phase: 135_git_source_branch

All verification complete. No edits were needed by this pass — the phase work and docs were already consistent and green.

**Phase 135 final verification pass — report**

- Verified all 5 tasks' work present & correct: migration 0024 (reversible), `GitSource.branch` + 4 schema shapes, `validate_branch_name` (full check order per design), `clone_or_pull(…, branch)` (HEAD guard first, `--branch` clone, fetch+ff merge), both call sites pass `row.branch`, UI (add-form field, editor field, row tag), `file://` URL transport.
- Completion criteria: (1) branch-mirrored through Sync + CLI — **pass** (E2E + integration); (2) `branch=None` byte-identical — **pass** (`test_branch_none_argv_is_byte_identical_pre_phase_sequence` green); (3) fixed 422s / local-row 422 / tri-state — **pass**; (4) mismatch fails loudly with remove-and-re-add — **pass** (E2E); (5) coverage 99% >90%, E2E isolated green — **pass**; (6) no regressions — **pass**.
- Tests: `uv run pytest --cov=app --cov-report=term-missing` → 3223 passed, app/ 99%; `uv run pytest tests/e2e/test_git_source_branch.py -v --no-cov` → 4 passed (16.4 s); `uv run ruff check .` clean; `uv run pyright` → 0 errors, 0 warnings.
- Documentation: README.md reviewed in full — phase-135 branch section accurate; the phase's README diff also correctly fixed a pre-existing stale line (shallow `--depth 1` clone vs full-history, phase 107). Routes, env defaults, feature lists verified against code. AGENTS.md — all 10 rules + quick-reference verified (referenced tests, PLAN.md, phases dirs, commands all accurate). **Verified consistent — no changes needed.**
- No live-infrastructure changes (dev DB already running and healthy; no live steps in this phase).
- Next pending phase: `.agents/phases/todo/136_force_push_reset`.

app/api/sync.py

@@ -37,7 +37,14 @@ decisions):
    — the row's ``token`` column injected as
    ``https://x-access-token:<token>@…`` only for https? rows; NULL
    token → the bare stored URL verbatim, so public repos and legacy
-   embedded-token rows clone exactly as before) into
+   embedded-token rows clone exactly as before) and the row's
+   BRANCH PIN as the third argument (phase 135 — a fresh clone checks
+   it out, ``git clone --branch``; an existing checkout is guarded — a
+   mismatched branch fails loudly, the remove-and-re-add error — and
+   tracked, ``git fetch origin <b>`` + ``git merge --ff-only
+   FETCH_HEAD``; ``branch=None``, i.e. every pre-phase-135 row and
+   every env-fallback row, keeps the pre-phase argv byte-identical)
+   into
    ``BOR_SOURCES_DIR/<repo-name>/`` (phase 28 — reused, not
    re-implemented; the checkout name stays on the bare URL —
    credential-free); ``kind=local`` → the stored directory, re-verified
@@ -498,7 +505,17 @@ async def _run_sync() -> None:
                 # URL ONLY here (clone_url_for — NULL token → the bare
                 # stored URL verbatim); repo_name stays on the bare URL
                 # so the checkout directory name is credential-free.
-                root = clone_or_pull(clone_url_for(row), sources_root / repo_name(row.url))
+                # Phase 135: the row's branch pin is the third
+                # argument — NULL (every pre-phase-135 row + every
+                # env-fallback row) keeps the pre-phase argv
+                # byte-identical; a pinned branch is checked out on a
+                # fresh clone (--branch) and guarded + tracked on an
+                # existing checkout (fetch + ff-merge of that ref).
+                root = clone_or_pull(
+                    clone_url_for(row),
+                    sources_root / repo_name(row.url),
+                    row.branch,
+                )
                 # Phase 106 (D2): the checkout's per-file last-commit
                 # dates, keyed by the SAME root string the importer
                 # sees (full-history checkouts → true per-file