fix(tests): pause reopen timer, lock edits to assignee, restore Jira operator on reopen

- reopen_red_review starts the timer paused (paused_at set) instead of
  immediately running, since the operator hasn't resumed working yet —
  blue already did this via blue_work_started_at, red needed the same
  behavior via the existing pause/resume mechanism.
- update_test_red/update_test_blue now lock edits to the actual assigned
  operator for leads too, not just techs — a lead could previously edit
  another operator's in-progress test. Mirrored in TeamTabs.tsx.
- push_test_event reassigns the Jira ticket to the original operator
  (not the reopening lead) when a test returns to red_executing or
  blue_evaluating for rework, instead of leaving it on the lead.

backend/app/domain/test_entity.py

@@ -414,10 +414,14 @@ class TestEntity:
         Called when the assigned Red Lead sends the work back for rework.
         Resets the red-phase timer for a fresh attempt (the first attempt's
         worklog was already recorded at submit time, so this loses nothing).
+        Starts the timer PAUSED — the operator hasn't resumed working yet,
+        just because the lead reopened it. It only starts counting once they
+        explicitly resume it, same as coming back from a hold.
         """
         self._transition(TestState.red_executing)
         self.red_started_at = datetime.utcnow()
         self.red_paused_seconds = 0
+        self.paused_at = self.red_started_at
         self._events.append(DomainEvent("red_review_reopened"))
 
     # Define function submit_blue_evidence

backend/app/routers/tests.py

@@ -672,11 +672,13 @@ def update_test_red(
     Returns:
         TestOut: The updated test with refreshed red-team field values.
     """
-    # Assignee lock: red_tech cannot work a test assigned to someone else
+    # Assignee lock: only the operator actually assigned to this test may
+    # edit it — applies to red_lead too, not just red_tech, since a lead
+    # editing another operator's in-progress test is exactly as wrong as
+    # a different tech doing it.
     _pre_test = crud_get_test_or_raise(db, test_id)
     if (
         _pre_test.red_tech_assignee is not None
-        and current_user.role == "red_tech"
         and _pre_test.red_tech_assignee != current_user.id
     ):
         raise HTTPException(status_code=403, detail="Test is assigned to another operator")
@@ -738,11 +740,11 @@ def update_test_blue(
     Returns:
         TestOut: The updated test with refreshed blue-team field values.
     """
-    # Assignee lock: blue_tech cannot work a test assigned to someone else
+    # Assignee lock: only the operator actually assigned to this test may
+    # edit it — applies to blue_lead too, not just blue_tech.
     _pre_test = crud_get_test_or_raise(db, test_id)
     if (
         _pre_test.blue_tech_assignee is not None
-        and current_user.role == "blue_tech"
         and _pre_test.blue_tech_assignee != current_user.id
     ):
         raise HTTPException(status_code=403, detail="Test is assigned to another operator")

backend/app/services/jira_service.py

@@ -828,9 +828,12 @@ def push_test_event(
                     link.jira_issue_key, target_status, exc_t,
                 )
 
-        # When the operator starts execution: assign the ticket to that operator.
+        # When the operator starts execution: assign the ticket to that
+        # operator. On reopen (rework), *actor* is the lead who reopened
+        # it, not the operator who should keep working it — the caller
+        # passes the original red_tech_assignee as *assignee* in that case.
         if new_state == "red_executing":
-            jira_account_id = getattr(actor, "jira_account_id", None)
+            jira_account_id = getattr(assignee or actor, "jira_account_id", None)
             if jira_account_id:
                 try:
                     jira.assign_issue(link.jira_issue_key, account_id=jira_account_id)
@@ -859,12 +862,30 @@ def push_test_event(
                         link.jira_issue_key, jira_account_id, exc_a,
                     )
 
-        # Both are hand-off points to a different team with no single owner
-        # yet: blue_evaluating is queued for Blue Team (whoever reviewed the
-        # red side is done with it), and in_review is dual-validation by both
-        # leads at once. Leaving the previous assignee (red/blue reviewer)
-        # stuck on the ticket is misleading, so clear it.
-        if new_state in ("blue_evaluating", "in_review"):
+        # blue_evaluating is reached two different ways: a fresh hand-off
+        # from Red (no blue_tech_assignee yet — queued, no owner) or a
+        # reopen/rework of a test some blue_tech already had (assignee is
+        # still set) — that operator should get the ticket back, not have
+        # it clear. in_review is always dual-validation by both leads at
+        # once, so it never has a single owner.
+        if new_state == "blue_evaluating":
+            if test.blue_tech_assignee:
+                reassignee = db.query(User).filter(User.id == test.blue_tech_assignee).first()
+                jira_account_id = getattr(reassignee, "jira_account_id", None)
+            else:
+                jira_account_id = None
+            try:
+                jira.assign_issue(link.jira_issue_key, account_id=jira_account_id)
+                logger.info(
+                    "%s Jira ticket %s (state=%s)",
+                    "Reassigned" if jira_account_id else "Unassigned", link.jira_issue_key, new_state,
+                )
+            except Exception as exc_a:
+                logger.warning(
+                    "Could not update assignee on %s for state %s: %s",
+                    link.jira_issue_key, new_state, exc_a,
+                )
+        elif new_state == "in_review":
             try:
                 jira.assign_issue(link.jira_issue_key, account_id=None)
                 logger.info("Unassigned Jira ticket %s (state=%s)", link.jira_issue_key, new_state)

backend/app/services/test_workflow_service.py

@@ -410,7 +410,14 @@ def reopen_red_review(db: Session, test: Test, user: User, notes: str) -> Test:
 
     try:
         from app.services.jira_service import push_test_event
-        push_test_event(db, test, user, "red_executing", extra={"notes": notes.strip()})
+        original_operator = (
+            db.query(User).filter(User.id == test.red_tech_assignee).first()
+            if test.red_tech_assignee else None
+        )
+        push_test_event(
+            db, test, user, "red_executing",
+            extra={"notes": notes.strip()}, assignee=original_operator,
+        )
     except Exception as e:
         logger.warning("Jira push failed for test %s: %s", test.id, e, exc_info=True)