Bug: parallel worktree commits cause stash cross-contamination — commits bypass PR review #1684

Problem

When committing across multiple git worktrees in parallel (e.g., 5 parallel git commit calls in separate worktrees), pre-commit hooks' git stash push/git stash pop operations corrupt branch state because git stash is shared across all worktrees.

What happened (session 2026-03-14)

5 worktrees were created from origin/Dev_new_gui for issues #1667, #1663, #1571, #1564, #1517. All 5 commits were launched in parallel. Result:

• 3 of 5 commits landed directly on Dev_new_gui instead of their feature branches
• Commits d67adbd05 (Bug: getSeverityColor() exported but has zero callers — dead code in useCssVars.ts #1667), 02b1f1846 (Bug: .gitignore core.* pattern blocks legitimate files in subdirectories #1663), d807d440f (fix: bug_predictor.py line 1202 exceeds 100-char line length limit (E501) #1564) appeared in origin/Dev_new_gui history without PRs
• Only 2 commits (fix(vllm): remove dead destroy_model_parallel import in vllm_provider.py #1571, Bug: 3 intent context prompt files lack doc-first safeguard added in #1476 #1517) stayed on their correct feature branches
• The branch guard hook (Bug: pre-commit stash/pop silently switches active branch during commit #1670) PASSED in all 5 cases — it did not detect or prevent the contamination

Root cause

Git worktrees share the same .git/objects, .git/refs, and critically, .git/refs/stash. Pre-commit hooks call git stash push --include-untracked before validation and git stash pop after. When multiple worktrees run pre-commit hooks simultaneously:

1. Worktree A stashes its changes
2. Worktree B stashes its changes (pushing A's stash down)
3. Worktree A pops — gets B's stash instead of its own
4. Changes leak across branches

Why branch guard (#1670) didn't help

The branch guard hook checks if the current branch name changed between pre-commit and commit time. In this case, the branch names didn't change — the stash contamination caused commits to include wrong content but on the "right" branch. The commits were then pushed to remote branches that happened to be fast-forwardable into Dev_new_gui.

Impact

Critical — Commits bypass PR review process and land directly on the integration branch. This defeats code review, CI gating, and change tracking.

Mitigation (immediate)

Added to MEMORY.md and CLAUDE.md:

NEVER commit worktrees in parallel. Always commit sequentially.

Proposed fix

1. Lock file per worktree: Pre-commit hook acquires a repo-wide lock (flock /path/to/.git/pre-commit.lock) before stashing, ensuring only one worktree runs pre-commit at a time
2. Disable stash in hooks: Configure pre-commit to skip stash (--no-stash flag) — requires all files to be staged before commit (already enforced by policy)
3. Worktree-scoped stash: Git doesn't natively support this, but a wrapper script could use per-worktree temp branches instead of stash

Discovered during

Team-implement session fixing #1667, #1663, #1564, #1571, #1517

Related issues

• Infra: pre-commit stash/restore stages untracked in-progress files from other branches #1503 (closed): Pre-commit stash stages untracked files from other branches
• Bug: pre-commit stash/pop silently switches active branch during commit #1670 (closed): Branch guard hook for stash-induced branch switch
• Bug: pre-commit stash pop can switch active branch and orphan commits #1654 (closed): Worktree branch guard pre-commit hook