@feigi/fleet-ctl 3.79.6 → 3.80.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.79.6",
+  "version": "3.80.0",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/release-ticket.sh

@@ -1,9 +1,20 @@
 #!/bin/sh
-# Release a claim that was never dispatched: drop the in-progress label, remove
-# the worktree, delete the branch — but only when the claim provably carries no
-# work. The inverse of claim-ticket.sh.
+# Release a claim: drop the in-progress label, remove the worktree, delete the
+# branch — but only when the claim provably carries no work. The inverse of
+# claim-ticket.sh. Two claim shapes release, told apart by the branch on origin:
 #
-# Dry-run by default; --apply mutates the tracker and the filesystem.
+# - Never dispatched: no branch on origin. The branch must carry no commit
+#   beyond origin/main and no commit unique to it.
+# - Closed unmerged: the branch is on origin, and every PR of this repository
+#   whose head is that branch reads CLOSED — none OPEN, none MERGED, at least
+#   one present. The local branch must sit at the tip origin holds. Under
+#   --apply origin's tip is read again right before the remote branch is
+#   deleted, and that delete runs before the label drops. It is a plain one,
+#   not leased on the tip: a push landing between the re-read and the delete
+#   goes with the branch. A branch on origin with no PR, or with a PR list that
+#   cannot be read, blocks.
+#
+# Dry-run by default; --apply mutates the tracker, the remote and the filesystem.
 #
 # reap.sh will not do this: no merge happened, so no remote branch was ever
 # deleted, so the branch is not [gone] and reap's for-each-ref filter never
@@ -15,8 +26,10 @@
 # Every precondition is recomputed inside THIS invocation rather than trusted
 # from an earlier tool call, for the reason reap.sh gives: the dangerous
 # direction is a worktree that gained work after it was checked. Two of them are
-# recomputed a second time at the moment of the delete, which is why both
-# deletes run before the label is dropped rather than after.
+# recomputed a second time at the moment of the delete, and in closed mode
+# origin's tip is re-read at the remote delete as well, which is why every
+# delete — the remote one included — runs before the label is dropped rather
+# than after.
 #
 # The dirty check's second opinion is git's own — that is what `worktree remove`
 # without --force is for. It covers the live-directory case ONLY: `worktree
@@ -27,7 +40,8 @@
 #
 # The commit check's is this script's own: the compare-and-swap delete refuses
 # only a ref that moved, so the `ahead` count is re-run against $base right
-# before it. Why not `-d`, and what that recount does and does not cover, is
+# before it — in closed mode, a compare of the local tip against the tip origin
+# held instead. Why not `-d`, and what that recount does and does not cover, is
 # argued once at the delete site below — don't restate it here.
 set -eu
 
@@ -854,6 +868,44 @@ if [ -z "$wt" ] && [ -n "$stray" ]; then
   fi
 fi
 
+# A pushed branch — work that survives the local delete and that a PR may
+# already point at. Live query, so this one cannot be stale; a failure here is
+# an unknown answer, never a "no".
+# stderr stays on stderr, never folded into the value: the emptiness of $remote
+# IS the answer, so an SSH host-key notice on a successful query used to read as
+# a branch that exists. git's own message is more useful on the terminal anyway.
+# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
+# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
+# is the shorten-only override this lookup shares with the fleet's fetches — but
+# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
+# and nothing else, so shortening this one does not shorten that one. The rule
+# is net_budget's, in net.sh.
+ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
+ls_rc=0
+remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
+if [ "$ls_rc" -ne 0 ]; then
+  # A killed lookup and a refused one are different facts and get different
+  # words. Both leave the same verdict — the answer is unknown, so nothing is
+  # released — but only one of them names a cause this script observed.
+  if net_stalled "$ls_rc"; then
+    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
+  fi
+  die "git ls-remote failed, so whether $branch was pushed is unknown"
+fi
+
+# The tip origin holds, split off ls-remote's `<sha><TAB><ref>` line on the tab
+# itself rather than on a `[:space:]` class, which would put a locale-sensitive
+# construct under the `export LC_ALL=C` paragraph above that says there is none.
+# Whether this pushed branch is the one that releases is a tracker question,
+# asked below once nothing local blocks.
+tab=$(printf '\t')
+remote_sha=
+if [ -n "$remote" ]; then
+  remote_sha=${remote%%"$tab"*}
+  [ "${remote#*"$tab"}" = "refs/heads/$branch" ] ||
+    die "git ls-remote did not answer with refs/heads/$branch for $branch, so whether it was pushed is unknown"
+fi
+
 # An Orphaned worktree directory: this claim's directory still on disk with its
 # registration already cleared. `stray` cannot see it BY CONSTRUCTION — it is
 # awk over git's registry, and there is no registration left to match — so the
@@ -893,7 +945,10 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
     block "worktree directory $orphan is this claim's and has no registration — inspect it and remove the directory by hand"
   elif ! gone "$orphan"; then
     block "cannot tell whether an orphaned worktree directory is at $orphan, so whether #$issue can be released is unknown"
-  elif [ "$has_branch" = false ] && [ -z "$blockers" ]; then
+  elif [ "$has_branch" = false ] && [ -z "$blockers" ] && [ -z "$remote" ]; then
+    # A branch of this name on origin proves the slug right, so the die below
+    # does not fire: a closed-PR claim whose local branch is already gone
+    # releases from the remote alone.
     # A mistyped <slug>/<type> names a branch that does not exist, and without
     # this die the run would drop the label off a ticket whose real claim is
     # untouched — invisible to candidates.mjs and still in-flight. Refuse
@@ -927,7 +982,18 @@ if [ -z "$wt" ] && [ -z "$stray" ]; then
   fi
 fi
 
-if [ "$has_branch" = true ]; then
+# A closed PR's commits are the branch's whole content, so `ahead` and the `git
+# cherry` count below would refuse every one — and the PR states that tell a
+# closed-PR claim from any other pushed branch are not read until the blockers
+# below are known. So a branch on origin is held to one check here: the local
+# branch must sit at the tip origin holds. Any commit it carries beyond that is
+# unpushed, and the local delete would take it with the branch.
+if [ "$has_branch" = true ] && [ -n "$remote" ]; then
+  local_tip=$(git rev-parse --verify "refs/heads/$branch") ||
+    die "cannot read $branch's tip, so whether it matches origin's is unknown"
+  [ "$local_tip" = "$remote_sha" ] ||
+    block "$branch is not at the tip origin holds — unpushed work would be lost"
+elif [ "$has_branch" = true ]; then
   # Commits ahead — a member that did work. Measured on the branch ref rather
   # than the worktree's HEAD: the worktree above was located BY that ref, so the
   # two agree, and this still runs when the worktree is already gone.
@@ -951,32 +1017,6 @@ if [ "$has_branch" = true ]; then
   [ "$uniq" -eq 0 ] || block "$uniq commit(s) unique to $branch (git cherry)"
 fi
 
-# A pushed branch — work that survives the local delete and that a PR may
-# already point at. Live query, so this one cannot be stale; a failure here is
-# an unknown answer, never a "no".
-# stderr stays on stderr, never folded into the value: the emptiness of $remote
-# IS the answer, so an SSH host-key notice on a successful query used to read as
-# a branch that exists. git's own message is more useful on the terminal anyway.
-# 30s: `ls-remote` moves refs and no objects, so this is generous for the work,
-# and it is the budget inflight.sh's own `ls-remote` runs on. `FLEET_NET_TIMEOUT`
-# is the shorten-only override this lookup shares with the fleet's fetches — but
-# NOT with inflight.sh's `ls-remote`, which reads `INFLIGHT_LS_REMOTE_TIMEOUT`
-# and nothing else, so shortening this one does not shorten that one. The rule
-# is net_budget's, in net.sh.
-ls_budget=$(net_budget 30 "${FLEET_NET_TIMEOUT:-}")
-ls_rc=0
-remote=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") || ls_rc=$?
-if [ "$ls_rc" -ne 0 ]; then
-  # A killed lookup and a refused one are different facts and get different
-  # words. Both leave the same verdict — the answer is unknown, so nothing is
-  # released — but only one of them names a cause this script observed.
-  if net_stalled "$ls_rc"; then
-    die "git ls-remote did not finish within ${ls_budget}s and was killed, so whether $branch was pushed is unknown"
-  fi
-  die "git ls-remote failed, so whether $branch was pushed is unknown"
-fi
-[ -z "$remote" ] || block "branch $branch exists on origin"
-
 # `-d`, because a directory that is not there holds no uncommitted work. Deleted
 # by hand, a worktree leaves its admin files registered, so `worktree list
 # --porcelain` keeps listing the entry and the status below ran against a path
@@ -1197,10 +1237,52 @@ if [ -n "$wt" ]; then
   fi
 fi
 
-# Report the blockers before asking GitHub anything. The answer cannot change —
-# every artefact stays put either way — and reaching for the tracker first turns
-# an offline blocked claim into an unanswerable one, burying the finding the
-# caller actually needs. "label":null says it was never read.
+# The one pushed branch that releases: every PR of this repository whose head
+# is $branch reads CLOSED, and there is at least one. Read live, and failing
+# closed — a PR list that cannot be read is an unknown answer, as the lookup
+# above is. Any other pushed branch blocks, as it always did.
+#
+# Asked only once every local check has had its say and none blocked, for the
+# reason the report below gives: a claim already blocked is answered, and a
+# tracker that cannot be reached must not turn it into an exit 2 with no
+# receipt. Such a claim names its pushed branch as one more blocker instead,
+# without the PR states nothing asked for.
+closed_pr=false
+pr_seen=
+if [ -n "$remote" ] && [ -n "$blockers" ]; then
+  block "branch $branch exists on origin"
+elif [ -n "$remote" ]; then
+  # One `number:state` token per PR, so the loop below needs no JSON parser.
+  # --limit 1000: gh's default page of 30 would hide a later OPEN PR.
+  # `--head` matches a head branch NAME, from any fork, so a fork's PR whose
+  # branch shares this one's name is dropped before it is counted — the filter
+  # delete-merged-branch.sh applies to its own `--head` lookup. Without it, a
+  # fork's closed PR would read as this branch's and release a branch no PR of
+  # ours names.
+  prs=$(gh pr list --state all --head "$branch" --limit 1000 --json number,state,isCrossRepository \
+    --jq '.[] | select(.isCrossRepository | not) | "\(.number):\(.state)"') ||
+    die "gh pr list failed for $branch, so whether its PR closed unmerged is unknown"
+  pr_bad=
+  for pr in $prs; do
+    pr_seen="$pr_seen #${pr%%:*} ${pr#*:};"
+    case ${pr#*:} in
+      CLOSED) ;;
+      *) pr_bad="$pr_bad #${pr%%:*} ${pr#*:};" ;;
+    esac
+  done
+  if [ -z "$pr_seen" ]; then
+    block "branch $branch exists on origin and no PR names it"
+  elif [ -n "$pr_bad" ]; then
+    block "branch $branch exists on origin and its PR(s) are not closed unmerged:$pr_bad"
+  else
+    closed_pr=true
+  fi
+fi
+
+# Report the blockers before asking GitHub anything more. The answer cannot
+# change — every artefact stays put either way — and reaching for the tracker
+# first turns an offline blocked claim into an unanswerable one, burying the
+# finding the caller actually needs. "label":null says it was never read.
 if [ -n "$blockers" ]; then
   echo "$NAME: #$issue NOT released — nothing was touched" >&2
   printf '{"issue":%s,"branch":"%s","branchRewritten":%s,"worktree":"%s","worktreeRewritten":%s,"label":null,"released":false,"applied":%s,"blockers":[%s]}\n' \
@@ -1242,6 +1324,10 @@ if [ "$apply" = false ]; then
   [ "$has_label" = true ] && echo "    would: gh issue edit $issue --remove-label in-progress" >&2
   [ -n "$wt" ] && printf '    would: git worktree remove %s\n' "$wt" >&2
   [ "$has_branch" = true ] && echo "    would: git update-ref -d refs/heads/$branch <its current tip>" >&2
+  if [ "$closed_pr" = true ]; then
+    echo "    PR states on $branch:$pr_seen" >&2
+    echo "    would: git push origin --delete refs/heads/$branch (origin read at $remote_sha)" >&2
+  fi
 else
   # Label LAST. The two local deletes are the ones that refuse — that refusal is
   # the dirty check recomputed by git at the moment of the delete, so it is
@@ -1249,7 +1335,10 @@ else
   # left in-progress already gone: with the worktree still standing the ticket
   # read free to candidates.mjs while re-claiming failed on the existing branch.
   # Run them first and a refusal leaves the claim exactly as it was, label and
-  # all, which reads as still taken — the direction that costs nothing.
+  # all, which reads as still taken — the direction that costs nothing. Closed
+  # mode's remote delete runs after them, and ahead of the label for the same
+  # reason.
+
   if [ -n "$wt" ]; then
     # No --force, ever. A refusal is a finding to report, never something to
     # force past. Quote git's own reason: this fires precisely when something
@@ -1294,8 +1383,16 @@ else
       halt "cannot read $branch's tip at the delete"
     n=$(git rev-list --count "$base_rev..$tip") ||
       halt "cannot recount commits on $branch against $base at the delete"
-    [ "$n" -eq 0 ] ||
-      halt "$branch gained $n commit(s) since the checks — not deleted"
+    if [ "$closed_pr" != true ]; then
+      [ "$n" -eq 0 ] ||
+        halt "$branch gained $n commit(s) since the checks — not deleted"
+    else
+      # A closed PR's commits are the whole content of the branch, so the
+      # recount above refuses every one of them. What holds instead: the local
+      # tip has not moved off the tip origin held when the checks read it.
+      [ "$tip" = "$remote_sha" ] ||
+        halt "$branch is no longer at the tip origin holds — not deleted"
+    fi
 
     # What the CAS does not give back: `git update-ref` is ref-only plumbing
     # and, unlike `-D`, consults no worktree at all — so the one guard the CAS
@@ -1371,6 +1468,47 @@ else
     done_branch=true
   fi
 
+  # Closed mode only: the remote branch goes after the local one and before the
+  # label drops, for the same reason as the local deletes above.
+  #
+  # Origin is read again first, so a push that landed since the checks halts
+  # the release here rather than going with the branch. Here, beside the remote
+  # delete, and not inside the local branch delete: a closed-PR claim whose
+  # local branch is already gone releases from the remote alone, and has no
+  # local delete to hang the re-read on. The delete itself is a plain one: a
+  # push landing in the gap between that re-read and this call is deleted with
+  # the branch. A lease would close that gap, but this file spells no form of
+  # force, so the gap stays.
+  #
+  # A non-zero rc does not say the delete failed to land: the watchdog can kill
+  # the push after origin applied it. So a failed push is followed by a read of
+  # origin, as delete-merged-branch.sh does, and the halt names what origin
+  # holds rather than calling every non-zero rc a refusal. A branch already gone
+  # from origin is the outcome this step exists for, whoever removed it.
+  if [ "$closed_pr" = true ]; then
+    recheck=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+      halt "cannot re-read origin's $branch before the delete — not deleted"
+    [ "${recheck%%"$tab"*}" = "$remote_sha" ] ||
+      halt "origin's $branch moved since the checks — not deleted"
+
+    # $ls_budget: a ref-only `push --delete` moves no objects either, so it
+    # shares the lookup's budget, as delete-merged-branch.sh's own push does.
+    echo "\$ git push origin --delete refs/heads/$branch" >&2
+    push_rc=0
+    net_git "" "$ls_budget" push origin --delete "refs/heads/$branch" >&2 || push_rc=$?
+    if [ "$push_rc" -ne 0 ]; then
+      echo "\$ git ls-remote --heads origin refs/heads/$branch" >&2
+      back=$(net_git "" "$ls_budget" ls-remote --heads origin "refs/heads/$branch") ||
+        halt "git push --delete exited $push_rc and origin could not be read back, so whether origin still holds $branch is unknown"
+      if [ -n "$back" ] && net_stalled "$push_rc"; then
+        halt "git push --delete did not finish within ${ls_budget}s and was killed — origin still holds $branch"
+      elif [ -n "$back" ]; then
+        halt "git push --delete refused $branch on origin (rc $push_rc) — origin still holds it"
+      fi
+    fi
+    done_branch=true
+  fi
+
   if [ "$has_label" = true ]; then
     echo "\$ gh issue edit $issue --remove-label in-progress" >&2
     gh issue edit "$issue" --remove-label in-progress >/dev/null ||

package/skills/run-team/references/reaping.md

@@ -58,10 +58,12 @@ So nothing in the run cleans it up. Next run, the in-flight probe's local-worktr
 
 - **`ahead` + dirty catch a member that did work.** `ahead` against `origin/main`. Not redundant with `git cherry`: commit already cherry-picked upstream is upstream-equivalent (`-` line, not `+`), and only `ahead` still sees it. Pinned by a test.
 - **`git cherry` catches commits that exist only locally.** Against `origin/main`, never a local main — same trap reap has.
-- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server.
+- **Remote check catches a pushed branch.** Live `git ls-remote`, so it cannot be stale. Its failure is an unknown answer, never a "not pushed" — swallow it and a release deletes the local copy of work already on the server. A pushed branch blocks unless it is the closed-unmerged shape below.
 - **Label read first, `gh` failure fatal.** Worktree and branch gone with `in-progress` left behind hides the ticket from `candidates.mjs` entirely — worse than not releasing. All three artefacts or none.
 
-**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
+**One pushed branch releases: a claim whose PR closed unmerged.** Every PR of this repository whose head is the branch reads CLOSED — none OPEN, none MERGED, at least one present. Read with `gh pr list` only once no local check blocks, so a blocked claim still reports without asking GitHub; a list that cannot be read, or names no PR, blocks. `ahead` and `git cherry` do not apply — a closed PR's commits are the branch's whole content — so the local branch must sit at the tip origin holds instead, re-checked at the local delete. The remote branch is a fourth artefact: `--apply` deletes it after the local deletes and before the label drops, re-reading origin's tip first and halting if it moved. A plain delete, not leased on that tip, so a push landing between the re-read and the delete goes with the branch. A delete whose `git push` fails is read back from origin: gone counts as done.
+
+**The delete is `git update-ref -d`'s compare-and-swap here too, and for reap's reason** — authorized by the `ahead` and `git cherry` checks above, plus the `ahead` recount re-run against `origin/main` immediately before the delete itself (a commit can land across the `gh issue view` between the checks and the delete; `git cherry` is not re-run, because such a commit is ahead of `origin/main` by construction), plus a fresh check, re-read immediately before the delete, that no worktree holds the branch (`update-ref` consults no worktree, where `-D` refused a held branch; a worktree it cannot resolve, or a listing that will not re-read, stops the delete too), and by nothing else. In the closed-unmerged shape the tip-at-origin check and its re-check at the delete stand in for `ahead`, `git cherry` and the recount; the worktree check stays. A claim used to carry `origin/main` as its upstream, so `-d` compared against *that* and forgave a behind local main; now `claim-ticket.sh` passes `--no-track` (so `@{u}` cannot silently answer about main), a claim has no upstream until its first `push -u`, and `-d` falls back to comparing against local `HEAD`. Measured: with local `main` behind `origin/main`, `-d` refuses a pristine claim — half-releasing it, worktree deleted and branch stranded with `in-progress` still on the ticket. The two checks above are strictly stronger than what `-d` would have asked, and both measure against `origin/main` rather than a local ref.
 
 **A checkout that lands between that fresh check and the delete halts the release after it.** `git worktree add` of an existing branch does not move the ref, so the compare-and-swap succeeds under it. The same `wt_recheck_delete` reap uses then finds the worktree, recreates the branch at the tip, and the release halts with exit 2, `released:false` and a blocker naming that worktree — the shape of a holder caught before the delete. A restore that fails halts the same way, with the tip and the repair command in the blocker.