MC-4681

KEYSTONE BUG (4+ instances 2026-06-02/03). The control-room-recover path recovers a finished direct worker's DONE, sets the ticket to in_review, and references its cr/<slug> branch — but it NEVER merges that branch to master. So the work is committed + tested but NOT LIVE. Every such ticket reads 'done/in_review' while master is unchanged. Confirmed unmerged cr/ branches with real, test-passing work stranded: - MC-4634 0b71b90d (background-task permanent-auth alerting) - MC-4655 5ed940a6 (shell-safe --description-file/--body-file for ticket creation) - MC-4640 fcaa1f00+9884e2d8 (MC↔Hermes Kanban bridge, 21 tests pass) - MC-4629 7d577a7e landed but its TEST commit 36be9b3b stranded on cr branch → master pickup suite RED Compounds with: workers also report DONE without merging slot-pool branches (MC-4601 fee1babd), so 'done' systematically != 'on master'. Fix direction (council): - On control-room-recover of a DONE worker: fast-forward/merge the cr/<slug> branch to master (after the ticket's own tests pass), OR explicitly mark recovered-but-unmerged and surface a controller merge action — do NOT set in_review/done as if shipped. - Add a board invariant: a ticket cannot reach 'done' unless its referenced commit(s) are ancestors of origin/master. (This single guard would have caught every false-done this week.) - Regression: recover a worker whose branch is N commits ahead; assert the branch is merged (or ticket blocked) before done. This is the 4th keystone in the dispatch-hardening cluster: MC-4534 (prompt-echo false DONE/REVIEW), MC-4668 (reviewer reviews wrong commit), MC-4631 (pickup loop only alerts), and THIS (recover never merges). Together they make 'done' on the board untrustworthy — this session every 'done' needed git ground-truth verification. Sequence these four before trusting auto-dispatch/recover again.