@junghanacs/entwurf 0.12.8 → 0.12.9

package/scripts/check-fresh-cut-gate.sh

@@ -9,7 +9,9 @@
 #      naming the explicit fresh-cut verb in both invocation forms;
 #   3. fresh-cut REQUIRES quiescence (live OR unprovable both refuse) and archives
 #      the whole generation through one preflighted plan, opening an empty one;
-#   4. the archive is forensic only — no runtime reads it, no restore verb.
+#   4. the archive is forensic only — no runtime reads it, no restore verb;
+#   5. exit status reports what already moved: complete / no-move / usage /
+#      incomplete cut transition / complete-with-cleanup-residue.
 #
 # A–D drive the activation path. E pins the doctor and the writers to ONE
 # certification verdict on the three defects that PARSE (drift / duplicate /
@@ -20,6 +22,7 @@
 # from the record through the adapter probe the dispatch itself uses. I holds the
 # other half of the prescription: a store that cannot be READ is not a store with
 # defects, and the refusal must not send the operator at a cut that cannot help.
+# J executes the #54 exit contract, including the cut-complete cleanup-failure state.
 #
 # There is no frozen-fixture apparatus here: fresh-cut never rewrites a byte
 # (the archive is a rename), so the only byte claim is `archived == seeded`,
@@ -620,6 +623,165 @@ else
   bad "F8 the cut refused (or kept) a marker whose owner pid is provably absent" "$cut_out"
 fi
 
+# THE RESIDUE ROW (#53 A, measured on a second Linux host 2026-07-25). A marker
+# naming pid 1 is the one shape that is neither live, uncertain nor dead: init runs
+# for the whole boot and its start-key does not change while it does, so
+# classifyMarkerOwner answers `live` and THE ACTION THE REFUSAL PRESCRIBES cannot
+# change that — the operator quiesces every session, as told, and the cut refuses
+# again. Yet 0.12.8 refuses install on a pre-v3 store and names THIS cut as the only
+# repair, so that host was stuck until the file was removed by hand. The pure
+# classifier is right; the marker's claim is refuted by construction (no writer in
+# this tree can mint one any more — see the isPlausibleOwnerPid cells in
+# check-meta-receiver-marker / check-agy-sender-identity), so it is clearable
+# residue. The recorded key must be THIS host's real key for pid 1, or the marker
+# would classify `dead` on a key mismatch and the cell would pass while the bug
+# lived.
+init_key="$(node --experimental-strip-types -e '
+  import("'"$REPO"'/pi-extensions/lib/meta-session.ts").then((m) => process.stdout.write(m.processStartKey(1)));
+')"
+if [ -z "$init_key" ]; then
+  bad "F19 SETUP MISS: could not read this host's start key for pid 1 — the residue cells cannot run"
+else
+for surface in senders receivers; do
+  reset_world prevgen
+  case "$surface" in
+    senders)
+      mkdir -p "$PI_CODING_AGENT_DIR/meta-senders/claude-code"
+      ghost="$PI_CODING_AGENT_DIR/meta-senders/claude-code/1.json"
+      cat > "$ghost" <<JSON
+{
+  "backend": "claude-code",
+  "gardenId": "20260305T000000-dddd05",
+  "nativeSessionId": "prevgen-native-1",
+  "cwd": "/tmp/prevgen",
+  "ownerPid": 1,
+  "ownerStartKey": "$init_key",
+  "updatedAt": "2026-06-10T16:03:10.000Z"
+}
+JSON
+      ;;
+    receivers)
+      mkdir -p "$PI_CODING_AGENT_DIR/meta-receivers"
+      ghost="$PI_CODING_AGENT_DIR/meta-receivers/20260305T000000-dddd05.json"
+      cat > "$ghost" <<JSON
+{
+  "gardenId": "20260305T000000-dddd05",
+  "backend": "claude-code",
+  "nativeSessionId": "prevgen-native-1",
+  "ownerPid": 1,
+  "ownerStartKey": "$init_key",
+  "ownerKind": "claude-code-cli",
+  "armProvenance": "session-start",
+  "updatedAt": "2026-06-10T16:03:10.000Z"
+}
+JSON
+      ;;
+  esac
+  set +e
+  cut_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcr=$?
+  set -e
+  if [ "$rcr" = 0 ]; then
+    ok "F19 an init-owned $surface marker does NOT block the cut (refuted, not live)"
+  else
+    bad "F19 an init-owned $surface marker still deadlocks the cut — the upgrade path is closed" "$cut_out"
+  fi
+  if [ ! -e "$ghost" ]; then
+    ok "F20 the refuted $surface marker was cleared as residue"
+  else
+    bad "F20 the refuted $surface marker survived the cut"
+  fi
+  case "$cut_out" in
+    *refuted:*) ok "F21 the cut reports it as REFUTED, distinct from a proven-dead owner ($surface)" ;;
+    *) bad "F21 the cut disguised a proof of invalidity as a proof of death ($surface)" "$cut_out" ;;
+  esac
+done
+# The complement, and the reason F19 is a repair rather than a gate bypass: a marker
+# whose owner is genuinely live still refuses. C1 holds that for a real live pid; this
+# row proves the residue rule did not widen into "any marker the cut dislikes".
+if [ -z "$start_key" ]; then
+  bad "F22 SETUP MISS: no start key for this gate's own pid — the live-complement cell cannot run"
+else
+  reset_world prevgen
+  mkdir -p "$PI_CODING_AGENT_DIR/meta-senders/claude-code"
+  cat > "$PI_CODING_AGENT_DIR/meta-senders/claude-code/$$.json" <<JSON
+{
+  "backend": "claude-code",
+  "gardenId": "20260305T000000-dddd05",
+  "ownerPid": $$,
+  "ownerStartKey": "$start_key",
+  "updatedAt": "2026-03-05T00:00:00.000Z"
+}
+JSON
+  store_before="$(store_bytes)"
+  set +e
+  cut_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcl=$?
+  set -e
+  if [ "$rcl" != 0 ] && [ "$store_before" = "$(store_bytes)" ]; then
+    ok "F22 a LIVE owner still blocks the cut (the residue rule did not widen)"
+  else
+    bad "F22 the residue rule widened into a live owner — a running citizen would lose its address" "$cut_out"
+  fi
+  case "$cut_out" in
+    *"LIVE sender marker"*) ok "F22b the live owner is still reported LIVE, never refuted away" ;;
+    *) bad "F22b a live owner stopped being reported as live" "$cut_out" ;;
+  esac
+fi
+fi
+
+# POST-CUT CLEANUP IS REPORTED, NOT LAUNDERED. The sweep runs AFTER the archive has
+# moved, so a failure there must not throw away the story of what DID happen — and it
+# must not be swallowed either, because this command's own output claims the residue
+# was `cleared`. A bare `catch {}` around the unlink read EACCES/EROFS/an immutable
+# attribute as "raced away" (cross-review 2026-07-25, on the very loop #53 A added).
+# ENOENT alone is already-gone; everything else is named and turns the exit nonzero
+# while the success lines stay.
+if [ -z "$init_key" ]; then
+  bad "F23 SETUP MISS: no start key for pid 1 — the cleanup-failure cell cannot seed its marker"
+elif [ "$(id -u)" = 0 ]; then
+  ok "F23 vacuous under uid 0: permission bits cannot make a directory unwritable for root, so the class this row drives cannot occur here"
+else
+  reset_world prevgen
+  mkdir -p "$PI_CODING_AGENT_DIR/meta-senders/claude-code"
+  stuck_dir="$PI_CODING_AGENT_DIR/meta-senders/claude-code"
+  stuck="$stuck_dir/1.json"
+  cat > "$stuck" <<JSON
+{
+  "backend": "claude-code",
+  "gardenId": "20260305T000000-dddd05",
+  "ownerPid": 1,
+  "ownerStartKey": "$init_key",
+  "updatedAt": "2026-06-10T16:03:10.000Z"
+}
+JSON
+  # r-x: the walk can still readdir + lstat + read the marker, but the unlink needs
+  # WRITE on the parent and fails EACCES. Restored right after, or the sandbox trap
+  # (and reset_world) could not clean up.
+  chmod a-w "$stuck_dir"
+  set +e
+  cut_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcc=$?
+  set -e
+  chmod u+w "$stuck_dir"
+  if [ "$rcc" != 0 ]; then
+    ok "F23 an unremovable marker makes the cut exit NONZERO (a partial sweep never reads as a clean one)"
+  else
+    bad "F23 the cut reported success while a file it claims to have cleared is still there" "$cut_out"
+  fi
+  case "$cut_out" in
+    *"FAIL post-cut cleanup"*) ok "F23b the failure is NAMED as post-cut cleanup, with the file and the errno" ;;
+    *) bad "F23b the unlink failure was laundered into 'raced away'" "$cut_out" ;;
+  esac
+  if [ -n "$(find "$SANDBOX" -maxdepth 1 -type d -name 'store.archive-*')" ]; then
+    ok "F23c the archive still happened and is still reported — this is NOT a half-cut"
+  else
+    bad "F23c a cleanup failure threw away the generation move" "$cut_out"
+  fi
+  case "$cut_out" in
+    *"not a half-cut"*) ok "F23d the refusal tells the operator the store is safe and what to re-run" ;;
+    *) bad "F23d the failure left the operator unable to tell a cleanup miss from a half-cut" "$cut_out" ;;
+  esac
+  rm -f "$stuck"
+fi
+
 # WIRING: the cut must ASK for the verdict, never compute it from a start-key. An
 # inline `processStartKey(...) === recorded` is precisely how "" (UNKNOWN) was read
 # as "dead" before this review — a fail-open path that must not come back.
@@ -825,10 +987,10 @@ done
 set +e
 out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rcg=$?
 set -e
-if [ "$rcg" != 0 ]; then
-  ok "G1 an occupied archive destination REFUSES the cut"
+if [ "$rcg" = 1 ]; then
+  ok "G1 an occupied archive destination REFUSES the cut with the NO-MOVE status (exit 1)"
 else
-  bad "G1 the cut proceeded into an occupied destination" "$out"
+  bad "G1 the cut proceeded into an occupied destination, or refused with the wrong status (rc=$rcg, want 1)" "$out"
 fi
 if [ -z "$(find "$SANDBOX" -maxdepth 1 -type d -name 'store.archive-*')" ] && [ "$store_before" = "$(store_bytes)" ]; then
   ok "G2 the collision refusal moved NOTHING — the store never left its place (no half-cut generation)"
@@ -1187,6 +1349,145 @@ case "$out" in
 esac
 rm -rf "$SANDBOX/nm"
 
+# ── J. the EXIT CONTRACT (#54): the status says WHAT ALREADY MOVED ───────────
+# Three world-states used to share one `1`, so the documented `fresh-cut && setup`
+# chain stopped identically on a refusal that changed nothing and on a cut that had
+# already unblocked the install. These cells pin each reachable code to the state it
+# names — the point is not that failures are nonzero, it is that a caller can BRANCH.
+echo "[check-fresh-cut-gate] J. exit contract"
+
+# J1/J2 — the two states that need no host at all.
+set +e
+help_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" --help 2>&1)"; rc=$?
+set -e
+if [ "$rc" = 0 ]; then ok "J1 --help exits 0"; else bad "J1 --help exited $rc" "$help_out"; fi
+case "$help_out" in
+  *"EXIT CONTRACT"*) ok "J1b --help PRINTS the contract (an operator can read it where they hit it)" ;;
+  *) bad "J1b --help never printed the exit contract" "$help_out" ;;
+esac
+set +e
+bad_out="$(node --experimental-strip-types "${FRESH_CUT[@]}" --wat 2>&1)"; rc=$?
+set -e
+if [ "$rc" = 2 ]; then ok "J2 an unknown argument is USAGE (exit 2), never a store verdict"; else bad "J2 unknown arg exited $rc, want 2" "$bad_out"; fi
+
+# J3 — the success state, distinct from every failure below.
+reset_world prevgen
+set +e
+out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rc=$?
+set -e
+if [ "$rc" = 0 ]; then ok "J3 a complete cut exits 0"; else bad "J3 a complete cut exited $rc" "$out"; fi
+
+# J4 — quiesce refusal is NO-MOVE (1), the same code as the collision refusal in G1,
+# because they are the same world-state: the host is exactly what it was.
+reset_world prevgen
+start_key="$(node --experimental-strip-types -e '
+  import("'"$REPO"'/pi-extensions/lib/meta-session.ts").then((m) => process.stdout.write(m.processStartKey(Number(process.argv[1]))));
+' "$$")"
+if [ -z "$start_key" ]; then
+  bad "J4 could not compute a start key for the gate's own pid"
+else
+  mkdir -p "$PI_CODING_AGENT_DIR/meta-senders/claude-code"
+  cat > "$PI_CODING_AGENT_DIR/meta-senders/claude-code/$$.json" <<JSON
+{
+  "backend": "claude-code",
+  "gardenId": "20260305T000000-dddd05",
+  "nativeSessionId": "prevgen-native-1",
+  "cwd": "/tmp/prevgen",
+  "ownerPid": $$,
+  "ownerStartKey": "$start_key",
+  "updatedAt": "2026-03-05T00:00:00.000Z"
+}
+JSON
+  set +e
+  out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rc=$?
+  set -e
+  if [ "$rc" = 1 ]; then ok "J4 a quiesce refusal is NO-MOVE (exit 1) — same code as any other untouched host"; else bad "J4 quiesce refusal exited $rc, want 1" "$out"; fi
+  rm -f "$PI_CODING_AGENT_DIR/meta-senders/claude-code/$$.json"
+fi
+
+# J5 — THE state #54 was opened for: the cut IS done and the cleanup is not. Staged by
+# taking write permission off the socket surface AFTER a dead socket is parked in it:
+# readdir/lstat/probe all still work (r-x), the unlink does not. Root bypasses DAC, so
+# it cannot prove anything here and says so instead of passing vacuously.
+if [ "$(id -u)" = 0 ]; then
+  echo "  skip  J5 post-cut cleanup failure needs a non-root uid (DAC is what stages it)"
+else
+  reset_world prevgen
+  mkdir -p "$ENTWURF_DIR"
+  node -e '
+    const net = require("node:net");
+    net.createServer().listen(process.argv[1], () => process.exit(0));
+  ' "$ENTWURF_DIR/20260305T000000-dddd05.sock"
+  if [ ! -S "$ENTWURF_DIR/20260305T000000-dddd05.sock" ]; then
+    bad "J5 could not stage a dead socket — the cleanup-failure cells cannot run"
+  else
+    chmod 0500 "$ENTWURF_DIR"
+    set +e
+    out="$(node --experimental-strip-types "${FRESH_CUT[@]}" 2>&1)"; rc=$?
+    set -e
+    chmod 0700 "$ENTWURF_DIR"
+    if [ "$rc" = 4 ]; then
+      ok "J5 a cut whose post-cut cleanup failed exits 4 — NOT the 1 that means nothing moved"
+    else
+      bad "J5 post-cut cleanup failure exited $rc, want 4" "$out"
+    fi
+    if [ -n "$(find "$SANDBOX" -maxdepth 1 -type d -name 'store.archive-*')" ]; then
+      ok "J5b …and the generation really WAS archived (the 4 is a claim about a cut that happened)"
+    else
+      bad "J5b exit 4 was reported although nothing was archived" "$out"
+    fi
+    if [ -d "$ENTWURF_META_SESSIONS_DIR" ] && [ -z "$(find "$ENTWURF_META_SESSIONS_DIR" -name '*.meta.json' 2>/dev/null)" ]; then
+      ok "J5c …and the fresh generation is open and empty"
+    else
+      bad "J5c the fresh generation was not opened" "$out"
+    fi
+    case "$out" in
+      *"FAIL post-cut cleanup"*) ok "J5d the report still names every file it could not remove" ;;
+      *) bad "J5d the cleanup failure was silent" "$out" ;;
+    esac
+    # The whole point of distinguishing this state: the operator may go on.
+    set +e
+    out2="$("$REPO/run.sh" install "$PROJ" 2>&1)"; rc2=$?
+    set -e
+    if [ "$rc2" = 0 ]; then
+      ok "J5e install PASSES after an exit-4 cut — the store no longer blocks it, which is what 4 means"
+    else
+      bad "J5e install still refused after a completed cut (then 4 is describing the wrong state)" "$out2"
+    fi
+    rm -f "$ENTWURF_DIR/20260305T000000-dddd05.sock"
+  fi
+fi
+
+# J6 — the INCOMPLETE-TRANSITION verdict, EXECUTED. A real post-move failure needs a
+# rename/open step to fail after another move succeeded, and every unprivileged way to stage that is closed by the plan
+# preflight (collision, unreadable surface, non-writable parent) — the remaining causes
+# (immutable attr, read-only mount, LSM) all need privileges this gate must not take. So
+# the branch calls one exported decision function and the gate drives THAT, rather than
+# asserting the state by grep and calling it proven.
+half="$(node --experimental-strip-types -e '
+  import("'"$REPO"'/pi-extensions/lib/meta-session.ts").then((m) => {
+    process.stdout.write([m.midCutExit(0), m.midCutExit(1), m.midCutExit(2), m.FRESH_CUT_EXIT.HALF_CUT].join(","));
+  });
+')"
+if [ "$half" = "1,3,3,3" ]; then
+  ok "J6 midCutExit: a first-rename failure is NO-MOVE (1), any post-move failure is CUT-TRANSITION-INCOMPLETE (3)"
+else
+  bad "J6 midCutExit verdicts drifted (got '$half', want '1,3,3,3')"
+fi
+# …and the branch really routes through it, so the executed verdict is the shipped one.
+if grep -q 'return midCutExit(archived.length);' "$REPO/scripts/meta-bridge-fresh-cut.ts"; then
+  ok "J6b the mid-cut branch returns midCutExit(...), not a hand-written literal"
+else
+  bad "J6b the mid-cut branch no longer routes through midCutExit — J6 would be vacuous"
+fi
+# The crash path is the one place a wrong answer is invisible: it reports a status for a
+# state nobody inspected, so it must ask the same function rather than assume a no-op.
+if grep -q 'process.exit(midCutExit(archivedSoFar));' "$REPO/scripts/meta-bridge-fresh-cut.ts"; then
+  ok "J6c the top-level crash handler answers with midCutExit too (never a flat 'nothing moved')"
+else
+  bad "J6c the crash handler exits a fixed code — a post-rename crash would claim nothing moved"
+fi
+
 echo
 echo "[check-fresh-cut-gate] passed=$PASSED failed=$FAILED"
 [ "$FAILED" = 0 ] || exit 1