Walk the default branch first, and keep ssh noise out of the room

Rooms mapped before the push watch existed carry no default_branch, so
the "report a commit as being on master, not on some stale branch that
also contains it" ordering never applied to them. Look it up once and
keep it.

known_hosts lives in the image, so it resets on every rebuild and the
first ssh connection printed "Permanently added ... to the list of known
hosts" straight into the room, prepended to the first assessment. Set
LogLevel ERROR in the generated ssh config; real errors still come back.

Corrects two claims in Current state that the API contradicts: the repo
has had three PRs, not zero, and their review threads for #2 and #3 are
orphaned in the room right now.

AGENTS.md

@@ -36,7 +36,10 @@ flat JSON in a writable `state/` mount.
 
 - **Run (container, on the Spark):** from `~/gitea-review-bot`, `docker compose up -d --build`
   (host networking, `restart: unless-stopped`; read-only mounts of `.env`/`config.toml`/SSH key,
-  read-write `state/`). Logs: `docker compose logs -f`.
+  read-write `state/`). Logs: `docker compose logs -f`. `known_hosts` lives inside the image, so it
+  resets on every rebuild — the ssh config sets `LogLevel ERROR` so the first connection's
+  "Permanently added … to the list of known hosts" warning doesn't get prepended to a review or
+  assessment (it did, visibly, on 2026-08-21).
 - **Deploy:** the Spark's `~/gitea-review-bot` is a Gitea clone tracking `master`; deploy =
   `git fetch && git reset --hard origin/master && docker compose up -d --build`, **or one click on
   this bot's tile in Spark Control's Bots tab** (shipped since spark-control v0.28.0, confirmed live:
@@ -207,12 +210,16 @@ reproduces it.
   auto-publish → redacted). **PR #5 "Update index.html" is still open**, reviewed 2026-06-30, its thread
   live in the room and waiting on a `merge`/`reject`. Push watch is **off** here.
 - **ten31-brand** — onboarded 2026-08-18 to watch the interactive deck
-  (`design/deck/interactive/index.html`). It has had **zero PRs ever**, and collaborator `jonathan`
-  **is not blocked from `master`** — an earlier note here said he was, but the Gitea API says 18 of the
-  last 50 commits on `master` are his (`Jonathan Kirkwood <jonathan@ten31.vc>`, most recently
-  2026-08-21), pushed directly. That gap is what the push watch closes. His three `jonathan/*` branches
-  are all already merged into `master`. Every commit he has ever made touches exactly one file,
+  (`design/deck/interactive/index.html`). Collaborator `jonathan` uses **both** routes, so both are
+  now covered: three PRs (#1–#3, all his, all merged 08-19/08-20, all reviewed by the bot) **and**
+  direct pushes to `master` — 18 of the last 50 commits there are his
+  (`Jonathan Kirkwood <jonathan@ten31.vc>`, most recently 2026-08-21). Two earlier notes here were
+  wrong and are corrected: he is *not* blocked from pushing to `master`, and the repo has *not* had
+  zero PRs. Every commit he has made touches exactly one file,
   `design/deck/interactive/index.html`, which is why `expected_paths` is that subtree.
+  The review threads for #2 and #3 are **orphaned in the room right now** — merged outside the bot,
+  so the stale prune dropped their roots without redacting. That is Next step 2 below, no longer
+  hypothetical.
 
 **Next steps, in priority order:**
 1. **Deploy the push watch and watch one real notice land** (see the pending redeploy above).

docker-entrypoint.sh

@@ -24,6 +24,7 @@ config = f"""Host {mac.get('ssh_alias', 'mac-bridge')}
     IdentitiesOnly yes
     StrictHostKeyChecking accept-new
     UserKnownHostsFile {os.environ['KNOWN_HOSTS']}
+    LogLevel ERROR
 """
 with open(os.environ['SSH_CONFIG'], "w") as f:
     f.write(config)

src/bot.py

@@ -965,6 +965,13 @@ async def main():
         # A commit is usually reachable from several branches and gets reported under whichever we
         # walk first, so walk the default branch first: "3 new commits on master" is the true answer
         # for anything that has landed, rather than the name of some stale branch it also sits on.
+        # Rooms mapped before this existed have no default_branch, so look it up once and keep it.
+        if "default_branch" not in room:
+            dstatus, dbody = await asyncio.to_thread(lambda: gitea_g(f"/repos/{room['repo']}"))
+            room["default_branch"] = json.loads(dbody).get("default_branch", "") if dstatus == 200 else ""
+            save_state(rooms_path, rooms)
+            print(f"{room['label']}: default branch is {room['default_branch'] or '(unknown)'}",
+                  flush=True)
         default_branch = room.get("default_branch") or ""
         branches.sort(key=lambda b: (b != default_branch, b))
         since_q = urllib.parse.quote(watch["since"], safe="")