@zerwiz/ymir 0.1.4 → 0.1.7

package/.agents/tests/fm-spawn-pool-base-freshen.test.sh

@@ -0,0 +1,440 @@
+#!/usr/bin/env bash
+# Regression tests for fm-spawn's pooled-worktree base refresh.
+#
+# A treehouse pool can return a clean detached worktree whose origin/main was
+# advanced after the worktree was allocated.
+# These tests drive the real spawn path with a fake terminal, then prove it
+# starts the worker from the fetched origin/main tip or stops when origin is
+# unreachable.
+set -u
+
+# shellcheck source=tests/fixtures.sh
+. "$(dirname "${BASH_SOURCE[0]}")/fixtures.sh"
+
+TMP_ROOT=$(fm_test_tmproot fm-spawn-pool-base-freshen)
+
+make_case() {
+  local name=$1 id=$2 default=${3:-main} case_dir home project origin pool publisher fakebin initial
+  case_dir="$TMP_ROOT/$name"
+  home="$case_dir/home"
+  project="$case_dir/project"
+  origin="$case_dir/origin.git"
+  pool="$case_dir/pool"
+  publisher="$case_dir/publisher"
+  fakebin=$(make_spawn_fakebin "$case_dir/fake")
+
+  mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config"
+  printf 'codex\n' > "$home/config/crew-harness"
+  printf 'brief for %s\n' "$id" > "$home/data/$id/brief.md"
+  touch "$home/state/.last-watcher-beat"
+
+  git init --quiet -b "$default" "$project"
+  printf 'base\n' > "$project/README.md"
+  git -C "$project" add README.md
+  git -C "$project" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm initial
+  git clone --quiet --bare "$project" "$origin"
+  git -C "$project" remote add origin "file://$origin"
+  initial=$(git -C "$project" rev-parse HEAD)
+  git -C "$project" worktree add --quiet --detach "$pool" "$initial"
+
+  git clone --quiet "file://$origin" "$publisher"
+  printf 'must survive a newly spawned branch\n' > "$publisher/advanced-main.txt"
+  git -C "$publisher" add advanced-main.txt
+  git -C "$publisher" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm advance-main
+  git -C "$publisher" push --quiet origin "$default"
+
+  printf '%s\n' "$case_dir|$home|$project|$pool|$fakebin|$initial|$default"
+}
+
+read_case_record() {
+  IFS='|' read -r CASE_DIR HOME_DIR PROJECT_DIR POOL_DIR FAKEBIN_DIR INITIAL_SHA DEFAULT_BRANCH <<EOF
+$1
+EOF
+}
+
+run_spawn() {
+  local id=$1
+  shift
+  fm_test_run_spawn "$HOME_DIR" "$POOL_DIR" "$FAKEBIN_DIR" \
+    "$id" "$PROJECT_DIR" "$@"
+}
+
+test_stale_pool_base_refreshes_before_branching() {
+  local rec id out status current branch_head
+  id='pool-current-base-r1'
+  rec=$(make_case current-base "$id")
+  read_case_record "$rec"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  expect_code 0 "$status" "spawn should refresh a stale pooled worktree"
+  assert_contains "$out" "spawned $id" "spawn did not report success"
+  current=$(git -C "$POOL_DIR" rev-parse origin/main)
+  branch_head=$(git -C "$POOL_DIR" rev-parse HEAD)
+  [ "$branch_head" = "$current" ] || fail "spawn left the pooled worktree on stale history"
+  [ "$branch_head" != "$INITIAL_SHA" ] || fail "fixture did not prove origin/main advanced past the pool base"
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '# observed spawn: %s\n' "$(printf '%s\n' "$out" | tail -n 1)"
+    printf '# observed base: HEAD=%s origin/main=%s advanced-main=%s\n' \
+      "$branch_head" "$current" "$(cat "$POOL_DIR/advanced-main.txt")"
+  fi
+
+  id='pool-current-base-repeat-r1'
+  mkdir -p "$HOME_DIR/data/$id"
+  printf 'brief for %s\n' "$id" > "$HOME_DIR/data/$id/brief.md"
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  expect_code 0 "$status" "repeating the base refresh should be idempotent"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$current" ] \
+    || fail "an idempotent repeat moved the pool away from current origin/main"
+
+  git -C "$POOL_DIR" checkout --quiet -b "fm/$id"
+  git -C "$POOL_DIR" diff --exit-code origin/main...HEAD >/dev/null \
+    || fail "a branch created after spawn differs from current origin/main"
+  assert_grep 'must survive a newly spawned branch' "$POOL_DIR/advanced-main.txt" \
+    "the branch created after spawn omitted advanced-main content"
+  pass "a stale pooled worktree refreshes to current origin/main before a crew branch is created"
+}
+
+test_non_main_default_branch_refreshes_before_branching() {
+  local rec id out status current branch_head
+  id='pool-current-trunk-r2'
+  rec=$(make_case current-trunk "$id" trunk)
+  read_case_record "$rec"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  expect_code 0 "$status" "spawn should refresh a stale pooled worktree on a non-main default branch"
+  current=$(git -C "$POOL_DIR" rev-parse "origin/$DEFAULT_BRANCH")
+  branch_head=$(git -C "$POOL_DIR" rev-parse HEAD)
+  [ "$branch_head" = "$current" ] || fail "spawn did not refresh to current origin/$DEFAULT_BRANCH"
+  [ "$branch_head" != "$INITIAL_SHA" ] || fail "fixture did not prove origin/$DEFAULT_BRANCH advanced past the pool base"
+  pass "a stale pooled worktree resolves and refreshes a non-main default branch"
+}
+
+test_unreachable_origin_refuses_stale_pool_base() {
+  local rec id out status before after
+  id='pool-unreachable-origin-r2'
+  rec=$(make_case unreachable-origin "$id")
+  read_case_record "$rec"
+  git -C "$POOL_DIR" remote set-url origin "file://$CASE_DIR/missing-origin.git"
+  before=$(git -C "$POOL_DIR" rev-parse HEAD)
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn succeeded despite an unreachable origin"
+  assert_contains "$out" "could not fetch origin" \
+    "spawn did not clearly refuse an unreachable origin"
+  after=$(git -C "$POOL_DIR" rev-parse HEAD)
+  [ "$after" = "$before" ] || fail "spawn changed the pooled worktree after origin became unreachable"
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '# observed unreachable-origin refusal: %s\n' "$(printf '%s\n' "$out" | tail -n 1)"
+  fi
+  pass "an unreachable origin refuses a potentially stale pooled worktree"
+}
+
+test_direct_pr_and_scout_refresh_before_launch() {
+  local rec id out status contract current
+  for contract in direct-pr scout; do
+    id="pool-${contract}-r3"
+    rec=$(make_case "$contract" "$id")
+    read_case_record "$rec"
+    if [ "$contract" = scout ]; then
+      out=$(run_spawn "$id" --scout)
+    else
+      out=$(run_spawn "$id" --mode direct-PR --yolo off)
+    fi
+    status=$?
+    expect_code 0 "$status" "$contract spawn should refresh a stale pooled worktree"
+    current=$(git -C "$POOL_DIR" rev-parse origin/main)
+    [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$current" ] \
+      || fail "$contract spawn did not start at current origin/main"
+    assert_grep 'must survive a newly spawned branch' "$POOL_DIR/advanced-main.txt" \
+      "$contract spawn omitted advanced-main content"
+    if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+      printf '# observed %s spawn: %s\n' "$contract" "$(printf '%s\n' "$out" | tail -n 1)"
+    fi
+  done
+  pass "direct-PR ships and scouts both refresh stale pooled worktrees before launch"
+}
+
+test_dirty_pool_refuses_without_discarding_work() {
+  local rec id out status before
+  id='pool-dirty-refusal-r4'
+  rec=$(make_case dirty-refusal "$id")
+  read_case_record "$rec"
+  before=$(git -C "$POOL_DIR" rev-parse HEAD)
+  printf 'keep this local work\n' > "$POOL_DIR/uncommitted.txt"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn succeeded despite a dirty pooled worktree"
+  assert_contains "$out" "is not clean" "spawn did not clearly refuse a dirty pooled worktree"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$before" ] \
+    || fail "spawn moved HEAD while refusing a dirty pooled worktree"
+  assert_grep 'keep this local work' "$POOL_DIR/uncommitted.txt" \
+    "spawn discarded uncommitted work while refusing the pool"
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '# observed dirty refusal: %s; preserved=%s\n' \
+      "$(printf '%s\n' "$out" | tail -n 1)" "$(cat "$POOL_DIR/uncommitted.txt")"
+  fi
+  pass "a dirty pooled worktree is refused without discarding its local work"
+}
+
+test_unresolved_remote_default_refuses_pool() {
+  local rec id out status before
+  id='pool-unresolved-default-r5'
+  rec=$(make_case unresolved-default "$id")
+  read_case_record "$rec"
+  git --git-dir="$CASE_DIR/origin.git" symbolic-ref HEAD refs/heads/missing-default
+  before=$(git -C "$POOL_DIR" rev-parse HEAD)
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn succeeded despite an unresolved remote default branch"
+  assert_contains "$out" "could not resolve origin's current default branch" \
+    "spawn did not clearly refuse an unresolved remote default branch"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$before" ] \
+    || fail "spawn moved HEAD after failing to resolve the remote default branch"
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '# observed unresolved-default refusal: %s\n' "$(printf '%s\n' "$out" | tail -n 1)"
+  fi
+  pass "an unresolved remote default branch refuses the pooled worktree"
+}
+
+# A slot left on a stale submodule pin is the field failure this diagnosis exists
+# for: a refresh moved the superproject and left the submodule behind, so the
+# refusal fires a spawn later, on a slot whose own `git status` looks clean to the
+# operator. Nothing here is converged - the gate only has to say why. The fixture
+# only builds the repositories; the residue itself is produced by a real spawn, so
+# these tests cover the reset that actually strands the submodule.
+make_submodule_case() {  # <name> <id>
+  local name=$1 id=$2 case_dir home project origin pool publisher fakebin sub subpin1 subpin2 advanced
+  case_dir="$TMP_ROOT/$name"
+  home="$case_dir/home"
+  project="$case_dir/project"
+  origin="$case_dir/origin.git"
+  pool="$case_dir/pool"
+  publisher="$case_dir/publisher"
+  sub="$case_dir/sub-origin"
+  fakebin=$(make_spawn_fakebin "$case_dir/fake")
+
+  mkdir -p "$home/data/$id" "$home/projects" "$home/state" "$home/config"
+  printf 'codex\n' > "$home/config/crew-harness"
+  printf 'brief for %s\n' "$id" > "$home/data/$id/brief.md"
+  touch "$home/state/.last-watcher-beat"
+
+  git init --quiet -b main "$sub"
+  printf 'pin one\n' > "$sub/lib.txt"
+  git -C "$sub" add lib.txt
+  git -C "$sub" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm sub-one
+  subpin1=$(git -C "$sub" rev-parse HEAD)
+  printf 'pin two\n' > "$sub/lib.txt"
+  git -C "$sub" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qam sub-two
+  subpin2=$(git -C "$sub" rev-parse HEAD)
+  git -C "$sub" checkout --quiet "$subpin1"
+
+  git init --quiet -b main "$project"
+  printf 'base\n' > "$project/README.md"
+  git -C "$project" add README.md
+  git -C "$project" -c protocol.file.allow=always -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' \
+    submodule --quiet add "file://$sub" ui
+  git -C "$project" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qm initial
+  git clone --quiet --bare "$project" "$origin"
+  git -C "$project" remote add origin "file://$origin"
+  git -C "$project" worktree add --quiet --detach "$pool" HEAD
+  git -C "$pool" -c protocol.file.allow=always submodule --quiet update --init
+
+  # Advance origin and move the submodule pin, exactly as the field incident did.
+  git clone --quiet "file://$origin" "$publisher"
+  git -C "$publisher" -c protocol.file.allow=always submodule --quiet update --init
+  git -C "$publisher/ui" checkout --quiet "$subpin2"
+  git -C "$publisher" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' commit -qam advance-pin
+  git -C "$publisher" push --quiet origin main
+  advanced=$(git -C "$publisher" rev-parse HEAD)
+
+  printf '%s\n' "$case_dir|$home|$project|$pool|$fakebin|$subpin1|$subpin2|$advanced"
+}
+
+read_submodule_case() {
+  IFS='|' read -r CASE_DIR HOME_DIR PROJECT_DIR POOL_DIR FAKEBIN_DIR SUBPIN1 SUBPIN2 ADVANCED_SHA <<EOF
+$1
+EOF
+}
+
+# The first of two consecutive spawns: it succeeds, resets the superproject onto
+# the base that moved the pin, and leaves the submodule checkout on the pin the
+# old base recorded. That reset is what strands the slot, so every case below
+# starts from residue this code path actually produced rather than a hand-built one.
+strand_submodule_pin_via_spawn() {  # <seed-id>
+  local id=$1 out status
+  mkdir -p "$HOME_DIR/data/$id"
+  printf 'brief for %s\n' "$id" > "$HOME_DIR/data/$id/brief.md"
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  expect_code 0 "$status" "the spawn that moves the submodule pin should succeed"
+  assert_contains "$out" "spawned $id" "the spawn that moves the submodule pin did not report success"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$ADVANCED_SHA" ] \
+    || fail "the first spawn did not move the pooled base across the moved submodule pin"
+  [ "$(git -C "$POOL_DIR/ui" rev-parse HEAD)" = "$SUBPIN1" ] \
+    || fail "the first spawn did not strand the submodule on the pin the old base recorded"
+}
+
+test_stale_submodule_pin_explains_itself() {
+  local rec id out status before before_sub
+  id='pool-stale-pin-r7'
+  rec=$(make_submodule_case stale-pin "$id")
+  read_submodule_case "$rec"
+  strand_submodule_pin_via_spawn 'pool-stale-pin-seed-r7'
+  before=$(git -C "$POOL_DIR" rev-parse HEAD)
+  before_sub=$(git -C "$POOL_DIR/ui" rev-parse HEAD)
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "the second spawn launched from a slot carrying a stale submodule pin"
+  assert_contains "$out" "stale submodule checkout" \
+    "refusal did not name the cause as a stale submodule checkout"
+  assert_contains "$out" "submodule 'ui'" "refusal did not name the submodule"
+  assert_contains "$out" "$SUBPIN1" "refusal did not report the pin the slot actually has"
+  assert_contains "$out" "$SUBPIN2" "refusal did not report the pin the base records"
+  # No remedy is printed on purpose: the containment check reads local refs only,
+  # so a stale remote-tracking ref can make an unpushed commit look contained, and
+  # a checkout command on that judgement could cost the operator a commit.
+  assert_not_contains "$out" "submodule update --checkout" \
+    "refusal printed a remedy command the containment check cannot stand behind"
+  assert_not_contains "$out" "refusing to discard uncommitted work" \
+    "a stale pin was misreported as uncommitted work"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$before" ] \
+    || fail "spawn moved HEAD while refusing a stale submodule pin"
+  [ "$(git -C "$POOL_DIR/ui" rev-parse HEAD)" = "$before_sub" ] \
+    || fail "spawn converged the submodule; this gate must never touch the slot"
+  if [ "${FM_TEST_EVIDENCE:-0}" = 1 ]; then
+    printf '# observed stale-pin refusal: %s\n' "$(printf '%s\n' "$out" | grep 'submodule' | head -n 1)"
+  fi
+  pass "two consecutive spawns across a moved submodule pin end in a refusal naming both pins and no remedy"
+}
+
+test_unpushed_submodule_commit_is_still_uncommitted_work() {
+  local rec id out status unpushed before before_sub
+  id='pool-sub-unpushed-r10'
+  rec=$(make_submodule_case sub-unpushed "$id")
+  read_submodule_case "$rec"
+  strand_submodule_pin_via_spawn 'pool-sub-unpushed-seed-r10'
+  # A commit made inside the submodule and never pushed leaves the submodule work
+  # tree clean and the pins different - the same two facts a stale pin shows. Any
+  # checkout of the recorded pin would move HEAD off this commit and leave it
+  # unreferenced, so this case must keep the conservative refusal.
+  printf 'unlanded submodule work\n' > "$POOL_DIR/ui/unlanded.txt"
+  git -C "$POOL_DIR/ui" add unlanded.txt
+  git -C "$POOL_DIR/ui" -c user.name='Firstmate Tests' -c user.email='tests@example.invalid' \
+    commit -qm unlanded-submodule-work
+  unpushed=$(git -C "$POOL_DIR/ui" rev-parse HEAD)
+  [ -z "$(git -C "$POOL_DIR/ui" status --porcelain)" ] \
+    || fail "fixture did not leave the submodule work tree clean"
+  [ "$unpushed" != "$(git -C "$POOL_DIR" rev-parse "HEAD:ui")" ] \
+    || fail "fixture did not leave the recorded pin different from what is checked out"
+  before=$(git -C "$POOL_DIR" rev-parse HEAD)
+  before_sub=$unpushed
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched from a slot holding an unpushed submodule commit"
+  assert_contains "$out" "refusing to discard uncommitted work" \
+    "an unpushed submodule commit was not refused as uncommitted work"
+  assert_not_contains "$out" "stale submodule checkout" \
+    "an unpushed submodule commit was misreported as a stale pin"
+  assert_not_contains "$out" "is checked out at" \
+    "an unpushed submodule commit still drew the stale-pin diagnosis"
+  [ "$(git -C "$POOL_DIR/ui" rev-parse HEAD)" = "$before_sub" ] \
+    || fail "spawn moved the submodule off its unpushed commit"
+  git -C "$POOL_DIR/ui" cat-file -e "$unpushed^{commit}" \
+    || fail "the unpushed submodule commit did not survive the refusal"
+  assert_grep 'unlanded submodule work' "$POOL_DIR/ui/unlanded.txt" \
+    "spawn discarded the unpushed submodule work while refusing the pool"
+  [ "$(git -C "$POOL_DIR" rev-parse HEAD)" = "$before" ] \
+    || fail "spawn moved HEAD while refusing a slot holding an unpushed submodule commit"
+  pass "an unpushed submodule commit keeps the uncommitted-work refusal and survives it"
+}
+
+test_work_inside_submodule_is_still_uncommitted_work() {
+  local rec id out status
+  id='pool-sub-work-r8'
+  rec=$(make_submodule_case sub-work "$id")
+  read_submodule_case "$rec"
+  strand_submodule_pin_via_spawn 'pool-sub-work-seed-r8'
+  # Put the submodule back on the pin the base records, so the ONLY deviation is
+  # real work inside it. This must never be softened into a stale-pin diagnosis.
+  git -C "$POOL_DIR/ui" checkout --quiet "$SUBPIN2"
+  printf 'work that must survive\n' > "$POOL_DIR/ui/keep-me.txt"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched from a slot holding work inside a submodule"
+  assert_contains "$out" "refusing to discard uncommitted work" \
+    "work inside a submodule was not refused as uncommitted work"
+  assert_not_contains "$out" "stale submodule checkout" \
+    "real work inside a submodule was misreported as a stale pin"
+  assert_grep 'work that must survive' "$POOL_DIR/ui/keep-me.txt" \
+    "spawn discarded work inside the submodule while refusing the pool"
+  pass "work inside a submodule is still refused as uncommitted work, not called stale"
+}
+
+test_stale_pin_carrying_real_work_is_not_called_stale() {
+  local rec id out status
+  id='pool-sub-both-r9'
+  rec=$(make_submodule_case sub-both "$id")
+  read_submodule_case "$rec"
+  strand_submodule_pin_via_spawn 'pool-sub-both-seed-r9'
+  # Stale pin AND real work inside it: calling this merely stale would be wrong, so
+  # the refusal must stay the conservative one.
+  printf 'work that must survive\n' > "$POOL_DIR/ui/keep-me.txt"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched from a slot with a stale pin and work inside it"
+  assert_contains "$out" "refusing to discard uncommitted work" \
+    "a stale pin carrying real work was not refused as uncommitted work"
+  assert_not_contains "$out" "stale submodule checkout" \
+    "a submodule holding real work was reported as merely stale"
+  assert_grep 'work that must survive' "$POOL_DIR/ui/keep-me.txt" \
+    "spawn discarded work inside the submodule while refusing the pool"
+  pass "a stale pin carrying real work is refused conservatively, never called stale"
+}
+
+test_stale_pin_beside_other_dirt_reports_one_verdict() {
+  local rec id out status
+  id='pool-sub-mixed-r11'
+  rec=$(make_submodule_case sub-mixed "$id")
+  read_submodule_case "$rec"
+  strand_submodule_pin_via_spawn 'pool-sub-mixed-seed-r11'
+  # Git sorts status paths, so the stale 'ui' entry is scanned before this file.
+  # The conservative verdict must not arrive contradicted by a stale-pin line.
+  printf 'notes the operator still wants\n' > "$POOL_DIR/zz-notes.txt"
+
+  out=$(run_spawn "$id" --mode no-mistakes --yolo off)
+  status=$?
+  [ "$status" -ne 0 ] || fail "spawn launched from a slot with a stale pin beside an untracked file"
+  assert_contains "$out" "refusing to discard uncommitted work" \
+    "a stale pin beside an untracked file was not refused as uncommitted work"
+  assert_not_contains "$out" "stale submodule checkout" \
+    "a slot carrying more than a stale pin was reported as merely stale"
+  assert_not_contains "$out" "is checked out at" \
+    "the stale-pin diagnosis was printed alongside the conservative refusal"
+  assert_grep 'notes the operator still wants' "$POOL_DIR/zz-notes.txt" \
+    "spawn discarded the untracked file while refusing the pool"
+  pass "a stale pin beside other dirt yields the conservative refusal alone, with no stale-pin line"
+}
+
+test_stale_pool_base_refreshes_before_branching
+test_non_main_default_branch_refreshes_before_branching
+test_direct_pr_and_scout_refresh_before_launch
+test_dirty_pool_refuses_without_discarding_work
+test_unresolved_remote_default_refuses_pool
+test_unreachable_origin_refuses_stale_pool_base
+test_stale_submodule_pin_explains_itself
+test_unpushed_submodule_commit_is_still_uncommitted_work
+test_work_inside_submodule_is_still_uncommitted_work
+test_stale_pin_carrying_real_work_is_not_called_stale
+test_stale_pin_beside_other_dirt_reports_one_verdict
+
+echo "# all fm-spawn-pool-base-freshen tests passed"

package/.agents/tests/fm-spawn-worktree-settle.test.sh

@@ -0,0 +1,147 @@
+#!/usr/bin/env bash
+# Regression test for the fm-spawn.sh treehouse-get worktree-detection settle
+# loop (bin/fm-spawn.sh, the `for _ in $(seq 1 60)` loop after `treehouse get`).
+#
+# On some tmux/WSL setups a brand-new window's pane_current_path transiently
+# reports a stale, unrelated-but-real path on the very first poll, before the
+# pane actually settles into the worktree treehouse get moved it to. That stale
+# path still passes the loop's "differs from the project" check and
+# validate_spawn_worktree's "is a real, distinct worktree" check (it IS a real
+# git checkout, just the wrong one), so a naive single-read loop silently
+# records the wrong worktree= in state/<id>.meta. This test simulates that
+# transient-then-settled pane_current_path sequence with a fake tmux and
+# asserts the recorded worktree resolves to the real, settled worktree, never
+# the stale first read.
+set -u
+
+# shellcheck source=tests/lib.sh
+. "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+
+SPAWN="$ROOT/bin/fm-spawn.sh"
+TMP_ROOT=$(fm_test_tmproot fm-spawn-worktree-settle)
+
+# make_settle_fakebin <dir> builds a fake tmux whose `#{pane_current_path}`
+# query returns FM_FAKE_PANE_STALE for the first FM_FAKE_PANE_STALE_READS
+# calls, then FM_FAKE_PANE_PATH forever after - reproducing a pane that
+# transiently reports a stale cwd before settling into the real worktree.
+make_settle_fakebin() {
+  local dir=$1 fakebin
+  fakebin=$(fm_fakebin "$dir")
+  cat > "$fakebin/tmux" <<'SH'
+#!/usr/bin/env bash
+set -u
+case "$*" in
+  *"#{pane_current_path}"*)
+    countfile="${FM_FAKE_PANE_COUNTFILE:?FM_FAKE_PANE_COUNTFILE unset}"
+    n=0
+    [ -f "$countfile" ] && n=$(cat "$countfile")
+    n=$((n + 1))
+    printf '%s\n' "$n" > "$countfile"
+    if [ "$n" -le "${FM_FAKE_PANE_STALE_READS:-0}" ]; then
+      printf '%s\n' "${FM_FAKE_PANE_STALE:-}"
+    else
+      printf '%s\n' "${FM_FAKE_PANE_PATH:-}"
+    fi
+    exit 0
+    ;;
+esac
+case "${1:-}" in
+  display-message) printf 'firstmate\n'; exit 0 ;;
+  list-windows) exit 0 ;;
+  has-session|new-session|new-window|kill-window) exit 0 ;;
+  send-keys) exit 0 ;;
+esac
+exit 0
+SH
+  chmod +x "$fakebin/tmux"
+  fm_fake_exit0 "$fakebin" treehouse
+  printf '%s\n' "$fakebin"
+}
+
+# make_settle_case <name> <id> <stale_reads> builds a home, a primary project
+# with a real worktree (the eventual settled path), and a separate real git
+# repo standing in for the stale path (a real checkout of something else
+# entirely, distinct from both the project and the worktree - mirroring the
+# live incident where the stale read was another real firstmate home).
+make_settle_case() {
+  local name=$1 id=$2 stale_reads=$3 case_dir home proj wt stale fakebin countfile
+  case_dir="$TMP_ROOT/$name"
+  home="$case_dir/home"
+  proj="$case_dir/project"
+  wt="$case_dir/wt"
+  stale="$case_dir/stale-other-checkout"
+  countfile="$case_dir/pane-call-count"
+  fakebin=$(make_settle_fakebin "$case_dir/fake")
+  mkdir -p "$home/data" "$home/projects" "$home/state" "$home/config"
+  printf 'codex\n' > "$home/config/crew-harness"
+  fm_git_worktree "$proj" "$wt" "wt-$name"
+  fm_git_init_commit "$stale"
+  mkdir -p "$home/data/$id"
+  printf 'brief for %s\n' "$id" > "$home/data/$id/brief.md"
+  touch "$home/state/.last-watcher-beat"
+  printf '%s\n' "$case_dir|$home|$proj|$wt|$stale|$fakebin|$countfile|$stale_reads"
+}
+
+read_settle_record() {
+  IFS='|' read -r _ HOME_DIR PROJ_DIR WT_DIR STALE_DIR FAKEBIN_DIR COUNTFILE STALE_READS <<EOF
+$1
+EOF
+}
+
+run_settle_spawn() {
+  local id=$1
+  FM_ROOT_OVERRIDE='' FM_HOME="$HOME_DIR" \
+    FM_STATE_OVERRIDE="$HOME_DIR/state" FM_DATA_OVERRIDE="$HOME_DIR/data" \
+    FM_PROJECTS_OVERRIDE="$HOME_DIR/projects" FM_CONFIG_OVERRIDE="$HOME_DIR/config" \
+    FM_SPAWN_NO_GUARD=1 TMUX="fake,1,0" \
+    FM_FAKE_PANE_PATH="$WT_DIR" FM_FAKE_PANE_STALE="$STALE_DIR" \
+    FM_FAKE_PANE_STALE_READS="$STALE_READS" FM_FAKE_PANE_COUNTFILE="$COUNTFILE" \
+    PATH="$FAKEBIN_DIR:$PATH" \
+    "$SPAWN" "$id" "$PROJ_DIR" --mode no-mistakes --yolo off 2>&1
+}
+
+# A single stale first read (the exact incident) must not be accepted: the
+# loop should keep polling until two consecutive reads agree, landing on the
+# real settled worktree instead.
+test_single_stale_first_read_is_not_accepted() {
+  local rec id out status
+  id=settle-single-stale-z1
+  rec=$(make_settle_case settle-single "$id" 1)
+  read_settle_record "$rec"
+
+  out=$(run_settle_spawn "$id")
+  status=$?
+  expect_code 0 "$status" "spawn should succeed once the pane settles"
+  assert_contains "$out" "spawned $id" "spawn did not report success"
+  assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
+    "meta did not record the settled worktree"
+  assert_no_grep "worktree=$STALE_DIR" "$HOME_DIR/state/$id.meta" \
+    "meta wrongly recorded the transient stale path as the worktree"
+  pass "a single transient stale pane_current_path read is not accepted as the worktree"
+}
+
+# A pane that reports the real worktree from the very first read still only
+# costs the loop's existing one-second inter-poll sleep to confirm - not an
+# extra full cycle on top of that.
+test_already_settled_pane_costs_one_confirm_sleep() {
+  local rec id out status start end elapsed
+  id=settle-already-settled-z2
+  rec=$(make_settle_case settle-already-settled "$id" 0)
+  read_settle_record "$rec"
+
+  start=$(date +%s)
+  out=$(run_settle_spawn "$id")
+  status=$?
+  end=$(date +%s)
+  elapsed=$((end - start))
+  expect_code 0 "$status" "spawn should succeed when the pane is already settled"
+  assert_grep "worktree=$WT_DIR" "$HOME_DIR/state/$id.meta" \
+    "meta did not record the already-settled worktree"
+  [ "$elapsed" -le 5 ] || fail "already-settled pane took ${elapsed}s to confirm - expected close to the single inter-poll sleep"
+  pass "an already-settled pane confirms via the existing inter-poll sleep, not an extra full cycle"
+}
+
+test_single_stale_first_read_is_not_accepted
+test_already_settled_pane_costs_one_confirm_sleep
+
+echo "# all fm-spawn-worktree-settle tests passed"