Handle the origin/-qualified default branch on both read paths

`resolveDefaultBranch` deliberately returns a remote-only default QUALIFIED
(`origin/release`) because git cannot resolve a bare name against
`refs/remotes/origin/`. Two consumers assumed the bare form:

- repo_service.repairVanishedTargets built `live` from `listRemoteBranchNames`,
  which STRIPS the prefix — so `live` held `release` while `defaultBranch` was
  `origin/release`. `resolveThroughChain` rejected a perfectly live default as
  "gone" and skipped the repair, leaving the worktree on a broken target. It now
  records both spellings.

- target_candidates built the candidate list from local branches only, so a
  remote-only default was omitted entirely and NO candidate received the
  `default` group — the picker could not offer the branch every diff and new
  worktree measures against, recreating the exact disagreement the
  override-threading was meant to fix. It is now offered, and marked `onRemote`
  (it is on the remote by definition).

Coverage note: the picker test fails without its fix (verified). The
`repointVanishedTargets` unit tests pin the CONTRACT (the core honours a
qualified default; a default absent from `live` is never invented) but pass
`live` in by hand, so they do not by themselves cover the caller's `live`
construction — the existing "a target that still exists on origin is NOT repaired
away" test is what exercises that path.

Author: leduckhc

server/src/repo_service.test.ts

@@ -379,3 +379,37 @@ test("repointVanishedTargets: leaves a broken target in place when nothing resol
   });
   assert.deepEqual(writes, [], "no default to fall back to: surface targetResolved:false instead");
 });
+
+test("repointVanishedTargets: repairs to a remote-only, origin/-qualified default", () => {
+  // `resolveDefaultBranch` returns a remote-only default QUALIFIED (`origin/release`)
+  // because git cannot resolve a bare name against `refs/remotes/origin/`, while
+  // `listRemoteBranchNames` strips the prefix. The caller therefore records BOTH
+  // spellings in `live`; with only the bare one, `resolveThroughChain` rejected a
+  // live default as "gone" and the repair was skipped, leaving a broken target.
+  const writes = repointVanishedTargets({
+    here: new Set(["/wt"]),
+    persisted: { "/wt": { target: "feat/gone" } },
+    live: new Set(["release", "origin/release"]),
+    branchTarget: {},
+    ownBranch: { "/wt": "feat/child" },
+    defaultBranch: "origin/release",
+  });
+  assert.deepEqual(writes, [
+    { path: "/wt", target: "origin/release", retargetedFrom: "feat/gone" },
+  ]);
+});
+
+test("repointVanishedTargets: a default absent from `live` is never invented", () => {
+  // Pins WHY the caller must record both spellings: a `live` set carrying only the
+  // bare `release` cannot honour an `origin/release` default, and inventing a
+  // destination is worse than reporting `targetResolved: false`.
+  const writes = repointVanishedTargets({
+    here: new Set(["/wt"]),
+    persisted: { "/wt": { target: "feat/gone" } },
+    live: new Set(["release"]),
+    branchTarget: {},
+    ownBranch: { "/wt": "feat/child" },
+    defaultBranch: "origin/release",
+  });
+  assert.deepEqual(writes, []);
+});

server/src/repo_service.ts

@@ -229,7 +229,16 @@ async function repairVanishedTargets(
   // it just is not here yet); a wrong redirect is unrecoverable data loss of the
   // user's intent. Never trade the second for the first.
   const remotes = await listRemoteBranchNames(repoPath);
-  const live = new Set<string>([...locals, ...remotes]);
+  const live = new Set<string>(locals);
+  for (const b of remotes) {
+    // BOTH spellings. `listRemoteBranchNames` strips the prefix, but a stored
+    // target (and `resolveDefaultBranch`'s answer for a remote-only branch) is the
+    // QUALIFIED `origin/<b>` — git cannot resolve a bare name against
+    // `refs/remotes/origin/`. Recording only one form left `resolveThroughChain`
+    // rejecting a perfectly live default as "gone" and skipping the repair.
+    live.add(b);
+    live.add(`origin/${b}`);
+  }
   for (const e of entries) {
     if (!e.branch) continue;
     const pr = lastKnown(repoPath, e.branch);

server/src/target_candidates.test.ts

@@ -358,3 +358,25 @@ test("resolveThroughChain refuses a default branch that does not exist either",
     null,
   );
 });
+
+test("a remote-only default branch is still offered, and grouped as the default", async () => {
+  // `resolveDefaultBranch` returns a remote-only override QUALIFIED (`origin/x`),
+  // because git cannot resolve a bare name against `refs/remotes/origin/`. Building
+  // the candidate list from local branches alone dropped it, so the picker could
+  // not offer the very branch every diff and new worktree measures against.
+  const s = await makeStack();
+  try {
+    const sha = execFileSync("git", ["rev-parse", "HEAD"], { cwd: s.repo }).toString().trim();
+    execFileSync("git", ["remote", "add", "origin", "https://example.test/x/y.git"], {
+      cwd: s.repo,
+    });
+    execFileSync("git", ["update-ref", "refs/remotes/origin/release", sha], { cwd: s.repo });
+    const cands = await targetCandidates(s.repo, s.child, "release");
+    const def = cands.find((c) => c.group === "default");
+    assert.equal(def?.branch, "origin/release", "the remote-only default is offered");
+    assert.equal(def?.onRemote, true, "it is on the remote by definition, so selectable");
+    assert.equal(def?.isSelf, false);
+  } finally {
+    s.cleanup();
+  }
+});

server/src/target_candidates.ts

@@ -131,10 +131,19 @@ export async function targetCandidates(
   if (locals.length === 0) return [];
 
   const self = trees.find((t) => t.path === worktreePath)?.branch ?? null;
+  // The resolved default may be a remote-only branch, which `resolveDefaultBranch`
+  // returns QUALIFIED (`origin/release`) because git cannot resolve a bare name
+  // against `refs/remotes/origin/`. It is therefore absent from `locals`, and
+  // building the list from `locals` alone dropped it entirely — no candidate got
+  // the `default` group and the picker could not offer the very branch every diff
+  // and new worktree measures against. Offer it explicitly.
+  const remoteOnlyDefault =
+    defaultBranch && !locals.includes(defaultBranch) ? defaultBranch : null;
+  const selectable = remoteOnlyDefault ? [...locals, remoteOnlyDefault] : locals;
   // Candidate order matters: `closestAncestorBranch` breaks distance ties by it,
   // and the repo default is the tie we most want to win.
   const ordered = [
-    ...(defaultBranch && locals.includes(defaultBranch) ? [defaultBranch] : []),
+    ...(defaultBranch && selectable.includes(defaultBranch) ? [defaultBranch] : []),
     ...locals.filter((b) => b !== defaultBranch),
   ];
   const forkedFrom = await closestAncestorBranch(worktreePath, ordered);
@@ -159,7 +168,7 @@ export async function targetCandidates(
     other: 3,
   };
 
-  const candidates: TargetCandidate[] = locals.map((branch) => ({
+  const candidates: TargetCandidate[] = selectable.map((branch) => ({
     branch,
     group: groupOf(branch),
     // The push-state gate exists because a PULL REQUEST base must live on the
@@ -173,7 +182,9 @@ export async function targetCandidates(
     // repo whose only remote is `upstream` has a remote but no origin branches, so
     // an "any remote" gate would switch the rule ON against an EMPTY set and
     // disable every candidate.
-    onRemote: originExists ? onRemote.has(branch) : true,
+    // A remote-only default is `origin/<b>`, which is by definition on the remote
+    // but never in the stripped `onRemote` set — treat it as pushed.
+    onRemote: originExists ? branch === remoteOnlyDefault || onRemote.has(branch) : true,
     isSelf: branch === self,
   }));