test(server): cover reassign-to-self visible writes and run-lock deny copy on issue mutation routes

[claudegoogl-sudo]

Thinking Path

• Paperclip is the open source app people use to manage AI agents for work.
• Agents act on issues through server routes. Ownership guards decide which writes each caller may make.
• PR fix(server): let contextless heartbeat runs write issues under the run cap #323 changed these guards: contextless heartbeat runs can now write issues under the run cap. This shifted deny and allow behavior around reassignment.
• Four edge cases around the new behavior had no regression coverage: a creator retracting an idle agent-assigned issue by reassigning to itself, the run-lock deny copy, a standard-trust agent reassigning to itself, and out-of-visibility denial on read and write.
• This pull request adds four regression tests for those cases, plus the read-projection mocks they need.
• The benefit: future changes to the ownership guards cannot silently break these behaviors.

Linked Issues or Issue Description

Refs: #323 — locks in the reassign-to-self and run-lock deny behavior around the ownership guards this PR landed.

What Changed

• Add a new describe block creator reassign-to-self on idle agent-assigned issues (default-open visible write) to server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts with four regression tests:
  • AC1: the creating agent can retract an idle agent-assigned issue by reassigning to itself and cancelling.
  • AC2: the same creator patch is denied with the run-lock deny copy while the assignee holds the checkout.
  • AC3: an unrelated standard-trust agent can reassign the idle agent-assigned issue to itself.
  • AC4: an out-of-visibility actor is still denied with the not-visible code on both read and write.
• Add the read-projection mocks the tests need.
• Test-only change. No production code, no migrations, no docs changes.

Verification

• cd server && npx vitest run src/__tests__/issue-agent-mutation-ownership-routes.test.ts → Test Files 1 passed (1), Tests 91 passed (91) (about 50 s), including all four new tests.
• What did not run locally: the full monorepo suite (pnpm test:run). This PR touches one test file and adds no production code. CI on this PR runs the wider gates.

Risks

• Low risk. Test-only change. No production code paths, no migrations, no behavioral shifts. Worst case is a flaky test that needs a small follow-up fix.

For core feature work, check ROADMAP.md first and discuss it in #dev before opening the PR. Feature PRs that overlap with planned core work may need to be redirected — check the roadmap first. See CONTRIBUTING.md.

Model Used

GLM (glm-5-turbo) via the Z.ai provider, running as an autonomous coding agent (tool use, code execution, extended reasoning). The change was authored and verified by this agent with no human editing.

Checklist

• I have included a thinking path that traces from project context to this change
• I have specified the model used (with version and capability details)
• I have checked ROADMAP.md and confirmed this PR does not duplicate planned core work (checked; all milestones are feature-level, no test-coverage overlap)
• I have searched GitHub for duplicate or related PRs and linked them above (searched reassign, mutation ownership, issue-agent-mutation-ownership-routes; no duplicates found, related: fix(server): let contextless heartbeat runs write issues under the run cap #323)
• I have either (a) linked existing issues with Fixes: # / Closes # / Refs # OR (b) described the issue in-PR following the relevant issue template (Refs: fix(server): let contextless heartbeat runs write issues under the run cap #323)
• I have not referenced internal/instance-local Paperclip issues or links (only public GitHub #NNN / github.com/paperclipai/paperclip URLs)
• My branch name describes the change (e.g. docs/..., fix/...) and contains no internal Paperclip ticket id or instance-derived details (test/issue-visible-write-reassign-regression)
• I have run tests locally and they pass (91/91, see Verification)
• I have added or updated tests where applicable (this PR is tests only)
• I have updated relevant documentation to reflect my changes — N/A: test-only change, no documented behavior changes
• I have considered and documented any risks above
• All Paperclip CI gates are green (focused suite 91/91 locally; this PR must stay green before merge)
• Greptile is 5/5 with no open P2s, recommendations, or follow-ups — N/A: Greptile review is not active on this fork's PRs
• I will address all Greptile and reviewer comments before requesting merge

---

Follows CONTRIBUTING.md PR template — sections present: Thinking Path, Linked Issues or Issue Description, What Changed, Verification, Risks, Model Used, Checklist (all headings verbatim from .github/PULL_REQUEST_TEMPLATE.md at HEAD).