@feigi/fleet-ctl 3.23.6 → 3.23.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.6",
+  "version": "3.23.7",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/reaping-reap-authorizers-prose.test.mjs

@@ -0,0 +1,112 @@
+// reaping.md's reap section said reap.sh's `git update-ref -d` is
+// "authorized by that cherry check and only by it". The script halts the
+// delete on a second thing too: a fresh worktree check (`wt_holding`) over a
+// listing re-read right before it, which keeps a `[gone]` branch the cherry
+// check cleared whenever a worktree holds it or cannot be resolved. A sentence
+// naming the cherry check as the only authorizer is false as written.
+//
+// The reap-side twin of reaping-release-authorizers-prose.test.mjs, which pins
+// the release section's authorizer list. Kept apart so each section's pin can
+// be edited independently.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { between, bullet, phrase, unemphasized } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..");
+const REAPING = readFileSync(
+  join(REPO, "skills", "run-team", "references", "reaping.md"),
+  "utf8",
+);
+const SCRIPT = readFileSync(join(REPO, "scripts", "reap.sh"), "utf8");
+
+const reapSection = () =>
+  between(
+    REAPING,
+    "## Why the reap is shaped the way it is",
+    "## Why a second sweep, over worktrees rather than branches",
+    "reaping.md",
+  );
+
+// The bullet that names the delete, bounded to its own list item: it ends at
+// the next list marker, so a sibling bullet (the holder-check bullet sits
+// right after it) cannot supply the words, and rewording that sibling does
+// not move the bound.
+const deleteBullet = () =>
+  bullet(
+    reapSection(),
+    "- **The delete is `git update-ref -d`'s compare-and-swap",
+    "\n- ",
+    "reaping.md's reap section",
+  );
+
+// The clause that lists the authorizers: from "authorized by" to the
+// sentence after the bold lead, which explains the compare-and-swap. Sliced
+// emphasis-tolerantly, and every assertion below reads it through
+// `unemphasized()`, so a `**` moved onto or into the clause stays green: the
+// slice only locates the clause, and `phrase()` is matched against raw text.
+const authorizers = () =>
+  between(
+    deleteBullet(),
+    "authorized by that cherry check",
+    "Tip read before the cherry",
+    "reaping.md's reap delete bullet",
+    { emphasisTolerant: true },
+  );
+
+test("reaping.md: the reap delete's authorizer clause names the fresh worktree-holds-branch check", () => {
+  // ONE contiguous span, not keywords: "fresh" and the negation each
+  // satisfied somewhere in the slice pass a clause with either one gutted
+  // ("a check that no worktree holds the branch" has no freshness; "a fresh
+  // check ... that a worktree holds the branch" has the opposite meaning).
+  // Only a span binds the two to each other.
+  assert.match(
+    unemphasized(authorizers()),
+    phrase("a fresh check, re-read immediately before the delete, that no worktree holds the branch"),
+    "reaping.md's reap section names what authorizes the `update-ref` delete but not the fresh worktree check — reap.sh keeps a branch the cherry check cleared whenever a worktree holds it",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause does not make any one check the only authorizer", () => {
+  // The exclusivity the defect carried, in the spellings of it a reword can
+  // restore after the new words: "only by it", "only by them", "nothing
+  // else", "solely", "alone". Pinned on its own because the presence pin
+  // above stays green with any of them restored. A word list, so a spelling
+  // outside it goes unseen; `\s+` keeps a reflow between its words green.
+  assert.doesNotMatch(
+    unemphasized(authorizers()),
+    /\bonly\s+by\b|\bnothing\s+else\b|\bsolely\b|\balone\b/,
+    "reaping.md's reap section says one check alone authorizes the `update-ref` delete — reap.sh's worktree check stops that delete too",
+  );
+});
+
+test("reaping.md: the reap delete's authorizer clause still names the cherry check", () => {
+  // Input the new assertions must ACCEPT: naming the worktree check must not
+  // cost the clause the check it already had.
+  assert.match(unemphasized(deleteBullet()), phrase("authorized by that cherry check"));
+});
+
+// reap.sh's executable lines, comments and `echo` diagnostics dropped. The
+// check's name and the delete command both recur in comments: an indexOf over
+// the raw text lands on either and reads as the code, so a real delete moved
+// above the check, or the check commented out, stays green. Only whole-line
+// comments drop here, so each pattern below is anchored at the start of its
+// statement: a command spelled after a `#` inside a live line is not live.
+const liveLines = () => SCRIPT.split("\n").filter((l) => !/^\s*(?:#|echo\b)/.test(l));
+
+// The one live line matching `re`. Exactly one: a first-hit search would
+// bind the pin to whichever copy comes first.
+const liveLineOf = (re, what) => {
+  const hits = liveLines().flatMap((l, i) => (re.test(l) ? [i] : []));
+  assert.equal(hits.length, 1, `reap.sh: expected exactly one live line that ${what}, found ${hits.length}`);
+  return hits[0];
+};
+
+test("reap.sh: the worktree check the prose names sits before the delete", () => {
+  // The prose names a check the script runs; pin that the script still does,
+  // and runs it before the delete, so the prose cannot outlive the check.
+  const check = liveLineOf(/^\s*if\s+wt_holding\s+"refs\/heads\/\$b"/, "runs wt_holding on the branch");
+  const del = liveLineOf(/^\s*if\s+!\s+err=\$\(git\s+update-ref\s+--no-deref\s+-d\s+"refs\/heads\/\$b"\s+"\$tip"/, "runs `git update-ref -d` on the branch at its tip");
+  assert.ok(check < del, "reap.sh runs its worktree check after the delete, not before it");
+});

package/skills/run-team/references/reaping.md

@@ -22,7 +22,7 @@ Every precondition recomputed **inside** same command as delete:
 - **`for-each-ref`, not `git branch | grep`.** `%(upstream:track)` emits exactly `[gone]` as own field. Nothing to pattern-match, no `-v`/`-vv` trap.
 - **Recompute per branch, in this command.** Branch list from earlier tool call already false: one observed run listed 28 gone branches, two calls later 27 reaped by concurrent session. Benign direction is no-op; dangerous one is worktree that gained work *after* check.
 - **`git cherry origin/main`, not `git diff main..`.** Against `origin/main` — local `main` you never fast-forwarded reads every merged branch as unmerged. Any `+` line is commit that exists nowhere else.
-- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and only by it.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
+- **The delete is `git update-ref -d`'s compare-and-swap on a tip read once (ADR 0018), authorized by that cherry check and by a fresh check, re-read immediately before the delete, that no worktree holds the branch.** Tip read before the cherry, cherry runs against that SHA, delete refuses unless ref still equals it — commit landing between check and delete is kept with git's own `cannot lock ref`, never force-deleted, as it was under `git branch -D` until #2219. `--no-deref`, so symref branch deletes the symref, not its target (measured). Branch's config section removed after, as `-D` did — left behind, re-created branch of same name inherits dead upstream and reads `[gone]` at once. `git branch -d` would refuse everything here: upstream gone, so falls back to comparing against `HEAD`, a possibly-behind local `main`. Never delete branch whose cherry output you did not just read.
 - **A branch any worktree holds is a KEEP, checked right before the delete.** `update-ref` consults no worktree; `-D` did. So listing is re-read and worktree.sh's `wt_holding` asks: held by a `branch` line, or by detached worktree stopped mid `rebase -i` / mid `bisect` on it (admin dir's `head-name` / `BISECT_START`) — both routes `-D` refused on (#2218). Worktree it cannot resolve, or listing that will not re-read, is a KEEP. `--apply` only, like the delete: dry run cannot predict this refusal — not the same limitation `-D`'s dry run had, since an unrelated worktree elsewhere in the listing that this check cannot resolve keeps every `[gone]` branch in the pass (see below), a repo-wide case `-D` never produced.
 - **A cherry that cannot answer is a KEEP.** Capture git's output; never pipe git itself: `cmd | grep -q` takes grep's exit status, never cmd's, so a `git cherry` that dies (rc 128 — one unreadable loose object is enough) prints nothing, grep exits 1, and a dead probe reads identical to "nothing unmerged" (verified, git 2.50.1). Unanswerable probe authorizes no delete — same fail-closed shape as `worktree remove` below. Read the `+` anchored, too: the capture folds stderr in, so an unanchored match reads a `+` in a diagnostic as a commit. Pinned by a test.
 - **A worktree registry that cannot be read is a KEEP, for every `[gone]` branch in that pass.** The lookup decides whether the dirty, ignored-files and removal checks run at all; an unread registry reads identical to "no worktree", and `-D`, the delete then, needed no answer from the registry to delete a branch that has none — so failing open force-deleted merged branches blind (#622). The holder check before the delete asks only whether a worktree holds the branch, never those other questions, so the lookup still fails closed on its own. The listing is re-read per branch, so one repo-level failure keeps every `[gone]` branch in the pass, each with git's own cause. Reap runs after every merge pass, so the next one retries: nothing is lost, nothing is reaped blind.