Investigate Reviewer restart failure after local Git source removal

[shenjiecode]

Summary

A focused Reviewer local-Git recovery attempt found a restart failure after the live source repository was deliberately removed. Track this separately from the initial commit / git_diff activation in #40.

Reproduction observed

1. Admit and fully read a local commit target.
2. Append a direct git_diff target to the same active PracticeRun.
3. Verify the journal, Evidence, target snapshots, commit manifest, and diff Artifact before restart.
4. Wait for journal and Evidence durability.
5. Delete only the derived PracticeRun snapshot.
6. Delete the fixture repository's .git directory.
7. Restart the Reviewer Worker.

Observed result: the Worker did not report ready within the bounded recovery window. The run-owned Worker and storage were cleaned up. No root cause has been confirmed yet.

The local-Git Basic path passed before this recovery attempt: immutable commit/diff admission, manifest inspection, complete target-bound reads, checkpoint completion, Store/Evidence joins, repository byte-state unchanged, external helper sentinel not executed, Matrix delivery, Harness, and exact cleanup.

Expected behavior

Worker startup and active-run reconstruction use only the append-only PracticeRun journal, Evidence, and journal-authorized CapturedArtifactStore objects. They must not require live ref resolution or local-Git execution.

A later read of an incomplete commit member may access the pinned blob source and return a stable GIT_OBJECT_UNAVAILABLE if the source is gone. Stored diff consumption and durable replay must remain source-independent.

Acceptance criteria

• Identify the startup/reconstruction path that prevents Worker readiness.
• Prove startup and ContextPack/coverage reconstruction do not initialize or execute local Git.
• Rebuild the deleted derived PracticeRun snapshot from the unchanged journal.
• Preserve the same ordered target IDs, OIDs, snapshot identities, scope digest, manifest/diff identities, and Evidence boundary across restart.
• Prove stored diff consumption and successful exact replay do not access the removed repository.
• Prove a new incomplete commit-member read fails with the specified stable source-unavailable code rather than failing Worker startup.
• Add deterministic regression coverage before rerunning the expensive Recovery Full scenario.
• Run the local-Git Recovery Full oracle and exact cleanup once the deterministic failure is understood.

Verification discipline

Do not repeat the expensive recovery smoke without new deterministic evidence. Keep model liveness separate from the machine recovery oracle.