@ordewell/core 0.11.3 → 0.12.1

package/dist/testing.d.mts

@@ -1,5 +1,5 @@
-import { R as IRunnerSession, ar as QueuedTaskMessage, b6 as StructuredTurnEnd, b5 as StructuredEvent, bc as TaskCompleteArgs, t as CheckpointAnswer, aX as ScriptExit, be as TaskMessageFrom, aE as RunnerCommand, S as InvokedCommand, k as ApprovalDecision, O as IConfig, P as IFileSystem } from './IRunner-ihalYfTo.mjs';
-import { y as IntegrationDisposal, aA as RunnerSessionCost, x as IWorktreeIsolation, J as IsolationAvailability, R as IsolationMergeResult, b4 as TreeSnapshot, aF as SetupFailure, U as IsolationPruneResult, V as IsolationRemoval, S as IsolationOutcome, ao as RepairEvidence, X as IsolationRun, aS as Task, ah as PrepareIntent, ai as PreparedTask, q as HandoffCommit, K as IsolationHandoff } from './Task-BL4Idm9r.mjs';
+import { J as EventStore, bP as TreeEvent, bQ as TreeFact, aj as NodePath, K as ExecutionBackend, a4 as LeaseRequest, a5 as LeaseSpec, S as Guarantee, a3 as LeaseRepo, b5 as RunnerPlacement, a2 as LeaseRecord, T as GuaranteeReport, aR as ReservedLease, _ as IRunnerSession, aK as QueuedTaskMessage, bs as StructuredTurnEnd, br as StructuredEvent, by as TaskCompleteArgs, x as CheckpointAnswer, be as ScriptExit, bA as TaskMessageFrom, aX as RunnerCommand, $ as InvokedCommand, k as ApprovalDecision, V as IConfig, W as IFileSystem } from './eventStore-CcB8yELZ.mjs';
+import { U as IntegrationDisposal, b4 as RunnerSessionCost, T as IWorktreeIsolation, W as IsolationAvailability, a2 as IsolationMergeResult, bE as TreeSnapshot, bb as SetupFailure, a5 as IsolationPruneResult, a6 as IsolationRemoval, a3 as IsolationOutcome, a9 as IsolationRevertResult, a$ as RevertCommand, aP as RepairEvidence, ab as IsolationRun, bp as Task, aH as PrepareIntent, aI as PreparedTask, J as HandoffCommit, ai as LandedWork, b0 as RevertWatch, X as IsolationHandoff } from './Task-CxGgN6I0.mjs';
 import 'child_process';
 import 'zod/v4';
 
@@ -107,6 +107,82 @@ declare class FakeRunnerSession implements IRunnerSession {
     emitTurnEnd(reason: StructuredTurnEnd): void;
     private deliver;
 }
+/** An in-memory {@link EventStore}. `failing` makes the next appends reject, as a full disk would. */
+declare class FakeEventStore implements EventStore {
+    readonly events: TreeEvent[];
+    failing: Error | null;
+    private closed;
+    append(events: readonly TreeFact[]): Promise<void>;
+    read(after: number, path?: NodePath): AsyncIterable<TreeEvent>;
+    close(): Promise<void>;
+}
+/**
+ * An in-memory {@link ExecutionBackend}, as {@link FakeWorktreeIsolation} fakes
+ * git: a count of slots and nothing else. `requests`, `opened` and `released`
+ * log what the seam was asked; `holdOpen` keeps an open waiting, `openError`
+ * fails one, `refuse` turns a role down, `provenGuarantees` is what its probe
+ * proves, and `freed` is what a release does, a pool's tick.
+ */
+declare class FakeExecutionBackend implements ExecutionBackend {
+    /** Slots; a planner, a merge and a delegated task take none, as a flat run's do not. */
+    limit: number;
+    held: number;
+    requests: LeaseRequest[];
+    opened: {
+        request: LeaseRequest;
+        spec: LeaseSpec;
+    }[];
+    released: {
+        id: string;
+        reason: string;
+    }[];
+    letGoCalls: {
+        taskId: string;
+        keep: boolean;
+        reason: string;
+    }[];
+    openError: Error | null;
+    refuse: {
+        role: LeaseRequest['role'];
+        reason: string;
+    } | null;
+    provenGuarantees: readonly Guarantee[];
+    /** What exportResult reports of a session, in place of what it is told. */
+    sessionState: {
+        nativeSessionId: string;
+    } | null;
+    /** The repositories an open says its worktree holds. */
+    repos: readonly LeaseRepo[];
+    /** Where an open puts its runner, for a lease that does not run it on this host. */
+    placement: RunnerPlacement | null;
+    /** Brings a task's work back; absent, it is where the attempt ran. */
+    collect?: (taskId: string) => Promise<void>;
+    /** Waits on what it has running, as a closing Session does; absent, nothing outlives a runner. */
+    settle?: () => Promise<void>;
+    /** The workspace root's repositories; absent, none is known. */
+    checkoutRepos?: () => readonly LeaseRepo[];
+    records: LeaseRecord[];
+    freed: () => void;
+    private openHold;
+    private nextId;
+    /** Make the next open wait until the returned function is called. */
+    holdOpen(): () => void;
+    probe(): Promise<GuaranteeReport>;
+    private takesSlot;
+    refusal(request: LeaseRequest): string | null;
+    reserve(request: LeaseRequest): {
+        lease: ReservedLease;
+    } | {
+        refused: string;
+    };
+    private open;
+    letGo(taskId: string, { keep, landing, reason }: {
+        keep: boolean;
+        landing?: Promise<unknown> | null;
+        reason: string;
+    }): Promise<void>;
+    list(): Promise<readonly LeaseRecord[]>;
+}
 type FakeIsolationCall = {
     op: 'isActive';
     workspaceRoot: string;
@@ -131,6 +207,9 @@ type FakeIsolationCall = {
 } | {
     op: 'discard';
     integration: IntegrationDisposal;
+} | {
+    op: 'readLanded' | 'revert';
+    taskIds: readonly string[];
 };
 /**
  * An in-memory {@link IWorktreeIsolation} for scheduling tests: no git, no
@@ -144,6 +223,8 @@ type FakeIsolationCall = {
  */
 declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     availability: IsolationAvailability;
+    /** What `gitShortfall` answers. */
+    gitShortfallText: string | null;
     /** The repo paths `startRun` groups: a group of one at `.` unless set. */
     repos: string[];
     /** Per task id, the repos it changes; every repo of the group when not listed. */
@@ -179,23 +260,33 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     removal: IsolationRemoval;
     /** Per task id; a task not listed integrates as `merged`. */
     outcomes: Map<string, IsolationOutcome>;
+    /** What `revert` stops with; a revert that goes through when null. */
+    revertStop: Exclude<IsolationRevertResult, {
+        outcome: 'reverted';
+    }> | null;
+    /** What `readLanded` finds of a task's work in the user's branch, by task id. */
+    inBranch: Map<string, RevertCommand[]>;
     /** Per task id, what `verifyRepair` finds; a task not listed passes. */
     repairEvidence: Map<string, RepairEvidence>;
     calls: FakeIsolationCall[];
     private holds;
     private verifyHolds;
+    private revertHold;
     private runCount;
     private log;
     /** Task ids in the order `op` was called for them. */
     taskIdsFor(op: 'prepare' | 'reopen' | 'verifyRepair' | 'integrate' | 'release'): string[];
     /** Make `integrate` for this task wait until the returned function is called. */
     holdIntegration(taskId: string): () => void;
+    /** Make the next `revert` wait, past its `refusal`, until the returned function is called. */
+    holdRevert(): () => void;
     /** Make `verifyRepair` for this task wait until the returned function is called. */
     holdVerification(taskId: string): () => void;
+    gitShortfall(): Promise<string | null>;
     isActive(workspaceRoot: string): Promise<IsolationAvailability>;
     /** Like git: once the tracked changes are stashed, the tree is no longer dirty. */
     stash(workspaceRoot: string): Promise<void>;
-    startRun(workspaceRoot: string): Promise<IsolationRun>;
+    startRun(workspaceRoot: string, stateRoot?: string): Promise<IsolationRun>;
     prepare(task: Task, run: IsolationRun, _intent?: PrepareIntent, opts?: {
         readOnly?: boolean;
     }): Promise<PreparedTask>;
@@ -204,6 +295,10 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     verifyRepair(task: Task, _run: IsolationRun): Promise<RepairEvidence>;
     /** Like git: the landing is recorded and persisted before the (held) merge, and cleared once it settles. */
     integrate(task: Task, run: IsolationRun, persist?: () => void, commit?: HandoffCommit): Promise<IsolationOutcome>;
+    /** Newest landing first, read as the plan's highest order: scheduling tests land in plan order. */
+    readLanded(run: IsolationRun, taskIds: readonly string[]): Promise<LandedWork>;
+    /** Like git: the turn, then the judgement, then the records go in one step with the tasks back. */
+    revert(run: IsolationRun, taskIds: readonly string[], watch: RevertWatch): Promise<IsolationRevertResult>;
     release(run: IsolationRun, taskId: string, opts: {
         keep: boolean;
     }): Promise<IsolationRemoval>;
@@ -221,4 +316,4 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     sweep(): Promise<void>;
 }
 
-export { type FakeIsolationCall, FakeRunnerSession, FakeWorktreeIsolation, fakeConfig, fakeFileSystem, flushMicrotasks };
+export { FakeEventStore, FakeExecutionBackend, type FakeIsolationCall, FakeRunnerSession, FakeWorktreeIsolation, fakeConfig, fakeFileSystem, flushMicrotasks };

package/dist/testing.d.ts

@@ -1,5 +1,5 @@
-import { R as IRunnerSession, ar as QueuedTaskMessage, b6 as StructuredTurnEnd, b5 as StructuredEvent, bc as TaskCompleteArgs, t as CheckpointAnswer, aX as ScriptExit, be as TaskMessageFrom, aE as RunnerCommand, S as InvokedCommand, k as ApprovalDecision, O as IConfig, P as IFileSystem } from './IRunner-DOMtDTVt.js';
-import { y as IntegrationDisposal, aA as RunnerSessionCost, x as IWorktreeIsolation, J as IsolationAvailability, R as IsolationMergeResult, b4 as TreeSnapshot, aF as SetupFailure, U as IsolationPruneResult, V as IsolationRemoval, S as IsolationOutcome, ao as RepairEvidence, X as IsolationRun, aS as Task, ah as PrepareIntent, ai as PreparedTask, q as HandoffCommit, K as IsolationHandoff } from './Task-BL4Idm9r.js';
+import { J as EventStore, bP as TreeEvent, bQ as TreeFact, aj as NodePath, K as ExecutionBackend, a4 as LeaseRequest, a5 as LeaseSpec, S as Guarantee, a3 as LeaseRepo, b5 as RunnerPlacement, a2 as LeaseRecord, T as GuaranteeReport, aR as ReservedLease, _ as IRunnerSession, aK as QueuedTaskMessage, bs as StructuredTurnEnd, br as StructuredEvent, by as TaskCompleteArgs, x as CheckpointAnswer, be as ScriptExit, bA as TaskMessageFrom, aX as RunnerCommand, $ as InvokedCommand, k as ApprovalDecision, V as IConfig, W as IFileSystem } from './eventStore-CTCSKS9E.js';
+import { U as IntegrationDisposal, b4 as RunnerSessionCost, T as IWorktreeIsolation, W as IsolationAvailability, a2 as IsolationMergeResult, bE as TreeSnapshot, bb as SetupFailure, a5 as IsolationPruneResult, a6 as IsolationRemoval, a3 as IsolationOutcome, a9 as IsolationRevertResult, a$ as RevertCommand, aP as RepairEvidence, ab as IsolationRun, bp as Task, aH as PrepareIntent, aI as PreparedTask, J as HandoffCommit, ai as LandedWork, b0 as RevertWatch, X as IsolationHandoff } from './Task-CxGgN6I0.js';
 import 'child_process';
 import 'zod/v4';
 
@@ -107,6 +107,82 @@ declare class FakeRunnerSession implements IRunnerSession {
     emitTurnEnd(reason: StructuredTurnEnd): void;
     private deliver;
 }
+/** An in-memory {@link EventStore}. `failing` makes the next appends reject, as a full disk would. */
+declare class FakeEventStore implements EventStore {
+    readonly events: TreeEvent[];
+    failing: Error | null;
+    private closed;
+    append(events: readonly TreeFact[]): Promise<void>;
+    read(after: number, path?: NodePath): AsyncIterable<TreeEvent>;
+    close(): Promise<void>;
+}
+/**
+ * An in-memory {@link ExecutionBackend}, as {@link FakeWorktreeIsolation} fakes
+ * git: a count of slots and nothing else. `requests`, `opened` and `released`
+ * log what the seam was asked; `holdOpen` keeps an open waiting, `openError`
+ * fails one, `refuse` turns a role down, `provenGuarantees` is what its probe
+ * proves, and `freed` is what a release does, a pool's tick.
+ */
+declare class FakeExecutionBackend implements ExecutionBackend {
+    /** Slots; a planner, a merge and a delegated task take none, as a flat run's do not. */
+    limit: number;
+    held: number;
+    requests: LeaseRequest[];
+    opened: {
+        request: LeaseRequest;
+        spec: LeaseSpec;
+    }[];
+    released: {
+        id: string;
+        reason: string;
+    }[];
+    letGoCalls: {
+        taskId: string;
+        keep: boolean;
+        reason: string;
+    }[];
+    openError: Error | null;
+    refuse: {
+        role: LeaseRequest['role'];
+        reason: string;
+    } | null;
+    provenGuarantees: readonly Guarantee[];
+    /** What exportResult reports of a session, in place of what it is told. */
+    sessionState: {
+        nativeSessionId: string;
+    } | null;
+    /** The repositories an open says its worktree holds. */
+    repos: readonly LeaseRepo[];
+    /** Where an open puts its runner, for a lease that does not run it on this host. */
+    placement: RunnerPlacement | null;
+    /** Brings a task's work back; absent, it is where the attempt ran. */
+    collect?: (taskId: string) => Promise<void>;
+    /** Waits on what it has running, as a closing Session does; absent, nothing outlives a runner. */
+    settle?: () => Promise<void>;
+    /** The workspace root's repositories; absent, none is known. */
+    checkoutRepos?: () => readonly LeaseRepo[];
+    records: LeaseRecord[];
+    freed: () => void;
+    private openHold;
+    private nextId;
+    /** Make the next open wait until the returned function is called. */
+    holdOpen(): () => void;
+    probe(): Promise<GuaranteeReport>;
+    private takesSlot;
+    refusal(request: LeaseRequest): string | null;
+    reserve(request: LeaseRequest): {
+        lease: ReservedLease;
+    } | {
+        refused: string;
+    };
+    private open;
+    letGo(taskId: string, { keep, landing, reason }: {
+        keep: boolean;
+        landing?: Promise<unknown> | null;
+        reason: string;
+    }): Promise<void>;
+    list(): Promise<readonly LeaseRecord[]>;
+}
 type FakeIsolationCall = {
     op: 'isActive';
     workspaceRoot: string;
@@ -131,6 +207,9 @@ type FakeIsolationCall = {
 } | {
     op: 'discard';
     integration: IntegrationDisposal;
+} | {
+    op: 'readLanded' | 'revert';
+    taskIds: readonly string[];
 };
 /**
  * An in-memory {@link IWorktreeIsolation} for scheduling tests: no git, no
@@ -144,6 +223,8 @@ type FakeIsolationCall = {
  */
 declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     availability: IsolationAvailability;
+    /** What `gitShortfall` answers. */
+    gitShortfallText: string | null;
     /** The repo paths `startRun` groups: a group of one at `.` unless set. */
     repos: string[];
     /** Per task id, the repos it changes; every repo of the group when not listed. */
@@ -179,23 +260,33 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     removal: IsolationRemoval;
     /** Per task id; a task not listed integrates as `merged`. */
     outcomes: Map<string, IsolationOutcome>;
+    /** What `revert` stops with; a revert that goes through when null. */
+    revertStop: Exclude<IsolationRevertResult, {
+        outcome: 'reverted';
+    }> | null;
+    /** What `readLanded` finds of a task's work in the user's branch, by task id. */
+    inBranch: Map<string, RevertCommand[]>;
     /** Per task id, what `verifyRepair` finds; a task not listed passes. */
     repairEvidence: Map<string, RepairEvidence>;
     calls: FakeIsolationCall[];
     private holds;
     private verifyHolds;
+    private revertHold;
     private runCount;
     private log;
     /** Task ids in the order `op` was called for them. */
     taskIdsFor(op: 'prepare' | 'reopen' | 'verifyRepair' | 'integrate' | 'release'): string[];
     /** Make `integrate` for this task wait until the returned function is called. */
     holdIntegration(taskId: string): () => void;
+    /** Make the next `revert` wait, past its `refusal`, until the returned function is called. */
+    holdRevert(): () => void;
     /** Make `verifyRepair` for this task wait until the returned function is called. */
     holdVerification(taskId: string): () => void;
+    gitShortfall(): Promise<string | null>;
     isActive(workspaceRoot: string): Promise<IsolationAvailability>;
     /** Like git: once the tracked changes are stashed, the tree is no longer dirty. */
     stash(workspaceRoot: string): Promise<void>;
-    startRun(workspaceRoot: string): Promise<IsolationRun>;
+    startRun(workspaceRoot: string, stateRoot?: string): Promise<IsolationRun>;
     prepare(task: Task, run: IsolationRun, _intent?: PrepareIntent, opts?: {
         readOnly?: boolean;
     }): Promise<PreparedTask>;
@@ -204,6 +295,10 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     verifyRepair(task: Task, _run: IsolationRun): Promise<RepairEvidence>;
     /** Like git: the landing is recorded and persisted before the (held) merge, and cleared once it settles. */
     integrate(task: Task, run: IsolationRun, persist?: () => void, commit?: HandoffCommit): Promise<IsolationOutcome>;
+    /** Newest landing first, read as the plan's highest order: scheduling tests land in plan order. */
+    readLanded(run: IsolationRun, taskIds: readonly string[]): Promise<LandedWork>;
+    /** Like git: the turn, then the judgement, then the records go in one step with the tasks back. */
+    revert(run: IsolationRun, taskIds: readonly string[], watch: RevertWatch): Promise<IsolationRevertResult>;
     release(run: IsolationRun, taskId: string, opts: {
         keep: boolean;
     }): Promise<IsolationRemoval>;
@@ -221,4 +316,4 @@ declare class FakeWorktreeIsolation implements IWorktreeIsolation {
     sweep(): Promise<void>;
 }
 
-export { type FakeIsolationCall, FakeRunnerSession, FakeWorktreeIsolation, fakeConfig, fakeFileSystem, flushMicrotasks };
+export { FakeEventStore, FakeExecutionBackend, type FakeIsolationCall, FakeRunnerSession, FakeWorktreeIsolation, fakeConfig, fakeFileSystem, flushMicrotasks };

package/dist/testing.js

@@ -20,6 +20,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/testing.ts
 var testing_exports = {};
 __export(testing_exports, {
+  FakeEventStore: () => FakeEventStore,
+  FakeExecutionBackend: () => FakeExecutionBackend,
   FakeRunnerSession: () => FakeRunnerSession,
   FakeWorktreeIsolation: () => FakeWorktreeIsolation,
   fakeConfig: () => fakeConfig,
@@ -45,6 +47,9 @@ function integrationBranchFor(runId) {
 function noRemoval() {
   return { preserved: [], refused: [] };
 }
+function landedInRepo(run, record, repoPath) {
+  return !!record.repos[repoPath]?.changed || run.landings?.[record.taskId]?.[repoPath] !== void 0;
+}
 function handoffOf(run) {
   const merged = Object.values(run.tasks).filter((r) => r.status === "merged" && !r.inHead).sort((a, b) => a.order - b.order);
   const entry = (r) => ({
@@ -60,7 +65,7 @@ function handoffOf(run) {
       baseRef: repo.baseRef,
       ...repo.baseBranch ? { baseBranch: repo.baseBranch } : {},
       ...repo.startedDetached ? { startedDetached: true } : {},
-      landed: merged.filter((r) => r.repos[repo.path]?.changed).map(entry)
+      landed: merged.filter((r) => landedInRepo(run, r, repo.path)).map(entry)
     })),
     landed: merged.map(entry)
   };
@@ -70,6 +75,26 @@ function handoffOf(run) {
 var SKILL_NAME = new RegExp(`^${SKILL_NAME_PATTERN}$`);
 var DEFAULT_RUNNERS = ["claude-code"];
 
+// src/services/executionLease.ts
+var GUARANTEES = ["fs.hostHidden", "fs.writeScope", "net.allowlist", "net.noMetadata", "cred.unreadable", "kernel.separate", "limits.memory"];
+var LeaseGuaranteeError = class extends Error {
+  constructor(unproven) {
+    super(`This session requires ${unproven.join(", ")}, which its execution backend could not prove.`);
+    this.unproven = unproven;
+    this.name = "LeaseGuaranteeError";
+  }
+  unproven;
+};
+function refuseUnproven(required, report) {
+  const unproven = required.filter((guarantee) => !report[guarantee].proven);
+  if (unproven.length > 0) throw new LeaseGuaranteeError(unproven);
+}
+
+// src/models/TreeEvent.ts
+function isWithin(node, ancestor) {
+  return node === ancestor || node.startsWith(`${ancestor}/`);
+}
+
 // src/testing.ts
 async function flushMicrotasks(rounds = 20) {
   for (let i = 0; i < rounds; i += 1) await Promise.resolve();
@@ -107,6 +132,7 @@ function fakeConfig(overrides = {}) {
     // Off so a test that is not about the allowlist sees every prompt it raises.
     approvalDefaults: false,
     effectAllowlist: [],
+    notifyCommand: [],
     webReadBudget: 40,
     plannerNativeShell: false,
     setProviderModelLists: () => {
@@ -340,8 +366,121 @@ var FakeRunnerSession = class {
     this.emitEvent({ type: "turn_start", text, ...from ? { from } : {} });
   }
 };
+var FakeEventStore = class {
+  events = [];
+  failing = null;
+  closed = false;
+  async append(events) {
+    if (this.closed) throw new Error("This event log is closed.");
+    if (this.failing) throw this.failing;
+    for (const event of events) this.events.push({ ...event, seq: this.events.length + 1 });
+  }
+  async *read(after, path) {
+    for (const event of [...this.events]) {
+      if (event.seq > after && (path === void 0 || isWithin(event.node, path))) yield event;
+    }
+  }
+  async close() {
+    this.closed = true;
+  }
+};
+var FakeExecutionBackend = class {
+  /** Slots; a planner, a merge and a delegated task take none, as a flat run's do not. */
+  limit = Infinity;
+  held = 0;
+  requests = [];
+  opened = [];
+  released = [];
+  letGoCalls = [];
+  openError = null;
+  refuse = null;
+  provenGuarantees = [];
+  /** What exportResult reports of a session, in place of what it is told. */
+  sessionState = null;
+  /** The repositories an open says its worktree holds. */
+  repos = [];
+  /** Where an open puts its runner, for a lease that does not run it on this host. */
+  placement = null;
+  /** Brings a task's work back; absent, it is where the attempt ran. */
+  collect;
+  /** Waits on what it has running, as a closing Session does; absent, nothing outlives a runner. */
+  settle;
+  /** The workspace root's repositories; absent, none is known. */
+  checkoutRepos;
+  records = [];
+  freed = () => void 0;
+  openHold = null;
+  nextId = 0;
+  /** Make the next open wait until the returned function is called. */
+  holdOpen() {
+    let open;
+    this.openHold = new Promise((resolve) => {
+      open = resolve;
+    });
+    return open;
+  }
+  async probe() {
+    const at = (/* @__PURE__ */ new Date(0)).toISOString();
+    return Object.fromEntries(GUARANTEES.map((g) => [g, { proven: this.provenGuarantees.includes(g), by: "fake probe", at }]));
+  }
+  takesSlot(request) {
+    return request.role === "task" || request.role === "script";
+  }
+  refusal(request) {
+    if (this.refuse?.role === request.role) return this.refuse.reason;
+    return this.takesSlot(request) && this.held >= this.limit ? `no slot for ${request.node.taskId ?? request.role}` : null;
+  }
+  reserve(request) {
+    this.requests.push(request);
+    const refused = this.refusal(request);
+    if (refused) return { refused };
+    const holdsSlot = this.takesSlot(request);
+    if (holdsSlot) this.held += 1;
+    const id = `lease-${++this.nextId}`;
+    let live = true;
+    return {
+      lease: {
+        id,
+        holdsSlot,
+        open: (spec) => this.open(request, spec),
+        release: (reason) => {
+          if (!live) return;
+          live = false;
+          this.released.push({ id, reason });
+          if (holdsSlot) this.held -= 1;
+          this.freed();
+        }
+      }
+    };
+  }
+  async open(request, spec) {
+    this.opened.push({ request, spec });
+    const guarantees = await this.probe();
+    refuseUnproven(spec.required, guarantees);
+    const hold = this.openHold;
+    this.openHold = null;
+    await hold;
+    if (this.openError) throw this.openError;
+    const worktree = spec.workspace.kind === "worktree";
+    return {
+      workspace: { cwd: worktree ? `/fake-lease/${spec.task?.id}` : "/repo", worktree, ...this.repos.length ? { repos: this.repos } : {} },
+      guarantees,
+      exportResult: (session) => ({ refs: {}, sessionState: { ...session, ...this.sessionState } }),
+      ...this.placement ? { placement: this.placement } : {}
+    };
+  }
+  async letGo(taskId, { keep, landing, reason }) {
+    await landing;
+    this.letGoCalls.push({ taskId, keep, reason });
+  }
+  async list() {
+    return this.records;
+  }
+};
 var FakeWorktreeIsolation = class {
   availability = { active: true };
+  /** What `gitShortfall` answers. */
+  gitShortfallText = null;
   /** The repo paths `startRun` groups: a group of one at `.` unless set. */
   repos = [SELF_REPO];
   /** Per task id, the repos it changes; every repo of the group when not listed. */
@@ -377,11 +516,16 @@ var FakeWorktreeIsolation = class {
   removal = noRemoval();
   /** Per task id; a task not listed integrates as `merged`. */
   outcomes = /* @__PURE__ */ new Map();
+  /** What `revert` stops with; a revert that goes through when null. */
+  revertStop = null;
+  /** What `readLanded` finds of a task's work in the user's branch, by task id. */
+  inBranch = /* @__PURE__ */ new Map();
   /** Per task id, what `verifyRepair` finds; a task not listed passes. */
   repairEvidence = /* @__PURE__ */ new Map();
   calls = [];
   holds = /* @__PURE__ */ new Map();
   verifyHolds = /* @__PURE__ */ new Map();
+  revertHold = null;
   runCount = 0;
   log(call) {
     this.calls.push(call);
@@ -398,6 +542,14 @@ var FakeWorktreeIsolation = class {
     }));
     return open;
   }
+  /** Make the next `revert` wait, past its `refusal`, until the returned function is called. */
+  holdRevert() {
+    let open;
+    this.revertHold = new Promise((resolve) => {
+      open = resolve;
+    });
+    return open;
+  }
   /** Make `verifyRepair` for this task wait until the returned function is called. */
   holdVerification(taskId) {
     let open;
@@ -406,6 +558,9 @@ var FakeWorktreeIsolation = class {
     }));
     return open;
   }
+  async gitShortfall() {
+    return this.gitShortfallText;
+  }
   async isActive(workspaceRoot) {
     this.log({ op: "isActive", workspaceRoot });
     return this.availability;
@@ -415,13 +570,14 @@ var FakeWorktreeIsolation = class {
     this.log({ op: "stash", workspaceRoot });
     if (!this.availability.active && this.availability.reason === "dirty") this.availability = { active: true };
   }
-  async startRun(workspaceRoot) {
+  async startRun(workspaceRoot, stateRoot) {
     this.log({ op: "startRun", workspaceRoot });
     if (this.startRunError) throw this.startRunError;
     const id = `run${++this.runCount}`;
     return {
       id,
       workspaceRoot,
+      ...stateRoot !== void 0 ? { stateRoot } : {},
       repos: this.repos.map((repo) => ({
         path: repo,
         root: `${workspaceRoot}/${repo}`.replace(/\/\.$/, ""),
@@ -431,7 +587,9 @@ var FakeWorktreeIsolation = class {
       })),
       shared: [...this.shared],
       sharedRepos: [...this.sharedRepos],
-      tasks: {}
+      tasks: {},
+      keepsEveryLanding: true,
+      carried: {}
     };
   }
   async prepare(task, run, _intent, opts = {}) {
@@ -494,6 +652,10 @@ var FakeWorktreeIsolation = class {
     if (outcome === "merged") {
       delete record.conflictRepo;
       delete record.conflictFiles;
+      for (const repo of changed) {
+        ((run.landings ??= {})[task.id] ??= {})[repo] = [...run.landings?.[task.id]?.[repo] ?? [], `tip-${repo}`];
+        (run.landedTasks ??= {})[task.id] = { taskId: task.id, order: task.order, title: task.title };
+      }
     } else {
       record.conflictRepo = this.stopsIn.get(task.id) ?? changed[0] ?? SELF_REPO;
       const files = this.conflictFiles.get(task.id);
@@ -502,6 +664,44 @@ var FakeWorktreeIsolation = class {
     }
     return outcome;
   }
+  /** Newest landing first, read as the plan's highest order: scheduling tests land in plan order. */
+  async readLanded(run, taskIds) {
+    this.log({ op: "readLanded", taskIds });
+    const records = taskIds.flatMap((id) => run.tasks[id] ?? run.landedTasks?.[id] ?? []).sort((a, b) => b.order - a.order);
+    const tasks = records.map((r) => ({
+      taskId: r.taskId,
+      order: r.order,
+      title: r.title,
+      repos: Object.keys(run.landings?.[r.taskId] ?? {})
+    }));
+    return { ok: true, tasks, inBranch: records.flatMap((r) => this.inBranch.get(r.taskId) ?? []) };
+  }
+  /** Like git: the turn, then the judgement, then the records go in one step with the tasks back. */
+  async revert(run, taskIds, watch) {
+    this.log({ op: "revert", taskIds });
+    const hold = this.revertHold;
+    this.revertHold = null;
+    await hold;
+    const reason = watch.refusal();
+    if (reason) return { outcome: "refused", reason };
+    if (this.revertStop) return this.revertStop;
+    const landed = await this.readLanded(run, taskIds);
+    if (!landed.ok) return { outcome: "failed", error: landed.error };
+    if (landed.inBranch.length > 0) return { outcome: "in-branch", commands: landed.inBranch };
+    run.landing = { taskId: taskIds[0], tips: {}, reverts: {} };
+    watch.persist();
+    delete run.landing;
+    for (const id of taskIds) {
+      if (run.tasks[id]?.status === "merged") delete run.tasks[id];
+      else if (run.tasks[id]?.status === "conflict") run.tasks[id].status = "kept";
+      delete run.landings?.[id];
+      delete run.landedTasks?.[id];
+      delete run.landedOn?.[id];
+    }
+    run.reverted = true;
+    watch.settled(taskIds);
+    return { outcome: "reverted", tasks: landed.tasks };
+  }
   async release(run, taskId, opts) {
     this.log({ op: "release", taskId, keep: opts.keep });
     const record = run.tasks[taskId];
@@ -543,13 +743,16 @@ var FakeWorktreeIsolation = class {
   }
   async findInHead(run) {
     this.log({ op: "findInHead" });
-    const found = [];
+    const changed = [];
     for (const record of Object.values(run.tasks)) {
-      if (record.status !== "merged" || record.inHead || !this.mergedByHand.has(record.taskId)) continue;
-      record.inHead = true;
-      found.push(record.taskId);
+      if (record.status !== "merged") continue;
+      const merged = this.mergedByHand.has(record.taskId);
+      if (merged === !!record.inHead) continue;
+      if (merged) record.inHead = true;
+      else delete record.inHead;
+      changed.push(record.taskId);
     }
-    return found;
+    return changed;
   }
   async snapshotTree() {
     this.log({ op: "snapshotTree" });
@@ -571,6 +774,8 @@ var FakeWorktreeIsolation = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  FakeEventStore,
+  FakeExecutionBackend,
   FakeRunnerSession,
   FakeWorktreeIsolation,
   fakeConfig,