Require fresh clean worktrees on acquire

internal/manager/manager.go

@@ -676,7 +676,7 @@ func (m *Manager) createWorktree(r *db.Repository, defaultBranch, branchName str
 func (m *Manager) prepareWorktree(gr *gitops.Repo, wt *db.Worktree, defaultBranch string) error {
 	if gr.HasRemote() {
 		if err := gr.FetchOrigin(); err != nil {
-			m.logf("warning: fetch origin failed: %v", err)
+			return fmt.Errorf("fetch origin: %w", err)
 		}
 	}
 	target := "origin/" + defaultBranch
@@ -690,6 +690,25 @@ func (m *Manager) prepareWorktree(gr *gitops.Repo, wt *db.Worktree, defaultBranc
 	if err := gr.Clean(wt.Path); err != nil {
 		return err
 	}
+
+	baseCommit, err := gr.RevParse(target)
+	if err != nil {
+		return fmt.Errorf("read default branch commit: %w", err)
+	}
+	headCommit, err := gr.WorktreeRevParse(wt.Path, "HEAD")
+	if err != nil {
+		return fmt.Errorf("read worktree commit: %w", err)
+	}
+	if headCommit != baseCommit {
+		return fmt.Errorf("worktree is at %s, want %s", headCommit, baseCommit)
+	}
+	clean, err := gr.IsClean(wt.Path)
+	if err != nil {
+		return fmt.Errorf("check worktree status: %w", err)
+	}
+	if !clean {
+		return errors.New("worktree is not clean")
+	}
 	return nil
 }
 

internal/manager/manager_test.go

@@ -351,6 +351,17 @@ func TestReleaseFetchesLatestDefaultBranch(t *testing.T) {
 	}
 }
 
+func TestAcquireFailsWhenFetchFails(t *testing.T) {
+	repo := setupRepo(t)
+	d := newManagerDB(t)
+	m := newTestManager(t, d)
+	run(t, repo, "git", "remote", "set-url", "origin", filepath.Join(filepath.Dir(repo), "missing.git"))
+
+	if _, err := m.Acquire(repo, "task-1"); err == nil || !strings.Contains(err.Error(), "fetch origin") {
+		t.Fatalf("expected fetch failure, got %v", err)
+	}
+}
+
 func TestReleaseDoesNotReturnStaleWorktreeWhenFetchFails(t *testing.T) {
 	repo := setupRepo(t)
 	d := newManagerDB(t)