@ultimat3/cli 23.0.0 → 25.0.0

package/src/workspace-graph.ts

@@ -4,7 +4,7 @@
 // for `tsc` and is invisible to bun, to `--filter` ordering and to any change-detection tool.
 
 import { join } from 'node:path';
-import { ERROR_DOCS_URL } from '@ultimat3/core';
+import { ERROR_DOCS_URL, maskLiterals } from '@ultimat3/core';
 import { scanAllImports } from './import-scan';
 import type { Finding } from './output';
 import { eachSourceFile, isGenerated, isTest, isVendored } from './source-files';
@@ -148,10 +148,11 @@ export function packageOfSpecifier(specifier: string): string | undefined {
  * included, because a type edge still needs its manifest line. The transpiler is the parser, so a
  * generator's template literal (even one nested in a `${…}`, #493) is a string and never an import,
  * and `from<Row>('posts')` is a call. A file it cannot parse throws rather than reading as empty.
+ * The mask is what reads a type-position `typeof import('x')`, which the transpiler erases whole.
  */
 export function importedPackages(source: string, path = 'source.ts'): readonly string[] {
   const packages = new Set<string>();
-  for (const specifier of scanAllImports({ path, source })) {
+  for (const specifier of scanAllImports({ path, source }, maskLiterals(source))) {
     const name = packageOfSpecifier(specifier);
     if (name !== undefined) packages.add(name);
   }

package/src/write-line.ts

@@ -7,7 +7,7 @@
 import { writeSync } from 'node:fs';
 // The one import beyond `node:fs`, and it costs nothing here: `create-ultimate` reaches this
 // module through `@ultimat3/cli`'s barrel, which has already evaluated core.
-import { stringField } from '@ultimat3/core';
+import { backoffDelay, stringField } from '@ultimat3/core';
 
 /**
  * Write to stdout and be certain it arrived, even if the next statement exits the process.
@@ -22,22 +22,97 @@ import { stringField } from '@ultimat3/core';
  *
  * `EAGAIN` is "the pipe is full right now", not a failure. CI hands the process a NON-BLOCKING
  * stdout, where `writeSync` throws rather than blocking — so the loop that fixed the truncation
- * took the whole command down on a runner, emitting nothing at all. The reader drains in
- * microseconds; the retry is the correct response to "would block".
+ * took the whole command down on a runner, emitting nothing at all. A draining reader clears it in
+ * microseconds, so it is retried — but BOUNDED: a reader that never drains (a stopped `| less`, a
+ * wedged parent) turned the unbounded retry into a command that never exits, spinning a core.
+ * `EAGAIN_ATTEMPTS` consecutive stalls, each waiting longer (capped), then the line is dropped and
+ * counted (`droppedLineCount()`): one lost line beats a process that cannot finish. After a drop
+ * the fd is DEGRADED: each later line gets one attempt and no sleep, or a never-draining reader
+ * would cost ~1.5 s per line forever. Any byte arriving clears it.
  */
 function writeTo(fd: 1 | 2, line: string): void {
-  const buffer = Buffer.from(`${line}\n`);
+  writeAll(fd, Buffer.from(`${line}\n`));
+}
+
+/** Consecutive stalls one write may absorb before its line is dropped. Progress resets it. */
+export const EAGAIN_ATTEMPTS = 50;
+
+/**
+ * Core's one curve, exponential and capped: 1, 2, 4 … 32 ms — under 1.5 s for a reader that never
+ * drains at all. No jitter: one process waiting on its own pipe has no herd to decorrelate.
+ */
+const backoffMs = (stall: number): number => backoffDelay({ attempt: stall, base: 1, max: 32 });
+
+/** `writeSync`'s shape, so a test can hand in a pipe that is full forever. */
+export type WriteSync = (fd: number, buffer: Uint8Array, offset: number, length: number) => number;
+
+let dropped = 0;
+
+/**
+ * Per fd, because fd 1 and fd 2 are two readers. `degraded`: the last line was dropped, so the next
+ * gets one attempt. `torn`: it was dropped HALF-written, so the next line that arrives opens with
+ * the newline the torn one never got — otherwise the two glue into one unparseable line.
+ */
+const pipes = new Map<number, { degraded: boolean; torn: boolean }>();
+
+const pipeOf = (fd: number): { degraded: boolean; torn: boolean } => {
+  let pipe = pipes.get(fd);
+  if (pipe === undefined) {
+    pipe = { degraded: false, torn: false };
+    pipes.set(fd, pipe);
+  }
+  return pipe;
+};
+
+const NEWLINE = 0x0a;
+
+/** Lines this process dropped to a reader that never drained. */
+export const droppedLineCount = (): number => dropped;
+
+/**
+ * Write every byte of `buffer` to `fd`, or drop it after `EAGAIN_ATTEMPTS` stalls in a row — one
+ * stall while the fd is degraded. Returns whether it all arrived. A write of zero bytes is a stall
+ * too, so no path spins.
+ */
+export function writeAll(
+  fd: number,
+  buffer: Uint8Array,
+  write: WriteSync = writeSync,
+  sleep: (ms: number) => void = Bun.sleepSync,
+): boolean {
+  const pipe = pipeOf(fd);
+  const prefix = pipe.torn ? 1 : 0;
+  const bytes = prefix === 0 ? buffer : Buffer.concat([Uint8Array.of(NEWLINE), buffer]);
   let written = 0;
-  while (written < buffer.length) {
+  let stalls = 0;
+  while (written < bytes.length) {
+    let progress = 0;
     try {
-      written += writeSync(fd, buffer, written, buffer.length - written);
+      progress = write(fd, bytes, written, bytes.length - written);
     } catch (cause) {
       // `stringField`, never a cast plus a property read — the rule `metrics-endpoint.ts` states
       // and `caught-value-reads.test.ts` enforces. Here it is also the difference between
-      // rethrowing and an infinite loop: a `code` that cannot be read must not read as `EAGAIN`.
+      // rethrowing and retrying: a `code` that cannot be read must not read as `EAGAIN`.
       if (stringField(cause, 'code') !== 'EAGAIN') throw cause;
     }
+    if (progress > 0) {
+      written += progress;
+      stalls = 0;
+      pipe.degraded = false; // The reader drained: it gets the full budget again.
+      continue;
+    }
+    stalls += 1;
+    if (stalls >= (pipe.degraded ? 1 : EAGAIN_ATTEMPTS)) {
+      dropped += 1;
+      pipe.degraded = true;
+      // Nothing written leaves a torn line torn; only the prefix written closes it cleanly.
+      if (written > 0) pipe.torn = written > prefix;
+      return false;
+    }
+    sleep(backoffMs(stalls));
   }
+  pipe.torn = false;
+  return true;
 }
 
 export function writeLine(line: string): void {

package/src/browser-launcher-fake-html.ts

@@ -1,80 +0,0 @@
-// CSS selectors over an HTML string, on Bun's own `HTMLRewriter`: the `query()` the offline
-// `fakeShotDriver` answers from markup. The selector subset is lol-html's — type, `#id`, `.class`,
-// `[attr]`, `[attr=value]`, descendant and child combinators. No box and no hit-target on any
-// answer: this has no layout engine, and a fabricated box would make a covered button clickable.
-import type { ElementSnapshot } from './browser-launcher-port';
-
-/** Elements with no end tag: `onEndTag` never fires for them, so they close on open. */
-const VOID_TAGS = new Set([
-  'area',
-  'base',
-  'br',
-  'col',
-  'embed',
-  'hr',
-  'img',
-  'input',
-  'link',
-  'meta',
-  'source',
-  'track',
-  'wbr',
-]);
-
-const HIDDEN_STYLE = /(?:^|;)\s*(?:display\s*:\s*none|visibility\s*:\s*hidden)\s*(?:;|$)/i;
-
-const visible = (tag: string, attrs: ReadonlyMap<string, string>): boolean =>
-  !attrs.has('hidden') &&
-  !(tag === 'input' && attrs.get('type')?.toLowerCase() === 'hidden') &&
-  !HIDDEN_STYLE.test(attrs.get('style') ?? '') &&
-  attrs.get('aria-hidden') !== 'true';
-
-interface Open {
-  readonly tag: string;
-  readonly attrs: Map<string, string>;
-  readonly parts: string[];
-}
-
-const finish = (open: Open): ElementSnapshot => ({
-  tag: open.tag,
-  attrs: Object.fromEntries(open.attrs),
-  text: open.parts.join('').replaceAll(/\s+/g, ' ').trim(),
-  value: open.attrs.get('value') ?? '',
-  visible: visible(open.tag, open.attrs),
-  enabled: !open.attrs.has('disabled') && open.attrs.get('aria-disabled') !== 'true',
-});
-
-/** Every element matching `selector`, as the markup states it. A selector lol-html refuses throws. */
-export async function queryHtml(
-  html: string,
-  selector: string,
-): Promise<readonly ElementSnapshot[]> {
-  const done: ElementSnapshot[] = [];
-  const open: Open[] = [];
-  const rewriter = new HTMLRewriter().on(selector, {
-    element(element): void {
-      const tag = element.tagName.toLowerCase();
-      const attrs = new Map<string, string>();
-      for (const [name, value] of element.attributes) attrs.set(name.toLowerCase(), value);
-      const record: Open = { tag, attrs, parts: [] };
-      if (VOID_TAGS.has(tag)) {
-        done.push(finish(record));
-        return;
-      }
-      open.push(record);
-      element.onEndTag(() => {
-        const index = open.lastIndexOf(record);
-        if (index !== -1) open.splice(index, 1);
-        done.push(finish(record));
-      });
-    },
-    text(chunk): void {
-      // Every OPEN match: `div, span` matches both, and both contain the text.
-      for (const record of open) record.parts.push(chunk.text);
-    },
-  });
-  await rewriter.transform(new Response(html)).text();
-  // Never closed is malformed markup; the element still matched, so it is still reported.
-  for (const record of open) done.push(finish(record));
-  return done;
-}

package/src/browser-launcher-fake.ts

@@ -1,168 +0,0 @@
-// `fakeShotDriver`: a `ShotDriver` over recorded pages, so every `x shot` and `ui.*` test runs with
-// no Chrome. It parses markup and runs none of it — `query()` is answered from the HTML,
-// `evaluate()` from a recorded table, and a click follows `data-goto` or an `<a href>`. What it
-// cannot know it refuses by name rather than inventing: no layout box, and no accessibility tree.
-import { hostDecision, notImplemented } from '@ultimat3/core';
-import { CdpCallFailedError } from '@ultimat3/testing';
-import { queryHtml } from './browser-launcher-fake-html';
-import type {
-  CaptureClip,
-  ElementSnapshot,
-  NetworkEntry,
-  ShotColorScheme,
-  ShotDriver,
-  ShotPage,
-  ShotSession,
-  ShotSessionInit,
-} from './browser-launcher-port';
-import { awaitReady } from './cdp-shot-element';
-import { ShotHostRefusedError } from './cdp-shot-errors';
-import { parseKeyChord } from './cdp-shot-keys';
-
-export const FAKE_SHOT_DRIVER = 'fake';
-
-/** One recorded page: its url, its markup, and `expression -> JSON text` for `evaluate()`. */
-export interface FakeShotPage {
-  readonly url: string;
-  readonly html: string;
-  readonly evaluate?: Readonly<Record<string, string>> | undefined;
-  /** The document's HTTP status. Absent is 200 — the page was recorded because it exists. */
-  readonly status?: number | undefined;
-}
-
-/** A PNG signature, and nothing behind it: deterministic bytes, never a render. */
-export const FAKE_PNG = new Uint8Array([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]);
-
-/**
- * Different deterministic bytes for every framing fact that was set — one per rectangle, one per
- * colour preference — so a caller that dropped the clip or the scheme fails a test here, which is
- * the only place a framing knob can be proved without a browser (issue #338).
- */
-export const framedPng = (clip: CaptureClip | undefined, scheme: ShotColorScheme): Uint8Array => {
-  const notes =
-    (clip === undefined
-      ? ''
-      : ` clip ${String(clip.x)},${String(clip.y)},${String(clip.width)},${String(clip.height)}`) +
-    (scheme === 'no-preference' ? '' : ` scheme ${scheme}`);
-  if (notes === '') return FAKE_PNG;
-  const suffix = new TextEncoder().encode(notes);
-  const out = new Uint8Array(FAKE_PNG.length + suffix.length);
-  out.set(FAKE_PNG);
-  out.set(suffix, FAKE_PNG.length);
-  return out;
-};
-
-const normalise = (url: string): string => {
-  try {
-    return new URL(url).toString();
-  } catch {
-    return url;
-  }
-};
-
-function fakePage(byUrl: ReadonlyMap<string, FakeShotPage>, init: ShotSessionInit): ShotPage {
-  let current: FakeShotPage | undefined;
-  let scheme: ShotColorScheme = 'no-preference';
-  const network: NetworkEntry[] = [];
-  const url = (): string => current?.url ?? 'about:blank';
-
-  const navigate = (to: string): void => {
-    const page = byUrl.get(normalise(to));
-    if (page === undefined) {
-      throw new CdpCallFailedError({
-        method: `Page.navigate to ${to}`,
-        detail: 'fakeShotDriver() has no page recorded at that url',
-      });
-    }
-    current = page;
-    network.push({
-      method: 'GET',
-      url: page.url,
-      // Data the page answers with, never a bound — a recorded page exists, so absent is a 200.
-      status: page.status === undefined ? 200 : page.status,
-      resourceType: 'document',
-      at: init.clock.now().getTime(),
-    });
-  };
-
-  const query = (selector: string): Promise<readonly ElementSnapshot[]> =>
-    queryHtml(current?.html ?? '', selector);
-
-  const ready = (selector: string, options?: Parameters<ShotPage['waitFor']>[1]) =>
-    awaitReady({
-      selector,
-      state: options?.state ?? 'actionable',
-      timeoutMs: options?.timeout ?? init.timeoutMs,
-      clock: init.clock,
-      url,
-      snapshot: async () => (await query(selector))[0],
-    });
-
-  return {
-    url,
-    async goto(to) {
-      if (!hostDecision(to, init.rules.allowHosts).allowed) {
-        throw new ShotHostRefusedError({ url: to, allowHosts: init.rules.allowHosts });
-      }
-      navigate(to);
-    },
-    waitFor: (selector, options) => ready(selector, options),
-    async click(selector, options) {
-      const target = await ready(selector, options);
-      // What the browser would do with the click, as far as markup can say: follow the link.
-      const next =
-        target.attrs['data-goto'] ?? (target.tag === 'a' ? target.attrs['href'] : undefined);
-      if (next !== undefined) navigate(new URL(next, url()).toString());
-    },
-    async type(selector, _text, options) {
-      await ready(selector, options);
-    },
-    async focus(selector, options) {
-      await ready(selector, options);
-    },
-    async press(chord) {
-      parseKeyChord(chord);
-    },
-    async accessibility() {
-      return notImplemented(
-        'accessibility() on fakeShotDriver()',
-        'assert on the markup with page.query(selector) — a role read off the HTML would hide the element a screen reader cannot name, which is the finding this read exists for',
-      );
-    },
-    query,
-    async evaluate(expression) {
-      const table = current?.evaluate ?? {};
-      const recorded = Object.hasOwn(table, expression) ? table[expression] : undefined;
-      if (recorded === undefined) {
-        throw new CdpCallFailedError({
-          method: 'Runtime.evaluate',
-          detail: 'fakeShotDriver() has no answer recorded for that expression on this page',
-        });
-      }
-      return JSON.parse(recorded) as unknown;
-    },
-    async screenshot(options) {
-      return framedPng(options?.clip, scheme);
-    },
-    async colorScheme(next) {
-      scheme = next;
-    },
-    async prepare() {},
-    console: () => [],
-    pageErrors: () => [],
-    pageErrorsDropped: () => 0,
-    network: () => [...network],
-    networkDropped: () => 0,
-  };
-}
-
-/** A driver whose every session reads from `pages`. An unrecorded url is refused, never fetched. */
-export function fakeShotDriver(pages: readonly FakeShotPage[]): ShotDriver {
-  const byUrl = new Map(pages.map((page) => [normalise(page.url), page]));
-  return {
-    name: FAKE_SHOT_DRIVER,
-    async open(init): Promise<ShotSession> {
-      return { page: fakePage(byUrl, init), close: async () => undefined };
-    },
-  };
-}

package/src/build-errors.ts

@@ -1,54 +0,0 @@
-// The CLI's build and bundle refusals: an entry an app does not have, an island that will not
-// compile, a framework browser script that will not bundle. Split from `errors.ts` at its 500-line
-// ceiling; `errors.ts` re-exports every name, so no import site moves.
-
-import { UltimateError } from '@ultimat3/core';
-import { quoteArg } from './shell-quote';
-
-/**
- * A build target names an entry file the app does not have. `x build` refuses before it spawns the
- * builder: `bun build`'s own "module not found" says nothing about which file an Ultimate app is
- * supposed to own, and `docker build`'s says nothing about which target wanted it.
- */
-export class BuildEntryMissingError extends UltimateError {
-  constructor(input: { target: string; entry: string }) {
-    super({
-      code: 'X_BUILD_ENTRY_MISSING',
-      cause: `x build --target ${input.target} builds from ${input.entry}, and the app does not have it`,
-      fix: `x new scratch-app --dry-run --json   # its file list carries ${input.entry}; copy that file into this app`,
-    });
-  }
-}
-
-/**
- * A client entry would not compile. `X_BUILD_FAILED`, not a code of its own: an island is a bundle
- * entry point like any other, and the target's own logs are what says which line. The fix builds
- * exactly that one file, so the next message an author reads is the compiler's and not the CLI's.
- */
-export class IslandBuildFailedError extends UltimateError {
-  constructor(input: { file: string; logs: string }) {
-    super({
-      code: 'X_BUILD_FAILED',
-      cause: `${input.file} is an island entry point and would not bundle: ${input.logs}`,
-      fix: `bun build --target browser ${input.file}`,
-    });
-  }
-}
-
-/** Which framework script a page ships: the sync worker, the page boot, or the client router. */
-export type FrameworkScriptKind = 'sync worker' | 'page boot' | 'client router';
-
-/**
- * One of the page's framework scripts would not bundle. Same code as an island: "a browser entry
- * the framework builds did not build" is one condition, and the entry here is framework code, not
- * the app's — the cause names WHICH script, so the reader knows what the page is now missing.
- */
-export class FrameworkScriptBuildFailedError extends UltimateError {
-  constructor(input: { what: FrameworkScriptKind; entry: string; logs: string }) {
-    super({
-      code: 'X_BUILD_FAILED',
-      cause: `the ${input.what} (${input.entry}) would not bundle for the browser: ${input.logs}`,
-      fix: `bun build --target browser --format iife ${quoteArg(input.entry)}`,
-    });
-  }
-}

package/src/jobs-drain.ts

@@ -1,163 +0,0 @@
-// `x jobs drain`: moving in-flight work from one queue driver onto another. Its own file because
-// it is the only command here that WRITES to two drivers at once, and the ordering rule that makes
-// that safe — lease, copy steps, enqueue, then ack — has to be readable in one screen.
-
-import { uuid } from '@ultimat3/core';
-import type { ClaimedJob, JobDriver, JobRecord, JobState } from '@ultimat3/jobs';
-import { claimOf, inspectJobList } from '@ultimat3/jobs';
-import type { Finding } from './output';
-import { findingFrom } from './output';
-
-/** `running` is deliberately excluded: a job a worker is mid-execution on is not "pending". */
-const PENDING_STATES: readonly JobState[] = ['ready', 'delayed', 'suspended'];
-
-/**
- * The lease has to outlive the WHOLE transfer loop, not one record: the batch is claimed up
- * front, and a lease expiring mid-drain would hand a half-transferred job back to a source
- * worker. The snapshot is bounded by the drivers' own 100-row-per-state list cap, so this is a
- * ceiling over a few hundred sequential enqueues rather than a guess about one.
- */
-const DRAIN_LEASE_MS = 300_000;
-
-const NO_LEASE = 'no lease could be taken — not yet due, or a worker is already running it';
-
-export interface DrainFailure {
-  readonly id: string;
-  readonly name: string;
-  readonly finding: Finding;
-}
-
-/** A candidate the drain deliberately left alone, because it could not prove it owned the job. */
-export interface DrainSkip {
-  readonly id: string;
-  readonly name: string;
-  readonly queue: string;
-  readonly state: JobState;
-  readonly reason: string;
-}
-
-export interface DrainOutcome {
-  readonly from: string;
-  readonly to: string;
-  readonly dryRun: boolean;
-  readonly candidates: readonly JobRecord[];
-  readonly moved: readonly JobRecord[];
-  readonly skipped: readonly DrainSkip[];
-  readonly failures: readonly DrainFailure[];
-}
-
-/**
- * The lease IS the proof of ownership. `ack()` takes only a job id, so a drain that ack'd rows
- * off a snapshot could acknowledge a job a source worker claimed and is executing right now —
- * the target would then run a duplicate of a job still in flight. One batch claim over the
- * candidates' own queues; whatever comes back is the drain's to move, and everything else is
- * left alone. `queues` is always explicit because the pg driver reads an empty list as
- * `['default']` rather than as "every queue".
- */
-function leaseCandidates(
-  source: JobDriver,
-  candidates: readonly JobRecord[],
-): Promise<readonly ClaimedJob[]> {
-  if (candidates.length === 0) return Promise.resolve([]);
-  return source.claim({
-    queues: [...new Set(candidates.map((record) => record.queue))],
-    limit: candidates.length,
-    visibilityTimeoutMs: DRAIN_LEASE_MS,
-    workerId: `x-jobs-drain:${uuid()}`,
-  });
-}
-
-/** Steps carry their own `runId`, so a copy lands under the same key the target job resumes on. */
-async function copySteps(source: JobDriver, target: JobDriver, runId: string): Promise<void> {
-  for (const record of await source.steps.list(runId)) await target.steps.put(record);
-}
-
-/**
- * Hand a leased job back exactly as the drain found it. `countsAsAttempt: false` is the point:
- * a transfer that failed is not a failed attempt, and burning one per `x jobs drain` retry would
- * dead-letter a job nobody ever ran.
- *
- * It returns to `ready`, which is what "as the drain found it" means — the drain leased a ready
- * job and could not move it. It used to land in `suspended`, not by intent but because
- * `countsAsAttempt: false` was the only bit the drivers had and `step.sleep` had claimed it;
- * `NackOptions.park` now carries the suspension, so the two callers no longer share one meaning.
- */
-async function releaseLease(source: JobDriver, leased: ClaimedJob): Promise<void> {
-  try {
-    // Fenced on the drain's own claim, like every settle: a lease that lapsed is not handed back.
-    await source.nack(leased.id, {
-      ...claimOf(leased),
-      delayMs: 0,
-      countsAsAttempt: false,
-    });
-  } catch {
-    // The lease expires on its own. Masking the transfer's real error with this one helps nobody.
-  }
-}
-
-const toSkip = (record: JobRecord): DrainSkip => ({
-  id: record.id,
-  name: record.name,
-  queue: record.queue,
-  state: record.state,
-  reason: NO_LEASE,
-});
-
-/**
- * Move every pending job the drain can take a lease on from `source` onto `target`. `--dry-run`
- * reports the candidate list, takes no lease and enqueues nothing. Per-record try/catch, not a
- * batch operation: one record that cannot enqueue on the target (a redis/nats stub, a transient
- * error) must not stop the rest from moving, and the caller reports each failure on its own.
- */
-export async function drainJobs(
-  source: JobDriver,
-  target: JobDriver,
-  dryRun: boolean,
-): Promise<DrainOutcome> {
-  const lists = await Promise.all(PENDING_STATES.map((state) => inspectJobList(source, { state })));
-  const candidates = lists.flat();
-  const base = { from: source.name, to: target.name, candidates };
-  if (dryRun) return { ...base, dryRun: true, moved: [], skipped: [], failures: [] };
-
-  const leased = await leaseCandidates(source, candidates);
-  const held = new Set(leased.map((record) => record.id));
-  const found = new Map(candidates.map((record) => [record.id, record]));
-  const skipped = candidates.filter((record) => !held.has(record.id)).map(toSkip);
-
-  const moved: JobRecord[] = [];
-  const failures: DrainFailure[] = [];
-  for (const record of leased) {
-    let enqueued = false;
-    try {
-      // Steps BEFORE the job: a worker on the target must never be able to claim a run whose
-      // checkpoint has not landed, or it repeats completed steps or loses them outright.
-      await copySteps(source, target, record.runId);
-      await target.enqueue({
-        name: record.name,
-        queue: record.queue,
-        input: record.input,
-        idempotencyKey: record.idempotencyKey,
-        runId: record.runId,
-        maxAttempts: record.maxAttempts,
-        runAt: record.runAt,
-        ...(record.tenantId === undefined ? {} : { tenantId: record.tenantId }),
-      });
-      enqueued = true;
-      // Only now is the ack the drain's to make: the lease proves no source worker holds this
-      // job, and the target already has both the row and its steps. A crash between the two
-      // leaves the job live on both drivers, where `idempotencyKey` dedupes it.
-      // `counted: false`: the row is finished HERE because it left, and a job that was moved is
-      // not a job that completed — it must add nothing to the source's `done` history.
-      await source.ack(record.id, { ...claimOf(record), counted: false });
-      // Report the row as the drain FOUND it: `claim()` returns it mid-lease (`running`, one
-      // attempt higher), a state nothing on either driver is in once this returns.
-      moved.push(found.get(record.id) ?? record);
-    } catch (error) {
-      // A failed enqueue left nothing on the target, so the lease goes back. A failed ack did
-      // not: the job is already live there, and releasing it would race the target's worker.
-      if (!enqueued) await releaseLease(source, record);
-      failures.push({ id: record.id, name: record.name, finding: findingFrom(error) });
-    }
-  }
-  return { ...base, dryRun: false, moved, skipped, failures };
-}