@fluado/enmetu 0.0.0-stage → 0.2.0

package/dist/state/stateRecorder.js

@@ -0,0 +1,69 @@
+import { errorMessage } from '../core/errors/errorMessage.js';
+import { stateRecordStep } from '../core/state/stateRecordStep.js';
+/**
+ * Service, the imperative shell around stateRecordStep (design 12.1): holds
+ * the current record (read from the store once, at the first event, so the
+ * history survives a restart), applies each event with the clock's time and
+ * the history cap, and writes the result. A failed read means no record;
+ * a failed write logs STATE_WRITE_FAILED once until a write succeeds again
+ * and is never thrown, so state recording cannot stop syncing.
+ */
+export class StateRecorder {
+    store;
+    clock;
+    logger;
+    historyCap;
+    current = null;
+    loaded = false;
+    writeFailing = false;
+    constructor(store, clock, logger, historyCap) {
+        this.store = store;
+        this.clock = clock;
+        this.logger = logger;
+        this.historyCap = historyCap;
+    }
+    async record(event) {
+        const previous = await this.previous();
+        const at = new Date(this.clock.now()).toISOString();
+        // Kept in memory even when the write fails, so the next event builds on
+        // what the process knows and the next successful write carries it.
+        this.current = stateRecordStep(previous, event, at, this.historyCap);
+        try {
+            await this.store.write(this.current);
+            this.writeFailing = false;
+        }
+        catch (error) {
+            if (!this.writeFailing) {
+                this.writeFailing = true;
+                this.logger.log({
+                    level: 'WARN',
+                    code: 'STATE_WRITE_FAILED',
+                    message: `state.json could not be written: ${errorMessage(error)}`,
+                });
+            }
+        }
+    }
+    /** The rebase abort's view of this recorder (design 14.15); never throws, like record. */
+    async orphaned(facts) {
+        await this.record({
+            type: 'commitOrphaned',
+            commit: facts.commit,
+            base: facts.base,
+            subject: facts.subject,
+        });
+    }
+    async previous() {
+        if (this.loaded) {
+            return this.current;
+        }
+        this.loaded = true;
+        try {
+            this.current = await this.store.read();
+        }
+        catch {
+            // An unreadable record only costs the history of earlier runs.
+            this.current = null;
+        }
+        return this.current;
+    }
+}

package/dist/state/stateRecordingSyncCycle.d.ts

@@ -0,0 +1,24 @@
+import type { IGitReader } from '../contracts/IGitReader.js';
+import type { IStateRecorder } from '../contracts/IStateRecorder.js';
+import type { ISyncCycle, SyncCycleInput, SyncCycleResult } from '../contracts/ISyncCycle.js';
+/**
+ * Decorator over ISyncCycle (design 12.1, Decision 65): runs the wrapped
+ * cycle, then reads the upstream facts from git (`pushed` is the verified
+ * ref; `unpushed` is the ahead count against the tracking ref, else the
+ * verified ref) and records cycleFinished; a cycle that throws is recorded
+ * cycleFailed and the error is rethrown unchanged. The result is returned
+ * unchanged; a failed facts read records null facts. The controller, the
+ * runner and the scheduler do not know it exists.
+ */
+export declare class StateRecordingSyncCycle implements ISyncCycle {
+    private readonly inner;
+    private readonly recorder;
+    private readonly git;
+    constructor(inner: ISyncCycle, recorder: IStateRecorder, git: IGitReader);
+    run(input: SyncCycleInput): Promise<SyncCycleResult>;
+    /**
+     * Read after the cycle, so the counts include what it committed and pushed.
+     * Counted against the base the cycle's UNPUSHED line uses (Decision 59).
+     */
+    private upstreamFacts;
+}

package/dist/state/stateRecordingSyncCycle.js

@@ -0,0 +1,71 @@
+import { verifiedRefFor } from '../core/git/enmetuRefs.js';
+const UNKNOWN_FACTS = { pushed: null, unpushed: null };
+/**
+ * Decorator over ISyncCycle (design 12.1, Decision 65): runs the wrapped
+ * cycle, then reads the upstream facts from git (`pushed` is the verified
+ * ref; `unpushed` is the ahead count against the tracking ref, else the
+ * verified ref) and records cycleFinished; a cycle that throws is recorded
+ * cycleFailed and the error is rethrown unchanged. The result is returned
+ * unchanged; a failed facts read records null facts. The controller, the
+ * runner and the scheduler do not know it exists.
+ */
+export class StateRecordingSyncCycle {
+    inner;
+    recorder;
+    git;
+    constructor(inner, recorder, git) {
+        this.inner = inner;
+        this.recorder = recorder;
+        this.git = git;
+    }
+    async run(input) {
+        let result;
+        try {
+            result = await this.inner.run(input);
+        }
+        catch (error) {
+            await this.recorder.record({
+                type: 'cycleFailed',
+                cycleId: input.cycleId,
+            });
+            throw error;
+        }
+        await this.recorder.record({
+            type: 'cycleFinished',
+            cycleId: input.cycleId,
+            outcome: result.outcome,
+            conflict: result.conflict,
+            upstream: await this.upstreamFacts(),
+        });
+        return result;
+    }
+    /**
+     * Read after the cycle, so the counts include what it committed and pushed.
+     * Counted against the base the cycle's UNPUSHED line uses (Decision 59).
+     */
+    async upstreamFacts() {
+        try {
+            const { branchRef } = await this.git.repositoryState();
+            if (branchRef === null) {
+                return UNKNOWN_FACTS;
+            }
+            const upstream = await this.git.upstream(branchRef);
+            if (upstream === null) {
+                return UNKNOWN_FACTS;
+            }
+            const trackingSha = await this.git.resolveCommit(upstream.trackingRef);
+            const verifiedSha = await this.git.resolveCommit(verifiedRefFor(branchRef));
+            const base = trackingSha ?? verifiedSha;
+            if (base === null) {
+                return { pushed: verifiedSha, unpushed: null };
+            }
+            const { ahead } = await this.git.divergence(base);
+            return { pushed: verifiedSha, unpushed: ahead };
+        }
+        catch {
+            // The record is a report; a failed read must not fail a cycle that
+            // already ran, and null says "unknown" truthfully.
+            return UNKNOWN_FACTS;
+        }
+    }
+}

package/dist/sync/hookAbortingSyncScheduler.d.ts

@@ -0,0 +1,16 @@
+import type { ISyncScheduler } from '../contracts/ISyncScheduler.js';
+/**
+ * Decorator over ISyncScheduler (Decision 92): a stop request also aborts the
+ * signal the hook-running facades carry, so a repository hook that would run
+ * for up to hookTimeoutMs is ended at once, which is a rejection; the
+ * running cycle then finishes in the time its remaining git commands take.
+ * The scheduler and the daemon stay unaware of hooks.
+ */
+export declare class HookAbortingSyncScheduler implements ISyncScheduler {
+    private readonly inner;
+    private readonly hooks;
+    constructor(inner: ISyncScheduler, hooks: AbortController);
+    run(): Promise<'stopped' | 'halted'>;
+    notifyChange(): void;
+    stop(): void;
+}

package/dist/sync/hookAbortingSyncScheduler.js

@@ -0,0 +1,27 @@
+/**
+ * Decorator over ISyncScheduler (Decision 92): a stop request also aborts the
+ * signal the hook-running facades carry, so a repository hook that would run
+ * for up to hookTimeoutMs is ended at once, which is a rejection; the
+ * running cycle then finishes in the time its remaining git commands take.
+ * The scheduler and the daemon stay unaware of hooks.
+ */
+export class HookAbortingSyncScheduler {
+    inner;
+    hooks;
+    constructor(inner, hooks) {
+        this.inner = inner;
+        this.hooks = hooks;
+    }
+    run() {
+        return this.inner.run();
+    }
+    notifyChange() {
+        this.inner.notifyChange();
+    }
+    stop() {
+        // Abort first: the inner stop waits for the running cycle, which may be
+        // inside a hook right now.
+        this.hooks.abort();
+        this.inner.stop();
+    }
+}

package/dist/sync/integrateUpstreamController.d.ts

@@ -0,0 +1,95 @@
+import type { IClock } from '../contracts/IClock.js';
+import type { IGitReader } from '../contracts/IGitReader.js';
+import type { IGitWriter } from '../contracts/IGitWriter.js';
+import type { HaltCode, IHaltStore } from '../contracts/IHaltStore.js';
+import type { ILogger } from '../contracts/ILogger.js';
+import type { IOperationJournal } from '../contracts/IOperationJournal.js';
+import type { IPathQuarantine } from '../contracts/IPathQuarantine.js';
+import type { IOrphanedCommitRecorder } from '../contracts/IStateRecorder.js';
+import type { ConflictKey, PauseReason } from '../contracts/syncTypes.js';
+export interface IntegrateUpstreamInput {
+    readonly cycleId: string;
+    /** The branch the cycle resolved its upstream for. */
+    readonly branchRef: string;
+    /** The verified upstream sha to rebase onto. */
+    readonly ontoSha: string;
+    /** Commits the upstream has that HEAD lacks, for the PULLED line. */
+    readonly behind: number;
+    readonly knownConflict: ConflictKey | null;
+}
+export interface IntegrateUpstreamDeps {
+    readonly git: IGitReader;
+    readonly writer: IGitWriter;
+    readonly halt: IHaltStore;
+    readonly journal: IOperationJournal;
+    readonly quarantine: IPathQuarantine;
+    readonly logger: ILogger;
+    readonly clock: IClock;
+    /** Passed to the rebase abort, which reports each commit it orphans (design 14.15). */
+    readonly orphans?: IOrphanedCommitRecorder | undefined;
+}
+export type IntegrateUpstreamResult = {
+    readonly kind: 'rebased';
+}
+/** Only a rebase that really stopped and whose abort was verified. */
+ | {
+    readonly kind: 'conflict';
+    readonly conflict: ConflictKey;
+} | {
+    readonly kind: 'busy';
+}
+/**
+ * git refused to start the rebase and left nothing in progress (design 12.7,
+ * Decisions 78 and 82); detail is git's stderr. Never aborted or verified.
+ */
+ | {
+    readonly kind: 'not-started';
+    readonly detail: string;
+} | {
+    readonly kind: 'paused';
+    readonly reason: PauseReason;
+} | {
+    readonly kind: 'halted';
+    readonly code: HaltCode;
+};
+/**
+ * The integrate step with its deps bound, the shape the sync cycle consumes. The
+ * composition root builds it in a closure over integrateUpstreamController, so
+ * the cycle's tests mock one result instead of the rebase's internals.
+ */
+export type IntegrateUpstream = (input: IntegrateUpstreamInput) => Promise<IntegrateUpstreamResult>;
+/**
+ * Controller: rebase HEAD onto the verified upstream with the excluded
+ * paths held aside (design 1.11).
+ *
+ * 1. head = git.headCommit(); an identical knownConflict logs CONFLICT and returns it (Decision 11).
+ * 2. Dirty tracked paths: quarantine.hold; pending returns busy, unsupported pauses QUARANTINE_UNSUPPORTED.
+ * 3. From here on in try/finally:
+ *    a. git.repositoryState() again: operation pauses FOREIGN_OPERATION, indexLocked returns busy,
+ *       another branch pauses BRANCH_CHANGED.
+ *    b. journal.begin(entry), then writer.rebase(ontoSha, rebaseReflogAction(entry)):
+ *       the attempt's token in HEAD's reflog (Decision 104).
+ *    c. rebased: journal.clear(). refused: journal.clear(), pause FOREIGN_OPERATION, no abort.
+ *       not-started: journal.clear(), returned with git's stderr in detail; no
+ *       abort, no verification, no conflict key (Decisions 78, 82).
+ *       stopped: rebaseOwner first (Decision 104): HEAD's newest start entry not this
+ *       attempt's token (another action, an earlier token, none) clears the journal and
+ *       pauses FOREIGN_OPERATION with nothing captured, adopted or aborted. Otherwise
+ *       Decision 97's adoption, then abort only a rebase whose onto and orig-head are
+ *       enmetu's, capturing first every write that landed during the stop (step 0,
+ *       Decision 45) and naming staged writes (step 0b, Decision 105), then verify (no
+ *       operation, nothing unmerged, HEAD back at head); unverified halts
+ *       REBASE_ABORT_UNVERIFIED and keeps journal and memento. A branch a commit
+ *       moved while the rebase ran ends the rebase at its tip instead (Decision
+ *       122): verified, that returns busy with no conflict key and no CONFLICT line.
+ *    d. A throw from a to c before the abort: the same abort-and-verify, ownership
+ *       included; with nothing in progress and a failed verification, another owner
+ *       clears the journal and pauses FOREIGN_OPERATION instead of halting.
+ *       GIT_INDEX_LOCKED and GIT_TIMEOUT return busy without a conflict key, anything
+ *       else is rethrown.
+ *    A throw out of abort-and-verify itself (from c or d) is never retried and escapes.
+ *    finally: quarantine.restore() when paths were held or captured, unless the abort was
+ *    unverified or threw; failed halts QUARANTINE_RESTORE_FAILED, kept blobs log QUARANTINE_KEPT.
+ * 4. rebased logs PULLED with the count.
+ */
+export declare function integrateUpstreamController(input: IntegrateUpstreamInput, deps: IntegrateUpstreamDeps): Promise<IntegrateUpstreamResult>;

package/dist/sync/integrateUpstreamController.js

@@ -0,0 +1,353 @@
+import { EnmetuError } from '../contracts/errors.js';
+import { rebaseOwner, rebaseReflogAction, } from '../core/git/rebaseOwnership.js';
+import { logRestoreWarnings } from '../core/quarantine/restoreWarnings.js';
+import { recordHalt } from '../halt/recordHalt.js';
+import { abortEnmetuRebase, rebaseAbortFailure, recordAbortUnverified, } from '../recovery/enmetuRebaseAbort.js';
+const SHORT_SHA_LENGTH = 7;
+/**
+ * Controller: rebase HEAD onto the verified upstream with the excluded
+ * paths held aside (design 1.11).
+ *
+ * 1. head = git.headCommit(); an identical knownConflict logs CONFLICT and returns it (Decision 11).
+ * 2. Dirty tracked paths: quarantine.hold; pending returns busy, unsupported pauses QUARANTINE_UNSUPPORTED.
+ * 3. From here on in try/finally:
+ *    a. git.repositoryState() again: operation pauses FOREIGN_OPERATION, indexLocked returns busy,
+ *       another branch pauses BRANCH_CHANGED.
+ *    b. journal.begin(entry), then writer.rebase(ontoSha, rebaseReflogAction(entry)):
+ *       the attempt's token in HEAD's reflog (Decision 104).
+ *    c. rebased: journal.clear(). refused: journal.clear(), pause FOREIGN_OPERATION, no abort.
+ *       not-started: journal.clear(), returned with git's stderr in detail; no
+ *       abort, no verification, no conflict key (Decisions 78, 82).
+ *       stopped: rebaseOwner first (Decision 104): HEAD's newest start entry not this
+ *       attempt's token (another action, an earlier token, none) clears the journal and
+ *       pauses FOREIGN_OPERATION with nothing captured, adopted or aborted. Otherwise
+ *       Decision 97's adoption, then abort only a rebase whose onto and orig-head are
+ *       enmetu's, capturing first every write that landed during the stop (step 0,
+ *       Decision 45) and naming staged writes (step 0b, Decision 105), then verify (no
+ *       operation, nothing unmerged, HEAD back at head); unverified halts
+ *       REBASE_ABORT_UNVERIFIED and keeps journal and memento. A branch a commit
+ *       moved while the rebase ran ends the rebase at its tip instead (Decision
+ *       122): verified, that returns busy with no conflict key and no CONFLICT line.
+ *    d. A throw from a to c before the abort: the same abort-and-verify, ownership
+ *       included; with nothing in progress and a failed verification, another owner
+ *       clears the journal and pauses FOREIGN_OPERATION instead of halting.
+ *       GIT_INDEX_LOCKED and GIT_TIMEOUT return busy without a conflict key, anything
+ *       else is rethrown.
+ *    A throw out of abort-and-verify itself (from c or d) is never retried and escapes.
+ *    finally: quarantine.restore() when paths were held or captured, unless the abort was
+ *    unverified or threw; failed halts QUARANTINE_RESTORE_FAILED, kept blobs log QUARANTINE_KEPT.
+ * 4. rebased logs PULLED with the count.
+ */
+export async function integrateUpstreamController(input, deps) {
+    const { cycleId, ontoSha } = input;
+    // --- Step 1: an identical conflict is reported, not re-run (Decision 11) ---
+    const head = await deps.git.headCommit();
+    if (head === null) {
+        // The cycle only integrates after a divergence against HEAD succeeded.
+        throw new EnmetuError('HEAD is unborn; there is nothing to rebase', 'HEAD_UNBORN', cycleId);
+    }
+    const key = { head, upstream: ontoSha };
+    if (input.knownConflict !== null &&
+        input.knownConflict.head === head &&
+        input.knownConflict.upstream === ontoSha) {
+        deps.logger.log({
+            level: 'WARN',
+            code: 'CONFLICT',
+            message: `rebase onto ${shortSha(ontoSha)} already stopped from this HEAD; not re-run, local commits intact`,
+            cycleId,
+        });
+        return { kind: 'conflict', conflict: key };
+    }
+    // --- Step 2: hold dirty tracked paths aside; untracked ones never block a rebase ---
+    const dirty = (await deps.git.status())
+        .filter((entry) => entry.index !== '?' &&
+        (entry.worktree === 'M' ||
+            entry.worktree === 'D' ||
+            entry.worktree === 'T'))
+        .map((entry) => entry.path);
+    let held = false;
+    if (dirty.length > 0) {
+        const hold = await deps.quarantine.hold(dirty);
+        if (hold.kind === 'pending') {
+            return { kind: 'busy' };
+        }
+        if (hold.kind === 'unsupported') {
+            return { kind: 'paused', reason: 'QUARANTINE_UNSUPPORTED' };
+        }
+        held = true;
+    }
+    // --- Step 3: rebase under try/finally, so a throw never leaves held paths at HEAD ---
+    let attempt;
+    let restoreFailed = false;
+    try {
+        attempt = await attemptRebase(input, head, deps);
+    }
+    finally {
+        // An attempt that threw out of abort-and-verify itself has an unknown
+        // abort state; it counts like an unverified abort and keeps the memento for the next
+        // cycle or the startup recovery, like a verification that failed.
+        if (attempt !== undefined &&
+            (held || attempt.captured) &&
+            !isUnverifiedAbort(attempt)) {
+            restoreFailed = !(await restoreHeld(cycleId, deps));
+        }
+    }
+    if (restoreFailed) {
+        return { kind: 'halted', code: 'QUARANTINE_RESTORE_FAILED' };
+    }
+    if (attempt.kind === 'thrown') {
+        throw attempt.error;
+    }
+    // --- Step 4: report what was pulled ---
+    if (attempt.result.kind === 'rebased') {
+        deps.logger.log({
+            level: 'INFO',
+            code: 'PULLED',
+            message: commits(input.behind),
+            cycleId,
+        });
+    }
+    return attempt.result;
+}
+/**
+ * Steps 3a to 3d; an error comes back in a 'thrown' attempt only after
+ * abort-and-verify. A throw out of abort-and-verify itself escapes: step 3c runs
+ * it outside 3d's catch, so it is never run a second time (1.11).
+ */
+async function attemptRebase(input, head, deps) {
+    const { cycleId, ontoSha } = input;
+    const rebased = await rebaseOrRecover(input, head, deps);
+    if (rebased.kind !== 'stopped') {
+        return rebased;
+    }
+    // --- Step 3c, stopped: ownership first, then adoption and abort-and-verify ---
+    const owner = await attemptOwner(rebased.entry, deps);
+    if (owner === 'other') {
+        // HEAD's reflog says this attempt did not start the rebase in progress,
+        // whatever its orig-head and onto: a person's (Decision 104).
+        await deps.journal.clear();
+        return paused('FOREIGN_OPERATION', false);
+    }
+    const startedFrom = await ownRebaseOrigHead(input, head, rebased.entry, deps);
+    const abort = await abortAndVerify(input, startedFrom, rebased.entry, deps, owner);
+    if (abort.verdict !== 'verified') {
+        return verdictResult(abort.verdict, abort.captured);
+    }
+    if (abort.branchMovedTo !== null) {
+        // Not a conflict of this HEAD: the next cycle rebases the moved branch,
+        // the commit that moved it included (Decision 122).
+        return {
+            kind: 'result',
+            result: { kind: 'busy' },
+            captured: abort.captured,
+        };
+    }
+    const detail = rebased.detail.trim();
+    deps.logger.log({
+        level: 'WARN',
+        code: 'CONFLICT',
+        message: `rebase onto ${shortSha(ontoSha)} stopped; aborted and verified, local commits intact${detail === '' ? '' : ` (${detail})`}`,
+        cycleId,
+    });
+    return {
+        kind: 'result',
+        result: {
+            kind: 'conflict',
+            conflict: { head: startedFrom, upstream: ontoSha },
+        },
+        captured: abort.captured,
+    };
+}
+/**
+ * The HEAD enmetu's stopped rebase started from (Decision 97). Step 3a saw no
+ * operation in progress and enmetu's own `git rebase` left the rebase
+ * directory, so a rebase onto ontoSha in progress now is enmetu's even when
+ * its orig-head is not the HEAD read in step 1: a person's commit landed in
+ * between, and git rebased from it. The journal is rewritten with that HEAD
+ * first, so startup recovery recognises the rebase too; it keeps the
+ * attempt's cycle id and time, so the token recovery rebuilds from it still
+ * names this attempt (Decision 104). Any other state keeps step 1's HEAD, and
+ * abort-and-verify decides unchanged. Runs only after the ownership check
+ * found no other owner.
+ */
+async function ownRebaseOrigHead(input, head, entry, deps) {
+    const origHead = await deps.git.rebaseOrigHead();
+    if (origHead === null ||
+        origHead === head ||
+        (await deps.git.rebaseOnto()) !== input.ontoSha) {
+        return head;
+    }
+    await deps.journal.begin({
+        origHead,
+        onto: input.ontoSha,
+        cycleId: entry.cycleId,
+        at: entry.at,
+    });
+    return origHead;
+}
+/**
+ * Who started the rebase in progress, from HEAD's newest start entry (Decision
+ * 104). Without a begun journal entry this attempt ran no `git rebase`, so no
+ * start entry can carry its token: someone else's, unless HEAD has no reflog
+ * and orig-head and onto decide like before.
+ */
+async function attemptOwner(entry, deps) {
+    const start = await deps.git.rebaseStart();
+    if (entry === null) {
+        return start.kind === 'unlogged' ? 'unknown' : 'other';
+    }
+    return rebaseOwner(start, entry);
+}
+/** Steps 3a, 3b, 3c for rebased and refused, and 3d; a stopped rebase is returned for 3c's abort. */
+async function rebaseOrRecover(input, head, deps) {
+    const { cycleId, ontoSha } = input;
+    // The entry whose token this attempt's rebase carries; null until 3b.
+    let attempted = null;
+    try {
+        // --- Step 3a: a person may have started something while enmetu fetched ---
+        const state = await deps.git.repositoryState();
+        if (state.operation !== null) {
+            return paused('FOREIGN_OPERATION', false);
+        }
+        if (state.indexLocked) {
+            return { kind: 'result', result: { kind: 'busy' }, captured: false };
+        }
+        if (state.branchRef !== input.branchRef) {
+            return paused('BRANCH_CHANGED', false);
+        }
+        // --- Step 3b: journal first, so a crash mid-rebase is recognisable at startup ---
+        const entry = {
+            origHead: head,
+            onto: ontoSha,
+            cycleId,
+            at: isoTime(deps.clock),
+        };
+        attempted = entry;
+        await deps.journal.begin(entry);
+        const rebase = await deps.writer.rebase(ontoSha, rebaseReflogAction(entry));
+        // --- Step 3c: interpret the rebase ---
+        if (rebase.kind === 'rebased') {
+            await deps.journal.clear();
+            return { kind: 'result', result: { kind: 'rebased' }, captured: false };
+        }
+        if (rebase.kind === 'refused') {
+            // The rebase in progress is a person's; aborting it would destroy their work.
+            await deps.journal.clear();
+            return paused('FOREIGN_OPERATION', false);
+        }
+        if (rebase.kind === 'not-started') {
+            // Nothing is in progress, so there is nothing to abort or verify, and
+            // no conflict: the cycle counts the refusal (Decisions 78, 82).
+            await deps.journal.clear();
+            return {
+                kind: 'result',
+                result: { kind: 'not-started', detail: rebase.detail },
+                captured: false,
+            };
+        }
+        return { kind: 'stopped', detail: rebase.detail, entry };
+    }
+    catch (error) {
+        // --- Step 3d: whatever threw, enmetu's rebase must not stay in progress ---
+        const abort = await abortAndVerify(input, head, attempted, deps);
+        if (abort.verdict !== 'verified') {
+            return verdictResult(abort.verdict, abort.captured);
+        }
+        // A lock or a timeout carries no conflict key, so the next cycle retries.
+        if (error instanceof EnmetuError &&
+            (error.code === 'GIT_INDEX_LOCKED' || error.code === 'GIT_TIMEOUT')) {
+            return {
+                kind: 'result',
+                result: { kind: 'busy' },
+                captured: abort.captured,
+            };
+        }
+        return { kind: 'thrown', error, captured: abort.captured };
+    }
+}
+/**
+ * Aborts a rebase in progress only when it is enmetu's through
+ * abortEnmetuRebase, the implementation recovery shares: HEAD's reflog must
+ * not name another owner (Decision 104), and orig-head and onto must both
+ * match. With no rebase in progress (git refused before it started, or
+ * removed its directory) there is nothing to capture or abort, and only the
+ * verification runs; when it fails, the owner is asked before any halt,
+ * because a start entry that is not this attempt's means enmetu's rebase
+ * never checked out and moved nothing (form iii of design 13.2). known is the
+ * owner step 3c already read.
+ */
+async function abortAndVerify(input, head, entry, deps, known) {
+    const target = {
+        cycleId: input.cycleId,
+        origHead: head,
+        onto: input.ontoSha,
+        reflogAction: entry === null ? null : rebaseReflogAction(entry),
+    };
+    const owner = async () => known ?? (await attemptOwner(entry, deps));
+    const foreign = async () => {
+        await deps.journal.clear();
+        return { verdict: 'foreign', captured: false, branchMovedTo: null };
+    };
+    const origHead = await deps.git.rebaseOrigHead();
+    const onto = await deps.git.rebaseOnto();
+    if (origHead === null && onto === null) {
+        const failure = await rebaseAbortFailure(target, deps);
+        if (failure === null) {
+            await deps.journal.clear();
+            return { verdict: 'verified', captured: false, branchMovedTo: null };
+        }
+        if ((await owner()) === 'other') {
+            return foreign();
+        }
+        await recordAbortUnverified(target, failure, deps);
+        return { verdict: 'unverified', captured: false, branchMovedTo: null };
+    }
+    if ((await owner()) === 'other' ||
+        origHead !== head ||
+        onto !== input.ontoSha) {
+        return foreign();
+    }
+    return abortEnmetuRebase(target, deps);
+}
+/** Restores the held paths; false when the restore failed and the halt is set. */
+async function restoreHeld(cycleId, deps) {
+    const restore = await deps.quarantine.restore();
+    if (restore.kind === 'failed') {
+        await recordHalt({
+            code: 'QUARANTINE_RESTORE_FAILED',
+            message: `restoring the paths held during the rebase failed (${restore.detail}); the quarantine memento is kept`,
+            cycleId,
+        }, deps);
+        return false;
+    }
+    if (restore.kind === 'restored') {
+        logRestoreWarnings(restore, cycleId, deps.logger);
+    }
+    return true;
+}
+function isUnverifiedAbort(attempt) {
+    return (attempt.kind === 'result' &&
+        attempt.result.kind === 'halted' &&
+        attempt.result.code === 'REBASE_ABORT_UNVERIFIED');
+}
+function verdictResult(verdict, captured) {
+    return verdict === 'foreign'
+        ? paused('FOREIGN_OPERATION', captured)
+        : {
+            kind: 'result',
+            result: { kind: 'halted', code: 'REBASE_ABORT_UNVERIFIED' },
+            captured,
+        };
+}
+function paused(reason, captured) {
+    return { kind: 'result', result: { kind: 'paused', reason }, captured };
+}
+function commits(count) {
+    return count === 1 ? '1 commit' : `${count} commits`;
+}
+function shortSha(sha) {
+    return sha.slice(0, SHORT_SHA_LENGTH);
+}
+function isoTime(clock) {
+    return new Date(clock.now()).toISOString();
+}