devlyn-cli 4.3.4 → 4.3.6

package/bin/devlyn.js

@@ -1564,8 +1564,8 @@ function cleanupCurrentFingerprints() {
   return Object.fromEntries([...CLEANUP_CORE, '_shared'].map((name) => [name, fingerprint(path.join(CONFIG_SOURCE, 'skills', name))]));
 }
 
-function cleanupGit(root, args) {
-  return spawnSync('git', ['-C', root, ...args], { env: { ...gitEnvironment(), GIT_OPTIONAL_LOCKS: '0' }, encoding: 'utf8' });
+function cleanupGit(root, args, options = {}) {
+  return spawnSync('git', ['-C', root, ...args], { env: { ...gitEnvironment(), GIT_OPTIONAL_LOCKS: '0' }, encoding: 'utf8', ...options });
 }
 
 let cleanupPythonBinary;
@@ -1834,43 +1834,114 @@ function cleanupDeliver(scope, items, current) {
     '--branch', branch, '--worktree', worktree, '--repository', scope.remote.repository,
     '--remote', 'origin', '--base', scope.remote.base], scope.root).stdout);
   if (allocated?.status !== 'ALLOCATED') return { error: cleanupReason('delivery-failed', { detail: allocated?.reason || 'allocation failed' }) };
-  const release = (error) => {
+  const release = (error = null) => {
     for (const args of [['worktree', 'remove', '--force', worktree], ['branch', '-D', branch]]) {
       const result = cleanupGit(scope.root, args);
-      if (result.error || result.status !== 0) return { error: cleanupReason(error.code, { ...error.params,
+      if (result.error || result.status !== 0) return { error: cleanupReason(error?.code || 'delivery-failed', { ...error?.params,
         releaseError: result.error?.message || result.stderr.trim(), worktree, receipt: allocated.receipt }) };
     }
     fs.rmSync(path.dirname(allocated.receipt), { recursive: true, force: true });
-    return { error };
+    return error ? { error } : {};
   };
   let prepared;
-  try { prepared = cleanupDeliveryCommit(worktree, items, current, release); }
+  try { prepared = cleanupDeliveryCommit(worktree, items, current, release, cleanupRemovedUpstream(scope.root, worktree)); }
   catch (error) { return release(cleanupReason('apply-failed', { detail: error.message })); }
   if (prepared.error) return prepared;
+  // Every reviewed copy is already gone from the remote base: the checkout only has to take it.
+  if (!prepared.acceptance) return cleanupUpdateCheckout(scope);
   const completed = lastJson(run(['complete', '--receipt', allocated.receipt, '--acceptance', prepared.acceptance, '--writers-stopped'], scope.root).stdout);
   const status = completed?.delivery_status || completed?.status;
-  if (status === 'COMPLETE' || status === 'MERGED') return { delivery: { state: 'merged', url: completed.pr || null } };
+  if (status === 'COMPLETE' || status === 'MERGED') return { ...cleanupUpdateCheckout(scope), delivery: { state: 'merged', url: completed.pr || null } };
   if (completed?.pr) return { delivery: { state: 'pr-open', url: completed.pr } };
   const reason = completed?.reason || 'delivery did not complete';
   const auth = /\b(authentication|unauthorized|gh auth login|could not read Username|HTTP 40[13])\b/i.test(reason);
   return { error: cleanupReason(auth ? 'auth-failed' : 'delivery-failed', { detail: reason, ...(completed?.resume ? { resume: completed.resume } : {}) }) };
 }
 
+// Whether the remote base (the allocated worktree's HEAD) removed a copy this checkout tracks: the
+// base holds no path of that name in any spelling, and the checkout holds the copy, under its
+// tracked spelling, as it was where the two histories meet. A copy committed only here, or changed
+// here since, is not one the base removed.
+function cleanupRemovedUpstream(root, worktree) {
+  const read = (cwd, args, options) => {
+    const result = cleanupGit(cwd, args, options);
+    return !result.error && result.status === 0 ? result.stdout : null;
+  };
+  const object = (spec) => read(root, ['rev-parse', '--verify', '--quiet', spec])?.trim() || null;
+  const base = read(worktree, ['rev-parse', 'HEAD'])?.trim();
+  const fork = base ? read(root, ['merge-base', 'HEAD', base])?.trim() : null;
+  let upstream; // the base's paths, folded to lower case, read once and only when needed
+  return (relative) => {
+    if (!fork) return false;
+    if (upstream === undefined) {
+      upstream = read(root, ['ls-tree', '-r', '-z', '--name-only', base], { maxBuffer: 1 << 30 })
+        ?.split('\0').filter(Boolean).map((name) => name.toLowerCase()) ?? null;
+    }
+    const lower = relative.toLowerCase();
+    if (!upstream || upstream.some((name) => name === lower || name.startsWith(`${lower}/`))) return false;
+    // The tracked spelling, which a case-insensitive file system lets differ from the one on disk.
+    const tracked = read(root, ['ls-files', '-z', '--', `:(icase,literal)${relative}`])?.split('\0').find(Boolean);
+    const spelled = tracked?.slice(0, relative.length);
+    if (!spelled || spelled.toLowerCase() !== lower) return false;
+    const before = object(`${fork}:${spelled}`);
+    return before !== null && before === object(`HEAD:${spelled}`);
+  };
+}
+
+// The copies the remote base dropped stay in this checkout until it takes that base: a checkout on
+// the base branch is fast-forwarded to it, as a task's owner reconciles after delivery. The base is
+// fetched into a ref this call owns (FETCH_HEAD can be rewritten by another fetch meanwhile) and
+// merged by its commit, only while the checkout is still the one checked before the fetch, and the
+// result must be that commit. Another branch, or a fast-forward Git refuses (local changes or ignored
+// files in the way, local commits), is left as it is.
+function cleanupUpdateCheckout(scope) {
+  const failed = (detail) => ({ error: cleanupReason('update-checkout', { detail }) });
+  const read = (args) => {
+    const result = cleanupGit(scope.root, args);
+    return !result.error && result.status === 0 ? result.stdout.trim() : null;
+  };
+  const checkout = () => [read(['symbolic-ref', '--quiet', '--short', 'HEAD']), read(['rev-parse', 'HEAD'])];
+  const [branch, head] = checkout();
+  if (branch !== scope.remote.base || !head) return failed(`${branch || 'a detached HEAD'} is checked out`);
+  const ref = `refs/devlyn/cleanup/${crypto.randomBytes(8).toString('hex')}`;
+  try {
+    const fetched = cleanupGit(scope.root, ['fetch', '--quiet', '--no-write-fetch-head', 'origin', `+refs/heads/${scope.remote.base}:${ref}`]);
+    if (fetched.error || fetched.status !== 0) return failed(fetched.error?.message || fetched.stderr.trim());
+    const target = read(['rev-parse', '--verify', `${ref}^{commit}`]);
+    const [now, at] = checkout();
+    if (!target || now !== branch || at !== head) return failed('the checkout changed while the base was fetched');
+    // The branch's own merge options (`--squash`, `-s ours`) would turn this into something else.
+    const merged = cleanupGit(scope.root, ['-c', `branch.${branch}.mergeOptions=`,
+      'merge', '--ff-only', '--no-squash', '--no-autostash', '--no-overwrite-ignore', '--quiet', target]);
+    if (merged.error || merged.status !== 0) return failed(merged.error?.message || merged.stderr.trim());
+    const [after, landed] = checkout();
+    return after === branch && landed === target ? {} : failed('the fast-forward did not land on the base');
+  } finally {
+    cleanupGit(scope.root, ['update-ref', '-d', ref]);
+  }
+}
+
 // Inside the allocated worktree: prove every reviewed item, remove them, commit, and write the
 // acceptance completion binds. A failure releases the worktree; so does a throw, in the caller.
-function cleanupDeliveryCommit(worktree, items, current, release) {
+// With every reviewed copy already removed by the remote base, the worktree is released with
+// nothing to deliver.
+function cleanupDeliveryCommit(worktree, items, current, release, removedUpstream) {
   const fresh = cleanupProjectScope(worktree, current);
   const available = new Map(fresh.items.map((item) => [`${item.kind}\u0000${item.relative}`, item]));
   const pairs = items.map((reviewed) => {
     const fresh = available.get(`${reviewed.kind}\u0000${reviewed.relative}`);
     return { reviewed, fresh, before: fresh && cleanupPreimage(fresh.path) };
   });
-  const stale = pairs.filter(({ reviewed, fresh, before }) => !fresh || fresh.action !== reviewed.action || fresh.route !== 'delivery'
-    || before.type !== reviewed.before.type || before.sha256 !== reviewed.before.sha256);
+  const stale = pairs.filter(({ reviewed, fresh, before }) => (fresh
+    ? fresh.action !== reviewed.action || fresh.route !== 'delivery'
+      || before.type !== reviewed.before.type || before.sha256 !== reviewed.before.sha256
+    : !removedUpstream(reviewed.relative)));
   // Check the entire batch before mutating even one item; the remote base cannot replace the reviewed preimage.
   if (stale.length) return release(cleanupReason('stale-plan', { detail: stale.map(({ reviewed }) => reviewed.relative).join(', ') }));
+  const present = pairs.filter(({ fresh }) => fresh);
+  if (!present.length) return release();
   const applied = [];
-  for (const { reviewed, fresh } of pairs) {
+  for (const { reviewed, fresh } of present) {
     const error = cleanupApplyItem({ ...fresh, before: reviewed.before });
     if (error) return release(cleanupReason(error.code, { ...error.params, detail: reviewed.relative }));
     applied.push(fresh.relative);

package/bin/skill-history.json

@@ -53,6 +53,7 @@
       "430d156eb8c62c7edba3d660050f90b267f928976c3a3688e95d54f00dc34747",
       "450d578ef177a9e8f0b693940ad64b41c1d9719975ba6305f62a7c82ac3a892f",
       "4685be6a94ad5587ce53785c14a60cccf9a852d9d23391dba0a5bcd0c64931cf",
+      "484db9dd2635de5f5acbcf692e2f329f33c0a483951e27bcd77bcbafbc052e19",
       "4ecb004b24a8adfe41c7416c3fa24e62cf76baa3b276ae1ce5091caef77e57b8",
       "4fed91aed4dc1cd28a9e07229dbe9b7f6d8127e5f763dde8f76bb1b6f6855cce",
       "514bfaf5667af3c9d4d36f391e6567a5eb759c6dfb06a5c3ea23cf29692844ef",
@@ -82,6 +83,7 @@
       "6d1a5458b23196b6f6fde6b7e9dc097ed173cb5914de439e512a032ca1892812",
       "6e70044cab5a3fb1f78b7148c2111e4298ce8f5f8e902220430ca316bb61255d",
       "6fa2b5e089dcd00613c6e9800d2e763da9e5b2c80e6a7ef5d54d5ad7113e8399",
+      "713921f9a442770fc4de24b990dee6a4a5358a0d69bc26af80c33dc6f15a7274",
       "71fb125e20420d6f3fcd3396093fcdc8d552bab9626c3cbd962351e0d19adac8",
       "725395f70eec7e2ceae1f3aa122893433923b098a1e0d6202dd410979ef4eea0",
       "72baab9daecfdbcafb2f9484a16c2e89fc6ffc5fc693f1a2627042f1e8197f06",
@@ -338,6 +340,7 @@
       "65770e3f20c3a3afd2822e9acdcfc80b827f84a7737010b79332da70d431b05d",
       "65c781764633b912e5947362eba0837c8027461a904975401d79ad4fe8714084",
       "694c8920e50d92cba46dbb27eb44dd88035a89ed625d3cbf9f2bce9366d44c96",
+      "6b403afbf5a117cc08603d3648b9dded4f9ac4ca02fc1d8e1f0035615148bb5c",
       "6c3e2e4b84b0b4f81aed3759704da7c14f3cbabf3beeb0d1654feda3a15a8675",
       "6d9df58c117165e9d297aa6be0df8d076bac1ed49dc29ae93906af1969798ab1",
       "6e7228610628fc4bca31dc0b0aaf5eb4445e1f123f2c54bd13921c5cd01129fe",
@@ -762,6 +765,8 @@
     "4.3.1",
     "4.3.2",
     "4.3.3",
-    "4.3.4"
+    "4.3.4",
+    "4.3.5",
+    "4.3.6"
   ]
 }

package/config/skills/_shared/task-complete.py

@@ -239,14 +239,25 @@ def allocate(args, *, exclude_receipts=()):
         policy(receipt, None)
         receipt["remote_url"] = remote_url(receipt)
         require("\n" not in receipt["remote_url"]["push"] and receipt["remote_url"]["push"] == receipt["remote_url"]["fetch"], "split/multiple remote URLs are unsupported")
-    receipt["baseline"] = local or exact_commit(receipt, args.start, "--start") or remote_base(receipt)
     target = Path(args.worktree).resolve()  # A relative, `..` or symlinked (macOS /tmp) path names its real location.
     require(not target.exists() and all(not target.is_relative_to(p) and not p.is_relative_to(target) for p in map(Path, registrations(receipt))), "linked worktree must be an absent path disjoint from every registered worktree")
     receipt["worktree"] = str(target)
     key = hashlib.sha256(args.branch.encode()).hexdigest()[:24]
     directory = common / "devlyn-completion" / key
-    directory.mkdir(parents=True, exist_ok=False)
     path = directory / "receipt.json"
+    reconciled = [] if local else reconcile(common, path, work, exclude_receipts=exclude_receipts)
+    measured = target
+    while not measured.exists():
+        require(measured.parent != measured, f"no existing ancestor of {target} to measure free space")
+        measured = measured.parent
+    usage = shutil.disk_usage(measured)
+    floor = max(10 * 1024**3, (usage.total + 49) // 50)
+    require(usage.free >= floor,
+            f"BLOCKED:disk {usage.free} bytes ({usage.free / 1024**3:.2f} GiB) free is below the "
+            f"{floor} byte ({floor / 1024**3:.2f} GiB) floor on {measured}; free space "
+            "(for example, run Devlyn disk cleanup or remove finished task worktrees' build output), then allocate again")
+    receipt["baseline"] = local or exact_commit(receipt, args.start, "--start") or remote_base(receipt)
+    directory.mkdir(parents=True, exist_ok=False)
     receipt["id"] = key
     receipt["recovery_ref"] = "refs/devlyn/completed/" + key
     scratch = directory / "scratch"
@@ -270,7 +281,7 @@ def allocate(args, *, exclude_receipts=()):
         atomic_json(path, owned)
     return {"status": "ALLOCATED", "receipt": str(path), "worktree": str(target), "scratch": str(scratch),
             "build_dirs": owned["build_dirs"],
-            "reconciled": [] if local else reconcile(common, path, work, exclude_receipts=exclude_receipts)}
+            "reconciled": reconciled}
 
 
 def exact_commit(receipt, value, flag):
@@ -451,7 +462,15 @@ def validate_pr(receipt, pr):
 
 
 def workspace_identity(work, gitdir):
-    return [[p.stat().st_dev, p.stat().st_ino] for p in (work, gitdir)]
+    return [[info.st_dev, info.st_ino] for info in (work.stat(), gitdir.stat())]
+
+
+def same_workspace_identity(current, recorded):
+    # Device numbers change across restarts: compare inodes and whether the pair shares a filesystem.
+    def shape(identity):
+        (first_dev, first_ino), (second_dev, second_ino) = identity
+        return first_ino, second_ino, first_dev == second_dev
+    return shape(current) == shape(recorded)
 
 
 def inspect_workspace(receipt):
@@ -461,7 +480,7 @@ def inspect_workspace(receipt):
     expected = "refs/heads/" + receipt["branch"]
     require(row.get("branch") == expected, "foreign worktree branch; retain workspace")
     require(git(work, "rev-parse", "--absolute-git-dir") == receipt["worktree_gitdir"] and str(Path(git(work, "rev-parse", "--path-format=absolute", "--git-common-dir")).resolve()) == receipt["common_gitdir"], "worktree Gitdir ownership changed")
-    require(workspace_identity(work, Path(receipt["worktree_gitdir"])) == receipt["worktree_identity"], "worktree/registration was replaced; receipt no longer owns it")
+    require(same_workspace_identity(workspace_identity(work, Path(receipt["worktree_gitdir"])), receipt["worktree_identity"]), "worktree/registration was replaced; receipt no longer owns it")
     require(git(work, "rev-parse", "HEAD") == receipt.get("publish_sha", receipt["baseline"]), "task HEAD changed")
     require(not git(work, "status", "--porcelain", "--untracked-files=all"), "dirty/untracked workspace; retain files and commit only accepted scope")
 
@@ -581,8 +600,8 @@ def clean_scratch(receipt, path, writers_stopped):
         return {"status": "NOT_OWNED"}
     require(writers_stopped, "stop/yield scratch writers, then use --writers-stopped")
     require(scratch == scratch.resolve() and scratch.is_dir(), "owned scratch missing or redirected; retain and inspect")
-    identity = receipt["scratch_identity"]
-    require(workspace_identity(scratch, path.parent) == identity, "scratch directory was replaced; retain")
+    identity = workspace_identity(scratch, path.parent)
+    require(same_workspace_identity(identity, receipt["scratch_identity"]), "scratch directory was replaced; retain")
     require(shutil.rmtree.avoids_symlink_attacks, "safe scratch removal unsupported on this platform; retain")
     require(not any(mount.is_relative_to(scratch) for mount in scratch_mounts()), "scratch contains a mounted filesystem; retain")
     stopped_writers(scratch)
@@ -592,6 +611,7 @@ def clean_scratch(receipt, path, writers_stopped):
         for name in dirs + files:
             item = Path(directory) / name
             info = item.lstat()
+            # During this cleanup, device numbers must stay exact, including every child's device.
             require(info.st_dev == identity[0][0], "scratch contains a mounted filesystem; retain")
             size += info.st_size if stat.S_ISREG(info.st_mode) else 0
     stopped_writers(scratch)
@@ -1061,9 +1081,21 @@ sys.exit(r.returncode)
 
 class CompletionTests(unittest.TestCase):
     def setUp(self):
+        from unittest.mock import Mock, patch
         self.temp = tempfile.TemporaryDirectory(prefix="devlyn-completion-")
         self.addCleanup(self.temp.cleanup)
         self.root = Path(self.temp.name).resolve()
+        (self.root / "sitecustomize.py").write_text(
+            "import importlib.machinery, importlib.util, pathlib, sys\n"
+            "spec = importlib.machinery.PathFinder.find_spec('sitecustomize', [p for p in sys.path if pathlib.Path(p or '.').resolve() != pathlib.Path(__file__).resolve().parent])\n"
+            "if spec is not None and spec.loader is not None:\n"
+            "    spec.loader.exec_module(importlib.util.module_from_spec(spec))\n"
+            "import shutil\nfrom types import SimpleNamespace\n"
+            "shutil.disk_usage = lambda path: SimpleNamespace(total=100 * 1024**3, free=100 * 1024**3)\n",
+            encoding="utf-8")
+        disk_usage = patch.object(shutil, "disk_usage", return_value=Mock(total=100 * 1024**3, free=100 * 1024**3))
+        disk_usage.start()
+        self.addCleanup(disk_usage.stop)
         self.work = self.root / "work"
         self.bare = self.root / "remote.git"
         self.bin = self.root / "bin"
@@ -1075,6 +1107,8 @@ class CompletionTests(unittest.TestCase):
                     "GIT_COMMITTER_NAME": "Fixture", "GIT_COMMITTER_EMAIL": "fixture@example.invalid",
                     "FIXTURE_GH": str(self.data), "REAL_GIT": shutil.which("git"),
                     "GIT_CONFIG_COUNT": "0", "GIT_ALLOW_PROTOCOL": "file"}
+        self.env["PYTHONPATH"] = str(self.root) + os.pathsep + self.env.get("PYTHONPATH", "")
+        self.env["PYTHONDONTWRITEBYTECODE"] = "1"
         for key in list(self.env):
             if key in {"GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_COMMON_DIR"}:
                 del self.env[key]
@@ -1118,6 +1152,80 @@ class CompletionTests(unittest.TestCase):
         self.task = Path(result["worktree"])
         return result
 
+    def allocation_args(self, name, worktree):
+        return argparse.Namespace(repo=str(self.work), task=name, branch="task/" + name,
+                                  repository="test/project", base="main", remote="origin", worktree=str(worktree),
+                                  local_base=None, from_receipt=None, start=None)
+
+    def test_disk_gate_refuses_without_allocation_artifacts(self):
+        # Prediction: below 10 GiB on a 100 GiB filesystem, no receipt, branch or worktree is created.
+        from unittest.mock import Mock, patch
+        target = self.root / "absent" / "new"
+        before = self.g("worktree", "list", "--porcelain")
+        with patch.dict(os.environ, self.env), patch.object(shutil, "disk_usage", return_value=Mock(total=100 * 1024**3, free=9 * 1024**3)) as usage:
+            with self.assertRaisesRegex(CompletionError, r"^BLOCKED:disk") as raised:
+                allocate(self.allocation_args("new", target))
+        usage.assert_called_once_with(self.root)
+        self.assertIn(str(9 * 1024**3), str(raised.exception))
+        self.assertIn(str(10 * 1024**3), str(raised.exception))
+        self.assertIn(str(self.root), str(raised.exception))
+        self.assertIn("allocate again", str(raised.exception))
+        self.assertFalse((self.work / ".git/devlyn-completion").exists())
+        self.assertFalse(target.exists())
+        self.assertFalse(target.parent.exists())
+        self.assertEqual(self.g("branch", "--list", "task/new"), "")
+        self.assertEqual(self.g("worktree", "list", "--porcelain"), before)
+
+    def test_disk_gate_refuses_when_no_ancestor_exists(self):
+        # Prediction: even if the filesystem root is absent, the walk stops before disk usage or artifact creation.
+        from unittest.mock import patch
+        target = self.root / "absent" / "new"
+        exists = Path.exists
+        with patch.object(Path, "exists", lambda path: False if path == target or path in target.parents else exists(path)), \
+                patch.object(shutil, "disk_usage") as usage:
+            with self.assertRaisesRegex(CompletionError, f"no existing ancestor of {re.escape(str(target))} to measure free space"):
+                allocate(self.allocation_args("new", target))
+        usage.assert_not_called()
+        self.assertFalse(target.parent.exists())
+        self.assertFalse(target.exists())
+        self.assertFalse((self.work / ".git/devlyn-completion").exists())
+        self.assertEqual(self.g("branch", "--list", "task/new"), "")
+
+    def test_disk_gate_uses_larger_floor_and_admits_boundary(self):
+        # Prediction: 100 GiB uses a 10 GiB floor; 2 TiB uses the ceiling of 2%, and exactly-at-floor allocates.
+        from unittest.mock import Mock, patch
+        for name, total in (("small", 100 * 1024**3), ("large", 2 * 1024**4)):
+            floor = max(10 * 1024**3, (total + 49) // 50)
+            with self.subTest(name=name):
+                target = self.root / name
+                with patch.dict(os.environ, self.env), patch.object(shutil, "disk_usage", return_value=Mock(total=total, free=floor - 1)):
+                    with self.assertRaisesRegex(CompletionError, r"^BLOCKED:disk"):
+                        allocate(self.allocation_args(name, target))
+                self.assertFalse(target.exists())
+                with patch.dict(os.environ, self.env), patch.object(shutil, "disk_usage", return_value=Mock(total=total, free=floor)):
+                    result = allocate(self.allocation_args(name, target))
+                self.assertEqual((result["status"], result["reconciled"]), ("ALLOCATED", []))
+                self.assertTrue(Path(result["receipt"]).exists())
+                self.assertEqual(Path(result["worktree"]), target)
+
+    def test_reconcile_precedes_refused_disk_gate(self):
+        # Prediction: an earlier MERGED remote delivery is cleaned before the new allocation fails its disk gate.
+        from unittest.mock import Mock, patch
+        self.allocate(); self.accept()
+        self.complete("--mode", "pr", "--writers-stopped")
+        self.merge_pr()
+        previous_receipt, previous_tree = self.receipt, self.task
+        target = self.root / "next"
+        with patch.dict(os.environ, self.env), patch.object(shutil, "disk_usage", return_value=Mock(total=100 * 1024**3, free=9 * 1024**3)):
+            with self.assertRaisesRegex(CompletionError, r"^BLOCKED:disk"):
+                allocate(self.allocation_args("next", target))
+        self.assertEqual(json.loads(previous_receipt.read_text(encoding="utf-8"))["status"], "COMPLETE")
+        self.assertFalse(previous_tree.exists())
+        self.assertEqual(self.g("branch", "--list", "task/fixture"), "")
+        self.assertFalse(target.exists())
+        self.assertFalse((self.work / ".git/devlyn-completion" / hashlib.sha256(b"task/next").hexdigest()[:24]).exists())
+        self.assertEqual(self.g("branch", "--list", "task/next"), "")
+
     def allocate_legacy(self):
         common = Path(self.g("rev-parse", "--absolute-git-dir"))
         key = hashlib.sha256(b"task/fixture").hexdigest()[:24]
@@ -2621,6 +2729,118 @@ ctypes.CDLL(None).pthread_exit(None)
         self.assertEqual(self.g("branch", "--list", "task/fixture"), "")
         self.assertEqual(self.g("ls-remote", "origin", "refs/heads/task/fixture"), "")
 
+    def renumber_receipt_devices(self):
+        receipt = read_json(self.receipt)
+        for key in ("worktree_identity", "scratch_identity"):
+            for entry in receipt[key]:
+                entry[0] += 10000
+        atomic_json(self.receipt, receipt)
+        return receipt
+
+    def test_device_renumbering_allows_completion(self):
+        # Prediction: old device numbers do not invalidate unchanged inodes or require receipt migration.
+        scratch = Path(self.allocate()["scratch"])
+        self.accept()
+        receipt = self.renumber_receipt_devices()
+        (scratch / "target").mkdir()
+        (scratch / "target/object").write_bytes(b"rebuildable")
+        result, _ = self.complete("--mode", "auto", "--writers-stopped")
+        self.assertEqual(result["status"], "COMPLETE")
+        self.assertEqual(result["scratch_cleanup"], {"status": "CLEAN", "logical_bytes_removed": 11})
+        self.assertFalse(self.task.exists())
+        self.assertFalse(any(scratch.iterdir()))
+        saved = read_json(self.receipt)
+        for key in ("worktree_identity", "scratch_identity"):
+            self.assertEqual(saved[key], receipt[key])
+
+    def test_device_renumbering_allows_reconcile(self):
+        # Prediction: allocation reconciles an earlier merged receipt after the same renumbering.
+        scratch = Path(self.allocate()["scratch"])
+        self.accept()
+        self.complete("--mode", "pr", "--writers-stopped")
+        self.merge_pr()
+        self.renumber_receipt_devices()
+        (scratch / "object").write_bytes(b"rebuildable")
+        receipt, task = self.receipt, self.task
+        result = self.allocate("next")
+        self.assertEqual([(row["receipt"], row["status"]) for row in result["reconciled"]], [(str(receipt), "COMPLETE")])
+        self.assertFalse(task.exists())
+        self.assertFalse(any(scratch.iterdir()))
+
+    def test_device_renumbering_rejects_replaced_directories(self):
+        # Keep each original alive so the replacement cannot accidentally reuse its inode.
+        from unittest.mock import patch
+        scratch = Path(self.allocate()["scratch"])
+        receipt = self.renumber_receipt_devices()
+        for directory in (self.task, Path(receipt["worktree_gitdir"]), scratch, self.receipt.parent):
+            with self.subTest(directory=directory):
+                original = self.root / "original"
+                directory.rename(original)
+                if directory == self.receipt.parent:
+                    directory.mkdir()
+                    (original / "scratch").rename(scratch)
+                else:
+                    shutil.copytree(original, directory)
+                try:
+                    self.assertNotEqual(directory.stat().st_ino, original.stat().st_ino)
+                    if directory == self.receipt.parent:
+                        self.assertEqual(scratch.stat().st_ino, receipt["scratch_identity"][0][1])
+                    with patch.dict(os.environ, self.env), self.assertRaisesRegex(CompletionError, "replaced"):
+                        if directory in (scratch, self.receipt.parent):
+                            clean_scratch(receipt, self.receipt, True)
+                        else:
+                            inspect_workspace(receipt)
+                    self.assertTrue(directory.is_dir())
+                finally:
+                    if directory == self.receipt.parent:
+                        scratch.rename(original / "scratch")
+                    shutil.rmtree(directory)
+                    original.rename(directory)
+
+    def test_device_renumbering_rejects_changed_filesystem_relation(self):
+        # Matching inodes alone must not accept a peer that moved to another filesystem.
+        from unittest.mock import patch
+        scratch = Path(self.allocate()["scratch"])
+        receipt = self.renumber_receipt_devices()
+        original_stat = Path.stat
+        for directory in (self.task, Path(receipt["worktree_gitdir"]), scratch, self.receipt.parent):
+            def moved_stat(path, *args, **kwargs):
+                info = original_stat(path, *args, **kwargs)
+                if path == directory:
+                    fields = list(info)
+                    fields[2] += 1
+                    return os.stat_result(fields)
+                return info
+            with self.subTest(directory=directory), patch.dict(os.environ, self.env), patch.object(Path, "stat", moved_stat):
+                with self.assertRaisesRegex(CompletionError, "replaced"):
+                    if directory in (scratch, self.receipt.parent):
+                        clean_scratch(receipt, self.receipt, True)
+                    else:
+                        inspect_workspace(receipt)
+        # Preserve distinct-device relationships too: they must not collapse into one device.
+        for key in ("worktree_identity", "scratch_identity"):
+            receipt[key][0][0] += 1
+            with self.subTest(identity=key), patch.dict(os.environ, self.env), self.assertRaisesRegex(CompletionError, "replaced"):
+                if key == "scratch_identity":
+                    clean_scratch(receipt, self.receipt, True)
+                else:
+                    inspect_workspace(receipt)
+            receipt[key][0][0] -= 1
+
+    def test_device_renumbering_preserves_different_filesystems(self):
+        self.assertTrue(same_workspace_identity([[10, 101], [20, 202]], [[-1, 101], [-2, 202]]))
+
+    def test_device_renumbering_during_scratch_cleanup_is_refused(self):
+        # Reboot tolerance is only for persisted receipts, never a change during this operation.
+        from unittest.mock import Mock, patch
+        scratch = Path(self.allocate()["scratch"])
+        receipt = self.renumber_receipt_devices()
+        identity = workspace_identity(scratch, self.receipt.parent)
+        changed = [[dev + 1, ino] for dev, ino in identity]
+        with patch.dict(clean_scratch.__globals__, {"workspace_identity": Mock(side_effect=[identity, changed])}):
+            with self.assertRaisesRegex(CompletionError, "changed before removal"):
+                clean_scratch(receipt, self.receipt, True)
+
     def test_replaced_tree_and_unsafe_custody(self):
         self.allocate(); self.accept()
         elsewhere = self.root / "elsewhere"

package/config/skills/_shared/task-completion.md

@@ -60,6 +60,8 @@ python3 "$DEVLYN_SHARED_DIR/task-complete.py" allocate --repo . \
 
 Every delivery allocation owns a linked worktree; `--worktree` is required and
 must name an absent path.
+Remote allocation first cleans earlier merged deliveries, then allocation refuses with `BLOCKED:disk`
+without creating a receipt, branch or worktree when that filesystem has less than max(10 GiB, 2%) free; free space and allocate again.
 A publication allocation normally starts at the exact fetched remote base,
 independent of the anchor's branch or dirty state, and leaves the anchor's
 HEAD, index and files untouched. For a commit request, local-only work or
@@ -123,8 +125,9 @@ after merge, so a pending, failed or local-only task keeps it.
 
 Allocation also returns a receipt-owned `scratch` directory for other
 disposable build files, such as writable tool caches. Keep source checkouts,
-Git data, lockfiles, reports and restart evidence outside scratch. Do not create unowned
-temporary build trees or preserve them by copying them into evidence custody.
+Git data, lockfiles, reports and restart evidence outside scratch.
+Direct work keeps its temporary files (logs, downloads, review outputs and build trees) outside the checkout: use scratch when allocated, otherwise the system temporary directory, and never create new top-level `.devlyn/<name>` folders for them.
+Do not preserve temporary build trees by copying them into evidence custody.
 Prefer `TemporaryDirectory`/`finally` for short-lived test fixtures.
 
 After waiting for task writers, `complete --writers-stopped` empties this

package/config/skills/_shared/warm-build-dirs.py

@@ -678,6 +678,14 @@ class WarmTests(unittest.TestCase):
         temporary = tempfile.TemporaryDirectory(prefix="warm-build-dirs-")
         self.addCleanup(temporary.cleanup)
         self.root = Path(temporary.name).resolve()
+        (self.root / "sitecustomize.py").write_text(
+            "import importlib.machinery, importlib.util, pathlib, sys\n"
+            "spec = importlib.machinery.PathFinder.find_spec('sitecustomize', [p for p in sys.path if pathlib.Path(p or '.').resolve() != pathlib.Path(__file__).resolve().parent])\n"
+            "if spec is not None and spec.loader is not None:\n"
+            "    spec.loader.exec_module(importlib.util.module_from_spec(spec))\n"
+            "import shutil\nfrom types import SimpleNamespace\n"
+            "shutil.disk_usage = lambda path: SimpleNamespace(total=100 * 1024**3, free=100 * 1024**3)\n",
+            encoding="utf-8")
         self.anchor, self.work = self.root / "anchor", self.root / "work"
         self.staging = self.root / "scratch"
         self.staging.mkdir()
@@ -689,6 +697,8 @@ class WarmTests(unittest.TestCase):
         self.environment = mock.patch.dict(os.environ, {
             "PATH": f"{bin_dir}{os.pathsep}{os.environ['PATH']}", "FAKE_CARGO": str(self.fixture),
             "FAKE_CARGO_LOG": str(self.log), "GIT_CONFIG_GLOBAL": os.devnull, "GIT_CONFIG_NOSYSTEM": "1",
+            "PYTHONPATH": str(self.root) + os.pathsep + os.environ.get("PYTHONPATH", ""),
+            "PYTHONDONTWRITEBYTECODE": "1",
             "GIT_AUTHOR_NAME": "t", "GIT_AUTHOR_EMAIL": "t@t", "GIT_COMMITTER_NAME": "t", "GIT_COMMITTER_EMAIL": "t@t"})
         self.environment.start()
         self.addCleanup(self.environment.stop)

package/config/skills/devlyn-ideate/references/loop.md

@@ -12,7 +12,7 @@ python3 "$DEVLYN_SKILL_DIR/scripts/queue.py" drain --repo . [--local-only] [--wo
 Both print one JSON object; exit 1 is `BLOCKED` with a `reason`.
 
 - `status` takes `queue.lock` in the repository's Git directory and finishes `add`'s cleanup (step 1); it reports the running `skill` root and version, any `warnings`, reconciled counts (`pending`, `active`, `accepted`, `failed`, `blocked`, `legacy_pending`), the `next` task, `blockers`, deliveries still pending with their resume (drain again until the terminal commit is attached, then the printed completion command; add `--writers-stopped` only after stopping the task's writers), and under `cleanup` the package copies `add` kept or could not remove.
-- `drain` ends `DRAINED` (no runnable task remains; open deliveries show per task), `WAITING` (a task waits with its reason, or legacy rows need planning) or `BLOCKED` (unreadable or ambiguous authoritative queue, invalid invocation, preflight refusal or held drain lock). Progress lines `devlyn-loop: <task>: <event>` go to stderr.
+- `drain` ends `DRAINED` (no runnable task remains; open deliveries show per task), `WAITING` (a task waits with its reason, or legacy rows need planning) or `BLOCKED` (unreadable or ambiguous authoritative queue, invalid invocation, preflight refusal, held drain lock or `BLOCKED:disk` allocation refusal that stops new starts and leaves its task pending). Progress lines `devlyn-loop: <task>: <event>` go to stderr.
 - `--local-only` (alias `--no-push`) keeps the loop local. A manifest `delivery: local-only` and any earlier local receipt of the loop keep that restriction for later drains. A local loop needs no remote; nothing is fetched or pushed. An `auto`/`pr` loop none of whose tasks has a pushed PR runs as a local loop from its capture and the branch it was added on. Once one has, that PR is never rewritten to local and the loop is never run locally: its tasks wait, naming the PR, while other work continues.
 - Worktrees default to `<repo parent>/<repo name>.devlyn.noindex/<loop-id>/<task-id>`; tasks already allocated under an earlier default resume where their receipts record them. On Windows, a default root newly created by the drain gets the not-content-indexed attribute, inherited by new children (content only; names stay indexed). Microsoft Defender scanning is unaffected; use a Dev Drive via `--worktree-root` or an administrator's Defender exclusion for the root.
 

package/config/skills/devlyn-ideate/scripts/queue.py

@@ -1542,11 +1542,18 @@ def drain(args):
                 except (LoopError, OSError) as exc:
                     phase = last["states"][row["identity"]].get("phase", "allocation")
                     wait = f"{phase} blocked: {exc}"
-                    if phase in {"allocation", "inputs", "acceptance", "custody binding", "terminal transition"}:
+                    disk_blocked = phase == "allocation" and str(exc).startswith("task-complete allocate: BLOCKED:disk")
+                    if disk_blocked:
+                        status, reason = "BLOCKED", str(exc)
+                    if not disk_blocked and phase in {"allocation", "inputs", "acceptance", "custody binding", "terminal transition"}:
                         wait += f"; inspect and repair {row['identity']}'s {phase} state, then drain again"
                 if wait:
                     refused[row["identity"]] = wait
-            if any(state["kind"] in {"pending", "active"} for state in last["states"].values()) or counts(last)["legacy_pending"] or refused:
+                    if status == "BLOCKED":
+                        break
+            if status == "BLOCKED" and reason and reason.startswith("task-complete allocate: BLOCKED:disk"):
+                last = view(anchor, common, args.local_only)
+            if status != "BLOCKED" and (any(state["kind"] in {"pending", "active"} for state in last["states"].values()) or counts(last)["legacy_pending"] or refused):
                 status = "WAITING"
         except (LoopError, OSError) as exc:
             status, reason = "BLOCKED", str(exc)
@@ -1799,9 +1806,19 @@ class QueueTests(unittest.TestCase):
         self.temp = tempfile.TemporaryDirectory(prefix="devlyn-queue ✓ ")
         self.addCleanup(self.temp.cleanup)
         self.root = Path(self.temp.name).resolve()
+        (self.root / "sitecustomize.py").write_text(
+            "import importlib.machinery, importlib.util, pathlib, sys\n"
+            "spec = importlib.machinery.PathFinder.find_spec('sitecustomize', [p for p in sys.path if pathlib.Path(p or '.').resolve() != pathlib.Path(__file__).resolve().parent])\n"
+            "if spec is not None and spec.loader is not None:\n"
+            "    spec.loader.exec_module(importlib.util.module_from_spec(spec))\n"
+            "import shutil\nfrom types import SimpleNamespace\n"
+            "shutil.disk_usage = lambda path: SimpleNamespace(total=100 * 1024**3, free=100 * 1024**3)\n",
+            encoding="utf-8")
         self.env = {**os.environ, "GIT_CONFIG_NOSYSTEM": "1", "GIT_CONFIG_GLOBAL": str(self.root / "gitconfig"),
                     "GIT_AUTHOR_NAME": "Fixture", "GIT_AUTHOR_EMAIL": "fixture@example.invalid",
                     "GIT_COMMITTER_NAME": "Fixture", "GIT_COMMITTER_EMAIL": "fixture@example.invalid"}
+        self.env["PYTHONPATH"] = str(self.root) + os.pathsep + self.env.get("PYTHONPATH", "")
+        self.env["PYTHONDONTWRITEBYTECODE"] = "1"
         self.anchor = self.root / "repo"
         subprocess.run(["git", "init", "-q", "--initial-branch=main", str(self.anchor)], check=True, env=self.env)
         (self.anchor / ".gitignore").write_text(".devlyn/\n", encoding="utf-8")

package/native/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "devlyn",
-  "version": "4.3.4",
+  "version": "4.3.6",
   "description": "Devlyn harness skills",
   "skills": "./skills/"
 }