Branch owner escalation (one live owner per troubled branch)

The three rungs

Rung	Holder	How long
Owner	the session the existing owner ladder resolves	30 minutes
Crew lead	the lead seat of the crew that launched the branch, stored as a crew id	30 minutes
Lead seat	the Worktree Lifecycle crew lead, resolved fresh on every pass	terminal

A dead owner advances immediately; an owner whose liveness cannot be read waits out its deadline, because a guess is not a fact. A seat that will not resolve raises one line on the crew board and is counted in the census — it never falls back to a person.

Siblings share one owner

Two branches carrying one task — a branch and the rescue that carried it — resolve to one task key and therefore one owner, one deadline and one escalation. The join uses only a link the system recorded; a name that merely looks related is never guessed into another task, and the census reports how many branches joined nothing.

Dispositions settle a task

A branch its owner marked superseded, blocked by hand, or carried by a rescue is owned and resolved: it is never re-stamped, never given a worker, never woken. A crew can declare its own set-aside with POST /branch-owner/disposition, and only three callers may: the branch's own owner, the lead of the crew that launched it, or the Worktree Lifecycle lead. Every other caller is refused, and a caller that cannot prove its own session is refused before anything else is read. The declaration names who made it, and it is written only if the record still matches what the caller read — so a pass running beside it can never quietly undo it. A disposition is re-checked when the branch head moves.

The switch, and why it ships off

The record, the sweep and the census run from the first change and start nothing. Starting a session is allowed only when branchOwnerEscalationEnabled — a Worktree Lifecycle setting, default off — is turned on, after the shadow census has been read.

Starts are capped at 3 per pass and 24 per day box-wide. A refused start retries on the next pass, counts the refusal, and raises a board line after two in a row for one task.

What it never does

It creates no inbox item at all — there is no card to reveal, because the start is attempted straight through the app's own background-session starter. It reads the lander's and the branch store's outputs; it does not hold, land or mint anything.

Reading it

• GET /branch-owner/census — tasks by rung, live / dead / none, disposed, legacy, ungrouped, seat-unresolved, starts today, both caps, and when the last pass ran.
• GET /branch-owner/owners — every owner record.
• The sweep's own heartbeat is registered with the service registry, so a sweep that stops ticking is reported rather than silent.