@feigi/fleet-ctl 3.86.1 → 3.87.1

package/commands/run-merge-bot.md

@@ -237,6 +237,8 @@ For each labeled PR clearing the hold rule, lowest first:
 
    - **`head-moved-after-label`** — the PR head is neither `pre` nor `post`, nor a head whose net change the gate proved identical to `pre`'s (`rebaseCarry`, which names both). **Any third SHA is a push that landed while you waited on CI, and no CI check can see it**: `ci-state.mjs` selects the run whose `headSha` equals the *current* PR head (`scripts/ci-state.mjs`, the `r.headSha === prHead` filter), so a member's push plus its own green run satisfies every CI check while the audit behind the label belongs to a tree that is gone. A carry is proven only for the head `gh pr view` read; a different head at `ci-state`'s own read is still this row. The remedy is a fresh finisher against the new head, label untouched.
    - **`main-gain-removed:<path>`** — merging this head would remove lines `main` gained after the PR's work began: lines a later merge landed, deleted by a branch commit that every rebase since has replayed without a conflict, so no conflict preview and no `origin/main...HEAD` read is sure to show them. `mainGain.hits[]` names each file, the landing key (`#<n>` for a merged PR, else the landing commit's 12-character SHA), the removed lines, and the `ack` line to copy. Skip the PR, leave the label alone, and report `main-gain-removed:<path>-#<pr>` with the hit list and the keys. Never restore the lines yourself — the removal may be deliberate. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for every hit; the gate reads the body each run, so editing it is enough. An acknowledged removal is listed in `mainGain.acknowledged[]` and the gate passes it — name each one, with its reason, in your report. Your report's `refused[]` entry for the PR carries the gate's `reason` as it printed it, `main-gain-removed:<path>`, and the gate's `--out` file above stays where the gate wrote it: the controller parks the PR off that entry, at the `head` and `bodyDigest` that file records the gate refused, and no merge bot is dispatched on the PR's account until its head or its body changes — though a bot dispatched for another queued PR may still evaluate it again.
+
+     Each hit line carries a `kind`: `modified` when the hunk that removed it also adds lines, none of which claimed it as an in-place edit, or `deleted` when the hunk only removes lines. A removed line edited in place that keeps every token of its text is not a hit; the gate lists it in `mainGain.edited[]` and passes it.
    - **`main-gain-unanswerable`** — the main-gain check could not answer: a head object the main checkout does not hold after `git fetch origin`, a merge that does not resolve cleanly, a blame that failed. `mainGain.reason` says which. Stop and report `main-gain-unanswerable-#<pr>` with it, label untouched.
    - **`behind:<n>`** — you are the only place currency is proven, and a sibling merge since your rebase expires it (the staleness below).
    - **`instrument-set-changed` / `instruments-unanswerable`** — the instrument re-check the controller runs before its own gates (`run-team/SKILL.md`, **You read your instruments out of a tree every member can write to**), taken at this seat because nothing dispatches a merge bot to read that rule. Report `<reason>-#<pr>` with what the gate printed, leave the label alone, and do **not** re-run the gate.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.86.1",
+  "version": "3.87.1",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/main-gain.mjs

@@ -29,12 +29,16 @@
 // Removed lines are read off the merge the head would actually produce:
 // `git merge-tree --write-tree <base> <head>`, diffed against `<base>` with
 // rename detection on. That is right for a head that is behind `<base>` too,
-// where a three-dot diff is not. Every removed line is a candidate, including
-// one replaced by other text, and every line of a deleted file is. A removed
-// line whose exact text is added back in the same file is a move, not a
-// candidate. Binary files cannot be read line by line and are listed in
-// `unchecked[]` instead of blocking. A merge-tree that reports conflicts is a
-// head that cannot merge as it stands, which is no answer about its content.
+// where a three-dot diff is not. Every removed line is a candidate, and every
+// line of a deleted file is, except a move: a removed line whose exact text is
+// added back in the same file. A candidate edited in place is not a hit: an
+// added line of the same hunk that still holds every token of it claims it, and
+// each added line claims at most one. A token is a run of letters, digits or
+// underscores, or else one other character that is not whitespace, so
+// appending a name to an import is an in-place edit and dropping one is not.
+// Binary files cannot be read line by line and are listed in `unchecked[]`
+// instead of blocking. A merge-tree that reports conflicts is a head that
+// cannot merge as it stands, which is no answer about its content.
 //
 // Each hit carries a landing key: `#<n>` when the landing commit's subject is
 // GitHub's merge subject for PR n, otherwise that commit's 12-character
@@ -43,10 +47,15 @@
 // with an empty reason does not count. Acknowledged hits move from `hits[]`
 // to `acknowledged[]` and both are reported.
 //
-// Stdout: one JSON line, `{head, base, since, hits, acknowledged, unchecked,
-// reason}`, `since` being R as an ISO timestamp. Each hit is `{path, key,
-// landed, lines: [{line, text}], ack}`, `path` the file's name on `<base>` and
-// `ack` the body line to copy, reason left for the author to write.
+// Stdout: one JSON line, `{head, base, since, hits, acknowledged, edited,
+// unchecked, reason}`, `since` being R as an ISO timestamp. Each hit is `{path,
+// key, landed, lines: [{line, text, kind}], ack}`, `path` the file's name on
+// `<base>` and `ack` the body line to copy, reason left for the author to
+// write. `kind` is `modified` when the hunk that removed the line also adds
+// lines, and `deleted` when it only removes them. `edited` lists the gained
+// lines an in-place edit kept, as `{path, line, text, replacement}`, the
+// `replacement` being the added line that holds their tokens. An edited line is
+// not a hit and needs no acknowledgement.
 //
 //   0  clean, or every hit acknowledged
 //   1  at least one unacknowledged hit             reason main-gain-removed:<first path>
@@ -130,33 +139,72 @@ function changedPaths(tree) {
   return out;
 }
 
-// Removed lines `[{line, text}]` and added texts, or `binary`, for one path.
+// The hunks of one path, `{removed: [{line, text}], added: [text]}` each, in
+// diff order, or `binary`. Removed lines are numbered on `<base>`.
 function fileDiff(tree, oldPath, newPath) {
   const paths = oldPath === newPath ? [oldPath] : [oldPath, newPath];
   const r = git(["diff-tree", "-r", "-M", "-p", "-U0", "--no-color", "--no-ext-diff", "--no-textconv", baseRev, tree, "--", ...paths]);
   if (r === null) unanswerable(`diff-unreadable:${oldPath}`);
-  const removed = [];
-  const added = [];
-  let inHunk = false;
+  const hunks = [];
+  let hunk = null;
   let oldLine = 0;
   for (const line of r.stdout.split("\n")) {
     if (line.startsWith("diff --git ")) {
-      inHunk = false;
+      hunk = null;
       continue;
     }
     const h = /^@@ -(\d+)(?:,\d+)? \+\d+(?:,\d+)? @@/.exec(line);
     if (h) {
-      inHunk = true;
+      hunk = { removed: [], added: [] };
+      hunks.push(hunk);
       oldLine = Number(h[1]);
-    } else if (!inHunk) {
+    } else if (hunk === null) {
       if (line.startsWith("Binary files ")) return { binary: true };
     } else if (line.startsWith("-")) {
-      removed.push({ line: oldLine++, text: line.slice(1) });
+      hunk.removed.push({ line: oldLine++, text: line.slice(1) });
     } else if (line.startsWith("+")) {
-      added.push(line.slice(1));
+      hunk.added.push(line.slice(1));
+    }
+  }
+  return { binary: false, hunks };
+}
+
+// The tokens an in-place edit keeps: a run of letters, digits or underscores is
+// one token, and each other character that is not whitespace is one.
+const TOKEN = /[\p{L}\p{N}_]+|[^\s\p{L}\p{N}_]/gu;
+function tokensOf(text) {
+  const counts = new Map();
+  for (const t of text.match(TOKEN) ?? []) counts.set(t, (counts.get(t) ?? 0) + 1);
+  return counts;
+}
+
+// Each unclaimed added line of one hunk claims at most one removed line of that
+// hunk. Removed lines choose in turn, most tokens first so a short line does not
+// take the added line a long one needs, and each takes the first unclaimed added
+// line still holding every token of it. That is greedy: a removed line can stay
+// a hit where another pairing would have matched every line, an error toward
+// blocking. The rarest token of a removed line bounds the added lines tried for
+// it.
+function claimInPlace(removed, added) {
+  const index = new Map();
+  for (const a of added) {
+    if (a.claimed) continue;
+    a.tokens = tokensOf(a.text);
+    for (const t of a.tokens.keys()) {
+      if (!index.has(t)) index.set(t, []);
+      index.get(t).push(a);
+    }
+  }
+  const size = (counts) => [...counts.values()].reduce((s, n) => s + n, 0);
+  for (const c of [...removed].sort((x, y) => size(y.tokens) - size(x.tokens))) {
+    if (c.tokens.size === 0) continue;
+    const pool = [...c.tokens.keys()].map((t) => index.get(t) ?? []).reduce((best, l) => (l.length < best.length ? l : best));
+    const a = pool.find((x) => !x.claimed && [...c.tokens].every(([t, n]) => (x.tokens.get(t) ?? 0) >= n));
+    if (a) {
+      a.claimed = true;
+      c.replacement = a.text;
     }
   }
-  return { binary: false, removed, added };
 }
 
 // line number on `<base>` → {sha, time, summary} for the requested lines,
@@ -221,6 +269,7 @@ function check() {
 
   const hits = [];
   const unchecked = [];
+  const edited = [];
   // No commits of its own: the head is already on `<base>` and merges nothing.
   if (since !== null) {
     for (const { oldMode, status, oldPath, newPath } of changedPaths(tree)) {
@@ -234,25 +283,47 @@ function check() {
         unchecked.push(oldPath);
         continue;
       }
-      const addedBack = new Map();
-      for (const t of d.added) addedBack.set(t, (addedBack.get(t) ?? 0) + 1);
-      const candidates = d.removed.filter(({ text }) => {
-        const n = addedBack.get(text) ?? 0;
-        if (n === 0) return true;
-        addedBack.set(text, n - 1);
-        return false;
+      // A removed line whose exact text is added back in the same file is a
+      // move, and the added line is spent on it.
+      const addsByHunk = d.hunks.map(() => []);
+      const twins = new Map();
+      d.hunks.forEach((h, hunk) => {
+        for (const text of h.added) {
+          const a = { text, claimed: false, tokens: null };
+          addsByHunk[hunk].push(a);
+          if (!twins.has(text)) twins.set(text, []);
+          twins.get(text).push(a);
+        }
       });
-      if (candidates.length === 0) continue;
-      const blamed = blame(oldPath, candidates);
+      const candsByHunk = d.hunks.map(() => []);
+      d.hunks.forEach((h, hunk) => {
+        for (const { line, text } of h.removed) {
+          const spare = twins.get(text);
+          if (spare?.length) {
+            spare.pop().claimed = true;
+            continue;
+          }
+          const kind = h.added.length > 0 ? "modified" : "deleted";
+          candsByHunk[hunk].push({ line, text, kind, tokens: tokensOf(text), replacement: null });
+        }
+      });
+      d.hunks.forEach((_, hunk) => claimInPlace(candsByHunk[hunk], addsByHunk[hunk]));
+      const cands = candsByHunk.flat();
+      if (cands.length === 0) continue;
+      const blamed = blame(oldPath, cands);
       const byKey = new Map();
-      for (const c of candidates) {
+      for (const c of cands) {
         const b = blamed.get(c.line);
         if (b.time <= since) continue;
+        if (c.replacement !== null) {
+          edited.push({ path: oldPath, line: c.line, text: c.text, replacement: c.replacement });
+          continue;
+        }
         const key = landingKey(b.sha, b.summary);
         if (!byKey.has(key)) {
           byKey.set(key, { path: oldPath, key, landed: b.sha, lines: [], ack: `main-gain-removal: ${oldPath} ${key} - <why>` });
         }
-        byKey.get(key).lines.push(c);
+        byKey.get(key).lines.push({ line: c.line, text: c.text, kind: c.kind });
       }
       hits.push(...byKey.values());
     }
@@ -270,6 +341,7 @@ function check() {
     since: since === null ? null : new Date(since * 1000).toISOString(),
     hits: open,
     acknowledged,
+    edited,
     unchecked,
     reason: open.length ? `main-gain-removed:${open[0].path}` : null,
   };
@@ -282,7 +354,7 @@ try {
   result = check();
 } catch (e) {
   if (!(e instanceof Unanswerable)) die(`check failed: ${e.code ?? e.message} — could not evaluate`);
-  result = { since: null, hits: [], acknowledged: [], unchecked: [], reason: e.message, unknown: true };
+  result = { since: null, hits: [], acknowledged: [], edited: [], unchecked: [], reason: e.message, unknown: true };
 }
 const { unknown, ...payload } = result;
 writeAll(1, `${JSON.stringify({ head, base, ...payload })}\n`);

package/scripts/merge-gate.mjs

@@ -31,7 +31,7 @@
 // `bodyDigest`), or null with `head` when gh could not be read, `rebaseCarry`
 // naming the labelled head and the head accepted as carrying it (`{labelled,
 // accepted}`), or null when no carry was proven, `mainGain` echoing
-// main-gain.mjs's own payload — hits, acknowledged removals and unchecked
+// main-gain.mjs's own payload — hits, acknowledged removals, edited lines and unchecked
 // files — or null when it did not run or printed no JSON object; an unusable
 // payload is still echoed. Stderr: the children's own diagnostics, passed
 // straight through and never folded into stdout.
@@ -298,7 +298,7 @@ function readMainGain(root, prView) {
   const payload = isObject(v) ? v : null;
   const read = (usable) => ({ usable, exit: r.status, payload });
   if (r.error || r.signal || payload === null || payload.head !== prView.headRefOid) return read(false);
-  if (![payload.hits, payload.acknowledged, payload.unchecked].every(Array.isArray)) return read(false);
+  if (![payload.hits, payload.acknowledged, payload.edited, payload.unchecked].every(Array.isArray)) return read(false);
   if (!payload.hits.every((h) => isObject(h) && typeof h.path === "string" && h.path !== "")) return read(false);
   return read((r.status === 0 && payload.hits.length === 0) || (r.status === 1 && payload.hits.length > 0));
 }

package/scripts/reap.sh

@@ -1436,8 +1436,9 @@ for b in $gone_branches; do
     # delete would refuse a branch checked out in a surviving worktree anyway.
     #
     # Ancestor match, not exact equality: a worktree nested inside `$wt`
-    # (a real, documented shape — SKILL.md names a member committing from a
-    # nested worktree) has `$wt` as an ancestor on disk, so removing `$wt`
+    # (a real, documented shape — run-team references/failure-handling.md,
+    # **Verify every reported SHA.**, names a member committing in a nested
+    # worktree) has `$wt` as an ancestor on disk, so removing `$wt`
     # removes the nested one's files too — taking any uncommitted work in it
     # along, the same cwd deletion this guard exists for, one path further
     # out — even though `$wt` itself never equals `$self_wt` in that shape.

package/skills/run-team/SKILL.md

@@ -831,7 +831,7 @@ and flag the PR for a human. A new review of the PR counts again from none.
 
 | Failure | Response |
 |---|---|
-| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, and no member is dispatched to restore the lines — the removal may be deliberate. `fleet-event.mjs merge-bot-report` parks it: a `parked=<head>:<body digest>:<reason>` token on its row, at the head and body digest the bot's gate reading `<scratch>/pr<pr>/merge-bot-<n>/ci.json` records it refused, and no bot is dispatched on its account — when nothing else queued is dispatchable the tick prints `HOLD (parked #<pr> <reason>)`, though a bot dispatched for another queued PR may still evaluate it again; a new head or an edited body lifts the park with no write. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
+| Merge bot's gate finds the merge would remove lines `main` gained after the PR's work began (`main-gain-removed:<path>`, exit 1) | Relay `main-gain-removed:<path>-#<pr>` to a human with the hit list and the acknowledgement keys the bot printed. PR stays queued, label untouched, and no member is dispatched to restore the lines — the removal may be deliberate. `fleet-event.mjs merge-bot-report` parks it: a `parked=<head>:<body digest>:<reason>` token on its row, at the head and body digest the bot's gate reading `<scratch>/pr<pr>/merge-bot-<n>/ci.json` records it refused, and no bot is dispatched on its account — when nothing else queued is dispatchable the tick prints `HOLD (parked #<pr> <reason>)`, though a bot dispatched for another queued PR may still evaluate it again; a new head or an edited body lifts the park with no write. A hit line's `kind` is `modified` when its hunk also adds lines, `deleted` when it only removes lines; a gained line edited in place keeping every token is listed in `mainGain.edited[]`, not a hit. It clears when the PR stops removing them or its body carries `main-gain-removal: <path> <key> - <why>` for each hit |
 | Merge bot's gate cannot answer the main-gain check (`main-gain-unanswerable`, exit 2) | Report `main-gain-unanswerable-#<pr>` with what it printed, PR stays queued, label untouched |
 
 ## Failure handling