MAIN/.mam.env"); fi
+  rc=0
+  env "${env_add[@]}" bash "$SKILL_DIR/multi-agent-mux-create/scripts/create_session.sh" "${args[@]}" || rc=$?
+  if [ "$rc" -ne 0 ]; then
+    echo "ERROR: create_session.sh failed (rc=$rc); the worktree is kept - remove it with worktree_remove.sh --path '$WT'" >&2
+    exit "$rc"
+  fi
+fi
+
+BASE_SHA="$(git -C "$WT" rev-parse HEAD)"
+echo "WORKTREE=$WT"
+echo "BRANCH=$BRANCH"
+echo "BASE=$BASE_SHA"
+echo "SUBMODULES=$SUB_STATE"
+echo "VENV=$VENV_STATE"
+[ -n "$CREATOR_AGENT" ] && echo "SESSION=$SESSION"
+echo "next: bash $SKILL_DIR/multi-agent-mux-loop/scripts/run_loop.sh --worktree '$WT' --base $BASE_SHA --review-only --creator <creator> --reviewer <reviewers> --task '...'"
+echo "then: bash $SKILL_DIR/multi-agent-mux-stop/scripts/worktree_remove.sh --path '$WT' --stop"
diff --git a/.agents/skills/multi-agent-mux-delegate-job/SKILL.md b/.agents/skills/multi-agent-mux-delegate-job/SKILL.md
index 84ed3f4..2da2678 100644
--- a/.agents/skills/multi-agent-mux-delegate-job/SKILL.md
+++ b/.agents/skills/multi-agent-mux-delegate-job/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-delegate-job
 description: "Delegate a unit of work to any autonomous agent (claude-code, hermes, agy, grok-build, codex, or a human) and observe it asynchronously over an MQTT event channel. Supported roles include orchestrator, worker, and reviewer."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos, windows]
diff --git a/.agents/skills/multi-agent-mux-loop/SKILL.md b/.agents/skills/multi-agent-mux-loop/SKILL.md
index d453597..a9fbb90 100644
--- a/.agents/skills/multi-agent-mux-loop/SKILL.md
+++ b/.agents/skills/multi-agent-mux-loop/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-loop
 description: "Run an autonomous planning-execution-review loop using multiple agents (Planner, Creator, Reviewers) in the workspace. Automatically orchestrates plan discussion, code changes, and peer reviews until a unanimous PASS is achieved or the maximum iteration limit is reached."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
@@ -58,7 +58,9 @@ process probing happens for it). The row still needs `role` and
 `status: running` to be picked up by `--all-reviewer`. Remote rows need the
 default Python loop runner: the legacy shell runner (`MAM_LOOP_PY=0`)
 addresses every session as `herdr:<name>` and does not support
-`transport: remote`.
+`transport: remote`. With `--worktree`/`--base` (review identity), remote reviewers are
+refused by default - they cannot reach the review tree on this host; `--remote-review diff-only`
+admits them with the snapshot diff as their only evidence, recorded as `evidence: diff-only`.
 
 ## Roles & Responsibilities
 
@@ -198,9 +200,13 @@ sequenceDiagram
 | **Source root** | `--worktree <path>` (env `MAM_LOOP_WORKTREE`, CLI 우선) | diff 수집·base·head·빈 변경분 판정만 이 git 워크트리 기준으로 합니다. wrapper·레지스트리·체크포인트·loop guard·리포트 승격·cleanup 은 루프를 띄운 본 체크아웃(제어 루트)에 남습니다. 모든 위임 프롬프트 앞에 `[워크트리 컨텍스트]` 블록(경로·브랜치·base·head·커밋 수·미커밋 변경)이 붙습니다. Python 루프 전용(Issue #21). |
 | **Diff base** | `--base <ref>` (CLI 전용, env 없음) | 리뷰 diff 의 base 를 고정합니다. 소스 HEAD 의 조상이어야 하며 아니면 exit 1. 생략 시 Phase 2 시작 시점의 소스 HEAD 입니다. |
 | **Review only** | `--review-only` | Phase 2(구현 위임)를 건너뛰고 `<base>..HEAD` 를 리뷰합니다. `--base` 필수, `--plan` 과 함께 쓸 수 없습니다. 수정·순응 잡은 여전히 creator 에게 갑니다. |
+| **Review isolation** | `--review-isolation worktree\|env` | `--worktree`/`--base` 에서만 의미. `worktree`(기본): 라운드마다 스냅샷의 detached 리뷰 워크트리(TMPDIR)에서 검증합니다. `env`: 소스 루트에서 `PYTHONDONTWRITEBYTECODE=1 … -p no:cacheprovider --basetemp=<밖>` 지침으로 검증합니다. 리뷰 워크트리를 열 수 없으면 조용히 낮추지 않고 exit 1. `env` 에서 리뷰어가 ignore 되지 않는 산출물을 소스 루트에 남기면 라운드가 stale 로 판정돼 재리뷰가 반복됩니다(fail-closed) — 산출물은 `--basetemp` 등으로 소스 밖에 둡니다. |
+| **Remote reviewers** | `--remote-review refuse\|diff-only` | `--worktree`/`--base` 에서만 의미. 원격 리뷰어(`transport: remote`)는 이 호스트의 리뷰 트리에 닿을 수 없으므로 기본으로 **어떤 잡도 위임하기 전에** 거부(exit 1)합니다. `diff-only` 는 스냅샷 SHA 와 diff 만을 근거로 받아들이고 그렇게 기록합니다. |
 
 `--worktree` 또는 `--base` 가 있으면 매 리뷰 라운드(셀프 리뷰 포함) 전에 소스 루트의 변경분을 git 종료 코드로 판정합니다. 변경분이 비었거나 판정할 수 없으면 리뷰를 요청하지 않고 exit 1 로 끝납니다(fail-closed). 둘 다 없으면 기존 동작 그대로입니다.
 
+**리뷰 identity (Issue #21 항목 5).** `--worktree`/`--base` 가 있으면 매 리뷰 라운드를 `(loop_id, base, head, tree)` 에 묶습니다. 소스의 미커밋·untracked 상태까지 담은 스냅샷(ref 없는 커밋)을 만들고, 리뷰어가 받는 diff 도 그 스냅샷에서 만듭니다(`base..snapshot`). 라운드가 끝난 뒤 소스가 바뀌었으면 그 라운드의 PASS 는 버리고 수정 잡 없이 다시 리뷰합니다(마지막 반복이면 exit 1). 승격 직전에도 한 번 더 확인하며, 승격된 리포트 옆에 `report-<jid>.identity.json`(loop_id·base·head·tree·스냅샷 커밋·리뷰어·`transport`·`evidence`: `review-tree`/`source-tree`/`diff-only`)을 둡니다. 추적되지 않는 중첩 git 저장소는 스냅샷에 담을 수 없어 거부합니다. 서브모듈 안의 미커밋·untracked 내용도 스냅샷에는 gitlink 커밋만 남으므로 거부합니다(라운드 시작 시 exit 1, 리뷰 중에 생기면 그 라운드는 stale). `submodule.*.ignore` 설정으로 가려지지 않습니다. 리뷰어가 없으면 creator 셀프 리뷰가 같은 리뷰어 경로(스냅샷 diff·증거 검사·승격 직전 재확인·사이드카)를 거치고, NOT PASS 면 수정 잡 없이 다시 리뷰합니다. 리뷰 잡의 `[워크트리 컨텍스트]` 는 검증 대상을 `[리뷰 identity]` 의 검증 경로 하나로만 지시합니다.
+
 구현이 루프 밖(워크트리의 creator 에게 `delegate-job --type direct`)에서 끝났다면, **구현 위임 전에** base 를 기록해 두고 리뷰만 돌립니다:
 
 ```bash
diff --git a/.agents/skills/multi-agent-mux-loop/scripts/diff_collect.sh b/.agents/skills/multi-agent-mux-loop/scripts/diff_collect.sh
index 3ba1fd4..7c75d76 100755
--- a/.agents/skills/multi-agent-mux-loop/scripts/diff_collect.sh
+++ b/.agents/skills/multi-agent-mux-loop/scripts/diff_collect.sh
@@ -55,6 +55,11 @@ _mam_untracked_diff() {
 mam_collect_changes_diff() {
   local repo_root="${1:-}"
   local base_commit="${2:-}"
+  # Optional third argument (Issue #21 item 5): a commit - the review
+  # snapshot - to diff against base, commit to commit. The snapshot already
+  # holds the untracked files, so no untracked scan; nothing falls back to
+  # the live tree.
+  local head_commit="${3:-}"
 
   if [ -z "$repo_root" ]; then
     printf '%s\nreason: repo_root parameter is required\n' "$MAM_DIFF_UNAVAILABLE_MARKER"
@@ -70,6 +75,12 @@ mam_collect_changes_diff() {
   raw_diff=$(
     cd -P "$repo_root" 2>/dev/null || exit 3
     git rev-parse --git-dir >/dev/null 2>&1 || exit 4
+    if [ -n "$head_commit" ]; then
+      git cat-file -e "${base_commit}^{commit}" 2>/dev/null || exit 6
+      git cat-file -e "${head_commit}^{commit}" 2>/dev/null || exit 6
+      git diff "$base_commit" "$head_commit" || exit 5
+      exit 0
+    fi
     if [ -n "$base_commit" ] && git cat-file -e "${base_commit}^{commit}" 2>/dev/null; then
       git diff "$base_commit" || exit 5
     else
@@ -86,6 +97,8 @@ mam_collect_changes_diff() {
       reason="not a git repository: $repo_root"
     elif [ "$rc" -eq 5 ]; then
       reason="git diff command failed"
+    elif [ "$rc" -eq 6 ]; then
+      reason="base '$base_commit' or head '$head_commit' is not a commit"
     fi
     printf '%s\nreason: %s\n' "$MAM_DIFF_UNAVAILABLE_MARKER" "$reason"
     return 2
@@ -104,6 +117,10 @@ mam_collect_changes_diff() {
     local stat_summary=""
     stat_summary=$(
       cd -P "$repo_root" 2>/dev/null || exit 0
+      if [ -n "$head_commit" ]; then
+        git diff "$base_commit" "$head_commit" --stat 2>/dev/null || true
+        exit 0
+      fi
       if [ -n "$base_commit" ] && git cat-file -e "${base_commit}^{commit}" 2>/dev/null; then
         git diff "$base_commit" --stat 2>/dev/null || true
       else
@@ -117,7 +134,11 @@ mam_collect_changes_diff() {
     printf 'The change set is %s bytes / %s lines, over the review limit (%s bytes / %s lines).\n' \
       "$byte_cnt" "$line_cnt" "$MAM_DIFF_MAX_BYTES" "$MAM_DIFF_MAX_LINES"
     printf 'Only the file-level summary is shown below. You have NOT been shown the\n'
-    printf 'full change set -- inspect the working tree directly before voting.\n\n'
+    if [ -n "$head_commit" ]; then
+      printf 'full change set -- inspect the review snapshot (%s) directly before voting.\n\n' "$head_commit"
+    else
+      printf 'full change set -- inspect the working tree directly before voting.\n\n'
+    fi
     printf '%s\n\n' "$stat_summary"
     printf '%s\n' "$MAM_DIFF_TRUNCATED_MARKER"
     return 0
diff --git a/.agents/skills/multi-agent-mux-loop/scripts/run_loop.sh b/.agents/skills/multi-agent-mux-loop/scripts/run_loop.sh
index f83b853..da0cbdf 100644
--- a/.agents/skills/multi-agent-mux-loop/scripts/run_loop.sh
+++ b/.agents/skills/multi-agent-mux-loop/scripts/run_loop.sh
@@ -35,6 +35,8 @@ PLANNER_SESSION_OVERRIDE=""
 LOOP_WORKTREE=""
 LOOP_BASE=""
 LOOP_REVIEW_ONLY=0
+LOOP_REVIEW_ISOLATION=""
+LOOP_REMOTE_REVIEW=""
 
 # Print usage instructions
 usage() {
@@ -53,6 +55,8 @@ usage() {
   echo "  --worktree <path>      Source worktree for diff/base/head (control plane stays here)"
   echo "  --base <ref>           Pin the review diff base (must be an ancestor of the source HEAD)"
   echo "  --review-only          Skip implementation; review <base>..HEAD (requires --base)"
+  echo "  --review-isolation <v> Review tree with --worktree/--base: worktree (default) or env"
+  echo "  --remote-review <v>    Remote reviewers with --worktree/--base: refuse (default) or diff-only"
   exit 1
 }
 
@@ -92,6 +96,8 @@ while [[ "$#" -gt 0 ]]; do
     --worktree) LOOP_WORKTREE="$2"; shift 2 ;;
     --base) LOOP_BASE="$2"; shift 2 ;;
     --review-only) LOOP_REVIEW_ONLY=1; shift ;;
+    --review-isolation) LOOP_REVIEW_ISOLATION="$2"; shift 2 ;;
+    --remote-review) LOOP_REMOTE_REVIEW="$2"; shift 2 ;;
     -h|--help) usage ;;
     *) echo "Unknown option: $1"; usage ;;
   esac
@@ -117,8 +123,9 @@ fi
 # diffs the checkout it runs in; the worktree/base options are Python-only.
 # Checked before the freeze and the loop lock (log_* are not defined yet).
 if [ "${MAM_LOOP_PY:-1}" = "0" ] && { [ -n "$LOOP_WORKTREE" ] || [ -n "$LOOP_BASE" ] \
-     || [ "$LOOP_REVIEW_ONLY" = "1" ] || [ -n "${MAM_LOOP_WORKTREE:-}" ]; }; then
-  echo "ERROR: --worktree/--base/--review-only require the Python loop (MAM_LOOP_PY=1)" >&2
+     || [ "$LOOP_REVIEW_ONLY" = "1" ] || [ -n "${MAM_LOOP_WORKTREE:-}" ] \
+     || [ -n "$LOOP_REVIEW_ISOLATION" ] || [ -n "$LOOP_REMOTE_REVIEW" ]; }; then
+  echo "ERROR: --worktree/--base/--review-only/--review-isolation/--remote-review require the Python loop (MAM_LOOP_PY=1)" >&2
   exit 1
 fi
 
diff --git a/.agents/skills/multi-agent-mux-monitor/SKILL.md b/.agents/skills/multi-agent-mux-monitor/SKILL.md
index 570c860..01ca21f 100644
--- a/.agents/skills/multi-agent-mux-monitor/SKILL.md
+++ b/.agents/skills/multi-agent-mux-monitor/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-monitor
 description: "Run a long-lived reconciler that watches .mam/agent-sessions.yaml against the actual herdr/agent runtime state and reconciles them. Use when you want live visibility into which agent sessions are running, which are dead, which have stale YAML entries, and which have new session ids that haven't been recorded yet. Runs as a persistent loop (`reconcile.sh --subscribe`) that keeps going until it times out, idles out, or is interrupted."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
diff --git a/.agents/skills/multi-agent-mux-orc-onboard/SKILL.md b/.agents/skills/multi-agent-mux-orc-onboard/SKILL.md
index 95cb8b0..9b33333 100644
--- a/.agents/skills/multi-agent-mux-orc-onboard/SKILL.md
+++ b/.agents/skills/multi-agent-mux-orc-onboard/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-orc-onboard
 description: "Register current or specified orchestrator session UUID into agent-sessions.yaml orchestrator_uuids list to prevent sub-agent discovery capture."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
diff --git a/.agents/skills/multi-agent-mux-resume/SKILL.md b/.agents/skills/multi-agent-mux-resume/SKILL.md
index 4410cf6..ace7f82 100644
--- a/.agents/skills/multi-agent-mux-resume/SKILL.md
+++ b/.agents/skills/multi-agent-mux-resume/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-resume
 description: "Resume an existing agent (claude, antigravity/agy) conversation by UUID into a herdr session. Reads .mam/agent-sessions.yaml for the saved session/conversation id, spawns (or reuses) a herdr session of the matching name, and runs `claude -r <id>` or `agy --conversation <id>` inside. Use when you want to reattach to a previous session's context, or revive a session whose herdr died but the agent's conversation is still on disk."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
@@ -123,6 +123,15 @@ bash .agents/skills/multi-agent-mux-resume/scripts/update_yaml_resumed.sh \
 herdr agent attach "$SESSION_NAME"
 ```
 
+## Original cwd only (Issue #21 phase 2)
+
+A session is resumed only in the directory it ran in (its row's `pane.cwd`): the conversation is keyed by that directory, and a class A agent (agy/hermes/opencode/codex) would otherwise start a new conversation in the wrong tree.
+
+- `--workspace` differing from `pane.cwd` → **exit 2** with the path to use (claude/grok used to fail with exit 1 "No saved session").
+- `pane.cwd` no longer exists (worktree removed) → **exit 2**; recreate the worktree at that path to resume.
+- Rows without `pane.cwd` are not checked. The check runs before session-id resolution and also under `--dry-run`.
+- The control-plane binding is computed before the herdr-alive check, so an already-running session's row gets it too; a binding that cannot be computed is refused (exit 2) for a worktree and warned about for the control root.
+
 ## Pitfalls
 
 - **`claude -r` requires the SAME project directory** — if the workspace path differs from when the session was created, claude will create a new project dir key (`-home-...-different-name`) and put the resume in a different location. Always `-c` (cd to workspace) before running.
diff --git a/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh b/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh
index 72fee21..c5a58ff 100755
--- a/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh
+++ b/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh
@@ -47,6 +47,57 @@ case "$AGENT" in
 esac
 [ -n "$SESSION_NAME" ] || { echo "ERROR: --session required" >&2; exit 2; }
 
+# Issue #21 phase 2 (A11): a session resumes only in the directory it ran in
+# (its conversation is keyed by that cwd; a class A agent would otherwise start
+# a fresh conversation in the wrong tree). Existence first: mam_abs_workspace
+# returns a missing path unchanged, which would read as "a different path".
+ROW_CWD="$(MAM_STATE_JSON="$(load_state_json)" SESSION_NAME="$SESSION_NAME" python3 -c '
+import json, os
+d = json.loads(os.environ.get("MAM_STATE_JSON") or "{}")
+for s in d.get("herdr_sessions", []):
+    if s.get("name") == os.environ["SESSION_NAME"]:
+        print((s.get("pane") or {}).get("cwd", "") or ""); break
+' 2>/dev/null || true)"
+if [ -n "$ROW_CWD" ]; then
+  if [ ! -d "$ROW_CWD" ]; then
+    echo "ERROR: session '$SESSION_NAME' ran in '$ROW_CWD', which no longer exists (worktree removed?). It cannot be resumed; recreate the worktree at that path, or create a new session." >&2
+    exit 2
+  fi
+  if [ "$(mam_abs_workspace "$ROW_CWD")" != "$(mam_abs_workspace "$WORKSPACE")" ]; then
+    echo "ERROR: session '$SESSION_NAME' was created in '$ROW_CWD'; resume it with --workspace '$ROW_CWD' (its conversation is keyed by that directory)." >&2
+    exit 2
+  fi
+fi
+
+# Issue #21 (item 3, D11): the control-plane binding recorded on the row wins
+# over the caller's environment (a difference is reported on stderr); a legacy
+# row without one uses the caller's binding, which update_yaml_resumed.sh then
+# records - on the already-running path too (phase 2, A13). A binding that
+# cannot be computed is refused for a worktree and warned about for the
+# control root itself (A12), as in create.
+ROW_CP="$(MAM_STATE_JSON="$(load_state_json)" SESSION_NAME="$SESSION_NAME" python3 -c "
+import json, os
+d = json.loads(os.environ.get('MAM_STATE_JSON') or '{}')
+for s in d.get('herdr_sessions', []):
+    if s.get('name') == os.environ['SESSION_NAME'] and isinstance(s.get('control_plane'), dict):
+        print(json.dumps(s['control_plane']))
+        break
+" 2>/dev/null || true)"
+CP_ROOT="$(printf '%s' "$ROW_CP" | python3 -c 'import json,sys
+try: print(json.load(sys.stdin).get("workspace_root") or "")
+except Exception: print("")' 2>/dev/null || true)"
+CP_ROOT="${CP_ROOT:-$WORKSPACE_ROOT}"
+cp_rc=0
+CP_JSON="$(mam_control_plane_json "$WORKSPACE" "$ROW_CP")" || cp_rc=$?
+if [ "$cp_rc" -ne 0 ] || [ -z "$CP_JSON" ]; then
+  if [ "$(mam_abs_workspace "$WORKSPACE")" != "$(mam_abs_workspace "$CP_ROOT")" ]; then
+    echo "ERROR: cannot compute the control-plane binding (rc=$cp_rc) for --workspace '$WORKSPACE' (control root '$CP_ROOT'); refusing to resume a session that would use the wrong control plane" >&2
+    exit 2
+  fi
+  echo "WARNING: control-plane binding unavailable (rc=$cp_rc); the row is kept without control_plane" >&2
+  CP_JSON=""
+fi
+
 # 1. Resolve the session id
 UUID=$(bash "$(dirname "${BASH_SOURCE[0]}")/resolve_session_id.sh" \
   --workspace "$WORKSPACE" --agent "$AGENT" --session "$SESSION_NAME")
@@ -91,7 +142,7 @@ if herdr has-session -t "$SESSION_NAME" 2>/dev/null; then
   fi
   echo "herdr '$SESSION_NAME' already running."
   # Just update YAML to make sure it's set to running
-  bash "$(dirname "${BASH_SOURCE[0]}")/update_yaml_resumed.sh" \
+  CONTROL_PLANE_JSON="$CP_JSON" bash "$(dirname "${BASH_SOURCE[0]}")/update_yaml_resumed.sh" \
     --session "$SESSION_NAME" --uuid "$UUID" --agent "$AGENT" --workspace "$WORKSPACE" \
     --herdr-session "$HERDR_SESSION_NAME" \
     ${HERDR_WORKSPACE_OPT:+--herdr-workspace "$HERDR_WORKSPACE_OPT"}
@@ -150,19 +201,8 @@ else
   fi
 fi
 
-# Issue #21 (item 3, D11): the control-plane binding recorded on the row wins
-# over the caller's environment (a difference is reported on stderr); a legacy
-# row without one uses the caller's binding, which update_yaml_resumed.sh then
-# records. Forwarded to the pane only when it differs from --workspace's own.
-ROW_CP="$(MAM_STATE_JSON="$(load_state_json)" SESSION_NAME="$SESSION_NAME" python3 -c "
-import json, os
-d = json.loads(os.environ.get('MAM_STATE_JSON') or '{}')
-for s in d.get('herdr_sessions', []):
-    if s.get('name') == os.environ['SESSION_NAME'] and isinstance(s.get('control_plane'), dict):
-        print(json.dumps(s['control_plane']))
-        break
-" 2>/dev/null || true)"
-CP_JSON="$(mam_control_plane_json "$WORKSPACE" "$ROW_CP" || true)"
+# The binding (computed above) is forwarded to the pane only when it differs
+# from --workspace's own; a forward with whitespace is refused (spawn path only).
 CP_PREFIX=""
 if [ -n "$CP_JSON" ]; then
   cp_rc=0
diff --git a/.agents/skills/multi-agent-mux-status/SKILL.md b/.agents/skills/multi-agent-mux-status/SKILL.md
index 73f0b30..304b52b 100644
--- a/.agents/skills/multi-agent-mux-status/SKILL.md
+++ b/.agents/skills/multi-agent-mux-status/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-status
 description: "Read-only instant snapshot of all agent herdr sessions — name, YAML status, herdr alive, pane cmd/cwd, resume UUID on disk, and any drift. No mutation. Reuses reconcile.sh --dry-run for the diff logic. Use when you want to know 'what's running RIGHT NOW' without spinning up the monitor loop."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
diff --git a/.agents/skills/multi-agent-mux-stop/SKILL.md b/.agents/skills/multi-agent-mux-stop/SKILL.md
index 43db5b3..afbf1cf 100644
--- a/.agents/skills/multi-agent-mux-stop/SKILL.md
+++ b/.agents/skills/multi-agent-mux-stop/SKILL.md
@@ -1,7 +1,7 @@
 ---
 name: multi-agent-mux-stop
 description: "Stop an agent herdr session (claude, antigravity/agy) and update .mam/agent-sessions.yaml. Default stops gracefully and marks status=stopped with conversation preserved for resume. Does NOT delete on-disk conversation artifacts (jsonl/db) — those are preserved unless --purge-conversation is passed. Use when ending a work session, switching to a different one, or cleaning up before a fresh start."
-version: 4.6.0
+version: 4.7.0
 author: godopu
 license: MIT
 platforms: [linux, macos]
@@ -109,6 +109,24 @@ The script:
 6. Updates the YAML entry and SQLite database atomically
 7. If `delegate_job_id` is set, publishes a `completed` event to the multi-agent-mux-delegate-job registry
 
+## Removing an issue worktree: `worktree_remove.sh` (Issue #21 item 4)
+
+```bash
+bash .agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh --path <WT> [--stop] [--dry-run]
+```
+
+Every check runs first and changes nothing; a refusal exits 3:
+
+1. a linked worktree of the control root, not locked (`git worktree unlock` first - git refuses even `--force` on a locked one);
+2. running sessions under it only with `--stop` (stopped normally, conversations kept);
+3. no open job of those sessions - never cancelled automatically, they may belong to a running loop (the delegate job of a session `--stop` stops is cancelled by stop itself);
+4. a clean tree, submodules included (`status --porcelain --untracked-files=all --ignore-submodules=none` - a `status.showUntrackedFiles=no` setting cannot hide a file from a check that decides a forced removal);
+5. inside submodules: no modification, no commit reachable from `HEAD` or any local ref that is on no remote (a submodule sits on a detached HEAD; a commit kept only by a tag or a note is protected too) and no stash (`refs/stash` is reachable from no branch and leaves the status clean) - checked in every repository under the worktree's `modules/`, including deinitialised submodules (their repository stays there) and nested ones; a repository that cannot be checked refuses.
+
+Then it stops the sessions, re-checks the jobs, runs checks 4 and 5 **again** (a session that is being stopped can still write, commit or stash - any change refuses with exit 3, sessions already stopped) and removes the worktree (the branch is kept): plain, or - when the worktree holds submodule state, which git refuses to remove otherwise - a **single `--force` justified by checks 4 and 5**. Do not run `git worktree remove --force` by hand on such a worktree: it deletes the worktree's own submodule repositories, unpushed commits included.
+
+Exit codes: 0 removed, 1 stop/git failure, 2 not a worktree of the control root, 3 refused (nothing changed). Sessions created in a removed worktree cannot be resumed until a worktree exists at that path again.
+
 ## Pitfalls
 
 - **Don't delete on-disk artifacts by default** — the agent's `*.jsonl` / `conversations/*.db` is the data that `multi-agent-mux-resume` needs. `--purge-conversation` is for when the user is genuinely done with the conversation and wants zero recovery chance.
diff --git a/.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh b/.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh
new file mode 100755
index 0000000..997f98d
--- /dev/null
+++ b/.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh
@@ -0,0 +1,171 @@
+#!/usr/bin/env bash
+# worktree_remove.sh — remove an issue worktree of the control root (Issue #21
+# item 4). Every check runs first and changes nothing; only when all pass are
+# sessions stopped and the worktree removed.
+#
+# Usage:
+#   worktree_remove.sh --path <WT> [--stop] [--dry-run]
+#
+# Checks: (1) a linked worktree of the control root, not locked; (2) no running
+# session under it unless --stop; (3) no open job of those sessions (the
+# delegate job of a session --stop will stop is cancelled by stop itself);
+# (4) clean tree, submodules included; (5) submodules: nothing modified and no
+# commit reachable from HEAD or any local ref (tags included - a submodule is
+# on a detached HEAD) that is on no remote, and no stash - in every repository under the worktree's modules/,
+# initialised or not. (4) and (5) run again right before the removal, after
+# --stop: a session that is being stopped can still write, commit or stash.
+# Removal is plain, or - when the worktree holds submodule state, which
+# git refuses to remove without it - a single --force justified by (4) and (5).
+# Never run `git worktree remove --force` by hand on such a worktree.
+#
+# Exit codes: 0 removed, 1 stop/git failure, 2 not a worktree of the control
+# root, 3 refused by a check (nothing changed).
+set -euo pipefail
+
+_script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+source "$(cd "$_script_dir/../.." && pwd)/lib.sh"
+
+usage() {
+  sed -n '2,20p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'
+}
+
+WT=""; STOP=0; DRY_RUN=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --path) WT="${2:-}"; shift 2 ;;
+    --stop) STOP=1; shift ;;
+    --dry-run) DRY_RUN=1; shift ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "ERROR: unknown arg: $1" >&2; usage >&2; exit 2 ;;
+  esac
+done
+[ -n "$WT" ] || { echo "ERROR: --path is required" >&2; usage >&2; exit 2; }
+
+MAIN="$(mam_abs_workspace "$WORKSPACE_ROOT")"
+case "$WT" in /*) ;; *) WT="$PWD/$WT" ;; esac
+WT="$(mam_abs_workspace "${WT%/}")"
+
+PY="$(_delegate_py_bin)"
+wt_py() { PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$PY" -m lib_py.worktree "$@"; }
+jget() { python3 -c 'import json,sys; d=json.load(sys.stdin); print(eval(sys.argv[1]))' "$1"; }
+
+if [ "$(wt_py is-linked "$MAIN" "$WT")" != "true" ]; then
+  echo "ERROR: '$WT' is not a linked worktree of the control root '$MAIN'" >&2
+  exit 2
+fi
+
+REFUSED=0
+refuse() { echo "REFUSED: $*" >&2; REFUSED=1; }
+
+# (1) locked: even a single --force is refused by git
+if [ "$(wt_py is-locked "$MAIN" "$WT")" = "true" ]; then
+  refuse "the worktree is locked (run: git worktree unlock '$WT')"
+fi
+
+# (2) sessions
+STATE="$(load_state_json)"
+ROWS="$(MAM_STATE_JSON="$STATE" wt_py rows "$WT")"
+RUNNING="$(printf '%s' "$ROWS" | jget '" ".join(s["name"] for s in d if s.get("status") == "running")')"
+RUNNING_AGENTS="$(printf '%s' "$ROWS" | jget '" ".join(s["name"] + ":" + ((s.get("pane") or {}).get("cmd") or "") for s in d if s.get("status") == "running")')"
+STOP_JIDS="$(printf '%s' "$ROWS" | jget '",".join(str(s.get("delegate_job_id")) for s in d if s.get("status") == "running" and s.get("delegate_job_id"))')"
+if [ -n "$RUNNING" ] && [ "$STOP" != "1" ]; then
+  refuse "running session(s) in the worktree: $RUNNING (pass --stop to stop them before removal)"
+fi
+
+# (3) open jobs (not the delegate jobs --stop will cancel)
+EXCLUDE=""
+[ "$STOP" = "1" ] && EXCLUDE="$STOP_JIDS"
+JOBS="$(MAM_STATE_JSON="$STATE" wt_py open-jobs "$WT" --exclude "$EXCLUDE")"
+if [ "$(printf '%s' "$JOBS" | jget 'len(d)')" != "0" ]; then
+  refuse "open job(s) of sessions in the worktree - not cancelled automatically, they may belong to a running loop:"
+  printf '%s' "$JOBS" | jget '"\n".join("  %s  %s  %s  (%s)" % (j["job_id"], j["agent_session"], j["status"], j["registry_dir"]) for j in d)' >&2
+  echo "  close one after checking it: python3 .agents/skills/multi-agent-mux-delegate-job/scripts/registry.py --registry-dir <dir> close --job <id> --request cancelled" >&2
+fi
+
+# (4) clean, submodules included, and (5) submodules. A function: it runs now,
+# before any change, and again right before the removal (review R1). It sets
+# METHOD from what it saw and returns 1 on any finding. --untracked-files=all:
+# a status.showUntrackedFiles=no setting (worktree or submodule) must not hide
+# files from a check that decides a forced removal (review R1).
+METHOD="plain"  # set before any early return below: the summary line reads it under set -u
+judge_tree() {
+  local found=0 dirty sub trace key val
+  if ! dirty="$(git -C "$WT" status --porcelain --untracked-files=all --ignore-submodules=none 2>&1)"; then
+    refuse "git status failed in the worktree: $dirty"
+    if [ ! -d "$WT" ]; then
+      echo "  the directory no longer exists; if that is intended, run: git -C '$MAIN' worktree prune" >&2
+    fi
+    return 1
+  fi
+  if [ -n "$dirty" ]; then
+    refuse "the worktree has uncommitted changes:"
+    printf '%s\n' "$dirty" | sed 's/^/  /' >&2
+    found=1
+  fi
+  sub="$(wt_py submodules "$WT")"
+  trace="$(printf '%s' "$sub" | jget 'd["trace"]')"
+  METHOD="plain"
+  if [ "$trace" = "True" ]; then
+    METHOD="single --force"
+    for key in error dirty unpushed stashes; do
+      val="$(printf '%s' "$sub" | jget "d.get('$key', '')")"
+      if [ -n "$val" ]; then
+        refuse "submodule check '$key' is not empty (a forced removal would destroy it):"
+        printf '%s\n' "$val" | sed 's/^/  /' >&2
+        found=1
+      fi
+    done
+  fi
+  return "$found"
+}
+judge_tree || true
+
+echo "checks: locked/sessions/jobs/clean/submodules -> $([ "$REFUSED" = 1 ] && echo refused || echo passed); removal method: $METHOD"
+if [ "$REFUSED" = "1" ]; then
+  echo "nothing was changed" >&2
+  exit 3
+fi
+if [ "$DRY_RUN" = "1" ]; then
+  echo "[dry-run] would ${RUNNING:+stop: $RUNNING, then }remove '$WT' ($METHOD)"
+  exit 0
+fi
+
+# (6) stop, then re-check every open job
+if [ "$STOP" = "1" ] && [ -n "$RUNNING_AGENTS" ]; then
+  for pair in $RUNNING_AGENTS; do
+    name="${pair%%:*}"; agent="${pair#*:}"
+    stop_args=(--session "$name")
+    [ -n "$agent" ] && stop_args+=(--agent "$agent")
+    if ! bash "$SKILL_DIR/multi-agent-mux-stop/scripts/stop_session.sh" "${stop_args[@]}"; then
+      echo "ERROR: stopping '$name' failed; the worktree was not removed" >&2
+      exit 1
+    fi
+  done
+  JOBS="$(MAM_STATE_JSON="$(load_state_json)" wt_py open-jobs "$WT")"
+  if [ "$(printf '%s' "$JOBS" | jget 'len(d)')" != "0" ]; then
+    echo "REFUSED: the sessions were stopped, but open job(s) appeared meanwhile; the worktree was not removed:" >&2
+    printf '%s' "$JOBS" | jget '"\n".join("  %s  %s  %s" % (j["job_id"], j["agent_session"], j["status"]) for j in d)' >&2
+    exit 3
+  fi
+fi
+
+# (6b) the tree again, right before removing it: the stopped sessions may have
+#      written, committed or stashed while they stopped (review R1). The
+#      removal method follows this latest look.
+if ! judge_tree; then
+  echo "REFUSED: ${RUNNING:+the sessions were stopped, but }the worktree changed after the checks; it was not removed" >&2
+  exit 3
+fi
+
+# (7) remove; the branch is kept
+if [ "$METHOD" = "plain" ]; then
+  git -C "$MAIN" worktree remove "$WT" || exit 1
+else
+  git -C "$MAIN" worktree remove --force "$WT" || exit 1
+  echo "submodule checks passed; removed with a single --force"
+fi
+echo "removed: $WT ($METHOD)"
+NAMES="$(printf '%s' "$ROWS" | jget '" ".join(s["name"] for s in d)')"
+if [ -n "$NAMES" ]; then
+  echo "Sessions created in this worktree ($NAMES) cannot be resumed; their conversations are kept, and recreating a worktree at the same path makes them resumable again."
+fi
diff --git a/BOOTSTRAP.ko.md b/BOOTSTRAP.ko.md
index 4f568b3..c4f866c 100644
--- a/BOOTSTRAP.ko.md
+++ b/BOOTSTRAP.ko.md
@@ -2,7 +2,7 @@
 
 본 문서는 `herdr_agent_orchestration` 오케스트레이션 및 메시징 백플레인 워크플로우를 새로운 프로젝트에 도입하여 이식하고, 새로운 개발자/에이전트가 초기 가동을 시작할 때 수행해야 하는 환경 설정 및 구축 절차를 안내합니다.
 
-[![Version: v4.6.0](https://img.shields.io/badge/version-v4.6.0-blue.svg)](VERSIONS.md)
+[![Version: v4.7.0](https://img.shields.io/badge/version-v4.7.0-blue.svg)](VERSIONS.md)
 
 새로운 에이전트는 이 안내서에 기술된 절차를 순차적으로 실행하여 초기 환경을 안정적으로 설정할 수 있습니다.
 
diff --git a/BOOTSTRAP.md b/BOOTSTRAP.md
index fa304e2..880dead 100644
--- a/BOOTSTRAP.md
+++ b/BOOTSTRAP.md
@@ -2,7 +2,7 @@
 
 This document guides you through the setup and initialization procedures required to adopt the `herdr_agent_orchestration` orchestration and messaging backplane workflow in a new project, enabling a new developer or agent to get up and running quickly.
 
-[![Version: v4.6.0](https://img.shields.io/badge/version-v4.6.0-blue.svg)](VERSIONS.md)
+[![Version: v4.7.0](https://img.shields.io/badge/version-v4.7.0-blue.svg)](VERSIONS.md)
 
 A new agent can follow the steps in this guide sequentially to establish a stable and reliable initial environment.
 
diff --git a/MESSAGING.md b/MESSAGING.md
index 9efb484..ebc80c7 100644
--- a/MESSAGING.md
+++ b/MESSAGING.md
@@ -1,6 +1,6 @@
 # Messaging System Technical Analysis & Architecture Report
 
-Applies to: MAM v4.6.0
+Applies to: MAM v4.7.0
 
 This report provides a comprehensive, deep-dive analysis of the messaging system implemented in the `multi-agent-mux-delegate-job` skill. It covers the MQTT broker architecture, event protocols, job lifecycles, codebase internals, cross-system integration, and a list of known limitations along with production recommendations.
 
diff --git a/README.ko.md b/README.ko.md
index 1faac87..2bb889d 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -2,7 +2,7 @@
 
 Herdr와 MQTT 브로커를 기반으로 구축된 고신뢰성 **다중 에이전트 오케스트레이션 및 메시징 백플레인** 프레임워크입니다. `claude`, `agy`, `hermes`, `grok`, `opencode`, `codex` 등 다중 LLM 백엔드 에이전트 전반에 걸쳐 장시간 수행되는 작업(코드 생성, 리팩토링, 보안 검토 등)을 조정, 격리 및 감사할 수 있도록 설계되었습니다.
 
-[![Version: v4.6.0](https://img.shields.io/badge/version-v4.6.0-blue.svg)](VERSIONS.md)
+[![Version: v4.7.0](https://img.shields.io/badge/version-v4.7.0-blue.svg)](VERSIONS.md)
 
 ---
 
diff --git a/README.md b/README.md
index 931688d..611b1f5 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,7 @@
 
 An advanced, high-reliability **Multi-Agent Orchestration & Messaging Backplane** framework built on Herdr and MQTT. It is designed to coordinate, isolate, and audit long-running agent tasks (such as code generation, refactoring, and security reviews) across multiple LLM backend clients (`claude`, `agy`, `hermes`, `grok`, `opencode`, `codex`).
 
-[![Version: v4.6.0](https://img.shields.io/badge/version-v4.6.0-blue.svg)](VERSIONS.md)
+[![Version: v4.7.0](https://img.shields.io/badge/version-v4.7.0-blue.svg)](VERSIONS.md)
 
 ---
 
diff --git a/VERSIONS.md b/VERSIONS.md
index dc0804c..0f2c9af 100644
--- a/VERSIONS.md
+++ b/VERSIONS.md
@@ -6,8 +6,8 @@
 
 ## 📌 현재 버전 개요 (Current Release)
 
-- **프레임워크 버전**: `v4.6.0`
-- **최신 릴리스 일시**: 2026-09-14 (KST)
+- **프레임워크 버전**: `v4.7.0`
+- **최신 릴리스 일시**: 2026-09-20 (KST)
 - **기준 브랜치**: `main`
 - **핵심 아키텍처**:
   - **Terminal 상태 단방향 불변성 (`engine.py`, Issue #6 Phase 1)**: `completed`, `error`, `cancelled` 터미널 상태 진입 후 후속 이벤트나 업데이트에 의한 덮어쓰기를 엄격히 차단(Terminal Immutability). `registry.py close` 서브커맨드 및 fail-closed 조기 종료 도입.
@@ -15,29 +15,49 @@
   - **Loop 모드 `attempt_id` 추적 및 안전 전이 (Issue #6 Phase 3)**: 워커/리뷰어 전환 시 동일 회차 내 재전이 충돌을 방지하는 `attempt_id` 규약 적용 및 4단계 fail-closed `finalize_unfinished` 보장.
   - **결정론적 종료 코드 계약 (Issue #6 Phase 4 & R1)**: `0` (Success), `1` (Failure / Inject error), `2` (Subscriber timeout; 단, 에이전트가 Herdr에서 working 중이면 벽시계 --timeout까지 디스크 재관측 후 fail-close), `3` (Broker unavailable), `5` (Precondition failed / session_busy) 표준화. (send_keys_safe 헬퍼의 배달 실패/busy 타임아웃 rc=4는 래퍼 차원에서 rc=1 실패로 수용).
   - **프로토콜 기반 생존·전달 계약 (Issue #18)**: heartbeat 의무(N, 자동 타이머) · 무응답 판정(K×N) · 전달 확인(T 내 `started`) · retained `<prefix>/state` · 원격 전송(`remote:<name>`). TUI 스크래핑은 주입·다이얼로그·진단에만 남는다.
+  - **워크트리 운영 모델 2단계 (Issue #21 항목 4·5·7)**: 워크트리 준비·해체 헬퍼(변경 전 판정, untracked 포함, 검증된 단일 `--force`), 리뷰 identity(라운드별 스냅샷·stale 재리뷰·승격 직전 재확인·`identity.json`), 수용 사례 A1–A8.
   - **4-Way 버전 락스텝**: `lib.sh`(`MAM_VERSION`) ↔ `lib_py/loop/eager.py`(`FRAMEWORK_VERSION`) ↔ `VERSIONS.md` ↔ 8개 `SKILL.md`.
 
 ---
 
 ## 🧭 스킬 패키지 버전 매트릭스 (Skills Version Matrix)
 
-모든 8개 스킬은 YAML frontmatter 메타데이터(`author`, `version`, `platforms`, `environments`) 표준화를 통해 `v4.6.0`로 동기화되어 배포됩니다.
+모든 8개 스킬은 YAML frontmatter 메타데이터(`author`, `version`, `platforms`, `environments`) 표준화를 통해 `v4.7.0`로 동기화되어 배포됩니다.
 
 | 스킬명 | 버전 | 역할 및 주요 책임 | 상태 |
 | :--- | :---: | :--- | :---: |
-| **`multi-agent-mux-create`** | `4.6.0` | 에이전트 세션 신규 생성 및 Herdr 컨테이너 격리 스폰 | ✅ 배포 |
-| **`multi-agent-mux-stop`** | `4.6.0` | 대화 UUID 원자적 캡처 및 세션 안전 종료 (Graceful Stop) | ✅ 배포 |
-| **`multi-agent-mux-resume`** | `4.6.0` | 온디스크 대화 컨텍스트 기반 Tier-1 초고속 세션 복원 | ✅ 배포 |
-| **`multi-agent-mux-status`** | `4.6.0` | 실시간 Herdr 세션 및 레지스트리 드리프트 스냅샷 조회 | ✅ 배포 |
-| **`multi-agent-mux-monitor`** | `4.6.0` | YAML ↔ 런타임 상태 간 자율 조정자 (Reconciler Loop) | ✅ 배포 |
-| **`multi-agent-mux-delegate-job`** | `4.6.0` | MQTT 이벤트 채널 기반 비동기 단위 작업 위임 | ✅ 배포 |
-| **`multi-agent-mux-loop`** | `4.6.0` | Planner-Creator-Reviewer 3자 자율 계획·실행·피어리뷰 루프 | ✅ 배포 |
-| **`multi-agent-mux-orc-onboard`** | `4.6.0` | 오케스트레이터 UUID 격리 등록 및 서브 세션 오염 방지 | ✅ 배포 |
+| **`multi-agent-mux-create`** | `4.7.0` | 에이전트 세션 신규 생성 및 Herdr 컨테이너 격리 스폰 | ✅ 배포 |
+| **`multi-agent-mux-stop`** | `4.7.0` | 대화 UUID 원자적 캡처 및 세션 안전 종료 (Graceful Stop) | ✅ 배포 |
+| **`multi-agent-mux-resume`** | `4.7.0` | 온디스크 대화 컨텍스트 기반 Tier-1 초고속 세션 복원 | ✅ 배포 |
+| **`multi-agent-mux-status`** | `4.7.0` | 실시간 Herdr 세션 및 레지스트리 드리프트 스냅샷 조회 | ✅ 배포 |
+| **`multi-agent-mux-monitor`** | `4.7.0` | YAML ↔ 런타임 상태 간 자율 조정자 (Reconciler Loop) | ✅ 배포 |
+| **`multi-agent-mux-delegate-job`** | `4.7.0` | MQTT 이벤트 채널 기반 비동기 단위 작업 위임 | ✅ 배포 |
+| **`multi-agent-mux-loop`** | `4.7.0` | Planner-Creator-Reviewer 3자 자율 계획·실행·피어리뷰 루프 | ✅ 배포 |
+| **`multi-agent-mux-orc-onboard`** | `4.7.0` | 오케스트레이터 UUID 격리 등록 및 서브 세션 오염 방지 | ✅ 배포 |
 
 ---
 
 ## 📋 버전별 상세 변경 내역 (Changelog)
 
+### 🚀 `v4.7.0` — Issue #21 워크트리 운영 모델 2단계: 워크트리 헬퍼, 리뷰 identity, 수용 사례 A1–A8, #20 테스트 격리, #27, #28 호스트 이식성 (2026-09-20, PR #29)
+
+> **마이너 마일스톤 (MINOR Release)**: 워크트리 운영 모델(#21, `docs/design/worktree-creator-model.md`)의 작업 항목 4·5·7 을 구현했다. 이슈별 워크트리를 만들고 지우는 헬퍼 2개, 리뷰 라운드를 `(loop_id, base, head, tree)` 에 묶는 리뷰 identity 와 루프 옵션 2개(`--review-isolation`, `--remote-review`), 수용 사례 8건이 추가되어 MINOR 로 올린다. 항목 8(다중 루프·리뷰어 스케줄러)은 보류로 남아 #21 은 열어 둔다. 함께 #20(테스트가 실제 `.mam` 을 오염), #27(`.gitignore` 관리 블록의 `.venv`), #28(Linux/py3.14 호스트의 테스트 실패 33건)을 닫는다.
+
+#### 🌟 주요 개선 사항
+1. **워크트리 준비·해체 헬퍼 (항목 4, `multi-agent-mux-create/scripts/worktree_prepare.sh`, `multi-agent-mux-stop/scripts/worktree_remove.sh`)**: prepare 는 제어 루트 옆에 워크트리를 멱등하게 만들고(안쪽 경로는 거부), 워크트리 **자체의** `.venv` 를 제어 루트의 `.venv/bin/python` 으로 만들어 `requirements*.txt` 를 설치하며(심링크는 만들지 않고 남아 있으면 exit 1 — 링크가 `git add -A` 로 커밋된 사고의 재발 방지), `/.venv`·`.pytest_cache/` 를 공유 `info/exclude` 에 넣고, 서브모듈은 `--submodules` 로만 초기화한다(실패한 시도는 사용 가능한 체크아웃으로 롤백). `--creator-agent` 는 제어 루트 바인딩과 `MAM_NO_SUBSCRIBER_DAEMON=1` 로 creator 세션을 만들고 `BASE=<sha>` 를 출력한다. remove 는 잠금·실행 중 세션(`--stop`)·열린 잡·수정(untracked 포함)·서브모듈(미push 커밋: HEAD 와 tag·notes 를 포함한 모든 로컬 ref, stash, deinit 된 저장소, 부분 저장소) 을 **아무것도 바꾸기 전에** 판정하고, `--stop` 뒤 제거 직전에 한 번 더 판정한 뒤, 서브모듈 상태가 있는 워크트리만 검증된 단일 `--force` 로 지운다.
+2. **resume 계약 (항목 4, `multi-agent-mux-resume`)**: 세션은 기록된 원래 cwd 에서만 재개한다(다른 경로는 exit 2, cwd 없는 기존 행은 호환). 이미 실행 중 경로에서도 제어 평면 바인딩을 영속화하고, 워크트리 바인딩 계산 실패는 삼키지 않고 exit 2 로 알린다. create 는 즉시 reconcile·watchdog 을 제어 루트의 코드로 띄운다.
+3. **리뷰 identity (항목 5, `lib_py/loop/runner.py`, `run_loop.sh --review-isolation worktree|env`, `--remote-review refuse|diff-only`)**: `--worktree`/`--base` 에서 매 리뷰 라운드 전에 소스의 미커밋·untracked 상태까지 담은 ref 없는 스냅샷 커밋을 만들고, 리뷰어의 diff 도 `base..snapshot` 에서 만들며, 기본은 스냅샷의 detached 리뷰 워크트리에서 검증한다. 라운드가 끝난 뒤 소스가 바뀌었으면 PASS 를 버리고 다시 리뷰하고(마지막 반복이면 exit 1), 승격 직전에도 재확인하며, 리포트 옆에 `report-<jid>.identity.json`(loop_id·base·head·tree·스냅샷·리뷰어·transport·evidence)을 둔다. 추적되지 않는 중첩 저장소와 dirty 서브모듈(`--ignore-submodules=none --untracked-files=all`, 어떤 `submodule.*.ignore`·`diff.ignoreSubmodules`·`status.showUntrackedFiles` 설정도 숨기지 못함)은 거부한다. 원격 리뷰어는 이 호스트의 리뷰 트리에 닿을 수 없으므로 어떤 잡도 위임하기 전에 거부하거나 `diff-only` 로만 받는다. 옵션이 없으면 이전 동작 그대로다.
+4. **테스트 격리 (#20, `tests/conftest.py`)**: 수집 전에 ambient 제어 평면 바인딩을 기록·제거하고 테스트마다 레지스트리·감사 로그 기본 루트를 tmp 로 보낸다. 기록된 제어 평면의 `.mam/jobs`·`.mam/delegate_job_logs` 에 새 항목이 생기면 세션 가드가 실패시키고, 기본 해석 규칙을 검증하는 #15 테스트는 명시적으로 옵트아웃한다. `MAM_ENV_FILE` 은 존재하지 않는 경로로 고정해 실 `.mam.env` 를 읽지 않는다.
+5. **호스트 이식성 (#28)**: `tests/test_workspace_scope.py` 는 `bash -c` 로 실행(dash 에 `source` 없음), argparse 도움말 비교는 `_normalize_help` 로 py3.10+ 의 "options:" 를 흡수, `test_deploy_freshness.py` 의 private-server 문서·docker 자산 의존 테스트는 자산이 없으면 skip, `lib_py/agents/base.py`·`lib_py/delegation/heartbeat.py` 의 프로세스 스캔은 POSIX `ps -eo pid=,ppid=,args=` 로 통일(BSD 전용 인자가 Linux 에서 purge 12건을 깨뜨리던 원인 가설). `test_issue14_delivery_ack.py` 의 벽시계 close 여유는 `timeout_s + 15`.
+6. **`.gitignore` 관리 블록 (#27, `deploy/install.sh`, `deploy/install_mam.sh`)**: `.venv` 를 파일·디렉터리·링크 어느 형태로도 무시한다(재설치는 옛 규칙만 바꾸고 사용자 줄은 보존).
+7. **문서**: 설계 문서(항목 4·5·7 상태, 서브모듈 제거 규칙, resume cwd 규칙, 루트 3종·리뷰 identity), create/stop/resume/loop SKILL.md, 호환성 표.
+
+#### ✅ 품질 검증
+- **신규 테스트** (`tests/test_issue21_phase2_loop_a.py`, `tests/test_issue21_loop_b.py`, `tests/test_issue21_acceptance.py`(A1–A8), `tests/test_issue20_state_isolation.py`, `tests/test_issue21_worktree_prereqs.py` 확장): prepare 의 멱등성·거부·dry-run·venv(생성/유지/링크 거부/인터프리터 부재)·서브모듈 롤백, remove 의 R1–R6(종료 중 쓰기, 서브모듈 stash, 부분 init 롤백, 기존 파일, deinit 저장소, tag 로만 보존한 커밋)과 `status.showUntrackedFiles=no` 로 숨긴 untracked 파일, 리뷰 identity 의 스냅샷·stale·승격 재확인·격리 실패·원격 거부·dirty 서브모듈(숨김 설정 포함), #20 가드. 수용 사례 A1–A8 은 mock herdr 기준이며 실제 pane 의 env 값 확인은 단계 C 로 남긴다.
+- **리뷰 (병합 워크스페이스, PR head 를 detached 워크트리에 받아 4인 독립 검토)**: @46ea4cc claude·agy·grok PASS, codex NOT PASS(R1 `status.showUntrackedFiles=no` 가 숨긴 서브모듈 untracked 파일이 force 제거를 통과, R2 같은 결함으로 리뷰 스냅샷이 미포착 내용을 승인, R3 prepare 의 `.venv` 심링크) → 08db1da 로 정정. 델타 리뷰 @08db1da claude·agy·grok PASS(비차단 D1–D3 → 80a5614 반영), codex 는 루프의 프롬프트 주입 실패(잡 14c7dc38, `started` 없음)로 직접 재위임해 @80a5614 PASS. 리포트 8건은 `.agents/reports/<session>/report-<jid>.md`(291e38b5·f27519ff·5f1486ee·b880c1f2·f1174fc0·d9275506·19d56cde·f6b21a0d).
+- **전체 스위트 (병합 워크스페이스)**: @46ea4cc 1013 통과 / 1 skip / 실패 1건(부하 시 벽시계 경계, 90a289d 로 여유 확대). @08db1da(자체 venv 가 없는 워크트리에서 실행) 1015 통과 / 1 skip / 4 실패 — 4건 모두 워크트리의 `.venv` 부재로 스크립트가 system python(paho 없음)을 잡은 탓이며, 워크트리 자체 venv 를 만든 뒤 4건 모두 통과(80a5614 가 prepare 의 설치 목록에 delegate-job requirements 를 넣은 동기).
+- **#28 후속**: Linux/py3.14 호스트에서 `ps -eo` 수정이 purge 12건을 실제로 고치는지 확인이 필요하다(가설 단계).
+
 ### 🚀 `v4.6.0` — Issue #21 워크트리 운영 모델 1단계 선행 작업: 래퍼 절대경로, 루프 `--worktree`, 제어 평면 바인딩, 설계 문서 (2026-09-14, PR #22)
 
 > **마이너 마일스톤 (MINOR Release)**: "워크스페이스 = 체크아웃 경로" 가정을 느슨하게 하는 1단계다. creator 는 이슈별 git 워크트리에서, 리뷰어 풀은 본 체크아웃에서, 잡 브리프·레지스트리·리포트·체크포인트(제어 평면)는 본 체크아웃 하나에 두는 운영 모델(#21, `docs/design/worktree-creator-model.md`)의 선행 조건 4건(작업 항목 1·2·3·6)을 구현했다. 루프 러너 옵션 3개와 `lib_py/control_plane.py` 가 추가되어 MINOR 로 올린다. 옵션 없이 쓰면 종전 동작과 프롬프트가 바이트 단위로 같다. 항목 4(워크트리 준비/종료 헬퍼)·5(리뷰 identity)·7(시험 운영)·8(다중 루프)은 #21 에 남아 있다.
diff --git a/deploy/install.sh b/deploy/install.sh
index c44e3ee..2a63d2b 100644
--- a/deploy/install.sh
+++ b/deploy/install.sh
@@ -546,7 +546,7 @@ gi_path, start_marker, end_marker = sys.argv[1], sys.argv[2], sys.argv[3]
 
 block_lines = [
     start_marker + "\n",
-    "/.venv/\n",
+    "/.venv\n",
     "/.mam/\n",
     "/.mam_deploy/\n",
     "/.mam.env\n",
diff --git a/deploy/install_mam.sh b/deploy/install_mam.sh
index cb98bfc..fa55e3f 100755
--- a/deploy/install_mam.sh
+++ b/deploy/install_mam.sh
@@ -246,7 +246,7 @@ gi_path, start_marker, end_marker = sys.argv[1], sys.argv[2], sys.argv[3]
 
 block_lines = [
     start_marker + "\n",
-    "/.venv/\n",
+    "/.venv\n",
     "/.mam/\n",
     "/.mam_deploy/\n",
     "/.mam.env\n",
diff --git a/docs/design/worktree-creator-model.md b/docs/design/worktree-creator-model.md
index 4425536..5d3e652 100644
--- a/docs/design/worktree-creator-model.md
+++ b/docs/design/worktree-creator-model.md
@@ -33,31 +33,29 @@ MAM 은 **워크스페이스 = `.agents/skills` 가 들어 있는 체크아웃 
 
 ### C. (제안) creator 만 워크트리, 리뷰어 풀은 공유, 제어 평면은 하나
 - **creator = 워크트리 전용 인스턴스.** 제품 코드를 편집·커밋하는 유일한 에이전트이므로 cwd 가 곧 이슈 브랜치여야 한다. 오케스트레이터 커밋과 루프의 리포트 승격(`runner.py` 의 Promotion 블록 → 제어 루트 `.agents/reports/`)은 별도 소유다. 이슈마다 `creator-<agent>-<issue>` 로 만들고 끝나면 정지(대화 보존, 필요 시 재개). 재개하려면 같은 워크트리 경로가 있어야 한다(대화 키가 cwd).
-- **리뷰어 풀 = 본 체크아웃 공유.** 리뷰어는 소스를 편집하지 않는다. 그러나 테스트 실행은 쓰기를 동반하므로 '읽기 전용'이 아니다. 검증 격리(head SHA detached 워크트리 또는 격리 옵션)와 (loop_id, base, head) 판정 결속은 항목 5 에서 정한다. 1단계 브리프는 러너가 경로·base·head·커밋 수를 자동 삽입한다(`--worktree`/`--base`). 리뷰가 병목이면 리뷰어 인스턴스를 추가한다.
+- **리뷰어 풀 = 본 체크아웃 공유.** 리뷰어는 소스를 편집하지 않는다. 그러나 테스트 실행은 쓰기를 동반하므로 '읽기 전용'이 아니다. `--worktree`/`--base` 에서는 러너가 매 라운드를 스냅샷 `(loop_id, base, head, tree)` 에 묶고(항목 5), 리뷰어는 그 스냅샷의 detached 리뷰 워크트리(기본) 또는 env 격리 지침으로 소스 루트에서 검증한다. 리뷰 중 소스가 바뀐 라운드의 승인은 버리고 다시 리뷰하며, 승격 직전에도 다시 확인한다. 원격 리뷰어는 리뷰 트리에 닿을 수 없어 기본 거부, `--remote-review diff-only` 로만 받는다. 리뷰가 병목이면 리뷰어 인스턴스를 추가한다.
 - **오케스트레이터 커밋 = 워크트리.** 본 체크아웃은 리뷰어의 작업 공간이므로 오케스트레이터는 그곳에서 브랜치를 바꾸지 않는다.
 - **제어 평면 = 본 체크아웃의 `.mam` 하나.** create/resume 이 바인딩(`WORKSPACE_ROOT`·`AGENT_SESSIONS_YAML`·`MAM_JOBS_DIR`·`DELEGATE_JOB_LOGS_DIR`)을 행(`control_plane`)에 영속하고, `--workspace` 기본값과 다르면 pane 에 명시 전파한다(항목 3). 호출자 env 만으로는 pane 상속이 보장되지 않는다(lib.sh:667-680 — new-session 은 선행 `K=V` 토큰만 `--env` 로 바꾼다). 행의 `pane.cwd` 는 워크트리다.
 
-## 3. C 안의 동작 방식 (부분 지원 + 1단계 수정 반영)
+## 3. C 안의 동작 방식 (1단계 + 2단계 루프 A 반영)
 
 ```bash
 MAIN=/path/to/multi-agent-mux            # 본 체크아웃: 리뷰어 풀 + .mam (제어 루트)
 WT=/path/to/multi-agent-mux-wt/issue-20  # 이슈 워크트리 (소스 루트)
-git -C "$MAIN" worktree add -b fix/issue-20 "$WT" main
-ln -s "$MAIN/.venv" "$WT/.venv"; git -C "$WT" submodule update --init   # 워크트리 준비(.venv, nats-docker) — 헬퍼는 항목 4
-
-# creator 를 워크트리 cwd 로, 그러나 본 체크아웃의 .mam 에 등록.
-# 바인딩은 행의 control_plane 에 남고, --workspace 기본값과 다르므로 pane 에 --env 로 전파된다.
-WORKSPACE_ROOT="$MAIN" AGENT_SESSIONS_YAML="$MAIN/.mam/agent-sessions.yaml" \
-MAM_JOBS_DIR="$MAIN/.mam/jobs" DELEGATE_JOB_LOGS_DIR="$MAIN/.mam/delegate_job_logs" \
-  bash "$MAIN/.agents/skills/multi-agent-mux-create/scripts/create_session.sh" \
-    --workspace "$WT" --agent claude --role Creator --session creator-claude-issue20 \
-    --herdr-session multi-agent-mux --herdr-workspace mam-agent
+# 워크트리 준비 + creator 생성(항목 4, worktree_prepare.sh): git worktree add, 제어 루트 .venv 링크,
+# 공통 info/exclude 에 /.venv·.pytest_cache/, creator 는 제어 루트 바인딩과 MAM_NO_SUBSCRIBER_DAEMON=1 로 생성.
+# 행의 pane.cwd 는 워크트리, control_plane 은 본 체크아웃. 서브모듈은 --submodules 를 줄 때만 초기화한다.
+cd "$MAIN" && bash .agents/skills/multi-agent-mux-create/scripts/worktree_prepare.sh \
+  --path "$WT" --branch fix/issue-20 --base main \
+  --creator-agent claude --session creator-claude-issue20 \
+  --herdr-session multi-agent-mux --herdr-workspace mam-agent
+# 출력 끝의 BASE=<sha> 가 워크트리 HEAD 다. (b) 흐름이면 구현 위임 전에 기록해 둔다.
 
 # (a) 루프가 구현까지 한다: base 는 Phase 2 시작 시점의 워크트리 HEAD
 cd "$MAIN" && bash .agents/skills/multi-agent-mux-loop/scripts/run_loop.sh \
   --worktree "$WT" --creator creator-claude-issue20 --all-reviewer --task "Issue #20 ..."
 
-# (b) 구현은 루프 밖(1단계 기본): base 를 구현 위임 **전에** 기록한다
+# (b) 구현은 루프 밖(1단계 기본): base 를 구현 위임 **전에** 기록한다(prepare 가 출력한 BASE 와 같다)
 BASE=$(git -C "$WT" rev-parse HEAD)
 bash "$MAIN/.agents/skills/multi-agent-mux-delegate-job/multi-agent-mux-delegate-job" submit --type direct \
   --agent claude --agent-session herdr:creator-claude-issue20 --workdir "$MAIN" --prompt "Issue #20 ..."
@@ -65,10 +63,15 @@ bash "$MAIN/.agents/skills/multi-agent-mux-delegate-job/multi-agent-mux-delegate
 cd "$MAIN" && bash .agents/skills/multi-agent-mux-loop/scripts/run_loop.sh \
   --worktree "$WT" --base "$BASE" --review-only --creator creator-claude-issue20 --all-reviewer --task "Issue #20 review"
 
-# 정지·재개: --workspace 는 원래 워크트리 경로. 재개는 행에 영속된 바인딩을 다시 전파한다
+# 정지·재개: --workspace 는 원래 워크트리 경로여야 한다(다른 경로·삭제된 경로는 exit 2).
+# 재개는 행에 영속된 바인딩을 다시 전파한다
 bash "$MAIN/.agents/skills/multi-agent-mux-stop/scripts/stop_session.sh" --session creator-claude-issue20
 bash "$MAIN/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh" \
   --workspace "$WT" --agent claude --session creator-claude-issue20
+
+# 정리(worktree_remove.sh): 잠금·세션·잡·청결·서브모듈 판정을 모두 통과해야 정지·제거한다.
+# 하나라도 걸리면 exit 3 이고 아무것도 바꾸지 않는다. 브랜치는 남긴다.
+bash "$MAIN/.agents/skills/multi-agent-mux-stop/scripts/worktree_remove.sh" --path "$WT" --stop
 ```
 
 - `--task` 에 base 를 적지 말 것. 러너가 넣는 base 와 둘이 된다. 리뷰어가 받는 base 는 러너의 `[워크트리 컨텍스트]` 블록 하나뿐이어야 한다.
@@ -83,19 +86,23 @@ bash "$MAIN/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh" \
 - **리뷰 단계는 풀 크기만큼만 병렬**이다. 이슈 3개를 동시에 돌려도 리뷰어 하나는 잡을 순서대로 처리한다(래퍼는 busy 세션에 rc 5 → 러너가 `MAM_SESSION_BUSY_RETRY_S` 뒤 1회 재시도 → 그래도 busy 면 실패). 다중 루프 동시 기동에는 **리뷰어 큐잉 또는 리뷰어 인스턴스 증설**이 전제다.
 - 같은 `.mam` 의 두 번째 루프는 경고가 아니라 **거부**다: loop lock 이 exit 1 로 막는다(`run_loop.sh` 의 `mam_acquire_loop_lock` 분기). 체크포인트·loop guard 도 파일 하나다(`runner.py` 의 `checkpoint_file`, `MAM_LOOP_MARKER`). YAML/SQLite 는 flock·`BEGIN IMMEDIATE` 로 트랜잭션 안전(atomic_yaml.py)하므로, 문제는 DB 손상이 아니라 **공유 논리 상태와 리뷰어 소유권**이다.
 - **1단계 운영 형태 = 구현 병렬, 리뷰 루프 하나**: creator 구현은 루프 밖(delegate-job direct)에서 워크트리마다 병렬로 한다. 리뷰는 `run_loop.sh --worktree <WT> --base <구현 전 sha> --review-only` 로 한 번에 하나씩 한다. base 를 구현 위임 **전에** 기록하지 않으면 리뷰를 시작할 수 없다(가드가 빈 변경분을 거부한다). busy 처리는 큐가 아니다(1회 재시도). 다중 루프는 항목 8(리뷰어 스케줄러) 이후다.
-- 준비 헬퍼는 항목 4 다. `.mam.env` 는 복사 대신 중앙 `MAM_ENV_FILE` 정책으로 하고, `.venv` 심링크는 gitignore 되지 않으므로 `.git/info/exclude` 로 처리한다.
+- 준비·해체 헬퍼는 항목 4 로 구현했다(`worktree_prepare.sh`, `worktree_remove.sh`).
+  - `.mam.env` 는 복사하지 않는다. creator 에는 제어 루트의 것을 `MAM_ENV_FILE` 로 준다.
+  - `.venv` 는 워크트리 자체의 것이다: 제어 루트의 `.venv/bin/python` 으로 만들고 delegate-job 스킬의 `requirements.txt`(paho-mqtt·PyYAML, `deploy/install.sh` 가 설치하는 것)와 `requirements*.txt` 를 설치한다. 설치가 실패하면 반쯤 만든 venv 를 지우고 exit 1 한다(다음 실행이 kept 로 오판하지 않도록). 심링크는 만들지 않으며 남아 있으면 prepare 가 거부한다(링크는 제어 루트 환경을 그대로 가리키고, 워크트리의 `git add -A` 가 링크 자체를 커밋한 적이 있다). 무시 규칙(`/.venv`, `.pytest_cache/`)은 linked worktree 가 공유하는 `$GIT_COMMON_DIR/info/exclude` 에 들어간다. 그래서 본 체크아웃에도 적용되며, 둘 다 본 체크아웃에서도 무시해야 하는 산출물이다.
+  - 서브모듈은 `--submodules` 로만 초기화한다. 초기화는 성공·실패와 무관하게 워크트리 git 디렉터리에 `modules/` 를 남기고, 그러면 git 이 force 없는 `worktree remove` 를 거부한다. 초기화하지 않은 서브모듈 경로에 이미 파일이 있으면 아무것도 바꾸지 않고 exit 3 으로 거부한다. prepare 는 실패한 시도가 만든 것만 되돌리고 exit 1 한다. 새 체크아웃은 git 디렉터리보다 먼저 deinit 해서 워크트리가 쓸 수 있는 체크아웃으로 남게 하고, 새 `submodule.*` 공유 설정 키는 지운다. 이전 초기화 상태와 기존 설정 값은 보존한다.
+  - 서브모듈을 초기화한 워크트리는 remove 가 수정(untracked 포함, `--untracked-files=all` 이라 `status.showUntrackedFiles` 설정으로 숨길 수 없다), HEAD 와 모든 로컬 ref(tag·notes 포함)에서 도달하는, 원격에 없는 커밋(서브모듈은 detached HEAD 다), stash 를 확인한 뒤 `--force` 를 한 번만 써서 제거한다. 이 확인은 초기화된 체크아웃뿐 아니라 워크트리 `modules/` 아래의 모든 저장소(deinit 된 서브모듈, 중첩 서브모듈 포함)에 직접 하며, 확인할 수 없는 저장소가 있으면 거부한다. 이 확인은 `--stop` 으로 세션을 정지한 뒤 제거 직전에 한 번 더 한다(정지 중에도 쓰기·커밋·stash 가 생길 수 있다). **사람이 `git worktree remove --force` 를 직접 쓰지 말 것.** 워크트리 전용 서브모듈 저장소와 미푸시 커밋이 함께 사라진다.
 
 ## 5. 필요한 변경 (Issue #21 작업 항목)
 
 | # | 항목 | 상태 |
 |---|---|---|
-| 1 | 래퍼 주입 문구·시작 명령(`--registry-dir`, 감사 로그 루트)·Output Report Path 절대경로화, `MAM_JOBS_DIR` 존중 | 이 브랜치 |
-| 2 | 루프 러너 `--worktree` / `--base` / `--review-only`, 빈 변경분 fail-closed 가드, 러너의 `MAM_JOBS_DIR` 존중 | 이 브랜치 |
-| 3 | 제어 평면 바인딩 영속(`control_plane`)·명시 전파(create/resume), stop·status·reconcile 의 `MAM_JOBS_DIR`·행 바인딩 존중 | 이 브랜치 |
-| 4 | 워크트리 준비·해체 헬퍼, resume 을 원래 cwd 로만 허용, create 의 reconcile/watchdog 기동 위치, `MAM_NO_SUBSCRIBER_DAEMON` 기본화, reconcile 의 루트 밖 cwd 재발견 거부(#17-4 셸 축소와 함께) | 대기 |
-| 5 | 리뷰 identity: (loop_id, base_sha, head_sha) 판정 기록·무효화, 리뷰어 검증 격리(detached 워크트리) | 대기 |
-| 6 | 이 설계 문서 정정 | 이 브랜치 |
-| 7 | 수용 사례 고정(실제 herdr 의 pane env 전파 포함) | 대기 |
+| 1 | 래퍼 주입 문구·시작 명령(`--registry-dir`, 감사 로그 루트)·Output Report Path 절대경로화, `MAM_JOBS_DIR` 존중 | 완료(v4.6.0) |
+| 2 | 루프 러너 `--worktree` / `--base` / `--review-only`, 빈 변경분 fail-closed 가드, 러너의 `MAM_JOBS_DIR` 존중 | 완료(v4.6.0) |
+| 3 | 제어 평면 바인딩 영속(`control_plane`)·명시 전파(create/resume), stop·status·reconcile 의 `MAM_JOBS_DIR`·행 바인딩 존중 | 완료(v4.6.0). 루프 A 에서 바인딩 계산 실패 처리·조기 종료 경로 영속 보강 |
+| 4 | 워크트리 준비·해체 헬퍼, resume 을 원래 cwd 로만 허용, create 의 reconcile/watchdog 기동 위치, `MAM_NO_SUBSCRIBER_DAEMON`(prepare 가 설정). reconcile 의 루트 밖 cwd 재발견 거부는 제한으로 남김 | 루프 A (이 브랜치) |
+| 5 | 리뷰 identity: (loop_id, base_sha, head_sha) 판정 기록·무효화, 리뷰어 검증 격리(detached 워크트리) | 루프 B (이 브랜치): 스냅샷 identity·스냅샷 diff·stale 재리뷰·승격 직전 재확인·`identity.json`(evidence), 원격 리뷰어 거부/diff-only. 리뷰 후속: dirty 서브모듈 거부(스냅샷·stale 검사), identity 모드 셀프 리뷰도 리뷰어 경로로 기록·승격, 리뷰 프롬프트의 검증 대상 단일화 |
+| 6 | 이 설계 문서 정정 | 완료(v4.6.0), 루프 A 에서 갱신 |
+| 7 | 수용 사례 고정(실제 herdr 의 pane env 전파 포함) | 루프 B (이 브랜치): 수용 사례 8건 테스트 고정(`tests/test_issue21_acceptance.py`, A1~A8). pane env 전파는 mock herdr 의 `--env` 호출 단언까지이며, 실제 herdr pane 안의 값 확인과 시험 운영은 단계 C |
 | 8 | 다중 루프 네임스페이스·리뷰어 스케줄러 | 보류 |
 
 ## 6. 리뷰어에게 묻는 것
@@ -116,12 +123,14 @@ bash "$MAIN/.agents/skills/multi-agent-mux-resume/scripts/resume_session.sh" \
 
 | 스킬 | 제어 평면 바인딩 | 워크트리 cwd 행 | 1단계 이후 남은 제한 (항목) |
 |---|---|---|---|
-| create | env 에서 결정 → 행 `control_plane` 에 항상 영속. `--workspace` 기본값과 다르면 새 pane 의 생성 호출(`pane split`/`workspace create`)에 `--env` 로 전파한다. 전파가 필요하면 idle pane 을 재사용하지 않는다(`agent start -- <args>` 는 `--` 뒤를 에이전트 인자로 넘기므로 `env K=V` 를 쓸 수 없다). 전파가 필요한데 경로에 공백이 있으면 exit 2. `~/.local/bin` wrapper 경로는 기록만 하고 경고 | pane.cwd = `--workspace` | create 가 `$WORKSPACE` 사본으로 reconcile/watchdog 기동, `MAM_NO_SUBSCRIBER_DAEMON` 미기본 (4) |
-| resume | 행 바인딩 우선(호출자 env 와 다르면 stderr 경고) 재전파. 바인딩 없는 기존 행은 호출자 바인딩으로 채움 | `--workspace` 는 원래 워크트리 경로여야 함 | 워크트리 삭제 시 재개 불가, 종료 헬퍼 (4) |
-| stop | `MAM_JOBS_DIR` > 행의 `mam_jobs_dir` > `$WORKSPACE_ROOT/.mam/jobs` 순으로 잡 조회·발행. 감사 로그도 `DELEGATE_JOB_LOGS_DIR` > 행의 `delegate_job_logs_dir` 순 | 행 cwd 로 uuid 캡처·purge | 해체 순서 헬퍼 (4) |
+| create | env 에서 결정 → 행 `control_plane` 에 항상 영속. `--workspace` 기본값과 다르면 새 pane 의 생성 호출(`pane split`/`workspace create`)에 `--env` 로 전파한다. 전파가 필요하면 idle pane 을 재사용하지 않는다(`agent start -- <args>` 는 `--` 뒤를 에이전트 인자로 넘기므로 `env K=V` 를 쓸 수 없다). 전파가 필요한데 경로에 공백이 있으면 exit 2. `~/.local/bin` wrapper 경로는 기록만 하고 경고 | pane.cwd = `--workspace`. 바인딩 계산 실패 시 워크트리면 exit 2, 제어 루트면 경고 | — (루프 A: 즉시 reconcile·watchdog 은 제어 루트 코드와 `WORKSPACE_ROOT` 로 기동, prepare 가 `MAM_NO_SUBSCRIBER_DAEMON=1`) |
+| resume | 행 바인딩 우선(호출자 env 와 다르면 stderr 경고) 재전파. 바인딩 없는 기존 행은 호출자 바인딩으로 채움. 이미 살아 있는 세션에도 바인딩을 영속한다. 계산 실패 시 워크트리면 exit 2 | 원래 cwd 로만: 경로 불일치·부재 시 exit 2 | 워크트리 삭제 시 재개 불가(대화 보존, 같은 경로에 다시 만들면 재개) |
+| stop | `MAM_JOBS_DIR` > 행의 `mam_jobs_dir` > `$WORKSPACE_ROOT/.mam/jobs` 순으로 잡 조회·발행. 감사 로그도 `DELEGATE_JOB_LOGS_DIR` > 행의 `delegate_job_logs_dir` 순 | 행 cwd 로 uuid 캡처·purge. 워크트리 해체는 `worktree_remove.sh` 가 판정(잠금·세션·잡·청결·서브모듈) 뒤에만 정지·제거, 서브모듈 워크트리는 검증 후 `--force` 1회 | — |
 | status | `MAM_JOBS_DIR`·행 `mam_jobs_dir`·감사 로그(`DELEGATE_JOB_LOGS_DIR`·행 `delegate_job_logs_dir`)·기존 후보 순 조회 | 행 cwd 로 대화 키 | — |
-| monitor/reconcile | `MAM_JOBS_DIR` 우선(정적 가드로만 검증) | 기존 행은 행 cwd 로 검증 | 루트 밖 cwd 의 미등록 세션은 자동 등록 안 됨 → create 로만 등록 (4) |
+| monitor/reconcile | `MAM_JOBS_DIR` 우선(정적 가드로만 검증) | 기존 행은 행 cwd 로 검증 | 루트 밖 cwd 의 미등록 세션은 자동 등록 안 됨 → create/prepare 로만 등록 (남은 제한) |
 | delegate-job | `--registry-dir` > `MAM_JOBS_DIR` > `.mam/jobs`(`--workdir` 기준), 모두 절대화. 발행 명령이 감사 로그 루트(`DELEGATE_JOB_LOGS_DIR`)를 고정 | 문구·명령·리포트 경로 절대 | 작은따옴표가 든 경로는 지원 범위 밖 |
-| loop | `MAM_JOBS_DIR` 존중, 래퍼에 `--registry-dir` 명시. `--worktree` 로 소스 루트 분리 | diff·base·head 만 소스 루트. **구현이 루프 밖이면 `--base <구현 전 sha> --review-only` 필수**. `--worktree`/`--base` 가 있으면 빈 변경분 거부 | 루프 하나(8), 리뷰 identity·검증 격리(5), 레거시 셸 루프(`MAM_LOOP_PY=0`)는 새 옵션 거부 |
+| loop | `MAM_JOBS_DIR` 존중, 래퍼에 `--registry-dir` 명시. `--worktree` 로 소스 루트 분리 | diff·base·head 만 소스 루트. **구현이 루프 밖이면 `--base <구현 전 sha> --review-only` 필수**. `--worktree`/`--base` 가 있으면 빈 변경분 거부 | 루프 하나(8). 원격 리뷰어는 identity 모드에서 거부(기본) 또는 diff-only(`--remote-review diff-only`); 원격 리뷰어가 트리를 검증하게 하는 스냅샷 공유(공유 원격의 `refs/mam/review/<loop_id>/<n>`)는 범위 밖. 레거시 셸 루프(`MAM_LOOP_PY=0`)는 새 옵션 거부 |
 
-실제 herdr 가 `pane split --env` / `workspace create --env` 로 pane 환경을 넘기는지는 1단계에서 mock 수준으로만 검증했다. 실제 전파는 항목 7 의 수용 사례로 고정한다.
+실제 herdr 가 `pane split --env` / `workspace create --env` 로 pane 환경을 넘기는지는 mock 수준으로만 검증했다. 수용 사례 A2 는 러너가 바인딩 4개를 `--env` 로 싣고 `agent start --` 뒤에는 싣지 않음을 고정한다. 실제 herdr pane 안에서 값이 보이는지는 단계 C 시험 운영에서 확인한다.
+
+**호환성 메모 (루프 B)**: 1단계부터 있던 `--worktree`/`--base` + 원격 리뷰어 조합은 이전에는 원격 리뷰어가 도달할 수 없는 로컬 경로를 프롬프트에 담아 진행했다. 이제는 어떤 잡도 위임하기 전에 기본으로 거부하며, `--remote-review diff-only` 로 opt-in 할 수 있다. 옵션 없는 루프는 그대로다. 스냅샷 커밋은 ref 가 없어 gc 가 정리하고(기본 2주), 리뷰 워크트리는 라운드마다 지운다.
diff --git a/tests/_mam_state_guard.py b/tests/_mam_state_guard.py
new file mode 100644
index 0000000..e90d23b
--- /dev/null
+++ b/tests/_mam_state_guard.py
@@ -0,0 +1,157 @@
+"""Issue #20 - helpers for the session guard over real control planes.
+
+A pytest process can reach two kinds of `.mam`: this checkout's own, and the
+one the agent pane's control-plane binding named before conftest's
+pytest_configure dropped it (a worktree creator's pane carries
+WORKSPACE_ROOT, AGENT_SESSIONS_YAML, MAM_JOBS_DIR and DELEGATE_JOB_LOGS_DIR,
+all at the live main checkout). The session guard snapshots their job
+registries and audit-log roots and, at the end, reports the new entries no
+live delegation explains. Pure functions, unit-tested in
+test_issue20_state_isolation.py (S4, S5); the name does not start with
+`test_`, so pytest never collects it.
+"""
+from __future__ import annotations
+
+import json
+import os
+import re
+
+SESSION_PREFIXES = ("herdr:", "remote:")
+# Top-level items of `herdr_sessions:` as atomic_dump_yaml writes them
+# (`- name: <session>` at column 0); indented `- name:` lines belong to nested
+# lists such as mcp_attachments. A regex keeps the guard free of PyYAML.
+_SESSION_LINE = re.compile(r"""^- name:\s*['"]?([^'"\s]+)""")
+
+
+def _listdir(path):
+    try:
+        return os.listdir(path)
+    except OSError:
+        return []
+
+
+def _load(path):
+    try:
+        with open(path, encoding="utf-8") as fh:
+            data = json.load(fh)
+    except (OSError, ValueError):
+        return {}
+    return data if isinstance(data, dict) else {}
+
+
+def watch_roots(repo_root, recorded):
+    """`.mam` directories to watch, realpath-deduplicated, in order: this
+    checkout's own (always, so a leak that creates it is still seen), then
+    those the recorded binding names - `$WORKSPACE_ROOT/.mam` and the parents
+    of MAM_JOBS_DIR / DELEGATE_JOB_LOGS_DIR - when they exist."""
+    roots = [os.path.realpath(os.path.join(str(repo_root), ".mam"))]
+    candidates = []
+    if recorded.get("WORKSPACE_ROOT"):
+        candidates.append(os.path.join(recorded["WORKSPACE_ROOT"], ".mam"))
+    for var in ("MAM_JOBS_DIR", "DELEGATE_JOB_LOGS_DIR"):
+        if recorded.get(var):
+            candidates.append(os.path.dirname(os.path.abspath(recorded[var])))
+    for path in candidates:
+        real = os.path.realpath(path)
+        if os.path.isdir(real) and real not in roots:
+            roots.append(real)
+    return roots
+
+
+def state_dirs(roots, recorded):
+    """(registry dirs, audit-log dirs): `<root>/jobs` and
+    `<root>/delegate_job_logs` of every root, plus a recorded MAM_JOBS_DIR /
+    DELEGATE_JOB_LOGS_DIR that is not one of those."""
+    jobs = [os.path.join(r, "jobs") for r in roots]
+    logs = [os.path.join(r, "delegate_job_logs") for r in roots]
+    for var, dirs in (("MAM_JOBS_DIR", jobs), ("DELEGATE_JOB_LOGS_DIR", logs)):
+        if recorded.get(var):
+            real = os.path.realpath(recorded[var])
+            if os.path.isdir(real) and real not in dirs:
+                dirs.append(real)
+    return jobs, logs
+
+
+def snapshot(roots, recorded):
+    """Registry records (`*.json`) and audit-log entries per watched dir; a
+    missing dir counts as empty."""
+    jobs, logs = state_dirs(roots, recorded)
+    return {
+        "jobs": {d: {n for n in _listdir(d) if n.endswith(".json")} for d in jobs},
+        "logs": {d: set(_listdir(d)) for d in logs},
+    }
+
+
+def session_names(yaml_path):
+    """Session names registered in an agent-sessions.yaml; empty if unreadable."""
+    try:
+        with open(yaml_path, encoding="utf-8", errors="replace") as fh:
+            return {m.group(1) for m in map(_SESSION_LINE.match, fh) if m}
+    except OSError:
+        return set()
+
+
+def _bare(session):
+    for prefix in SESSION_PREFIXES:
+        if session.startswith(prefix):
+            return session[len(prefix):]
+    return session
+
+
+def leaks(roots, before, recorded):
+    """New entries since `before` that no live delegation explains.
+
+    A real delegation writes its registry record before its audit log and
+    targets a registered session (registry.register_job), so a new entry is a
+    leak when
+      (a) it is an audit log whose job has no record in any watched registry, or
+      (b) its record's agent_session is missing or names no session in the
+          watched agent-sessions.yaml files.
+    Returns [{"path", "reason", "agent_session", "prompt"}] sorted by path."""
+    now = snapshot(roots, recorded)
+    yamls = [os.path.join(r, "agent-sessions.yaml") for r in roots]
+    if recorded.get("AGENT_SESSIONS_YAML"):
+        yamls.append(recorded["AGENT_SESSIONS_YAML"])
+    known = set()
+    for path in yamls:
+        known |= session_names(path)
+    records = {}
+    for d, names in now["jobs"].items():
+        for name in names:
+            records.setdefault(name[:-len(".json")], os.path.join(d, name))
+
+    found = []
+
+    def judge(path, meta, reason=None):
+        session = meta.get("agent_session")
+        if reason is None:
+            if not session:
+                reason = "no agent_session"
+            elif _bare(session) not in known:
+                reason = "agent_session names no registered session"
+            else:
+                return
+        found.append({"path": path, "reason": reason, "agent_session": session,
+                      "prompt": str(meta.get("prompt", ""))[:60]})
+
+    for d, names in now["jobs"].items():
+        for name in names - before["jobs"].get(d, set()):
+            path = os.path.join(d, name)
+            judge(path, _load(path))
+    for d, names in now["logs"].items():
+        for name in names - before["logs"].get(d, set()):
+            path = os.path.join(d, name)
+            if name in records:
+                judge(path, _load(records[name]))
+            else:
+                judge(path, _load(os.path.join(path, "meta.json")), "audit log without a registry record")
+    return sorted(found, key=lambda f: f["path"])
+
+
+def describe(found):
+    """Failure message for the session guard."""
+    lines = ["Issue #20: {} entr{} made during this session in a real control plane "
+             "(left in place; check and remove by hand):".format(len(found), "y" if len(found) == 1 else "ies")]
+    lines += ["  {path}  [{reason}]  agent_session={agent_session!r}  prompt={prompt!r}".format(**f)
+              for f in found]
+    return "\n".join(lines)
diff --git a/tests/conftest.py b/tests/conftest.py
index 32587ad..14ee7ac 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -109,6 +109,74 @@ def _pid_alive(pid):
     return bool(state) and not state.startswith("Z")
 
 
+# ==============================================================================
+# Issue #20: test state stays out of every real control plane.
+#
+# An agent pane can carry a control-plane binding: a worktree creator's pane
+# gets WORKSPACE_ROOT, AGENT_SESSIONS_YAML, MAM_JOBS_DIR and
+# DELEGATE_JOB_LOGS_DIR pointing at the live main checkout (create/resume
+# forward the row's control_plane), and each of them wins over a test's own
+# WORKSPACE_ROOT (mqtt_common.default_registry_dir/get_logs_dir, lib.sh's
+# AGENT_SESSIONS_YAML). pytest_configure records the binding and drops it
+# before collection - a session fixture is too late for a module that copies
+# os.environ at import (test_orc_onboard.SCRUBBED_ENV). WORKSPACE_ROOT is
+# dropped only when it names another checkout; naming this one, it is what
+# lib.sh derives anyway. Every test then defaults to a registry and an
+# audit-log root under its own tmp_path, and a session guard (next to the #19
+# one) reports new entries in the recorded control planes.
+# ==============================================================================
+_REPO_ROOT = Path(__file__).resolve().parent.parent
+_TESTS_DIR = str(Path(__file__).resolve().parent)
+if _TESTS_DIR not in sys.path:
+    sys.path.insert(0, _TESTS_DIR)
+import _mam_state_guard  # noqa: E402
+
+_BINDING_VARS = ("WORKSPACE_ROOT", "AGENT_SESSIONS_YAML", "MAM_JOBS_DIR", "DELEGATE_JOB_LOGS_DIR")
+_RECORDED_BINDING = {}
+_DROPPED_BINDING = pytest.StashKey[dict]()
+
+
+def pytest_configure(config):
+    _RECORDED_BINDING.clear()
+    _RECORDED_BINDING.update({k: os.environ[k] for k in _BINDING_VARS if os.environ.get(k)})
+    dropped = {k: os.environ.pop(k) for k in ("AGENT_SESSIONS_YAML", "MAM_JOBS_DIR", "DELEGATE_JOB_LOGS_DIR")
+               if k in os.environ}
+    ws = os.environ.get("WORKSPACE_ROOT")
+    if ws and os.path.realpath(ws) != str(_REPO_ROOT):
+        dropped["WORKSPACE_ROOT"] = os.environ.pop("WORKSPACE_ROOT")
+    config.stash[_DROPPED_BINDING] = dropped
+
+
+def pytest_unconfigure(config):
+    # Back for callers that run pytest.main() in-process.
+    os.environ.update(config.stash.get(_DROPPED_BINDING, {}))
+
+
+@pytest.fixture(scope="session")
+def _ambient_control_plane():
+    """The binding pytest_configure recorded (and dropped), as a copy."""
+    return dict(_RECORDED_BINDING)
+
+
+@pytest.fixture(autouse=True)
+def _isolate_mam_state_dirs(_ambient_control_plane, tmp_path, monkeypatch):
+    """Default registry and audit-log roots under this test's tmp_path; only
+    the env is set, nothing is created. mam_sandbox and a test's own
+    setenv/delenv run after this autouse fixture and win, and the shared
+    function-scope monkeypatch undoes them in LIFO order. A hidden directory,
+    so tests that use tmp_path/"jobs" as their own registry or list tmp_path
+    are unaffected. Takes _ambient_control_plane to state the order, not to
+    rely on it."""
+    state = tmp_path / ".mam-test-state"
+    monkeypatch.setenv("MAM_JOBS_DIR", str(state / "jobs"))
+    monkeypatch.setenv("DELEGATE_JOB_LOGS_DIR", str(state / "delegate_job_logs"))
+    # Issue #28: a workspace whose real .mam.env names a reachable broker made
+    # "broker unavailable" tests (T1-4) read it through the wrapper's env loader.
+    # Point every test at an absent env file; a test that wants a real broker
+    # config sets MAM_ENV_FILE itself.
+    monkeypatch.setenv("MAM_ENV_FILE", str(state / ".mam.env.absent"))
+
+
 @pytest.fixture
 def mam_sandbox(tmp_path, monkeypatch, request):
     """
@@ -1381,10 +1449,27 @@ def _drop_ambient_mam_version():
             os.environ["MAM_VERSION"] = previous
 
 
+@pytest.fixture(scope="session", autouse=True)
+def mam_state_leak_guard(_ambient_control_plane):
+    """Issue #20: no test may leave a record in a real `.mam/jobs` or an audit
+    log in a real `.mam/delegate_job_logs` - this checkout's, or the control
+    plane the ambient binding named before pytest_configure dropped it.
+    Delegations the live system runs meanwhile are told apart by
+    _mam_state_guard.leaks (record first, registered session). The per-test
+    defaults are the fix, this is the regression alarm; it reports and never
+    deletes - these are real control planes. The session registry yaml/db is
+    not hashed: reconcile and create write it during a run."""
+    roots = _mam_state_guard.watch_roots(_REPO_ROOT, _ambient_control_plane)
+    before = _mam_state_guard.snapshot(roots, _ambient_control_plane)
+    yield
+    found = _mam_state_guard.leaks(roots, before, _ambient_control_plane)
+    assert not found, _mam_state_guard.describe(found)
+
+
 @pytest.fixture(scope="session", autouse=True)
 def subscriber_daemon_leak_guard(tmp_path_factory):
     """Issue #19: no `reconcile.sh --subscribe` daemon anchored in this session's
-    pytest basetemp may survive the suite. Mirrors the #15 registry guard: the
+    pytest basetemp may survive the suite. Mirrors the #20 state guard: the
     per-sandbox finalizer is the fix, this is the regression alarm. Leftovers
     are reaped after being reported so a failing run still cleans up."""
     yield
diff --git a/tests/test_deploy_freshness.py b/tests/test_deploy_freshness.py
index 52a1218..faa6365 100644
--- a/tests/test_deploy_freshness.py
+++ b/tests/test_deploy_freshness.py
@@ -279,12 +279,19 @@ def _resolve_private_server_doc() -> str:
 
 
 PRIVATE_SERVER_DOC_PATH = _resolve_private_server_doc()
+# Issue #28: these guards read the nats-docker submodule. A checkout without
+# `git submodule update --init` has nothing to check; skip with the reason
+# instead of failing on every host that cloned without submodules.
+needs_private_server_doc = pytest.mark.skipif(
+    not os.path.exists(PRIVATE_SERVER_DOC_PATH),
+    reason="nats-docker submodule not initialized (git submodule update --init)")
 
 
 # --------------------------------------------------------------------------
 # D-11 — (G-D1) PRIVATE_SERVER.md must only document MQTT_* environment
 #        variables that broker_config_from_env() actually parses.
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d11_private_server_env_names_valid():
     sys.path.insert(0, os.path.join(REPO_ROOT, ".agents", "skills", "multi-agent-mux-delegate-job", "scripts"))
     import mqtt_common
@@ -315,6 +322,7 @@ def test_d11_private_server_env_names_valid():
 # D-12 — (G-D2) PRIVATE_SERVER.md must not contain invalid MAM_MQTT_* in
 #        active configuration code blocks.
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d12_private_server_no_mam_mqtt_in_code_fences():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -331,6 +339,7 @@ def test_d12_private_server_no_mam_mqtt_in_code_fences():
 # D-13 — (G-D3) nats-server launch instructions in PRIVATE_SERVER.md must
 #        use valid config blocks (mqtt {) and not HTTP port flag (-m 1883).
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d13_private_server_nats_config_valid():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -347,6 +356,7 @@ def test_d13_private_server_nats_config_valid():
 # D-14 — (G-D4) Verification commands in PRIVATE_SERVER.md must use valid
 #        CLI flags matching the actual scripts' argparse parsers.
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d14_private_server_cli_args_valid():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -367,6 +377,7 @@ def test_d14_private_server_cli_args_valid():
 # D-15 — (G-D5) store_dir in code blocks must be absolute path (/ or $HOME)
 #        and heredocs writing it must be unquoted (<<EOF).
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d15_private_server_store_dir_valid():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -388,6 +399,7 @@ def test_d15_private_server_store_dir_valid():
 # --------------------------------------------------------------------------
 # D-16 — (G-D6) nats image references in code fences must use pinned alpine
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d16_private_server_nats_image_alpine_pinned():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -404,6 +416,7 @@ def test_d16_private_server_nats_image_alpine_pinned():
 # --------------------------------------------------------------------------
 # D-17 — (G-D7) Port 8222 in docker examples must be bound to 127.0.0.1
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d17_private_server_monitoring_port_localhost_bound():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -421,6 +434,7 @@ def test_d17_private_server_monitoring_port_localhost_bound():
 # --------------------------------------------------------------------------
 # D-18 — (G-D8) TLS examples must not use IP literals for MQTT_BROKER
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d18_private_server_tls_examples_use_domain_names():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -437,6 +451,7 @@ def test_d18_private_server_tls_examples_use_domain_names():
 # --------------------------------------------------------------------------
 # D-19 — (G-D9) Subject literals in config examples match DEFAULT_TOPIC_ROOT
 # --------------------------------------------------------------------------
+@needs_private_server_doc
 def test_d19_private_server_subject_literals_match_default_topic_root():
     doc_path = PRIVATE_SERVER_DOC_PATH
     with open(doc_path, "r", encoding="utf-8") as f:
@@ -492,6 +507,9 @@ def _resolve_docker_dir() -> str:
 
 DOCKER_DIR = _resolve_docker_dir()
 COMPOSE_PATH = os.path.join(DOCKER_DIR, "docker-compose.yaml")
+needs_docker_assets = pytest.mark.skipif(
+    not os.path.exists(COMPOSE_PATH),
+    reason="nats-docker submodule not initialized (git submodule update --init)")
 NATS_CONF_PATH = os.path.join(DOCKER_DIR, "nats.conf")
 ENV_EXAMPLE_PATH = os.path.join(DOCKER_DIR, ".env.example")
 DOCKER_README_PATH = os.path.join(DOCKER_DIR, "README.md")
@@ -523,6 +541,7 @@ def _active_conf_lines():
 # --------------------------------------------------------------------------
 # D-22 — docker/ assets exist and are populated
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d22_docker_assets_exist_and_are_populated():
     for p in [COMPOSE_PATH, NATS_CONF_PATH, ENV_EXAMPLE_PATH, DOCKER_README_PATH]:
         assert os.path.exists(p), f"Required asset {p} does not exist"
@@ -533,6 +552,7 @@ def test_d22_docker_assets_exist_and_are_populated():
 # --------------------------------------------------------------------------
 # D-23 — compose image matches doc and is alpine
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d23_compose_image_matches_doc_and_is_alpine():
     _, svc = _load_compose()
     compose_img = svc.get("image", "")
@@ -552,6 +572,7 @@ def test_d23_compose_image_matches_doc_and_is_alpine():
 # --------------------------------------------------------------------------
 # D-24 — compose port exposure contract
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d24_compose_port_exposure_contract():
     _, svc = _load_compose()
     ports = svc.get("ports", [])
@@ -573,6 +594,7 @@ def test_d24_compose_port_exposure_contract():
 # --------------------------------------------------------------------------
 # D-25 — secrets are fail closed
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d25_secrets_are_fail_closed():
     _, svc = _load_compose()
     env = svc.get("environment", {})
@@ -615,6 +637,7 @@ def test_d25_secrets_are_fail_closed():
 # --------------------------------------------------------------------------
 # D-26 — nats_conf jetstream and mqtt contract
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d26_nats_conf_jetstream_and_mqtt_contract():
     _, svc = _load_compose()
     volumes = svc.get("volumes", [])
@@ -645,6 +668,7 @@ def test_d26_nats_conf_jetstream_and_mqtt_contract():
 # --------------------------------------------------------------------------
 # D-27 — observer permissions match topic root
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d27_observer_permissions_match_topic_root():
     sys.path.insert(0, os.path.join(REPO_ROOT, ".agents", "skills", "multi-agent-mux-delegate-job", "scripts"))
     import mqtt_common
@@ -666,6 +690,7 @@ def test_d27_observer_permissions_match_topic_root():
 # --------------------------------------------------------------------------
 # D-28 — healthcheck contract and image coupling
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d28_healthcheck_contract_and_image_coupling():
     _, svc = _load_compose()
     hc = svc.get("healthcheck")
@@ -684,6 +709,7 @@ def test_d28_healthcheck_contract_and_image_coupling():
 # --------------------------------------------------------------------------
 # D-29 — env secrets never tracked
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d29_env_secrets_never_tracked():
     is_submodule = os.path.exists(os.path.join(REPO_ROOT, ".gitmodules")) and "nats-docker" in DOCKER_DIR
     target_repo = os.path.join(REPO_ROOT, "nats-docker") if is_submodule else REPO_ROOT
@@ -703,6 +729,7 @@ def test_d29_env_secrets_never_tracked():
 # --------------------------------------------------------------------------
 # D-30 — websocket origin policy is startable
 # --------------------------------------------------------------------------
+@needs_docker_assets
 def test_d30_websocket_origin_policy_is_startable():
     active_lines = _active_conf_lines()
     active_text = "\n".join(active_lines)
diff --git a/tests/test_issue14_delivery_ack.py b/tests/test_issue14_delivery_ack.py
index 0ad19c9..eec2e3e 100644
--- a/tests/test_issue14_delivery_ack.py
+++ b/tests/test_issue14_delivery_ack.py
@@ -510,22 +510,29 @@ def test_wrapper_idle_grace_never_outlives_the_wall_clock(tmp_path):
     import calendar
     closed_at = calendar.timegm(time.strptime(job_data["updated_at"], "%Y-%m-%dT%H:%M:%SZ"))
     close_delay = closed_at - started
-    assert close_delay <= timeout_s + 8, f"idle grace outlived --timeout {timeout_s}s: closed after {close_delay:.0f}s\n{stderr}"
+    # Under full-suite load the wrapper's final poll, close and registry write
+    # have landed 8-9 s past the deadline (three full runs); the defect this
+    # pins was a close at ~2 x TIMEOUT, so a 15 s margin still separates them.
+    assert close_delay <= timeout_s + 15, f"idle grace outlived --timeout {timeout_s}s: closed after {close_delay:.0f}s\n{stderr}"
 
 
 # ---------------------------------------------------------------------------
 # publish_event: a heartbeat reaches events.log before the wire publish
 # ---------------------------------------------------------------------------
 def _job_for_inprocess_publish(tmp_path, monkeypatch):
-    """A registered job in a private registry. The audit log resolves against
-    the cwd, so it lands under tmp_path too, and no real .mam.env is read."""
-    from lib_py.delegation import registry
+    """A registered job in a private registry. Its audit log goes to the
+    per-test default under tmp_path (conftest, Issue #20): deleting
+    DELEGATE_JOB_LOGS_DIR here, to fall back to the cwd, fell through to an
+    ambient WORKSPACE_ROOT instead - the real .mam/delegate_job_logs (PR #22
+    rec 4). No real .mam.env is read."""
+    from lib_py.delegation import mqtt_common, registry
 
     monkeypatch.chdir(tmp_path)
-    monkeypatch.delenv("DELEGATE_JOB_LOGS_DIR", raising=False)
     monkeypatch.setenv("MAM_ENV_FILE", str(tmp_path / ".mam.env.absent"))
     reg_dir = tmp_path / "jobs"
     jid = registry.register_job("issue 14 heartbeat order", registry_dir=str(reg_dir))
+    logs = Path(mqtt_common.get_logs_dir())
+    assert tmp_path in logs.parents and (logs / jid).is_dir(), logs
     return reg_dir, jid
 
 
diff --git a/tests/test_issue15_registry_isolation.py b/tests/test_issue15_registry_isolation.py
index a1f232f..e1b9316 100644
--- a/tests/test_issue15_registry_isolation.py
+++ b/tests/test_issue15_registry_isolation.py
@@ -16,12 +16,13 @@ import json
 import os
 import subprocess
 import sys
+import uuid
 from pathlib import Path
 
+import _mam_state_guard
+
 REPO_ROOT = Path(__file__).resolve().parent.parent
 SKILLS = REPO_ROOT / ".agents" / "skills"
-REAL_JOBS = REPO_ROOT / ".mam" / "jobs"
-REAL_LOGS = REPO_ROOT / ".mam" / "delegate_job_logs"
 
 sys.path.insert(0, str(SKILLS))
 from lib_py.delegation import mqtt_common  # noqa: E402
@@ -67,8 +68,10 @@ def test_logs_dir_follows_the_same_order(monkeypatch, tmp_path):
 
 def test_cli_defaults_are_resolved_per_process(monkeypatch, tmp_path):
     """registry.py / publish_event.py build their argparse defaults at call
-    time, so a process started with WORKSPACE_ROOT set registers there."""
+    time, so a process started with WORKSPACE_ROOT set registers there - and
+    seeds its audit log there too."""
     monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
+    monkeypatch.delenv("DELEGATE_JOB_LOGS_DIR", raising=False)
     env = dict(os.environ, WORKSPACE_ROOT=str(tmp_path), PYTHONPATH=f"{SKILLS}:{os.environ.get('PYTHONPATH', '')}")
     env.pop("MAM_JOBS_DIR", None)
     res = subprocess.run(
@@ -80,6 +83,7 @@ def test_cli_defaults_are_resolved_per_process(monkeypatch, tmp_path):
     records = list((tmp_path / ".mam" / "jobs").glob("*.json"))
     assert len(records) == 1, records
     assert json.loads(records[0].read_text())["agent_session"] == "herdr:issue15-probe"
+    assert (tmp_path / ".mam" / "delegate_job_logs" / records[0].stem).is_dir()
 
 
 # ---------------------------------------------------------------------------
@@ -95,26 +99,65 @@ def _create_session_from_repo_root(sandbox: Path, session: str) -> subprocess.Co
     )
 
 
-def _assert_registered_in_sandbox_only(sandbox: Path, session: str, before_jobs: set, before_logs: set, res):
+def _real_state_dirs(recorded: dict) -> list:
+    """Every real registry and audit-log root this run could leak into: this
+    checkout's .mam and the control plane the ambient binding named (conftest
+    records it before dropping it)."""
+    jobs, logs = _mam_state_guard.state_dirs(_mam_state_guard.watch_roots(REPO_ROOT, recorded), recorded)
+    return jobs + logs
+
+
+def _entries(dirs: list) -> set:
+    return {(d, name) for d in dirs for name in _listing(Path(d))}
+
+
+def _unique(prefix: str) -> str:
+    """A session name no concurrent run shares (Issue #20)."""
+    return f"{prefix}-{uuid.uuid4().hex[:8]}"
+
+
+def _assert_registered_in_sandbox_only(sandbox: Path, session: str, real_dirs: list, before: set, res):
+    """Judged on this test's own job ids and session only (Issue #20): live
+    delegations and other test runs may add entries to the real .mam
+    meanwhile, so comparing whole listings gave false failures."""
     assert res.returncode == 0, res.stderr + res.stdout
-    assert _listing(REAL_JOBS) == before_jobs, "onboarding job leaked into the repo's .mam/jobs"
-    assert _listing(REAL_LOGS) == before_logs, "audit log leaked into the repo's .mam/delegate_job_logs"
-    records = [json.loads(p.read_text()) for p in (sandbox / ".mam" / "jobs").glob("*.json")]
-    assert any(r.get("agent_session") == f"herdr:{session}" for r in records), records
+    records = {p.stem: json.loads(p.read_text()) for p in (sandbox / ".mam" / "jobs").glob("*.json")}
+    own = [jid for jid, r in records.items() if r.get("agent_session") == f"herdr:{session}"]
+    assert own, records
+    for d in real_dirs:
+        for jid in own:
+            assert not (Path(d) / f"{jid}.json").exists(), f"onboarding job {jid} leaked into {d}"
+            assert not (Path(d) / jid).exists(), f"audit log {jid} leaked into {d}"
+    # A job that never reached the sandbox has an id we do not know: look for
+    # the session in whatever appeared in the real roots meanwhile.
+    for d, name in _entries(real_dirs) - before:
+        entry = Path(d) / name
+        meta = entry if name.endswith(".json") else entry / "meta.json"
+        try:
+            session_of = json.loads(meta.read_text()).get("agent_session")
+        except (OSError, ValueError):
+            continue
+        assert session_of != f"herdr:{session}", f"onboarding job for {session} leaked: {entry}"
 
 
-def test_onboarding_job_stays_in_sandbox_with_explicit_env(mam_sandbox, mock_herdr, mock_agents):
-    before_jobs, before_logs = _listing(REAL_JOBS), _listing(REAL_LOGS)
-    res = _create_session_from_repo_root(mam_sandbox, "issue15-explicit-creator-claude")
-    _assert_registered_in_sandbox_only(mam_sandbox, "issue15-explicit-creator-claude", before_jobs, before_logs, res)
+def test_onboarding_job_stays_in_sandbox_with_explicit_env(mam_sandbox, mock_herdr, mock_agents,
+                                                           _ambient_control_plane):
+    session = _unique("issue15-explicit-creator-claude")
+    real_dirs = _real_state_dirs(_ambient_control_plane)
+    before = _entries(real_dirs)
+    res = _create_session_from_repo_root(mam_sandbox, session)
+    _assert_registered_in_sandbox_only(mam_sandbox, session, real_dirs, before, res)
 
 
-def test_onboarding_job_follows_workspace_root_alone(mam_sandbox, mock_herdr, mock_agents, monkeypatch):
+def test_onboarding_job_follows_workspace_root_alone(mam_sandbox, mock_herdr, mock_agents, monkeypatch,
+                                                     _ambient_control_plane):
     """Without the explicit MAM_JOBS_DIR / DELEGATE_JOB_LOGS_DIR overrides the
     WORKSPACE_ROOT that lib.sh exports must be enough to keep the record out
     of the repo's registry."""
     monkeypatch.delenv("MAM_JOBS_DIR", raising=False)
     monkeypatch.delenv("DELEGATE_JOB_LOGS_DIR", raising=False)
-    before_jobs, before_logs = _listing(REAL_JOBS), _listing(REAL_LOGS)
-    res = _create_session_from_repo_root(mam_sandbox, "issue15-wsroot-creator-claude")
-    _assert_registered_in_sandbox_only(mam_sandbox, "issue15-wsroot-creator-claude", before_jobs, before_logs, res)
+    session = _unique("issue15-wsroot-creator-claude")
+    real_dirs = _real_state_dirs(_ambient_control_plane)
+    before = _entries(real_dirs)
+    res = _create_session_from_repo_root(mam_sandbox, session)
+    _assert_registered_in_sandbox_only(mam_sandbox, session, real_dirs, before, res)
diff --git a/tests/test_issue18_liveness_contract.py b/tests/test_issue18_liveness_contract.py
index 0ef2738..d2839dd 100644
--- a/tests/test_issue18_liveness_contract.py
+++ b/tests/test_issue18_liveness_contract.py
@@ -25,6 +25,7 @@ from __future__ import annotations
 
 import json
 import os
+import re
 import signal
 import subprocess
 import sys
@@ -1160,17 +1161,49 @@ def test_acceptance3_lost_heartbeats_close_the_job_and_a_late_completed_is_refus
 # 6. remote transport (broker): no shared disk, no pane, only the wire
 # ---------------------------------------------------------------------------
 
+def _skip_if_broker_did_not_deliver(reg: Path, runner_log: Path) -> None:
+    """acceptance5 runs over a public broker. The remote runner already covers
+    the idle window with `started --heartbeat` (remote.py handle_dispatch). The
+    observed failures were of one kind: the runner published started and
+    completed successfully, the orchestrator had subscribed to the right topic,
+    and it received nothing at all for the job - the broker did not deliver.
+    Only that proven non-delivery skips; a drop (HMAC, identity), a wrong
+    topic, or a runner that failed to publish still fails."""
+    log = runner_log.read_text(errors="replace")
+    m = re.search(r"published started seq=1 job=(\w+)", log)
+    if not m:
+        return
+    jid = m.group(1)
+    rec = reg / f"{jid}.json"
+    if not rec.exists():
+        return
+    topic = json.loads(rec.read_text()).get("topic_prefix") or ""
+    out = reg / f"{jid}.subscriber.out"
+    sub = out.read_text(errors="replace") if out.exists() else ""
+    if (topic and f"SUBSCRIBED {topic}/events" in sub
+            and f"job={jid}" not in sub and f"drop event for job {jid}" not in sub):
+        pytest.skip(f"public broker did not deliver the runner's events to the orchestrator "
+                    f"(runner published started for {jid}; subscriber received nothing for it)")
+
+
 def test_acceptance5_remote_runner_completes_a_job_over_the_broker_only(tmp_path):
     orch = tmp_path / "orchestrator"
     remote = tmp_path / "remote-host"
     for d in (orch, remote):
         (d / "jobs").mkdir(parents=True)
-    secret = "issue18-shared-secret"
+    # A fresh session name and secret per run: dispatches are retained on the
+    # (public) broker and the runner subscribes to every job's dispatch topic,
+    # so with fixed values a stale dispatch left by an earlier run was served
+    # instead of this run's job, which then timed out (observed: runner DONE
+    # for one job id, the orchestrator waiting on another).
+    tag = os.urandom(4).hex()
+    session = f"sim-worker-{tag}"
+    secret = f"issue18-shared-secret-{tag}"
     runner_env = _env(remote, {"MAM_DISPATCH_SECRET": secret, "MAM_JOBS_DIR": str(remote / "jobs")})
     runner_log = remote / "runner.log"
     with open(runner_log, "wb") as log:
         runner = subprocess.Popen(
-            [sys.executable, str(REMOTE_PY), "run", "--session", "sim-worker", "--registry-dir", str(remote / "jobs"),
+            [sys.executable, str(REMOTE_PY), "run", "--session", session, "--registry-dir", str(remote / "jobs"),
              "--exec", 'echo "remote work done for $JOB_ID"', "--once", "--timeout", "150"],
             cwd=str(remote), env=runner_env, stdout=log, stderr=subprocess.STDOUT)
     try:
@@ -1181,13 +1214,22 @@ def test_acceptance5_remote_runner_completes_a_job_over_the_broker_only(tmp_path
             pytest.skip("broker unreachable: " + runner_log.read_text(errors="replace")[-300:])
 
         reg = orch / "jobs"
-        proc, env = _submit(orch, reg, "remote:sim-worker", "remote",
-                            ["--heartbeat", "2", "--heartbeat-misses", "3", "--ack-timeout", "60"],
+        proc, env = _submit(orch, reg, f"remote:{session}", "remote",
+                            ["--heartbeat", "2", "--heartbeat-misses", "10", "--ack-timeout", "60"],
                             env_extra={"MAM_DISPATCH_SECRET": secret}, timeout_s=120)
         stdout, stderr = proc.communicate(timeout=180)
         jid = _wait_job_id(reg)
+        if proc.returncode != 0:
+            if ("no CONNACK from broker" in stderr
+                    and "published started" not in runner_log.read_text(errors="replace")):
+                pytest.skip("broker unreachable when publishing the dispatch (no CONNACK); the runner never saw the job")
+            _skip_if_broker_did_not_deliver(reg, runner_log)
         assert proc.returncode == 0, f"rc={proc.returncode}\n{stdout}\n{stderr}\nrunner:\n{runner_log.read_text()}"
-        assert "subscriber received started" in stderr or "advanced to 'running'" in stderr
+        # delivery is confirmed by the protocol: the subscriber saw `started`, or
+        # the registry left pending - to running, or straight to completed when
+        # the broker delivered only the retained terminal event
+        assert ("subscriber received started" in stderr or "advanced to 'running'" in stderr
+                or "advanced to 'completed'" in stderr), stderr
         assert _job(reg, jid)["status"] == "completed", \
             f"the subscriber mirrors the remote terminal into the registry\n{stdout}\n{stderr}\nrunner:\n{runner_log.read_text()}"
         assert _job(reg, jid)["transport"] == "remote"
diff --git a/tests/test_issue20_state_isolation.py b/tests/test_issue20_state_isolation.py
new file mode 100644
index 0000000..128bf38
--- /dev/null
+++ b/tests/test_issue20_state_isolation.py
@@ -0,0 +1,202 @@
+#!/usr/bin/env python3
+"""Issue #20 - test state stays out of every real control plane.
+
+conftest records the control-plane binding an agent pane carries and drops it
+before collection (pytest_configure), gives every test a registry and an
+audit-log root under its own tmp_path (_isolate_mam_state_dirs), and a
+session guard reports new entries in a real `.mam/jobs` or
+`.mam/delegate_job_logs` (mam_state_leak_guard, helpers in _mam_state_guard).
+"""
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+import _mam_state_guard as guard
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+SKILLS = REPO_ROOT / ".agents" / "skills"
+
+
+def _fake_control_plane(root: Path, sessions=()) -> Path:
+    """A checkout-shaped tree with a `.mam` registry, audit-log root and session yaml."""
+    mam = root / ".mam"
+    (mam / "jobs").mkdir(parents=True)
+    (mam / "delegate_job_logs").mkdir()
+    rows = "".join(f"- name: {s}\n  status: running\n  mcp_attachments:\n  - name: stitch\n" for s in sessions)
+    (mam / "agent-sessions.yaml").write_text("herdr_sessions:\n" + rows if rows else "herdr_sessions: []\n")
+    return root
+
+
+def _record(mam: Path, jid: str, session) -> None:
+    rec = {"job_id": jid, "prompt": f"prompt of {jid}"}
+    if session:
+        rec["agent_session"] = session
+    (mam / "jobs" / f"{jid}.json").write_text(json.dumps(rec))
+
+
+def _log(mam: Path, jid: str, session=None) -> None:
+    d = mam / "delegate_job_logs" / jid
+    d.mkdir()
+    if session:
+        (d / "meta.json").write_text(json.dumps({"job_id": jid, "agent_session": session}))
+
+
+# ---------------------------------------------------------------------------
+# the session guard (S4, S5)
+# ---------------------------------------------------------------------------
+def test_s4_guard_flags_only_entries_no_live_delegation_explains(tmp_path):
+    main = _fake_control_plane(tmp_path / "main", sessions=("creator-real",))
+    mam = main / ".mam"
+    _record(mam, "old00001", "herdr:nobody")        # before the snapshot: not judged
+    _log(mam, "old00001")
+    recorded = {"WORKSPACE_ROOT": str(main)}
+    roots = guard.watch_roots(tmp_path / "repo", recorded)
+    before = guard.snapshot(roots, recorded)
+
+    _record(mam, "live0001", "herdr:creator-real")  # a live delegation: record first, registered session
+    _log(mam, "live0001", "herdr:creator-real")
+    _record(mam, "live0002", "remote:creator-real")
+    _log(mam, "orphan01", "herdr:creator-real")     # (a) audit log with no record, even for a known session
+    _record(mam, "stray001", "herdr:nobody")         # (b) unknown session
+    _record(mam, "stitch01", "herdr:stitch")         # (b) `stitch` is an mcp attachment, not a session
+    _record(mam, "anon0001", None)                   # (b) no session at all
+
+    found = {Path(f["path"]).name: f for f in guard.leaks(roots, before, recorded)}
+    assert sorted(found) == ["anon0001.json", "orphan01", "stitch01.json", "stray001.json"], found
+    assert found["orphan01"]["reason"] == "audit log without a registry record"
+    assert found["anon0001.json"]["reason"] == "no agent_session"
+    assert found["stray001.json"]["reason"] == "agent_session names no registered session"
+    assert found["stray001.json"]["prompt"] == "prompt of stray001"
+    assert "orphan01" in guard.describe(list(found.values()))
+
+
+def test_s5_watch_roots_follow_the_recorded_binding(tmp_path):
+    repo = _fake_control_plane(tmp_path / "repo")
+    main = _fake_control_plane(tmp_path / "main")
+    (tmp_path / "main-link").symlink_to(main)
+    own, other = str((repo / ".mam").resolve()), str((main / ".mam").resolve())
+
+    assert guard.watch_roots(repo, {}) == [own]
+    # WORKSPACE_ROOT naming this checkout is counted once
+    assert guard.watch_roots(repo, {"WORKSPACE_ROOT": str(repo)}) == [own]
+    # a worktree creator's pane: all four at another checkout, reached through a symlink too
+    pane = {"WORKSPACE_ROOT": str(tmp_path / "main-link"),
+            "AGENT_SESSIONS_YAML": str(main / ".mam" / "agent-sessions.yaml"),
+            "MAM_JOBS_DIR": str(main / ".mam" / "jobs"),
+            "DELEGATE_JOB_LOGS_DIR": str(main / ".mam" / "delegate_job_logs")}
+    assert guard.watch_roots(repo, pane) == [own, other]
+    # a recorded root that does not exist is skipped; the checkout's own .mam never is
+    bare = tmp_path / "bare"
+    assert guard.watch_roots(bare, {"WORKSPACE_ROOT": str(tmp_path / "gone")}) == [str((bare / ".mam").resolve())]
+    # a registry outside any <root>/jobs is watched directly
+    odd = tmp_path / "elsewhere" / "registry"
+    odd.mkdir(parents=True)
+    rec = {"MAM_JOBS_DIR": str(odd)}
+    jobs, logs = guard.state_dirs(guard.watch_roots(repo, rec), rec)
+    assert str(odd.resolve()) in jobs and str(odd.resolve()) not in logs
+
+
+# ---------------------------------------------------------------------------
+# per-test defaults and the dropped binding (S1-S3, S6, S7)
+# ---------------------------------------------------------------------------
+# Copied at import, like test_orc_onboard.SCRUBBED_ENV: the binding has to be
+# gone before collection, not merely before the first test (S6).
+_IMPORT_ENV = dict(os.environ)
+PROBE_ENV = "MAM_ISSUE20_PROBE"
+BINDING = ("WORKSPACE_ROOT", "AGENT_SESSIONS_YAML", "MAM_JOBS_DIR", "DELEGATE_JOB_LOGS_DIR")
+
+
+def _tree(root: Path) -> dict:
+    return {str(p.relative_to(root)): hashlib.sha256(p.read_bytes()).hexdigest() if p.is_file() else None
+            for p in sorted(root.rglob("*"))}
+
+
+def _binding(root: Path) -> dict:
+    """The four variables a worktree creator's pane carries, aimed at `root`."""
+    mam = root / ".mam"
+    return {"WORKSPACE_ROOT": str(root), "AGENT_SESSIONS_YAML": str(mam / "agent-sessions.yaml"),
+            "MAM_JOBS_DIR": str(mam / "jobs"), "DELEGATE_JOB_LOGS_DIR": str(mam / "delegate_job_logs")}
+
+
+def test_s1_every_test_defaults_to_state_dirs_under_tmp_path(tmp_path, monkeypatch):
+    from lib_py.delegation import mqtt_common
+
+    state = tmp_path / ".mam-test-state"
+    assert os.environ["MAM_JOBS_DIR"] == str(state / "jobs")
+    assert os.environ["DELEGATE_JOB_LOGS_DIR"] == str(state / "delegate_job_logs")
+    # a WORKSPACE_ROOT on a checkout with a .mam no longer decides where state goes
+    monkeypatch.setenv("WORKSPACE_ROOT", str(_fake_control_plane(tmp_path / "repo")))
+    assert mqtt_common.default_registry_dir() == str(state / "jobs")
+    assert mqtt_common.get_logs_dir() == str(state / "delegate_job_logs")
+
+
+def test_s2_mam_sandbox_overrides_the_default(mam_sandbox):
+    assert os.environ["MAM_JOBS_DIR"] == str(mam_sandbox / ".mam" / "jobs")
+    assert os.environ["DELEGATE_JOB_LOGS_DIR"] == str(mam_sandbox / ".mam" / "delegate_job_logs")
+
+
+def test_s3_submit_with_workspace_root_on_a_checkout_leaves_its_mam_alone(tmp_path):
+    """The issue's acceptance check in small: WORKSPACE_ROOT names a checkout
+    with a real-looking .mam and the test sets nothing else."""
+    repo = _fake_control_plane(tmp_path / "repo", sessions=("creator-real",))
+    before = _tree(repo)
+    env = dict(os.environ, WORKSPACE_ROOT=str(repo), MAM_ENV_FILE=str(tmp_path / ".mam.env.absent"),
+               PYTHONPATH=f"{SKILLS}:{os.environ.get('PYTHONPATH', '')}")
+    res = subprocess.run(
+        [sys.executable, "-m", "lib_py.delegation.cli", "submit", "--prompt", "issue 20 probe",
+         "--agent", "claude-code", "--agent-session", "herdr:issue20-probe"],
+        capture_output=True, text=True, env=env, cwd=str(REPO_ROOT), timeout=60,
+    )
+    assert res.returncode == 0, res.stderr
+    state = tmp_path / ".mam-test-state"
+    records = list((state / "jobs").glob("*.json"))
+    assert len(records) == 1, records
+    assert (state / "delegate_job_logs" / records[0].stem).is_dir()
+    assert _tree(repo) == before
+
+
+def test_s6_a_pane_binding_is_dropped_before_collection(tmp_path):
+    """A pytest started with a worktree creator pane's binding - all four at
+    another checkout F - sees none of it, not even in a module-level copy of
+    os.environ, and leaves F untouched."""
+    fake_main = _fake_control_plane(tmp_path / "main", sessions=("creator-real",))
+    before = _tree(fake_main)
+    env = dict(os.environ, **_binding(fake_main), **{PROBE_ENV: "1"})
+    # An explicit basetemp: the inner run must not clean up the outer one's.
+    res = subprocess.run(
+        [sys.executable, "-m", "pytest", f"{__file__}::test_s6_probe", "-q", "-p", "no:cacheprovider",
+         f"--basetemp={tmp_path / 'inner'}"],
+        capture_output=True, text=True, env=env, cwd=str(REPO_ROOT), timeout=300,
+    )
+    assert res.returncode == 0, res.stdout[-4000:] + res.stderr[-2000:]
+    assert "1 passed" in res.stdout, res.stdout[-2000:]
+    assert _tree(fake_main) == before
+
+
+@pytest.mark.skipif(not os.environ.get(PROBE_ENV), reason="the inner half of S6 (nested pytest) only")
+def test_s6_probe(tmp_path):
+    assert not [k for k in BINDING if k in _IMPORT_ENV], {k: _IMPORT_ENV[k] for k in BINDING if k in _IMPORT_ENV}
+    assert "AGENT_SESSIONS_YAML" not in os.environ
+    assert "WORKSPACE_ROOT" not in os.environ  # it named another checkout
+    state = tmp_path / ".mam-test-state"
+    assert os.environ["MAM_JOBS_DIR"] == str(state / "jobs")
+    assert os.environ["DELEGATE_JOB_LOGS_DIR"] == str(state / "delegate_job_logs")
+
+
+def test_s7_lib_sh_takes_the_session_registry_from_a_tests_workspace_root(tmp_path):
+    """An ambient AGENT_SESSIONS_YAML (a worktree pane's) would win over the
+    test's WORKSPACE_ROOT in lib.sh; conftest dropped it before collection."""
+    assert "AGENT_SESSIONS_YAML" not in os.environ
+    repo = tmp_path / "repo"
+    repo.mkdir()
+    script = f'source "{SKILLS / "lib.sh"}" >/dev/null 2>&1; printf %s "$AGENT_SESSIONS_YAML"'
+    res = subprocess.run(["bash", "-c", script], capture_output=True, text=True,
+                         env=dict(os.environ, WORKSPACE_ROOT=str(repo)), timeout=60)
+    assert res.stdout == str(repo / ".mam" / "agent-sessions.yaml"), (res.stdout, res.stderr)
diff --git a/tests/test_issue21_acceptance.py b/tests/test_issue21_acceptance.py
new file mode 100644
index 0000000..7faaa77
--- /dev/null
+++ b/tests/test_issue21_acceptance.py
@@ -0,0 +1,278 @@
+"""Issue #21 item 7: the eight acceptance cases (A1-A8) of the worktree
+creator model, one test (or pair) per case.
+
+Everything runs against mock herdr / stubbed delegation inside mam_sandbox or
+tmp_path; nothing touches the real .mam. The real herdr pane (whether a pane
+sees the --env values) and the trial operation belong to stage C - A2 pins
+what the scripts hand to herdr.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import subprocess
+import time
+from pathlib import Path
+
+from test_issue21_loop_b import LOCAL_ROWS, _drive, _reviews, _sidecars, _state
+from test_issue21_phase2_loop_a import (REM, _calls, _prepare, _resume, _rows, _run, _skill, _wt,  # noqa: F401
+                                        ctl)
+from test_issue21_worktree_prereqs import (CP_ENV, WRAPPER, _assert_no_env_in_agent_args, _binding, _dry_submit,
+                                           _env, _env_flags, _injected, _kill_timer, _only_job_id)
+from test_issue21_worktree_prereqs import _git as _g
+from test_issue21_worktree_prereqs import wt_repo  # noqa: F401
+
+CREATE = ("multi-agent-mux-create", "scripts", "create_session.sh")
+HS = "multi-agent-mux"  # listed as running by mock herdr: an existing server
+
+
+def _raw_calls(state_file) -> list:
+    return json.loads(Path(state_file).read_text()).get("calls", [])
+
+
+def _sibling(main: Path, state_file):
+    """A1 setup: a session on the existing server in the control root, then a
+    sibling worktree's creator on the same server. Returns (wt, since, rows before)."""
+    res = _run(main, CREATE, "--workspace", str(main), "--agent", "claude", "--role", "reviewer",
+               "--herdr-session", HS, "--no-onboard")
+    assert res.returncode == 0, res.stdout + res.stderr
+    before = _rows(main)
+    since = len(_raw_calls(state_file))
+    wt = _wt(main)
+    res = _prepare(main, wt, "--creator-agent", "claude", "--herdr-session", HS)
+    assert res.returncode == 0, res.stdout + res.stderr
+    return wt, since, before
+
+
+# A1 -------------------------------------------------------------------------
+
+def test_a1_sibling_worktree_on_an_existing_herdr_server(ctl, mock_herdr, mock_agents):
+    main = ctl
+    wt, since, before = _sibling(main, mock_herdr)
+    new = _raw_calls(mock_herdr)[since:]
+    assert not [c for c in new if c[-1:] == ["server"]], "no server bootstrap on an existing server"
+    rows = _rows(main)
+    assert rows[0] == before[0], "the existing row is untouched"
+    creator = [r for r in rows if r.get("role") == "creator"]
+    assert len(rows) == 2 and len(creator) == 1
+    assert rows[0].get("herdr_session") == creator[0].get("herdr_session") == HS
+    assert os.path.realpath(creator[0]["pane"]["cwd"]) == os.path.realpath(wt)
+    assert creator[0]["control_plane"]["workspace_root"] == os.path.realpath(main)
+
+
+# A2 -------------------------------------------------------------------------
+
+def test_a2_pane_env_carries_the_binding_not_the_agent_args(ctl, mock_herdr, mock_agents):
+    main = ctl
+    wt, since, _ = _sibling(main, mock_herdr)
+    flags = _env_flags(mock_herdr, since)
+    for k, v in zip(CP_ENV, _binding(main).values()):
+        assert f"{k}={v}" in flags, flags
+    spawns = [c for c in _calls(mock_herdr) if c[:2] in (["pane", "split"], ["workspace", "create"])]
+    assert spawns and any("--env" in c for c in spawns), "the binding rides on the pane-creating call"
+    _assert_no_env_in_agent_args(mock_herdr, since)
+
+
+# A3 -------------------------------------------------------------------------
+
+def test_a3_brief_start_and_report_route_to_the_control_root(tmp_path):
+    main, wt = tmp_path / "main", tmp_path / "wt"
+    main.mkdir()
+    _g(main, "init", "-q")
+    (main / "a.txt").write_text("a\n")
+    _g(main, "add", "a.txt")
+    _g(main, "commit", "-q", "-m", "init")
+    _g(main, "worktree", "add", "-q", "-b", "feat", str(wt))
+    real = os.path.realpath(main)
+    res = _dry_submit(main, _env(tmp_path, {"WORKSPACE_ROOT": main}), "--workdir", str(main))
+    assert res.returncode == 0, res.stderr
+    reg = main / ".mam" / "jobs"
+    jid = _only_job_id(reg)
+    assert f"{real}/.mam/jobs/{jid}/brief.md" in res.stdout
+    start = _injected(res.stdout, "start")
+    assert f"--registry-dir {real}/.mam/jobs " in start and start.startswith(f"DELEGATE_JOB_LOGS_DIR={real}/")
+    # the brief (not written by --dry-run) derives its report path from that same
+    # absolute registry dir, so the report lands under MAIN as well
+    wrapper = WRAPPER.read_text()
+    assert "- **Output Report Path**: $REGISTRY_DIR/$JOB_ID/$AGENT-reports/report-final.md" in wrapper
+    try:
+        r1 = subprocess.run(["bash", "-c", start + " --attempts 1"], capture_output=True, text=True,
+                            env=_env(tmp_path), cwd=str(wt), timeout=120)  # no control env, broker unreachable
+        assert r1.returncode == 2, r1.stderr
+        assert json.loads((reg / f"{jid}.json").read_text())["status"] != "pending"
+    finally:
+        _kill_timer(reg, jid)
+    assert not (wt / ".mam").exists(), "nothing lands in the worktree"
+
+
+# A4 -------------------------------------------------------------------------
+
+def _main_state(main: Path) -> tuple:
+    branch = _g(main, "branch", "--show-current")
+    return (_g(main, "rev-parse", "HEAD"), branch, _g(main, "status", "--porcelain"),
+            _g(main, "rev-parse", f"refs/heads/{branch}"), _g(main, "worktree", "list", "--porcelain"))
+
+
+def test_a4_main_checkout_is_unchanged_by_the_whole_cycle(ctl, monkeypatch):
+    main = ctl
+    # what prepare adds to info/exclude is added up front, so status compares like for like
+    excl = main / ".git" / "info" / "exclude"
+    excl.write_text(excl.read_text() + "/.venv\n.pytest_cache/\n")
+    scratch = main.parent / f"{main.name}-a4"
+    scratch.mkdir()
+    pre = _main_state(main)
+    wt = _wt(main)
+    res = _prepare(main, wt)
+    assert res.returncode == 0, res.stdout + res.stderr
+    base = _g(wt, "rev-parse", "HEAD")
+    (wt / "impl.txt").write_text("impl line\n")
+    _g(wt, "add", "impl.txt")
+    _g(wt, "commit", "-q", "-m", "impl")
+    _state(monkeypatch, LOCAL_ROWS)
+    rc, calls, r = _drive(monkeypatch, scratch, ["--worktree", str(wt), "--base", base, "--review-only"])
+    assert rc == 0 and len(_reviews(calls)) == 1
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 0, res.stdout + res.stderr
+    assert _main_state(main) == pre, "HEAD, branch, status, branch tip and worktree list are unchanged"
+    assert "mam-review" not in _g(main, "worktree", "list", "--porcelain")
+
+
+# A5 -------------------------------------------------------------------------
+
+def _review_path(prompt: str) -> Path:
+    m = re.search(r"^- 검증 경로: (.+)$", prompt, re.M)
+    assert m, prompt[:800]
+    return Path(m.group(1))
+
+
+def _commit_h2(wt: Path) -> str:
+    (wt / "impl.txt").write_text("impl line\nsecond commit\n")
+    _g(wt, "commit", "-q", "-am", "h2")
+    return _g(wt, "rev-parse", "HEAD")
+
+
+def test_a5_fixed_sha_review_while_the_creator_keeps_committing(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _g(wt, "rev-parse", "HEAD")
+    (wt / "impl.txt").write_text("impl line\n")
+    _g(wt, "add", "impl.txt")
+    _g(wt, "commit", "-q", "-m", "h1")
+    h1 = _g(wt, "rev-parse", "HEAD")
+    seen = {}
+
+    def reviewer(r, n, prompt):
+        if seen:
+            return
+        path = _review_path(prompt)
+        seen["head"] = _g(path, "rev-parse", "HEAD")
+        seen["symref"] = subprocess.run(["git", "-C", str(path), "symbolic-ref", "-q", "HEAD"]).returncode
+        seen["content"] = (path / "impl.txt").read_text()
+        seen["h2"] = _commit_h2(wt)
+
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"],
+                          on_review=reviewer, max_loop=2)
+    assert rc == 0
+    assert (seen["head"], seen["symref"], seen["content"]) == (h1, 1, "impl line\n"), "round 1 saw H1, detached"
+    assert [role for _, role, _ in calls] == ["Reviewer", "Reviewer"], "no correction job for a stale round"
+    assert f"- head: {seen['h2']}" in _reviews(calls)[1][1]
+    rounds = r._rounds
+    assert rounds[0]["stale"] is True and rounds[1]["head_sha"] == seen["h2"]
+    (side,) = _sidecars(main)
+    data = json.loads(side.read_text())
+    assert (data["head_sha"], data["evidence"]) == (seen["h2"], "review-tree")
+
+
+def test_a5b_a_stale_last_round_is_not_accepted(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    base = _g(wt, "rev-parse", "HEAD")
+    (wt / "impl.txt").write_text("impl line\n")
+    _g(wt, "add", "impl.txt")
+    _g(wt, "commit", "-q", "-m", "h1")
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"],
+                          on_review=lambda *_: _commit_h2(wt), max_loop=1)
+    assert rc == 1 and "changed during review" in capsys.readouterr().err
+    assert _sidecars(main) == []
+
+
+# A6 -------------------------------------------------------------------------
+
+def test_a6_row_recovery_and_resume_only_at_the_original_cwd(ctl, mock_herdr, mock_agents):
+    main = ctl
+    wt = _wt(main)
+    res = _prepare(main, wt, "--creator-agent", "claude")
+    assert res.returncode == 0, res.stdout + res.stderr
+    (row,) = _rows(main)
+    name, binding = row["name"], row["control_plane"]
+    # the creator died: gone from herdr, the row terminated (reconcile drift A)
+    st = json.loads(Path(mock_herdr).read_text())
+    st["agents"] = {}
+    Path(mock_herdr).write_text(json.dumps(st))
+    from test_issue21_phase2_loop_a import _mutate
+    _mutate(main, "d['herdr_sessions'][0]['status'] = 'terminated'")
+    res = _resume(main, main, name)
+    assert res.returncode == 2 and (str(wt) in res.stderr or os.path.realpath(wt) in res.stderr), res.stderr
+    since = len(_raw_calls(mock_herdr))
+    res = _resume(main, wt, name)
+    assert res.returncode == 0, res.stdout + res.stderr
+    (row,) = _rows(main)
+    assert row["status"] == "running" and row["control_plane"] == binding
+    flags = _env_flags(mock_herdr, since)
+    assert f"WORKSPACE_ROOT={binding['workspace_root']}" in flags, flags
+
+
+# A7 -------------------------------------------------------------------------
+
+def test_a7_reviewer_test_output_stays_out_of_the_source_and_the_sandbox(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _g(wt, "rev-parse", "HEAD")
+    (wt / "impl.txt").write_text("impl line\n")
+    status0 = _g(wt, "status", "--porcelain")
+    paths = []
+
+    def reviewer_runs_tests(r, n, prompt):
+        path = _review_path(prompt)
+        paths.append(path)
+        (path / ".pytest_cache").mkdir()
+        (path / ".pytest_cache" / "v").write_text("x\n")
+        (path / "__pycache__").mkdir()
+        (path / "__pycache__" / "x.pyc").write_bytes(b"\0")
+        (path / "tmp-output.txt").write_text("output\n")
+
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"],
+                          on_review=reviewer_runs_tests)
+    assert rc == 0 and len(paths) == 1
+    assert _g(wt, "status", "--porcelain") == status0, "the source worktree did not change"
+    assert not paths[0].exists() and str(paths[0]) not in _g(main, "worktree", "list", "--porcelain")
+    prompt = _reviews(calls)[0][1]
+    assert "PYTHONDONTWRITEBYTECODE=1" in prompt and "-p no:cacheprovider" in prompt
+    assert not (wt / ".mam").exists() and not (wt / ".agents").exists(), "state stays in the control root"
+    assert len(_sidecars(main)) == 1
+
+
+# A8 -------------------------------------------------------------------------
+
+def test_a8_second_loop_is_refused_before_a_scheduler_exists(ctl):
+    main = ctl
+    wt2 = _wt(main, "wt2")
+    _g(main, "worktree", "add", "-q", "--detach", str(wt2))
+    holder = subprocess.Popen(["sleep", "60"])
+    try:
+        lstart = subprocess.run(["ps", "-p", str(holder.pid), "-o", "lstart="], capture_output=True,
+                                text=True).stdout.strip()
+        marker = main.parent / f"{main.name}-loop-marker"
+        content = f"pid={holder.pid}\nlstart={lstart}\nstarted={time.strftime('%Y-%m-%dT%H:%M:%SZ', time.gmtime())}\n"
+        marker.write_text(content)
+        env = {**os.environ, "WORKSPACE_ROOT": str(main), "MAM_LOOP_MARKER": str(marker), "MAM_LOOP_NO_FREEZE": "1"}
+        env.pop("MAM_LOOP_PY", None)
+        res = subprocess.run(["bash", _skill(main, "multi-agent-mux-loop", "scripts", "run_loop.sh"),
+                              "--creator", "c", "--task", "t", "--worktree", str(wt2), "--base", "HEAD",
+                              "--review-only", "--reviewer", "r"],
+                             capture_output=True, text=True, env=env, cwd=str(main), timeout=120)
+        assert res.returncode == 1 and "already running" in (res.stdout + res.stderr), res.stdout + res.stderr
+        assert list((main / ".mam" / "jobs").glob("*.json")) == [], "no job was registered"
+        assert marker.read_text() == content, "the live holder's marker is kept"
+    finally:
+        holder.kill()
+        holder.wait()
diff --git a/tests/test_issue21_loop_b.py b/tests/test_issue21_loop_b.py
new file mode 100644
index 0000000..1e426c2
--- /dev/null
+++ b/tests/test_issue21_loop_b.py
@@ -0,0 +1,535 @@
+"""Issue #21 phase 2, loop B, item 5: review identity.
+
+With --worktree/--base every review round is pinned to a snapshot of the
+source (loop_id, base, head, tree), reviewed in a detached review worktree (or
+env isolation), judged stale when the source changes during the round, and
+re-checked before promotion. Remote reviewers cannot reach this host's review
+tree: refused by default, admitted diff-only on request, recorded as such.
+Without the options nothing changes. All repositories live under tmp_path.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+from test_issue21_worktree_prereqs import GIT_ID, RUN_LOOP_SH, SKILLS, _git, wt_repo  # noqa: F401
+
+DIFF_SH = SKILLS / "multi-agent-mux-loop" / "scripts" / "diff_collect.sh"
+REMOTE_ROW = {"name": "reviewer-far-01", "agent": "claude", "role": "reviewer", "status": "running",
+              "transport": "remote"}
+LOCAL_ROWS = [{"name": "creator-claude-01", "agent": "claude", "role": "creator", "status": "running"},
+              {"name": "reviewer-claude-01", "agent": "claude", "role": "reviewer", "status": "running"}]
+WORK_TAIL = "코드 작업·검증 대상은 위 소스 경로다"
+
+
+def _state(monkeypatch, rows):
+    monkeypatch.setenv("MAM_STATE_JSON", json.dumps({"herdr_sessions": rows}))
+
+
+def _drive(monkeypatch, tmp_path, argv, on_review=None, reviewers="reviewer-claude-01", max_loop=1):
+    """run() with delegation stubbed: every job completes, every report is a
+    PASS; returns (rc, [(session, role, prompt)], runner)."""
+    from lib_py.loop import runner as lr
+    monkeypatch.setattr(lr.signal, "signal", lambda *a, **k: None)
+    args = ["--creator", "creator-claude-01", "--task", "t21", "--max-loop", str(max_loop), *argv]
+    if reviewers:
+        args += ["--reviewer", reviewers]
+    r = lr.LoopRunner(args)
+    calls = []
+    report = tmp_path / "pass-report.md"
+    report.write_text("looks fine\n\n[VERDICT: PASS]\n")
+
+    def fake_delegate(session, agent_type, role, prompt):
+        calls.append((session, role, prompt))
+        if role == "Reviewer" and on_review:
+            on_review(r, len(calls), prompt)
+        return f"j{len(calls)}"
+
+    monkeypatch.setattr(r, "delegate_job", fake_delegate)
+    monkeypatch.setattr(r, "wait_for_job", lambda *a, **k: True)
+    monkeypatch.setattr(r, "find_report", lambda jid: report)
+    return r.run(), calls, r
+
+
+def _reviews(calls):
+    return [(s, p) for s, role, p in calls if role == "Reviewer"]
+
+
+def _impl(wt: Path) -> str:
+    """Commit an implementation in the worktree; return the pre-implementation sha."""
+    before = _git(wt, "rev-parse", "HEAD")
+    (wt / "impl.txt").write_text("impl line\n")
+    _git(wt, "add", "impl.txt")
+    _git(wt, "commit", "-q", "-m", "impl")
+    return before
+
+
+def _worktree_count(main: Path) -> int:
+    return _git(main, "worktree", "list", "--porcelain").count("\nworktree ") + 1
+
+
+def _sidecars(main: Path) -> list:
+    return sorted((main / ".agents" / "reports").rglob("*.identity.json"))
+
+
+# ---------------------------------------------------------------------------
+
+def test_l1_without_options_nothing_changes(wt_repo, monkeypatch, tmp_path):
+    main, _ = wt_repo
+    (main / "a.txt").write_text("a\nchanged in main\n")
+    n = _worktree_count(main)
+    rc, calls, r = _drive(monkeypatch, tmp_path, [])
+    assert rc == 0
+    assert all("[리뷰 identity]" not in p and "[워크트리 컨텍스트]" not in p for _, _, p in calls)
+    assert _worktree_count(main) == n
+    assert r.loop_id.startswith("loop-") and r._rounds == []
+    assert _sidecars(main) == []
+
+
+def test_l2_snapshot_pins_uncommitted_and_untracked_not_ignored(wt_repo):
+    main, wt = wt_repo
+    (wt / ".gitignore").write_text("*.log\n")
+    _git(wt, "add", ".gitignore")
+    _git(wt, "commit", "-q", "-m", "ignore logs")
+    (wt / "a.txt").write_text("a\nmodified\n")
+    (wt / "new.txt").write_text("untracked\n")
+    (wt / "x.log").write_text("ignored\n")
+    status0 = _git(wt, "status", "--porcelain")
+    refs0 = _git(wt, "for-each-ref")
+    from lib_py.loop.runner import LoopRunner
+    r = LoopRunner(["--creator", "creator-claude-01", "--task", "t", "--worktree", str(wt)])
+    r.parse_args()
+    r.base_commit = _git(wt, "rev-parse", "HEAD")
+    snap = r._snapshot(1)
+    assert snap and snap["dirty"] and snap["review_commit"] != snap["head"]
+    assert r._worktree_tree() == snap["tree"], "the snapshot tree is stable for an unchanged tree"
+    path = Path(r._open_review_tree(snap, 1))
+    try:
+        assert (path / "new.txt").read_text() == "untracked\n"
+        assert "modified" in (path / "a.txt").read_text()
+        assert not (path / "x.log").exists(), "ignored files stay out of the snapshot"
+        assert _git(path, "rev-parse", "HEAD") == snap["review_commit"]
+    finally:
+        r._close_review_tree(str(path))
+    assert not path.exists()
+    assert _git(wt, "status", "--porcelain") == status0 and _git(wt, "for-each-ref") == refs0
+
+
+def test_l3_l5_stale_round_is_re_reviewed_and_the_sidecar_matches(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    before = _impl(wt)
+    seen = {}
+
+    def creator_commits_during_first_review(r, n, prompt):
+        if "h1" not in seen:
+            seen["h1"] = _git(wt, "rev-parse", "HEAD")
+            (wt / "late.txt").write_text("late\n")
+            _git(wt, "add", "late.txt")
+            _git(wt, "commit", "-q", "-m", "late")
+            seen["h2"] = _git(wt, "rev-parse", "HEAD")
+
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"],
+                          on_review=creator_commits_during_first_review, max_loop=2)
+    assert rc == 0
+    assert [role for _, role, _ in calls] == ["Reviewer", "Reviewer"], "no correction job for a stale round"
+    assert r._rounds[0]["stale"] is True and r._rounds[1]["stale"] is False
+    assert r._rounds[1]["head_sha"] == seen["h2"]
+    assert f"- head: {seen['h2']}" in _reviews(calls)[1][1]
+    (side,) = _sidecars(main)
+    data = json.loads(side.read_text())
+    assert data["loop_id"] == r.loop_id and data["head_sha"] == seen["h2"]
+    assert data["tree_sha"] == r._rounds[1]["tree_sha"] and data["base_sha"] == before
+    assert (data["transport"], data["evidence"], data["isolation"]) == ("herdr", "review-tree", "worktree")
+
+
+def test_l3b_stale_last_round_fails(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    before = _impl(wt)
+
+    def commit(r, n, prompt):
+        (wt / f"late{n}.txt").write_text("late\n")
+        _git(wt, "add", ".")
+        _git(wt, "commit", "-q", "-m", "late")
+
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"],
+                          on_review=commit, max_loop=1)
+    assert rc == 1 and "changed during review" in capsys.readouterr().err
+    assert _sidecars(main) == []
+
+
+def test_l4_source_changed_after_approval_is_not_promoted(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    before = _impl(wt)
+    from lib_py.loop import runner as lr
+    real = lr.LoopRunner._identity_now
+    state = {"accepted": False}
+
+    def identity_now(self):
+        return ("changed", "changed") if state["accepted"] else real(self)
+
+    def mark(r, n, prompt):
+        state["accepted"] = False
+
+    monkeypatch.setattr(lr.LoopRunner, "_identity_now", identity_now)
+    monkeypatch.setattr(lr.LoopRunner, "_round_is_stale",
+                        lambda self, snap: state.__setitem__("accepted", True) or False)
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"],
+                          on_review=mark)
+    assert rc == 1 and "source changed after approval" in capsys.readouterr().err
+    assert not list((main / ".agents" / "reports").rglob("report-*.md"))
+
+
+def test_l6_env_isolation_reviews_the_source_tree(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    before = _impl(wt)
+    n = _worktree_count(main)
+    counts = []
+    rc, calls, r = _drive(monkeypatch, tmp_path,
+                          ["--worktree", str(wt), "--base", before, "--review-only", "--review-isolation", "env"],
+                          on_review=lambda r, i, p: counts.append(_worktree_count(main)))
+    assert rc == 0 and counts == [n], "env isolation opens no review worktree"
+    prompt = _reviews(calls)[0][1]
+    assert f"- 검증 경로: {os.path.realpath(wt)}" in prompt and "PYTHONDONTWRITEBYTECODE=1" in prompt
+    assert WORK_TAIL not in prompt and "검증 경로(= 위 소스 경로)" in prompt, "one verification target (B-2)"
+    data = json.loads(_sidecars(main)[0].read_text())
+    assert (data["evidence"], data["isolation"]) == ("source-tree", "env")
+
+
+def test_l7_review_tree_failure_refuses_without_lowering_isolation(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    before = _impl(wt)
+    from lib_py.loop import runner as lr
+    real_git = lr.LoopRunner._git
+
+    def git(cwd, *args):
+        if args[:2] == ("worktree", "add"):
+            return subprocess.CompletedProcess(args, 128, "", "fatal: simulated")
+        return real_git(cwd, *args)
+
+    monkeypatch.setattr(lr.LoopRunner, "_git", staticmethod(git))
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"])
+    assert rc == 1 and _reviews(calls) == []
+    assert "cannot open the review worktree" in capsys.readouterr().err
+
+
+def test_l8_release_guard_closes_open_review_trees(wt_repo):
+    main, wt = wt_repo
+    (wt / "a.txt").write_text("a\nx\n")
+    from lib_py.loop.runner import LoopRunner
+    r = LoopRunner(["--creator", "creator-claude-01", "--task", "t", "--worktree", str(wt)])
+    r.parse_args()
+    r.base_commit = _git(wt, "rev-parse", "HEAD")
+    path = r._open_review_tree(r._snapshot(1), 1)
+    assert os.path.isdir(path)
+    r.release_guard()
+    assert not os.path.exists(path) and path not in _git(main, "worktree", "list")
+
+
+@pytest.mark.parametrize("opt", [["--review-isolation", "env"], ["--remote-review", "diff-only"]])
+def test_l9_l16_legacy_shell_loop_refuses_the_new_options(tmp_path, opt):
+    marker = tmp_path / "loop-marker"
+    env = {**os.environ, "WORKSPACE_ROOT": str(tmp_path), "MAM_LOOP_PY": "0", "MAM_LOOP_NO_FREEZE": "1",
+           "MAM_LOOP_MARKER": str(marker)}
+    res = subprocess.run(["bash", str(RUN_LOOP_SH), "--creator", "c", "--task", "t", *opt],
+                         capture_output=True, text=True, env=env, cwd=str(tmp_path), timeout=60)
+    assert res.returncode == 1 and "require the Python loop (MAM_LOOP_PY=1)" in res.stderr
+    assert not marker.exists()
+
+
+def test_l9b_invalid_values_are_rejected(wt_repo):
+    from lib_py.loop.runner import LoopRunner
+    for opt in (["--review-isolation", "bogus"], ["--remote-review", "maybe"]):
+        with pytest.raises(SystemExit) as e:
+            LoopRunner(["--creator", "c", "--task", "t", *opt]).parse_args()
+        assert e.value.code == 1
+
+
+@pytest.mark.parametrize("variant", ["reviewer", "all-reviewer", "env", "self-review"])
+def test_l10_remote_reviewer_refused_before_any_delegation(wt_repo, monkeypatch, tmp_path, capsys, variant):
+    main, wt = wt_repo
+    before = _impl(wt)
+    rows = LOCAL_ROWS + [REMOTE_ROW]
+    argv = ["--worktree", str(wt), "--base", before, "--review-only"]
+    reviewers = "reviewer-far-01"
+    if variant == "all-reviewer":
+        argv.append("--all-reviewer")
+        reviewers = None
+    elif variant == "env":
+        argv += ["--review-isolation", "env"]
+    elif variant == "self-review":
+        rows = [dict(LOCAL_ROWS[0], transport="remote")]
+        reviewers = None
+    _state(monkeypatch, rows)
+    rc, calls, r = _drive(monkeypatch, tmp_path, argv, reviewers=reviewers)
+    err = capsys.readouterr().err
+    assert rc == 1 and calls == [], "nothing is delegated"
+    assert "--remote-review diff-only" in err
+    assert ("creator-claude-01" if variant == "self-review" else "reviewer-far-01") in err
+
+
+def test_l11_diff_only_remote_reviewer_gets_shas_and_the_snapshot_diff(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    before = _impl(wt)
+    (wt / "a.txt").write_text("a\nuncommitted change\n")
+    _state(monkeypatch, LOCAL_ROWS + [REMOTE_ROW])
+    rc, calls, r = _drive(monkeypatch, tmp_path,
+                          ["--worktree", str(wt), "--base", before, "--review-only", "--remote-review", "diff-only"],
+                          reviewers="reviewer-claude-01,reviewer-far-01")
+    assert rc == 0
+    prompts = dict(_reviews(calls))
+    remote, local = prompts["reviewer-far-01"], prompts["reviewer-claude-01"]
+    snap = r._rounds[0]
+    assert os.path.realpath(wt) not in remote and "검증 경로" not in remote and "mam-review" not in remote
+    assert f"- head: {snap['head_sha']}" in remote and f"- tree: {snap['tree_sha']}" in remote
+    assert "diff 만으로" in remote and "+uncommitted change" in remote and "+impl line" in remote
+    assert "- 검증 경로: " in local and "mam-review" in local
+    assert WORK_TAIL not in local and "[리뷰 identity] 의 검증 경로에서만" in local, "one verification target (B-2)"
+    assert snap["reviewers"]["reviewer-far-01"]["evidence"] == "diff-only"
+    assert snap["reviewers"]["reviewer-claude-01"]["evidence"] == "review-tree"
+    side = {json.loads(p.read_text())["reviewer"]: json.loads(p.read_text()) for p in _sidecars(main)}
+    assert (side["reviewer-far-01"]["evidence"], side["reviewer-far-01"]["isolation"],
+            side["reviewer-far-01"]["transport"]) == ("diff-only", "none (remote)", "remote")
+    assert side["reviewer-claude-01"]["evidence"] == "review-tree"
+
+
+def test_l12_remote_reviewer_without_options_works_as_before(wt_repo, monkeypatch, tmp_path, capsys):
+    main, _ = wt_repo
+    (main / "a.txt").write_text("a\nchanged\n")
+    _state(monkeypatch, LOCAL_ROWS + [REMOTE_ROW])
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--remote-review", "diff-only"], reviewers="reviewer-far-01")
+    assert rc == 0 and [s for s, _ in _reviews(calls)] == ["reviewer-far-01"]
+    assert "[리뷰 identity]" not in _reviews(calls)[0][1] and _sidecars(main) == []
+    assert "only apply with --worktree or --base" in capsys.readouterr().out
+
+
+def _diff_collect(repo, *args, env=None):
+    cmd = "source " + str(DIFF_SH) + " && mam_collect_changes_diff " + " ".join(f"'{a}'" for a in (repo, *args))
+    return subprocess.run(["bash", "-c", cmd], capture_output=True, text=True, env={**os.environ, **(env or {})})
+
+
+def test_l13_snapshot_diff_is_commit_to_commit(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _git(wt, "rev-parse", "HEAD")
+    (wt / ".gitignore").write_text("*.log\n")
+    (wt / "a.txt").write_text("a\nmodified\n")
+    (wt / "new.txt").write_text("untracked\n")
+    (wt / "x.log").write_text("ignored\n")
+    from lib_py.loop.runner import LoopRunner
+    r = LoopRunner(["--creator", "creator-claude-01", "--task", "t", "--worktree", str(wt)])
+    r.parse_args()
+    r.base_commit = base
+    snap = r._snapshot(1)
+    out = _diff_collect(wt, base, snap["review_commit"])
+    assert out.returncode == 0 and "+modified" in out.stdout and "+untracked" in out.stdout
+    assert "x.log" not in out.stdout
+    bad = _diff_collect(wt, base, "0" * 40)
+    assert bad.returncode == 2 and "CHANGE SET UNAVAILABLE" in bad.stdout
+    cut = _diff_collect(wt, base, snap["review_commit"], env={"MAM_DIFF_MAX_LINES": "1"})
+    assert "DIFF TRUNCATED" in cut.stdout and f"inspect the review snapshot ({snap['review_commit']})" in cut.stdout
+    # the two-argument form is unchanged: same output as the script before this change
+    old = subprocess.run(["git", "-C", str(SKILLS.parent.parent), "show", "25f4be3:.agents/skills/multi-agent-mux-loop/scripts/diff_collect.sh"],
+                         capture_output=True, text=True)
+    new2 = _diff_collect(wt, base)
+    assert new2.returncode == 0 and "+modified" in new2.stdout and "+untracked" in new2.stdout
+    if old.returncode == 0 and old.stdout:  # needs git history (absent in a `git archive` export)
+        old_sh = tmp_path / "diff_collect_old.sh"
+        old_sh.write_text(old.stdout)
+        old2 = subprocess.run(["bash", "-c", f"source '{old_sh}' && mam_collect_changes_diff '{wt}' '{base}'"],
+                              capture_output=True, text=True)
+        assert (new2.returncode, new2.stdout) == (old2.returncode, old2.stdout)
+
+
+def test_l13b_prompt_diff_comes_from_the_snapshot(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    before = _impl(wt)
+    from lib_py.loop import runner as lr
+    real = lr.LoopRunner._snapshot
+
+    def snapshot_then_edit(self, n):
+        s = real(self, n)
+        (wt / "after-snapshot.txt").write_text("written after the snapshot\n")
+        return s
+
+    monkeypatch.setattr(lr.LoopRunner, "_snapshot", snapshot_then_edit)
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"])
+    prompt = _reviews(calls)[0][1]
+    assert "+impl line" in prompt and "after-snapshot.txt" not in prompt
+    assert rc == 1, "the source changed after the snapshot: the round is stale"
+
+
+def test_l14_untracked_nested_repository_is_refused(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    before = _impl(wt)
+    nested = wt / "nested"
+    nested.mkdir()
+    _git(nested, "init", "-q")
+    (nested / "n.txt").write_text("n\n")
+    _git(nested, "add", "n.txt")
+    _git(nested, "commit", "-q", "-m", "n")
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", before, "--review-only"])
+    assert rc == 1 and _reviews(calls) == []
+    assert "untracked nested git repository nested" in capsys.readouterr().err
+
+
+def test_l14b_nested_repository_without_options_proceeds(wt_repo, monkeypatch, tmp_path):
+    main, _ = wt_repo
+    nested = main / "nested"
+    nested.mkdir()
+    _git(nested, "init", "-q")
+    rc, calls, r = _drive(monkeypatch, tmp_path, [])
+    assert rc == 0 and len(_reviews(calls)) == 1
+
+
+def test_l15_truncated_diff_refuses_diff_only_but_not_local(wt_repo, monkeypatch, tmp_path, capsys):
+    main, wt = wt_repo
+    before = _impl(wt)
+    # the runner uses the control root's collector (the python fallback never truncates)
+    dst = main / ".agents" / "skills" / "multi-agent-mux-loop" / "scripts"
+    dst.mkdir(parents=True)
+    (dst / "diff_collect.sh").write_text(DIFF_SH.read_text())
+    monkeypatch.setenv("MAM_DIFF_MAX_LINES", "1")
+    _state(monkeypatch, LOCAL_ROWS + [REMOTE_ROW])
+    argv = ["--worktree", str(wt), "--base", before, "--review-only", "--remote-review", "diff-only"]
+    rc, calls, r = _drive(monkeypatch, tmp_path, argv, reviewers="reviewer-claude-01,reviewer-far-01")
+    assert rc == 1 and _reviews(calls) == [] and "would have no evidence" in capsys.readouterr().err
+    rc, calls, r = _drive(monkeypatch, tmp_path, argv, reviewers="reviewer-claude-01")
+    assert rc == 0 and len(_reviews(calls)) == 1
+
+
+# ---------------------------------------------------------------------------
+# loop B review follow-up: B-2, B-R1..B-R3, N1, N3, N5
+# ---------------------------------------------------------------------------
+
+def _add_submodule(wt: Path, tmp_path: Path) -> None:
+    src = tmp_path / "sm-src"
+    src.mkdir()
+    _git(src, "init", "-q")
+    (src / "x.txt").write_text("original\n")
+    _git(src, "add", "x.txt")
+    _git(src, "commit", "-q", "-m", "initial")
+    _git(wt, "-c", "protocol.file.allow=always", "submodule", "add", "-q", str(src), "sm")
+    _git(wt, "commit", "-q", "-m", "add sm")
+
+
+@pytest.mark.parametrize("when", ["before", "before-ignored", "untracked", "untracked-hidden", "during", "during-hidden"])
+def test_l17_dirty_submodule_is_refused_or_makes_the_round_stale(wt_repo, monkeypatch, tmp_path, capsys, when):
+    """The -hidden variants (PR #29 review R2): status.showUntrackedFiles=no in
+    the submodule must not let an untracked file past the snapshot guard,
+    neither before the first review nor when it appears mid-round."""
+    main, wt = wt_repo
+    base = _impl(wt)
+    _add_submodule(wt, tmp_path)
+    if when == "before-ignored":  # no ignore setting hides the dirty content
+        _git(wt, "config", "submodule.sm.ignore", "all")
+        _git(wt, "config", "diff.ignoreSubmodules", "all")
+    if when.endswith("-hidden"):
+        _git(wt / "sm", "config", "status.showUntrackedFiles", "no")
+
+    def dirty(*_):
+        (wt / "sm" / "x.txt").write_text("unreviewed work\n")
+
+    def untracked(*_):
+        (wt / "sm" / "new.txt").write_text("untracked in the submodule\n")
+
+    if when.startswith("before"):
+        dirty()
+    elif when.startswith("untracked"):
+        untracked()
+    on_review = {"during": dirty, "during-hidden": untracked}.get(when)
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"],
+                          on_review=on_review)
+    assert rc == 1 and _sidecars(main) == []
+    err = capsys.readouterr().err
+    assert "submodule(s) with uncommitted or untracked content: sm" in err
+    if when.startswith("during"):
+        assert len(_reviews(calls)) == 1 and r._rounds[0]["stale"] is True
+    else:
+        assert _reviews(calls) == [], "refused before any review"
+
+
+def test_l17b_clean_submodule_is_reviewed(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _impl(wt)
+    _add_submodule(wt, tmp_path)
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"])
+    assert rc == 0 and len(_sidecars(main)) == 1
+
+
+def test_l18_self_review_is_a_recorded_verdict_and_not_pass_re_reviews(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _impl(wt)
+    report = tmp_path / "pass-report.md"
+
+    def verdicts(r, n, prompt):
+        report.write_text("[VERDICT: NOT PASS]\n" if n == 1 else "[VERDICT: PASS]\n")
+
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"],
+                          on_review=verdicts, reviewers=None, max_loop=2)
+    assert rc == 0
+    assert [(s, role) for s, role, _ in calls] == [("creator-claude-01", "Reviewer")] * 2, \
+        "a NOT PASS self-review is re-reviewed, no correction job"
+    prompt = _reviews(calls)[1][1]
+    assert "Self-Review" in prompt and "+impl line" in prompt and "[리뷰 identity]" in prompt
+    assert r._rounds[0]["verdicts"] == {"creator-claude-01": "NOT PASS"}
+    (side,) = _sidecars(main)
+    data = json.loads(side.read_text())
+    assert (data["reviewer"], data["loop_id"], data["head_sha"]) == ("creator-claude-01", r.loop_id,
+                                                                    _git(wt, "rev-parse", "HEAD"))
+    assert data["evidence"] == "review-tree"
+
+
+def test_l18b_self_review_without_options_is_unchanged(wt_repo, monkeypatch, tmp_path):
+    main, _ = wt_repo
+    (main / "a.txt").write_text("a\nchanged\n")
+    rc, calls, r = _drive(monkeypatch, tmp_path, [], reviewers=None)
+    (review,) = _reviews(calls)
+    assert rc == 0 and review[0] == "creator-claude-01"
+    assert review[1].startswith("작업 완료 상태에 대해 스스로 검증") and "변경분" not in review[1]
+    assert _sidecars(main) == []
+
+
+def test_l19_remote_self_review_gets_the_snapshot_diff(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _impl(wt)
+    _state(monkeypatch, [dict(LOCAL_ROWS[0], transport="remote")])
+    rc, calls, r = _drive(monkeypatch, tmp_path,
+                          ["--worktree", str(wt), "--base", base, "--review-only", "--remote-review", "diff-only"],
+                          reviewers=None)
+    assert rc == 0
+    prompt = _reviews(calls)[0][1]
+    assert "diff --git" in prompt and "+impl line" in prompt and "검증 경로" not in prompt
+    data = json.loads(_sidecars(main)[0].read_text())
+    assert (data["reviewer"], data["evidence"]) == ("creator-claude-01", "diff-only")
+
+
+def test_l20_snapshot_diff_failure_keeps_the_unavailable_marker(wt_repo):
+    main, wt = wt_repo
+    dst = main / ".agents" / "skills" / "multi-agent-mux-loop" / "scripts"
+    dst.mkdir(parents=True)
+    (dst / "diff_collect.sh").write_text("mam_collect_changes_diff() { return 1; }\n")
+    from lib_py.loop.runner import UNAVAILABLE_MARKER, LoopRunner
+    r = LoopRunner(["--creator", "creator-claude-01", "--task", "t", "--worktree", str(wt)])
+    r.parse_args()
+    r.base_commit = _git(wt, "rev-parse", "HEAD")
+    assert UNAVAILABLE_MARKER in r.collect_changes_diff(r.base_commit)
+    assert UNAVAILABLE_MARKER not in r.collect_changes_diff(), "the live-tree form keeps its git fallback"
+
+
+def test_l21_closing_a_review_tree_keeps_other_worktree_entries_and_its_parent_dir(wt_repo, monkeypatch, tmp_path):
+    main, wt = wt_repo
+    base = _impl(wt)
+    other = tmp_path / "detached-disk"
+    _git(main, "worktree", "add", "-q", "--detach", str(other))
+    import shutil
+    import tempfile
+    shutil.rmtree(other)  # a worktree whose directory is gone (a detached disk)
+    rc, calls, r = _drive(monkeypatch, tmp_path, ["--worktree", str(wt), "--base", base, "--review-only"])
+    assert rc == 0
+    assert str(other) in _git(main, "worktree", "list", "--porcelain"), "the loop does not prune others' entries"
+    assert not (Path(tempfile.gettempdir()) / "mam-review" / r.loop_id).exists()
diff --git a/tests/test_issue21_phase2_loop_a.py b/tests/test_issue21_phase2_loop_a.py
new file mode 100644
index 0000000..3dda3b1
--- /dev/null
+++ b/tests/test_issue21_phase2_loop_a.py
@@ -0,0 +1,709 @@
+"""Issue #21 phase 2, loop A: worktree helpers (item 4), resume only at the
+original cwd, loud control-plane binding failures (recommendation 1), the
+binding persisted on resume's already-running path (recommendation 2), and the
+installer's `/.venv` ignore rule (#27).
+
+Every git repository lives under tmp_path / mam_sandbox; local submodules are
+allowed through GIT_CONFIG_* environment only (never global config), and every
+subprocess gets WORKSPACE_ROOT so lib.sh's .mam/shim lands in the sandbox.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import shlex
+import shutil
+import subprocess
+import sys
+import time
+from pathlib import Path
+
+import pytest
+
+REPO_ROOT = Path(__file__).resolve().parent.parent
+SKILLS = REPO_ROOT / ".agents" / "skills"
+if str(SKILLS) not in sys.path:
+    sys.path.insert(0, str(SKILLS))
+
+GIT_ID = {"GIT_AUTHOR_NAME": "t", "GIT_AUTHOR_EMAIL": "t@example.invalid",
+          "GIT_COMMITTER_NAME": "t", "GIT_COMMITTER_EMAIL": "t@example.invalid"}
+FILE_OK = {"GIT_CONFIG_COUNT": "1", "GIT_CONFIG_KEY_0": "protocol.file.allow", "GIT_CONFIG_VALUE_0": "always"}
+FILE_NO = {"GIT_CONFIG_COUNT": "1", "GIT_CONFIG_KEY_0": "protocol.file.allow", "GIT_CONFIG_VALUE_0": "never"}
+PREP = ("multi-agent-mux-create", "scripts", "worktree_prepare.sh")
+REM = ("multi-agent-mux-stop", "scripts", "worktree_remove.sh")
+CP_KEYS = ("workspace_root", "agent_sessions_yaml", "mam_jobs_dir", "delegate_job_logs_dir")
+
+
+def _git(cwd, *args, env=None, check=True):
+    return subprocess.run(["git", "-C", str(cwd), *args], capture_output=True, text=True, check=check,
+                          env={**os.environ, **GIT_ID, **(env or {})})
+
+
+def _skill(root: Path, *parts) -> str:
+    return str(root / ".agents" / "skills" / Path(*parts))
+
+
+def _run(root: Path, parts, *args, env=None, timeout=180):
+    return subprocess.run(["bash", _skill(root, *parts), *args], capture_output=True, text=True, cwd=str(root),
+                          env={**os.environ, "WORKSPACE_ROOT": str(root), **(env or {})}, timeout=timeout)
+
+
+def _rows(root: Path) -> list:
+    import yaml
+    return (yaml.safe_load((root / ".mam" / "agent-sessions.yaml").read_text()) or {}).get("herdr_sessions") or []
+
+
+def _mutate(root: Path, code: str) -> None:
+    res = subprocess.run(["bash", "-c", f"source {_skill(root, 'lib.sh')} && atomic_dump_yaml {root / '.mam' / 'agent-sessions.yaml'}"],
+                         input=code, capture_output=True, text=True, env={**os.environ, "WORKSPACE_ROOT": str(root)})
+    assert res.returncode == 0, res.stderr
+
+
+def _calls(mock_state_file, since=0) -> list:
+    calls = json.loads(Path(mock_state_file).read_text()).get("calls", [])[since:]
+    return [c[2:] if c[:1] == ["--session"] else c for c in calls]
+
+
+def _spawn_calls(mock_state_file, since=0) -> list:
+    return [c for c in _calls(mock_state_file, since)
+            if c[:2] in (["pane", "split"], ["workspace", "create"], ["agent", "start"])]
+
+
+def _worktrees(main: Path) -> str:
+    return _git(main, "worktree", "list", "--porcelain").stdout
+
+
+@pytest.fixture
+def ctl(mam_sandbox, monkeypatch):
+    """The sandbox is the control root: a git checkout with one commit and a .venv."""
+    for k, v in GIT_ID.items():
+        monkeypatch.setenv(k, v)
+    main = mam_sandbox
+    _git(main, "init", "-q")
+    (main / "README").write_text("r\n")
+    _git(main, "add", "README")
+    _git(main, "commit", "-q", "-m", "init")
+    (main / ".venv").mkdir(exist_ok=True)
+    return main
+
+
+@pytest.fixture
+def ctl_sub(ctl):
+    """Control root with a submodule (bare local remote) left uninitialised in
+    the main checkout, like nats-docker."""
+    main = ctl
+    src, bare = main.parent / f"{main.name}-subsrc", main.parent / f"{main.name}-sub.git"
+    src.mkdir()
+    _git(src, "init", "-q")
+    (src / "s.txt").write_text("s\n")
+    _git(src, "add", "s.txt")
+    _git(src, "commit", "-q", "-m", "s")
+    subprocess.run(["git", "clone", "-q", "--bare", str(src), str(bare)], check=True, capture_output=True)
+    _git(main, "submodule", "add", "-q", str(bare), "sm", env=FILE_OK)
+    _git(main, "commit", "-q", "-m", "add sm")
+    _git(main, "submodule", "deinit", "-q", "-f", "sm")
+    assert _git(main, "config", "--get", "submodule.sm.url", check=False).returncode != 0
+    return main
+
+
+def _wt(main: Path, name: str = "wt") -> Path:
+    return main.parent / f"{main.name}-{name}"
+
+
+def _prepare(main, wt, *extra, env=None):
+    return _run(main, PREP, "--path", str(wt), "--branch", f"b-{wt.name}", *extra, env=env)
+
+
+# ---------------------------------------------------------------------------
+# #27: the managed .gitignore block ignores .venv as a file, directory or link
+# ---------------------------------------------------------------------------
+
+def _install_env():
+    env = dict(os.environ)
+    env["MAM_REPO_URL"] = str(REPO_ROOT)
+    env["MAM_SKIP_VENV"] = "1"
+    env["MAM_INSTALLER_URL"] = "file://" + str(REPO_ROOT / "deploy" / "install.sh")
+    return env
+
+
+GI_START = "# >>> MAM managed block (managed by install.sh — do not edit) >>>"
+GI_END = "# <<< MAM managed block <<<"
+
+
+def _block(gi: str) -> list:
+    lines = gi.splitlines()
+    return lines[lines.index(GI_START) + 1:lines.index(GI_END)]
+
+
+@pytest.mark.parametrize("installer", ["install.sh", "install_mam.sh"])
+def test_w10_managed_block_ignores_venv_in_every_form(tmp_path, installer):
+    tgt = tmp_path / "tgt"
+    tgt.mkdir()
+    cmd = ["bash", str(REPO_ROOT / "deploy" / installer)] + ([str(tgt)] if installer == "install.sh" else ["--target", str(tgt)])
+    res = subprocess.run(cmd, capture_output=True, text=True, env=_install_env(), cwd=str(tmp_path), timeout=300)
+    assert res.returncode == 0, res.stdout[-2000:] + res.stderr[-2000:]
+    block = _block((tgt / ".gitignore").read_text())
+    assert "/.venv" in block and "/.venv/" not in block
+    _git(tgt, "init", "-q")
+    v = tgt / ".venv"
+
+    def clear():
+        if v.is_symlink() or v.is_file():
+            v.unlink()
+        elif v.exists():
+            shutil.rmtree(v)
+
+    if v.exists() or v.is_symlink():  # whatever the installer itself left there is ignored too
+        assert _git(tgt, "check-ignore", "-q", ".venv", check=False).returncode == 0
+    for make in (lambda p: p.symlink_to(tmp_path), lambda p: p.write_text("x"), lambda p: p.mkdir()):
+        clear()
+        make(v)
+        assert _git(tgt, "check-ignore", "-q", ".venv", check=False).returncode == 0, make
+    clear()
+
+
+def test_w11_reinstall_replaces_the_old_rule_and_keeps_user_lines(tmp_path):
+    tgt = tmp_path / "tgt"
+    tgt.mkdir()
+    # an installation made before #27: the same markers, the old directory-only rule
+    (tgt / ".gitignore").write_text(f"user-one\n{GI_START}\n/.venv/\n/.mam/\n{GI_END}\nuser-two\n")
+    res = subprocess.run(["bash", str(REPO_ROOT / "deploy" / "install.sh"), str(tgt)],
+                         capture_output=True, text=True, env=_install_env(), cwd=str(tmp_path), timeout=300)
+    assert res.returncode == 0, res.stdout[-2000:] + res.stderr[-2000:]
+    gi = (tgt / ".gitignore").read_text()
+    assert gi.count(GI_START) == 1 and gi.count(GI_END) == 1
+    assert "/.venv" in _block(gi) and "/.venv/" not in _block(gi)
+    assert "user-one" in gi.splitlines() and "user-two" in gi.splitlines()
+    for ledger in list(tgt.rglob("asset_hashes.txt")) + list(tgt.rglob("install_manifest.txt")):
+        assert ".gitignore" not in ledger.read_text().split(), ledger
+
+
+# ---------------------------------------------------------------------------
+# resume: original cwd only (A11), binding failures (A12), already running (A13)
+# ---------------------------------------------------------------------------
+
+def _resume(root, ws, name, agent="claude", env=None):
+    return _run(root, ("multi-agent-mux-resume", "scripts", "resume_session.sh"),
+                "--workspace", str(ws), "--agent", agent, "--session", name, env=env)
+
+
+def test_w7_resume_only_at_the_original_cwd(mam_sandbox, mock_herdr, mock_agents):
+    root = mam_sandbox
+    here, there, gone = root / "here", root / "there", root / "gone"
+    here.mkdir()
+    there.mkdir()
+    _mutate(root, f"""d['herdr_sessions'] = [
+  {{'name': 'x-creator-claude', 'status': 'stopped', 'pane': {{'cwd': {str(here)!r}, 'cmd': 'claude'}},
+    'claude_session_id_own': '11111111-2222-4333-8444-555555555555', 'session_id_source': 'assigned'}},
+  {{'name': 'x-creator-agy', 'status': 'stopped', 'pane': {{'cwd': {str(here)!r}, 'cmd': 'agy'}}}},
+  {{'name': 'y-creator-claude', 'status': 'stopped', 'pane': {{'cwd': {str(gone)!r}, 'cmd': 'claude'}}}}]""")
+    since = len(_calls(mock_herdr))
+    res = _resume(root, there, "x-creator-claude")
+    assert res.returncode == 2 and f"--workspace '{here}'" in res.stderr
+    res = _resume(root, there, "x-creator-agy", agent="agy")
+    assert res.returncode == 2
+    res = _resume(root, gone, "y-creator-claude")
+    assert res.returncode == 2 and "no longer exists" in res.stderr
+    assert _spawn_calls(mock_herdr, since) == [], "nothing was spawned in the wrong directory"
+
+
+def test_w8_binding_failure_refused_for_a_worktree_warned_for_the_control_root(mam_sandbox, mock_herdr, mock_agents):
+    root = mam_sandbox
+    Path(_skill(root, "lib_py", "control_plane.py")).write_text("raise SystemExit(1)\n")
+    wt = root.parent / f"{root.name}-wt8"
+    wt.mkdir()
+    since = len(_calls(mock_herdr))
+    create = ("multi-agent-mux-create", "scripts", "create_session.sh")
+    res = _run(root, create, "--workspace", str(wt), "--agent", "claude", "--role", "creator", "--no-onboard")
+    assert res.returncode == 2 and "cannot compute the control-plane binding" in res.stderr
+    assert _rows(root) == [] and _spawn_calls(mock_herdr, since) == []
+    res = _run(root, create, "--workspace", str(root), "--agent", "claude", "--role", "creator", "--no-onboard")
+    assert res.returncode == 0 and "WARNING: control-plane binding unavailable" in res.stderr, res.stderr
+    (row,) = _rows(root)
+    assert "control_plane" not in row
+
+    _mutate(root, f"""d['herdr_sessions'].append({{'name': 'w8-creator-claude', 'status': 'stopped',
+  'pane': {{'cwd': {str(wt)!r}, 'cmd': 'claude'}},
+  'claude_session_id_own': '11111111-2222-4333-8444-555555555555', 'session_id_source': 'assigned'}})""")
+    res = _resume(root, wt, "w8-creator-claude")
+    assert res.returncode == 2 and "cannot compute the control-plane binding" in res.stderr
+
+
+def test_w9_already_running_resume_persists_the_binding(mam_sandbox, mock_herdr, mock_agents):
+    root = mam_sandbox
+    create = ("multi-agent-mux-create", "scripts", "create_session.sh")
+    res = _run(root, create, "--workspace", str(root), "--agent", "claude", "--role", "creator", "--no-onboard")
+    assert res.returncode == 0, res.stdout + res.stderr
+    name = _rows(root)[0]["name"]
+    _mutate(root, "d['herdr_sessions'][0].pop('control_plane', None)")
+    res = _resume(root, root, name)
+    assert res.returncode == 0 and "already running" in res.stdout, res.stdout + res.stderr
+    row = _rows(root)[0]
+    assert set(row["control_plane"]) == set(CP_KEYS)
+    assert row["control_plane"]["workspace_root"] == os.path.realpath(root)
+
+    custom = {**row["control_plane"], "mam_jobs_dir": str(root / "custom-jobs")}
+    _mutate(root, f"d['herdr_sessions'][0]['control_plane'] = {custom!r}")
+    assert _resume(root, root, name).returncode == 0
+    assert _rows(root)[0]["control_plane"] == custom, "an existing row binding is kept"
+
+
+# ---------------------------------------------------------------------------
+# prepare
+# ---------------------------------------------------------------------------
+
+def test_w1_prepare_worktree_venv_exclude_base(ctl_sub):
+    """R3 (PR #29 review): the worktree gets its own venv from the control
+    root's interpreter, never a link to the control root's .venv (a link
+    aliases the environment and was once committed by `git add -A`)."""
+    main = ctl_sub
+    wt = _wt(main)
+    shutil.rmtree(main / ".venv")
+    subprocess.run([sys.executable, "-m", "venv", "--without-pip", str(main / ".venv")], check=True)
+    for expect in ("VENV=created", "VENV=kept"):
+        res = _prepare(main, wt)
+        assert res.returncode == 0, res.stdout + res.stderr
+        assert expect in res.stdout
+    assert os.path.realpath(wt) in _worktrees(main)
+    assert not os.path.islink(wt / ".venv") and os.access(wt / ".venv" / "bin" / "python", os.X_OK)
+    assert os.path.realpath(wt / ".venv") != os.path.realpath(main / ".venv")
+    excl = (main / ".git" / "info" / "exclude").read_text().splitlines()
+    assert excl.count("/.venv") == 1 and excl.count(".pytest_cache/") == 1
+    assert _git(wt, "status", "--porcelain").stdout == ""
+    assert f"BASE={_git(wt, 'rev-parse', 'HEAD').stdout.strip()}" in res.stdout
+    assert "SUBMODULES=skipped" in res.stdout
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert not os.path.exists(os.path.join(gd, "modules")), "no submodule trace without --submodules"
+    assert _git(main, "config", "--get", "submodule.sm.url", check=False).returncode != 0
+
+
+def test_w1b_prepare_refuses_a_venv_link_and_skips_without_a_control_root_interpreter(ctl):
+    main = ctl  # ctl's .venv is an empty directory: no interpreter to create from
+    wt = _wt(main)
+    res = _prepare(main, wt)
+    assert res.returncode == 0 and "VENV=skipped" in res.stdout and "no venv created" in res.stderr
+    assert not (wt / ".venv").exists()
+    os.symlink(main / ".venv", wt / ".venv")
+    res = _prepare(main, wt)
+    assert res.returncode == 1 and "symbolic link" in res.stderr, res.stdout + res.stderr
+    assert os.path.islink(wt / ".venv"), "nothing is changed by the refusal"
+
+
+def test_w1c_failed_requirements_install_removes_the_half_made_venv(ctl):
+    """Review D1 (PR #29 delta): after a failed pip install the next run must
+    not report VENV=kept for an environment without the requirements."""
+    main = ctl
+    shutil.rmtree(main / ".venv")
+    subprocess.run([sys.executable, "-m", "venv", "--without-pip", str(main / ".venv")], check=True)
+    (main / "requirements.txt").write_text("this-package-does-not-exist-mam-w1c==0.0.0\n")
+    _git(main, "add", "requirements.txt")
+    _git(main, "commit", "-q", "-m", "req")
+    wt = _wt(main)
+    res = _prepare(main, wt, env={**os.environ, "PIP_INDEX_URL": "http://127.0.0.1:9/simple", "PIP_RETRIES": "0", "PIP_TIMEOUT": "1"})
+    assert res.returncode == 1 and "pip install" in res.stderr, res.stdout + res.stderr
+    assert not (wt / ".venv").exists() and os.path.realpath(wt) in _worktrees(main)
+
+
+def test_w2_prepare_refusals_and_dry_run(ctl):
+    main = ctl
+    res = _run(main, PREP, "--path", str(main / "inside"), "--branch", "x")
+    assert res.returncode == 2 and "inside the control root" in res.stderr
+    wt = _wt(main)
+    assert _prepare(main, wt).returncode == 0
+    res = _run(main, PREP, "--path", str(_wt(main, "other")), "--branch", f"b-{wt.name}")
+    assert res.returncode == 1, "a branch checked out in another worktree: git's refusal is passed on"
+    dry = _wt(main, "dry")
+    res = _run(main, PREP, "--path", str(dry), "--branch", "dry", "--dry-run")
+    assert res.returncode == 0 and "[dry-run]" in res.stdout
+    assert not dry.exists() and _git(main, "show-ref", "--verify", "--quiet", "refs/heads/dry", check=False).returncode != 0
+
+
+def test_w3_w4_prepare_creator_binding_no_daemon_control_root_reconcile(ctl, mock_herdr, mock_agents, monkeypatch):
+    """The creator row points at the worktree but belongs to the control plane;
+    prepare suppresses the subscriber daemon; create's immediate reconcile runs
+    the control root's reconcile.sh, not the worktree's copy (A8)."""
+    from conftest import _subscriber_daemon_pids
+    main = ctl
+    wt = _wt(main)
+    marker_a, marker_b = main / "marker-control-root", main / "marker-worktree"
+    ctl_reconcile = Path(_skill(main, "multi-agent-mux-monitor", "scripts", "reconcile.sh"))
+    ctl_reconcile.write_text(f"#!/usr/bin/env bash\ntouch '{marker_a}'\n")
+    monkeypatch.delenv("MAM_NO_SUBSCRIBER_DAEMON", raising=False)
+    assert _prepare(main, wt).returncode == 0
+    wt_reconcile = wt / ".agents" / "skills" / "multi-agent-mux-monitor" / "scripts" / "reconcile.sh"
+    wt_reconcile.parent.mkdir(parents=True)
+    wt_reconcile.write_text(f"#!/usr/bin/env bash\ntouch '{marker_b}'\n")
+    _git(wt, "add", ".agents")
+    _git(wt, "commit", "-q", "-m", "worktree copy of reconcile")
+    res = _prepare(main, wt, "--creator-agent", "claude", "--onboard")
+    assert res.returncode == 0, res.stdout + res.stderr
+    (row,) = _rows(main)
+    assert os.path.realpath(row["pane"]["cwd"]) == os.path.realpath(wt)
+    assert row["control_plane"]["workspace_root"] == os.path.realpath(main)
+    deadline = time.time() + 10
+    while time.time() < deadline and not marker_a.exists():
+        time.sleep(0.2)
+    assert marker_a.exists(), "the control root's reconcile.sh ran"
+    assert not marker_b.exists(), "the worktree's reconcile.sh must not run"
+    assert _subscriber_daemon_pids(main) == [], "prepare passes MAM_NO_SUBSCRIBER_DAEMON=1"
+
+
+def test_w6c_submodule_init_failure_rolls_back_and_prepare_recovers(ctl_sub):
+    main = ctl_sub
+    wt = _wt(main)
+    res = _prepare(main, wt, "--submodules", "--creator-agent", "claude", env=FILE_NO)
+    assert res.returncode == 1 and "submodule initialisation failed" in res.stderr
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert not os.path.exists(os.path.join(gd, "modules"))
+    assert _git(main, "config", "--get", "submodule.sm.url", check=False).returncode != 0
+    assert _rows(main) == [], "no creator after a failed step"
+    assert _prepare(main, wt).returncode == 0, "re-running without --submodules finishes the preparation"
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 0 and "removal method: plain" in res.stdout, res.stdout + res.stderr
+
+
+# ---------------------------------------------------------------------------
+# remove
+# ---------------------------------------------------------------------------
+
+def _row(main, name, wt, status="running", job=None):
+    return (f"{{'name': {name!r}, 'status': {status!r}, 'role': 'creator', 'delegate_job_id': {job!r}, "
+            f"'pane': {{'cwd': {str(wt)!r}, 'cmd': 'claude'}}}}")
+
+
+def test_w5_remove_refusals_change_nothing(ctl, mock_herdr, mock_agents):
+    from lib_py.delegation import registry
+    main = ctl
+    wt = _wt(main)
+    assert _prepare(main, wt).returncode == 0
+    jobs = main / ".mam" / "jobs"
+    own = registry.register_job("own", registry_dir=str(jobs), agent_session="herdr:wt-creator-claude")
+    _mutate(main, f"d['herdr_sessions'] = [{_row(main, 'wt-creator-claude', wt, job=own)}]")
+
+    res = _run(main, REM, "--path", str(wt))  # (a) running, no --stop
+    assert res.returncode == 3 and "pass --stop" in res.stderr
+    res = _run(main, REM, "--path", str(wt), "--stop", "--dry-run")
+    assert res.returncode == 0, "with --stop the row's own delegate job is not a refusal"
+
+    other = registry.register_job("other", registry_dir=str(jobs), agent_session="herdr:wt-creator-claude")
+    res = _run(main, REM, "--path", str(wt), "--stop")  # (b) another open job
+    assert res.returncode == 3 and other in res.stderr
+    rec = json.loads((jobs / f"{other}.json").read_text())
+    rec["status"] = "completed"
+    (jobs / f"{other}.json").write_text(json.dumps(rec))
+
+    (wt / "dirty.txt").write_text("x\n")  # (c) dirty
+    res = _run(main, REM, "--path", str(wt), "--stop")
+    assert res.returncode == 3 and "uncommitted changes" in res.stderr
+    (wt / "dirty.txt").unlink()
+
+    _git(main, "worktree", "lock", str(wt))  # (d) locked
+    res = _run(main, REM, "--path", str(wt), "--stop")
+    assert res.returncode == 3 and "locked" in res.stderr
+    _git(main, "worktree", "unlock", str(wt))
+
+    assert os.path.realpath(wt) in _worktrees(main)
+    (row,) = _rows(main)
+    assert row["status"] == "running", "no refusal may stop a session first"
+    assert json.loads((jobs / f"{own}.json").read_text())["status"] == "pending"
+
+
+def test_w6_remove_plain_and_with_stop(ctl, mock_herdr, mock_agents):
+    main = ctl
+    wt1, wt2 = _wt(main, "one"), _wt(main, "two")
+    assert _prepare(main, wt1).returncode == 0
+    _mutate(main, f"d['herdr_sessions'] = [{_row(main, 'one-creator-claude', wt1, status='stopped')}]")
+    res = _run(main, REM, "--path", str(wt1))
+    assert res.returncode == 0 and "removal method: plain" in res.stdout, res.stdout + res.stderr
+    assert os.path.realpath(wt1) not in _worktrees(main)
+    assert _git(main, "show-ref", "--verify", "--quiet", f"refs/heads/b-{wt1.name}", check=False).returncode == 0
+
+    res = _prepare(main, wt2, "--creator-agent", "claude")
+    assert res.returncode == 0, res.stdout + res.stderr
+    name = [r for r in _rows(main) if os.path.realpath(r["pane"]["cwd"]) == os.path.realpath(wt2)][0]["name"]
+    res = _run(main, REM, "--path", str(wt2), "--stop")
+    assert res.returncode == 0, res.stdout + res.stderr
+    assert [r for r in _rows(main) if r["name"] == name][0]["status"] == "stopped"
+    assert os.path.realpath(wt2) not in _worktrees(main)
+
+
+def test_w6b_submodule_worktree_single_force_after_checks(ctl_sub):
+    main = ctl_sub
+    wt = _wt(main)
+    res = _prepare(main, wt, "--submodules", env=FILE_OK)
+    assert res.returncode == 0 and "SUBMODULES=initialised" in res.stdout, res.stdout + res.stderr
+
+    (wt / "sm" / "junk.txt").write_text("u\n")  # (i) untracked in the submodule
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and os.path.realpath(wt) in _worktrees(main)
+    (wt / "sm" / "junk.txt").unlink()
+
+    (wt / "sm" / "new.txt").write_text("n\n")  # (ii) detached commit, gitlink committed above
+    _git(wt / "sm", "add", "new.txt")
+    _git(wt / "sm", "commit", "-q", "-m", "local only")
+    local = _git(wt / "sm", "rev-parse", "HEAD").stdout.strip()
+    _git(wt, "add", "sm")
+    _git(wt, "commit", "-q", "-m", "bump sm")
+    assert _git(wt, "status", "--porcelain", "--ignore-submodules=none").stdout == ""
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "unpushed" in res.stderr, res.stdout + res.stderr
+    assert _git(wt / "sm", "cat-file", "-e", local, check=False).returncode == 0
+
+    _git(wt / "sm", "push", "-q", "origin", "HEAD:refs/heads/pushed", env=FILE_OK)
+    _git(wt / "sm", "fetch", "-q", "origin", env=FILE_OK)
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 0, res.stdout + res.stderr
+    assert "single --force" in res.stdout and os.path.realpath(wt) not in _worktrees(main)
+
+
+def test_w6d_failed_init_trace_outside_prepare_is_removable(ctl_sub):
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt).returncode == 0
+    assert _git(wt, "submodule", "update", "--init", env=FILE_NO, check=False).returncode != 0
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert os.path.isdir(os.path.join(gd, "modules")), "git leaves modules/ behind after a failed init"
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 0 and "single --force" in res.stdout, res.stdout + res.stderr
+
+
+# ---------------------------------------------------------------------------
+# review ffb5055e: work that a forced removal must not destroy; rollback that
+# must leave a usable checkout
+# ---------------------------------------------------------------------------
+
+@pytest.mark.parametrize("hidden", [False, True])
+def test_w6e_work_written_while_stopping_is_not_force_removed(ctl_sub, mock_herdr, mock_agents, hidden):
+    """R1: the checks run again after --stop; a file a stopping session wrote
+    into a submodule keeps the worktree (and the file) - also when the
+    submodule's status.showUntrackedFiles=no would hide it (PR #29 review R1)."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+    if hidden:
+        _git(wt / "sm", "config", "status.showUntrackedFiles", "no")
+    _mutate(main, f"d['herdr_sessions'] = [{_row(main, 'late-creator-claude', wt)}]")
+    late = wt / "sm" / "late-user-work.txt"
+    stop = Path(_skill(main, "multi-agent-mux-stop", "scripts", "stop_session.sh"))
+    stop.write_text("#!/usr/bin/env bash\nprintf 'unsaved work\\n' > " + shlex.quote(str(late)) + "\n" + stop.read_text())
+    res = _run(main, REM, "--path", str(wt), "--stop")
+    assert res.returncode == 3, res.stdout + res.stderr
+    assert "changed after the checks" in res.stderr
+    assert late.is_file() and os.path.realpath(wt) in _worktrees(main)
+
+
+def test_w6e2_untracked_submodule_file_hidden_by_config_blocks_the_forced_removal(ctl_sub):
+    """PR #29 review R1: `status --porcelain` honours status.showUntrackedFiles;
+    a display setting must not decide what a forced removal deletes."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+    _git(wt / "sm", "config", "status.showUntrackedFiles", "no")
+    keep = wt / "sm" / "valuable-untracked.txt"
+    keep.write_text("not committed anywhere\n")
+    assert _git(wt, "status", "--porcelain", "--ignore-submodules=none").stdout == "", "git hides it by default"
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "'dirty'" in res.stderr, res.stdout + res.stderr
+    assert keep.is_file() and os.path.realpath(wt) in _worktrees(main)
+    _git(wt, "config", "status.showUntrackedFiles", "no")  # the worktree's own status check too
+    keep.unlink()
+    top = wt / "valuable-top.txt"
+    top.write_text("x\n")
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "uncommitted changes" in res.stderr, res.stdout + res.stderr
+    assert top.is_file() and os.path.realpath(wt) in _worktrees(main)
+
+
+def test_w6f_submodule_stash_blocks_the_forced_removal(ctl_sub):
+    """R2: a stash in a submodule is reachable from no branch and leaves the
+    status clean; it must still refuse the forced removal."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+    (wt / "sm" / "s.txt").write_text("valuable stashed work\n")
+    _git(wt / "sm", "stash", "push", "-q", "-m", "keep this work")
+    assert _git(wt, "status", "--porcelain", "--ignore-submodules=none").stdout == ""
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "'stashes'" in res.stderr, res.stdout + res.stderr
+    assert os.path.realpath(wt) in _worktrees(main)
+    assert _git(wt / "sm", "rev-parse", "--verify", "-q", "refs/stash", check=False).returncode == 0
+
+
+def _add_unreachable_submodule(repo: Path, missing: Path) -> None:
+    """A second submodule `zbad` (sorted after `sm`) whose remote does not exist."""
+    sm_sha = _git(repo, "ls-tree", "HEAD", "sm").stdout.split()[2]
+    _git(repo, "config", "-f", ".gitmodules", "submodule.zbad.path", "zbad")
+    _git(repo, "config", "-f", ".gitmodules", "submodule.zbad.url", str(missing))
+    _git(repo, "add", ".gitmodules")
+    _git(repo, "update-index", "--add", "--cacheinfo", f"160000,{sm_sha},zbad")
+    _git(repo, "commit", "-q", "-m", "second, unreachable submodule")
+
+
+def test_w6g_partial_submodule_failure_rolls_back_to_a_usable_worktree(ctl_sub):
+    """R3: `sm` clones, `zbad` fails. The rollback deinits the new checkout
+    before deleting its git dir, so the worktree stays a usable checkout."""
+    main = ctl_sub
+    _add_unreachable_submodule(main, main.parent / "missing-remote.git")
+    wt = _wt(main)
+    res = _prepare(main, wt, "--submodules", env=FILE_OK)
+    assert res.returncode == 1 and "submodule initialisation failed" in res.stderr
+    assert _git(wt, "status", "--porcelain", check=False).returncode == 0
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert not os.path.exists(os.path.join(gd, "modules"))
+    assert not (wt / "sm" / ".git").exists()
+    for name in ("sm", "zbad"):
+        assert _git(main, "config", "--get", f"submodule.{name}.url", check=False).returncode != 0
+    assert _prepare(main, wt).returncode == 0
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 0 and "removal method: plain" in res.stdout, res.stdout + res.stderr
+
+
+def test_w6h_failed_retry_keeps_the_earlier_submodule_state(ctl_sub):
+    """R3: a submodule initialised by an earlier run (and its shared config)
+    survives the rollback of a later, failing run."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+    url_before = _git(main, "config", "--get", "submodule.sm.url").stdout.strip()
+    _add_unreachable_submodule(wt, main.parent / "missing-remote.git")
+    res = _prepare(main, wt, "--submodules", env=FILE_OK)
+    assert res.returncode == 1, res.stdout + res.stderr
+    assert _git(wt, "status", "--porcelain", check=False).returncode == 0
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert os.path.isdir(os.path.join(gd, "modules", "sm"))
+    assert not os.path.exists(os.path.join(gd, "modules", "zbad"))
+    assert (wt / "sm" / ".git").exists() and (wt / "sm" / "s.txt").exists()
+    assert _git(main, "config", "--get", "submodule.sm.url").stdout.strip() == url_before
+    assert _git(main, "config", "--get", "submodule.zbad.url", check=False).returncode != 0
+
+
+# ---------------------------------------------------------------------------
+# reviews 8f141362 (N1) and 275fdc4f (R4, R5)
+# ---------------------------------------------------------------------------
+
+def test_w6i_deleted_worktree_directory_is_refused_cleanly(ctl):
+    """N1: `git status` fails in a worktree whose directory is gone - the
+    helper refuses (exit 3) instead of dying on an unset METHOD."""
+    main = ctl
+    wt = _wt(main)
+    assert _prepare(main, wt).returncode == 0
+    shutil.rmtree(wt)
+    for extra in ([], ["--dry-run"]):
+        res = _run(main, REM, "--path", str(wt), *extra)
+        assert res.returncode == 3, res.stdout + res.stderr
+        assert "worktree prune" in res.stderr
+        assert "nothing was changed" in res.stdout + res.stderr
+        assert "unbound variable" not in res.stderr
+    assert str(wt) in _worktrees(main), "nothing was pruned or removed"
+
+
+def _deinit_after(wt: Path, make_state) -> str:
+    """Put state into the initialised `sm`, then deinit it (no force); returns
+    the submodule's repository, which stays under the worktree's modules/."""
+    make_state(wt / "sm")
+    gd = _git(wt / "sm", "rev-parse", "--absolute-git-dir").stdout.strip()
+    _git(wt, "submodule", "deinit", "-q", "sm")
+    assert not (wt / "sm" / ".git").exists() and os.path.isdir(gd)
+    return gd
+
+
+def test_w6j_stash_in_a_deinitialised_submodule_repository_is_kept(ctl_sub):
+    """R5: foreach no longer visits a deinit'd submodule, but its repository -
+    and its stash - is still under modules/ and would be force-removed."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+
+    def stash(sm):
+        (sm / "s.txt").write_text("valuable stashed work\n")
+        _git(sm, "stash", "push", "-q", "-m", "keep this work")
+
+    gd = _deinit_after(wt, stash)
+    before = _git(gd, "rev-parse", "refs/stash").stdout.strip()
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "'stashes'" in res.stderr, res.stdout + res.stderr
+    assert _git(gd, "rev-parse", "refs/stash").stdout.strip() == before
+
+
+def test_w6j2_unpushed_commit_in_a_deinitialised_submodule_repository_is_kept(ctl_sub):
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+
+    local = []
+
+    def commit(sm):
+        (sm / "new.txt").write_text("n\n")
+        _git(sm, "add", "new.txt")
+        _git(sm, "commit", "-q", "-m", "local only")
+        local.append(_git(sm, "rev-parse", "HEAD").stdout.strip())
+        # record the new gitlink first: deinit refuses a submodule whose HEAD
+        # differs from it, and the top level must be clean for the scenario
+        _git(wt, "add", "sm")
+        _git(wt, "commit", "-q", "-m", "bump sm")
+
+    gd = _deinit_after(wt, commit)
+    assert _git(wt, "status", "--porcelain", "--ignore-submodules=none").stdout == ""
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "'unpushed'" in res.stderr, res.stdout + res.stderr
+    assert _git(gd, "cat-file", "-e", local[0], check=False).returncode == 0
+
+
+def test_w6k_files_in_an_uninitialised_submodule_path_refuse_the_init(ctl_sub):
+    """R4: files that predate the attempt in a not-yet-initialised submodule
+    path refuse --submodules up front; nothing is changed or deleted."""
+    main = ctl_sub
+    wt = _wt(main)
+    assert _prepare(main, wt).returncode == 0
+    valuable = wt / "sm" / "user-work.txt"
+    valuable.write_text("existing user work\n")
+    res = _prepare(main, wt, "--submodules", env=FILE_OK)
+    assert res.returncode == 3 and "not empty" in res.stderr, res.stdout + res.stderr
+    assert valuable.read_text() == "existing user work\n"
+    gd = _git(wt, "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert not os.path.exists(os.path.join(gd, "modules"))
+    assert _git(main, "config", "--get", "submodule.sm.url", check=False).returncode != 0
+
+
+# ---------------------------------------------------------------------------
+# review ec50fbe7 (R6): a submodule commit kept only by a tag
+# ---------------------------------------------------------------------------
+
+def _tag_only_commit(sm: Path, annotated: bool = False) -> str:
+    """Commit on the submodule's detached HEAD, keep it only by a tag, go back
+    to the recorded commit (the top level stays clean). Returns the commit."""
+    orig = _git(sm, "rev-parse", "HEAD").stdout.strip()
+    (sm / "tagged.txt").write_text("kept only by a tag\n")
+    _git(sm, "add", "tagged.txt")
+    _git(sm, "commit", "-q", "-m", "tag-only work")
+    local = _git(sm, "rev-parse", "HEAD").stdout.strip()
+    _git(sm, "tag", *(["-a", "-m", "keep"] if annotated else []), "saved-work")
+    _git(sm, "checkout", "-q", orig)
+    return local
+
+
+def _remove_refuses_tag_only_commit(main: Path, annotated: bool, deinit: bool) -> None:
+    wt = _wt(main)
+    assert _prepare(main, wt, "--submodules", env=FILE_OK).returncode == 0
+    local = _tag_only_commit(wt / "sm", annotated)
+    gd = _git(wt / "sm", "rev-parse", "--absolute-git-dir").stdout.strip()
+    assert _git(wt, "status", "--porcelain", "--ignore-submodules=none").stdout == ""
+    if deinit:
+        _git(wt, "submodule", "deinit", "-q", "sm")
+    res = _run(main, REM, "--path", str(wt))
+    assert res.returncode == 3 and "'unpushed'" in res.stderr, res.stdout + res.stderr
+    assert os.path.isdir(gd)
+    assert _git(gd, "rev-parse", "saved-work^{commit}").stdout.strip() == local
+
+
+@pytest.mark.parametrize("deinit", [False, True])
+def test_w6l_tag_only_submodule_commit_is_kept(ctl_sub, deinit):
+    """R6: HEAD and --branches miss a commit only a tag reaches; both checks
+    (initialised checkout via foreach, retained repository via --git-dir) use
+    the same rev list and refuse."""
+    _remove_refuses_tag_only_commit(ctl_sub, annotated=False, deinit=deinit)
+
+
+def test_w6m_annotated_tag_only_submodule_commit_is_kept(ctl_sub):
+    _remove_refuses_tag_only_commit(ctl_sub, annotated=True, deinit=False)
diff --git a/tests/test_issue21_worktree_prereqs.py b/tests/test_issue21_worktree_prereqs.py
index 92b9a5e..b091832 100644
--- a/tests/test_issue21_worktree_prereqs.py
+++ b/tests/test_issue21_worktree_prereqs.py
@@ -362,23 +362,19 @@ def test_t2_5b_prompts_unchanged_without_options(wt_repo, monkeypatch, tmp_path)
     assert _roles(calls, "Reviewer")[0].startswith("다음 구현 사항(작업 목표: t21)")
 
 
-def test_t2_6_worktree_env_fallback_and_no_base_env(wt_repo, tmp_path):
+def test_t2_6_worktree_env_fallback_and_no_base_env(wt_repo, tmp_path, monkeypatch):
     main, wt = wt_repo
     wt2 = tmp_path / "wt2"
     _git(main, "worktree", "add", "-q", "-b", "feat2", str(wt2))
-    os.environ["MAM_LOOP_WORKTREE"] = str(wt)
-    os.environ["MAM_LOOP_BASE"] = _git(main, "rev-parse", "HEAD")
-    try:
-        r = _runner()
-        r.parse_args()
-        assert r.worktree_root == Path(os.path.realpath(wt)) and r.worktree_given
-        assert r.base_ref is None and r.base_sha == "" and r.base_source == "head", "MAM_LOOP_BASE is ignored (D17)"
-        r = _runner("--worktree", str(wt2))
-        r.parse_args()
-        assert r.worktree_root == Path(os.path.realpath(wt2)), "the CLI wins over MAM_LOOP_WORKTREE"
-    finally:
-        os.environ.pop("MAM_LOOP_WORKTREE", None)
-        os.environ.pop("MAM_LOOP_BASE", None)
+    monkeypatch.setenv("MAM_LOOP_WORKTREE", str(wt))
+    monkeypatch.setenv("MAM_LOOP_BASE", _git(main, "rev-parse", "HEAD"))
+    r = _runner()
+    r.parse_args()
+    assert r.worktree_root == Path(os.path.realpath(wt)) and r.worktree_given
+    assert r.base_ref is None and r.base_sha == "" and r.base_source == "head", "MAM_LOOP_BASE is ignored (D17)"
+    r = _runner("--worktree", str(wt2))
+    r.parse_args()
+    assert r.worktree_root == Path(os.path.realpath(wt2)), "the CLI wins over MAM_LOOP_WORKTREE"
 
 
 def test_t2_7_runner_reads_mam_jobs_dir(wt_repo, tmp_path, monkeypatch):
diff --git a/tests/test_issue5_phase1_delegation.py b/tests/test_issue5_phase1_delegation.py
index 6eee8d5..89de227 100644
--- a/tests/test_issue5_phase1_delegation.py
+++ b/tests/test_issue5_phase1_delegation.py
@@ -497,6 +497,11 @@ def test_importing_delegation_does_not_mutate_environment(mam_sandbox):
     assert set(os.environ) == keys
 
 
+def _normalize_help(text: str) -> str:
+    text = text.replace("optional arguments:", "options:")
+    return re.sub(r"\s+", " ", text).strip()
+
+
 def test_shim_help_output_matches_pre_move_capture():
     """The shim must be indistinguishable from the implementation at the CLI.
 
@@ -512,7 +517,12 @@ def test_shim_help_output_matches_pre_move_capture():
             capture_output=True, text=True, timeout=60,
         )
         assert res.returncode == 0, res.stderr
-        assert res.stdout + res.stderr == golden, "--help drifted for {}".format(mod)
+        # argparse re-wraps usage/help text and renamed the "optional arguments"
+        # group across Python versions (Issue #28: the captures were taken on
+        # 3.9, the Linux host runs 3.14). Compare the content, not the layout:
+        # whitespace runs collapsed, the group label unified.
+        assert _normalize_help(res.stdout + res.stderr) == _normalize_help(golden), \
+            "--help drifted for {}".format(mod)
 
 
 # --- PV-4: the context matrix, each scenario in a fresh interpreter ------------
diff --git a/tests/test_workspace_scope.py b/tests/test_workspace_scope.py
index 251bd42..6688ccf 100644
--- a/tests/test_workspace_scope.py
+++ b/tests/test_workspace_scope.py
@@ -25,7 +25,9 @@ class TestWorkspaceScope(unittest.TestCase):
         lib_sh = os.path.join(repo_root, ".agents", "skills", "lib.sh")
         
         cmd = f"source {lib_sh} && env -u HERDR_SESSION_NAME -u HERDR_SERVER_NAME bash -c 'source {lib_sh} && resolve_herdr_session \"test-session\" \"{self.ws_dir}\"'"
-        res = subprocess.run(cmd, shell=True, capture_output=True, text=True)
+        # `source` is a bash builtin; on hosts where /bin/sh is dash `shell=True`
+        # fails with "source: not found" (Issue #28), so run the string under bash.
+        res = subprocess.run(["bash", "-c", cmd], capture_output=True, text=True)
         self.assertEqual(res.returncode, 0, f"Command failed: {res.stderr}")
         parent = os.path.basename(os.path.dirname(os.path.abspath(self.ws_dir))).lower().replace('_', '-')
         work = os.path.basename(os.path.abspath(self.ws_dir)).lower().replace('_', '-')