phase: 135_git_source_branch

All verification complete. No edits were needed by this pass — the phase work and docs were already consistent and green.

**Phase 135 final verification pass — report**

- Verified all 5 tasks' work present & correct: migration 0024 (reversible), `GitSource.branch` + 4 schema shapes, `validate_branch_name` (full check order per design), `clone_or_pull(…, branch)` (HEAD guard first, `--branch` clone, fetch+ff merge), both call sites pass `row.branch`, UI (add-form field, editor field, row tag), `file://` URL transport.
- Completion criteria: (1) branch-mirrored through Sync + CLI — **pass** (E2E + integration); (2) `branch=None` byte-identical — **pass** (`test_branch_none_argv_is_byte_identical_pre_phase_sequence` green); (3) fixed 422s / local-row 422 / tri-state — **pass**; (4) mismatch fails loudly with remove-and-re-add — **pass** (E2E); (5) coverage 99% >90%, E2E isolated green — **pass**; (6) no regressions — **pass**.
- Tests: `uv run pytest --cov=app --cov-report=term-missing` → 3223 passed, app/ 99%; `uv run pytest tests/e2e/test_git_source_branch.py -v --no-cov` → 4 passed (16.4 s); `uv run ruff check .` clean; `uv run pyright` → 0 errors, 0 warnings.
- Documentation: README.md reviewed in full — phase-135 branch section accurate; the phase's README diff also correctly fixed a pre-existing stale line (shallow `--depth 1` clone vs full-history, phase 107). Routes, env defaults, feature lists verified against code. AGENTS.md — all 10 rules + quick-reference verified (referenced tests, PLAN.md, phases dirs, commands all accurate). **Verified consistent — no changes needed.**
- No live-infrastructure changes (dev DB already running and healthy; no live steps in this phase).
- Next pending phase: `.agents/phases/todo/136_force_push_reset`.

scripts/import_docs.py

@@ -24,7 +24,14 @@ precedence order:
    column injected as ``https://x-access-token:<token>@…`` only for
    https? rows, NULL token → the bare stored URL verbatim (public
    repos and legacy embedded-token rows clone exactly as before);
-   the checkout name stays on the bare URL (credential-free); local
+   the checkout name stays on the bare URL (credential-free). Phase
+   135: a row's BRANCH PIN (``branch``) is honored by the clone — a
+   fresh clone checks it out (``git clone --branch``), an existing
+   checkout is guarded (a mismatched branch fails loudly — remove and
+   re-add the source to switch) and tracked (``git fetch origin <b>``
+   + ``git merge --ff-only FETCH_HEAD``); rows without a branch (all
+   pre-phase-135 rows + the env-fallback rows) keep the pre-phase
+   clone/pull byte-identical; local
    rows are the existing directories themselves, walked directly. A
    failing clone/pull — or a local directory that is missing at run
    time — aborts the whole run *before* anything is imported.
@@ -245,7 +252,17 @@ def _resolve_sources(
                 # URL ONLY here (clone_url_for — NULL token → the bare
                 # stored URL verbatim); repo_name stays on the bare URL
                 # so the checkout directory name is credential-free.
-                root = clone_or_pull(clone_url_for(row), sources_root / repo_name(row.url))
+                # Phase 135: the row's branch pin is the third
+                # argument — NULL (every pre-phase-135 row + every
+                # env-fallback row) keeps the pre-phase argv
+                # byte-identical; a pinned branch is checked out on a
+                # fresh clone (--branch) and guarded + tracked on an
+                # existing checkout (fetch + ff-merge of that ref).
+                root = clone_or_pull(
+                    clone_url_for(row),
+                    sources_root / repo_name(row.url),
+                    row.branch,
+                )
                 # Phase 106 (D2): the checkout's per-file last-commit
                 # dates, keyed by the SAME root string the importer
                 # sees; local rows contribute nothing (mtime fallback).