@feigi/fleet-ctl 3.23.8 → 3.23.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.23.8",
+  "version": "3.23.9",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/reap-cherry-check-prose.test.mjs

@@ -0,0 +1,80 @@
+// reap.sh's branch sweep runs more checks than `git cherry` before its
+// `git update-ref --no-deref -d`: the worktree registry and listing checks,
+// the dirty check, the `worktree remove` refusal and the `wt_holding` re-read
+// can each keep the branch. The cherry check is the only one of them that
+// asks whether the tip is merged, so a comment saying the delete is
+// "authorized by this check and by nothing else" is false as written. The
+// component doc said reap deletes with `-D`; it deletes with `update-ref -d`.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { bullet, paragraph, phrase, runAbove, stripHashGutter } from "./prose-pin.mjs";
+
+const REPO = join(import.meta.dirname, "..", "..");
+const SCRIPT = readFileSync(join(REPO, "plugin", "scripts", "reap.sh"), "utf8");
+const DOC = readFileSync(join(REPO, "docs", "components", "reaping-and-liveness.md"), "utf8");
+
+// The comment block above the branch sweep's cherry probe, and the one above
+// its cherry scan: the two blocks that justify why the cherry check fails
+// closed.
+const probeComment = () =>
+  stripHashGutter(runAbove(SCRIPT, 'if ! cherry=$(git cherry "$base_rev" "$tip"', "reap.sh cherry probe", "#"));
+const scanComment = () =>
+  stripHashGutter(
+    runAbove(SCRIPT, `if ! grep_probe "$cherry" '^+'; then keep "$b"`, "reap.sh cherry scan", "#"),
+  );
+
+const NOTHING_ELSE = phrase("authorized by this check and by nothing else");
+
+for (const [name, comment] of [
+  ["cherry-probe", probeComment],
+  ["cherry-scan", scanComment],
+]) {
+  test(`reap.sh: the ${name} comment does not call the cherry check the delete's sole authorizer`, () => {
+    assert.doesNotMatch(
+      comment(),
+      NOTHING_ELSE,
+      `reap.sh's ${name} comment says the delete is authorized by the cherry check and by nothing else — the worktree checks and \`wt_holding\` can stop the delete too`,
+    );
+  });
+}
+
+test("reap.sh: the cherry-probe comment does not quote the retired \"By nothing else\" sentence", () => {
+  assert.doesNotMatch(
+    probeComment(),
+    phrase('"By nothing else" bounds'),
+    "reap.sh's cherry-probe comment says \"By nothing else\" bounds what ELSE authorizes the delete — the worktree checks and `wt_holding` can stop the delete too, and the sentence restates the sole-authorizer claim",
+  );
+});
+
+test("reap.sh: the cherry comments still say why an unanswerable probe must keep", () => {
+  // Input the pins above must ACCEPT: the fail-closed argument the old
+  // sentence carried survives, restated as what makes the cherry check
+  // unique — it is the only check that asks whether the tip is merged.
+  assert.match(probeComment(), phrase("this is the only one that asks whether `$tip` is merged"));
+  assert.match(probeComment(), phrase("never a `$tip` that is unmerged — so an unanswerable probe must KEEP"));
+  assert.match(scanComment(), phrase("no check between here and the delete below asks whether the branch is merged"));
+});
+
+const reapStep = () =>
+  bullet(DOC, "1. **Reap after every merge pass**", "2. **Release a claim", "reaping-and-liveness.md reap step");
+// The doc's last list item, so the blank-line bound is the end of the file.
+const reapAndRelease = () =>
+  paragraph(
+    DOC,
+    "- **Reap and release are two different scripts on purpose.**",
+    "reaping-and-liveness.md reap-and-release choice",
+  );
+
+test("reaping-and-liveness.md: the reap step names the delete as a compare-and-swap `update-ref -d`, not `-D`", () => {
+  const step = reapStep();
+  assert.match(step, phrase("compare-and-swap `git update-ref -d`"));
+  assert.doesNotMatch(step, /`-D`/, "reaping-and-liveness.md's reap step says the delete is `-D` — reap.sh deletes with `git update-ref -d`");
+});
+
+test("reaping-and-liveness.md: the reap-and-release choice names reap's delete as `update-ref -d`, not `-D`", () => {
+  const choice = reapAndRelease();
+  assert.match(choice, phrase("Reap authorizes a destructive `git update-ref -d`"));
+  assert.doesNotMatch(choice, /`-D`/, "reaping-and-liveness.md says reap authorizes a `-D` — reap.sh deletes with `git update-ref -d`");
+});

package/scripts/reap.sh

@@ -938,23 +938,26 @@ for b in $gone_branches; do
   # enough) prints nothing, grep sees empty input and exits 1 — the identical
   # verdict a genuinely clean cherry produces, so "merged" is indistinguishable
   # from "the probe could not answer". An unmerged branch is never the ambiguous
-  # one: its `+` line makes grep exit 0 and always keeps. The delete is
-  # authorized by this check and by nothing else — its compare-and-swap refuses
-  # a ref that moved off `$tip`, never a `$tip` that is unmerged — so an
-  # unanswerable probe must KEEP, the same fail-closed shape the worktree
-  # `status` check below already uses.
+  # one: its `+` line makes grep exit 0 and always keeps. Of the checks that
+  # must pass before the delete, this is the only one that asks whether `$tip`
+  # is merged — the worktree checks below and the `worktree remove` refusal
+  # can each keep the branch, but none of them looks at its commits, and the
+  # compare-and-swap refuses a ref that moved off `$tip`, never a `$tip` that
+  # is unmerged — so an unanswerable probe must KEEP, the same fail-closed
+  # shape the worktree `status` check below already uses.
   # `refs/heads/$b`, never a bare `$b`, where the tip is read above. Restoring
   # the bare name makes a branch that shares its name with a tag ambiguous AS A
   # REV again, and git resolves an ambiguous one by preferring refs/tags/ over
   # refs/heads/ (measured, git 2.50.1 Apple Git-155). This probe would then
   # answer about the TAG's commit while the delete below removes the BRANCH —
   # and a tag sitting on a merged commit reports clean for a branch whose
-  # commits exist nowhere else. The delete is authorized by this check and by
-  # nothing else, so that reads straight through to destroying them: measured
-  # on a fixture, the enumeration fix alone turned a branch this script
-  # currently KEEPS into `REAPED`, at exit 0, with an empty kept[]. Qualifying
-  # changes nothing for an ordinary branch — both spellings name the same
-  # commit — and it is the same key the worktree lookup below already builds.
+  # commits exist nowhere else. No other check before the delete asks whether
+  # those commits are merged, so that reads straight through to destroying
+  # them: measured on a fixture, the enumeration fix alone turned a branch
+  # this script currently KEEPS into `REAPED`, at exit 0, with an empty
+  # kept[]. Qualifying changes nothing for an ordinary branch — both spellings
+  # name the same commit — and it is the same key the worktree lookup below
+  # already builds.
   #
   # `$base_rev` is the other side of the same rule, and it was missing until
   # #924: `$base` reached this `git cherry` exactly as BASE_REF spelled it, so a
@@ -963,10 +966,10 @@ for b in $gone_branches; do
   # deleted the BRANCH — measured, an unmerged [gone] branch whose commit
   # existed nowhere else REAPED at exit 0 with an empty kept[]. The
   # qualification is built at the top of the file, where its own comment
-  # records why the accept-list beside it is what makes prefixing sound. "By
-  # nothing else" bounds what ELSE authorizes the delete, not whether this
-  # check itself can be wrong — which is why BOTH revs it consumes are
-  # qualified. #634
+  # records why the accept-list beside it is what makes prefixing sound. Being
+  # the only merge check bounds what ELSE could catch an unmerged branch, not
+  # whether this check itself can be wrong — which is why BOTH revs it
+  # consumes are qualified. #634
   if ! cherry=$(git cherry "$base_rev" "$tip" 2>&1); then
     keep "$b" "cherry probe failed — cannot tell if merged: $(printf '%s' "$cherry" | tr '\n' ' ')"
     continue
@@ -981,9 +984,9 @@ for b in $gone_branches; do
   # What "grep's is the only status left to take" missed, and what this shape
   # exists for: taking it is not the same as READING it. grep answers three
   # ways, and until #1419 the `if` had two arms — an rc 2 scan that never
-  # examined `$cherry` fell into the merged arm, and the delete below is
-  # authorized by this check and by nothing else. So the deletion went ahead on
-  # a merge status no tool had established. `grep_probe` splits the two
+  # examined `$cherry` fell into the merged arm, and no check between here and
+  # the delete below asks whether the branch is merged. So the deletion went
+  # ahead on a merge status no tool had established. `grep_probe` splits the two
   # questions; the answers are ruled on here, in the order that makes the
   # unanswerable case fail CLOSED like every other could-not-check in this
   # file: scan first, verdict second.