devrites 5.14.4 → 6.0.1

package/engine/internal/parallel/ops_test.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -167,61 +168,261 @@ func TestIntegrateSurfacesStuckStagingWorktree(t *testing.T) {
 }
 
 // TestCleanupNeverTouchesForeignWorktreePath proves a lease whose
-// worktree_path points outside the batch scratch layout is never salvaged
+// worktree_path is not the exact directory Create wrote is never salvaged
 // into nor deleted — the lease field is advisory, not a RemoveAll license.
+// Two spellings of "not ours" are covered: a path outside the batch scratch
+// layout, and the deterministic scratch path itself reached through a symlink.
 func TestCleanupNeverTouchesForeignWorktreePath(t *testing.T) {
-	repo, base := setupRepo(t)
 	slug, batch := "demo-feature", "batch1"
-	lease, err := Create(CreateOpts{
-		Root:    repo,
-		Slug:    slug,
-		BatchID: batch,
-		BaseSHA: base,
-		Slices: []SlicePaths{
-			{ID: "slice-a", Paths: []string{"src/a.go"}},
-			{ID: "slice-b", Paths: []string{"src/b.go"}},
-		},
-	})
-	if err != nil {
-		t.Fatal(err)
-	}
-	foreign := filepath.Join(t.TempDir(), "precious")
-	if err := os.MkdirAll(foreign, 0o755); err != nil {
-		t.Fatal(err)
-	}
-	if err := os.WriteFile(filepath.Join(foreign, "keep.txt"), []byte("x"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	lease.Slices[0].WorktreePath = foreign
-	// A forged branch outside the batch namespace must survive too.
-	gitOk(t, repo, "branch", "user/topic", base)
-	lease.Slices[0].Branch = "user/topic"
-	leasePath, err := LeasePath(repo, slug)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if err := WriteLease(leasePath, lease); err != nil {
-		t.Fatal(err)
+	slices := []SlicePaths{
+		{ID: "slice-a", Paths: []string{"src/a.go"}},
+		{ID: "slice-b", Paths: []string{"src/b.go"}},
 	}
 
-	var warnings []string
-	swapSeams(t)
-	warnf = func(format string, args ...any) {
-		warnings = append(warnings, fmt.Sprintf(format, args...))
-	}
-	if _, err := Cleanup(repo, slug, true); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := os.Stat(filepath.Join(foreign, "keep.txt")); err != nil {
-		t.Fatalf("foreign path was touched: %v", err)
-	}
-	if tip := gitOk(t, repo, "rev-parse", "user/topic"); tip != base {
-		t.Fatalf("foreign branch user/topic moved to %s, want %s", tip, base)
-	}
-	joined := strings.Join(warnings, "\n")
-	if !strings.Contains(joined, "outside") {
-		t.Fatalf("expected warnings naming foreign path and branch, got:\n%s", warnings)
-	}
+	t.Run("worktree_path outside the scratch root", func(t *testing.T) {
+		repo, base := setupRepo(t)
+		lease, err := Create(CreateOpts{
+			Root:    repo,
+			Slug:    slug,
+			BatchID: batch,
+			BaseSHA: base,
+			Slices:  slices,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		foreign := filepath.Join(t.TempDir(), "precious")
+		if err := os.MkdirAll(foreign, 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(filepath.Join(foreign, "keep.txt"), []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		lease.Slices[0].WorktreePath = foreign
+		// A forged branch outside the batch namespace must survive too.
+		gitOk(t, repo, "branch", "user/topic", base)
+		lease.Slices[0].Branch = "user/topic"
+		leasePath, err := LeasePath(repo, slug)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := WriteLease(leasePath, lease); err != nil {
+			t.Fatal(err)
+		}
+
+		var warnings []string
+		swapSeams(t)
+		warnf = func(format string, args ...any) {
+			warnings = append(warnings, fmt.Sprintf(format, args...))
+		}
+		if _, err := Cleanup(repo, slug, true); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := os.Stat(filepath.Join(foreign, "keep.txt")); err != nil {
+			t.Fatalf("foreign path was touched: %v", err)
+		}
+		if tip := gitOk(t, repo, "rev-parse", "user/topic"); tip != base {
+			t.Fatalf("foreign branch user/topic moved to %s, want %s", tip, base)
+		}
+		joined := strings.Join(warnings, "\n")
+		if !strings.Contains(joined, "outside") {
+			t.Fatalf("expected warnings naming foreign path and branch, got:\n%s", warnings)
+		}
+	})
+
+	// A stale lease still names exactly the path Create wrote; here the batch
+	// directory was replaced by a symlink, so the directory a forced cleanup
+	// would delete lives outside the scratch root. filepath.Abs matches both sides
+	// of the ownership check because neither side resolves symlinks.
+	t.Run("scratch worktree_path reached through a symlink", func(t *testing.T) {
+		repo, base := setupRepo(t)
+		if _, err := Create(CreateOpts{
+			Root:    repo,
+			Slug:    slug,
+			BatchID: batch,
+			BaseSHA: base,
+			Slices:  slices,
+		}); err != nil {
+			t.Fatal(err)
+		}
+
+		// An unrelated repository outside the workspace, carrying a committed file
+		// and a dirty one on the allowlisted path: a salvage would commit inside it
+		// and a RemoveAll would delete the tree.
+		outside := t.TempDir()
+		sliceA := filepath.Join(outside, "slice-a")
+		if err := os.MkdirAll(filepath.Join(sliceA, "src"), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		gitOk(t, sliceA, "init")
+		gitOk(t, sliceA, "checkout", "-b", "main")
+		if err := os.WriteFile(filepath.Join(sliceA, "src", "a.go"), []byte("package main\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		gitOk(t, sliceA, "add", ".")
+		gitOk(t, sliceA, "commit", "-m", "unrelated base")
+		unrelatedTip := gitOk(t, sliceA, "rev-parse", "HEAD")
+		if err := os.WriteFile(filepath.Join(sliceA, "src", "a.go"), []byte("package main\n\nfunc Unrelated() {}\n"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+
+		batchDir := filepath.Join(ScratchRoot(repo), batch)
+		if err := os.RemoveAll(batchDir); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(outside, batchDir); err != nil {
+			t.Fatal(err)
+		}
+
+		// The lease on disk is what Create wrote; only the filesystem moved.
+		// Assert the path cleanup will use really does resolve through the symlink,
+		// so this case cannot pass without traversing it.
+		leasePath, err := LeasePath(repo, slug)
+		if err != nil {
+			t.Fatal(err)
+		}
+		lease, err := ReadLease(leasePath)
+		if err != nil {
+			t.Fatal(err)
+		}
+		claimed := lease.Slices[0].WorktreePath
+		if want := WorkerWorktreePath(repo, batch, "slice-a"); claimed != want {
+			t.Fatalf("lease worktree_path %q, want the deterministic %q", claimed, want)
+		}
+		resolved, err := filepath.EvalSymlinks(claimed)
+		if err != nil {
+			t.Fatalf("claimed worktree_path does not resolve: %v", err)
+		}
+		realSliceA, err := filepath.EvalSymlinks(sliceA)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if resolved != realSliceA {
+			t.Fatalf("%q resolved to %q, want the symlink target %q", claimed, resolved, realSliceA)
+		}
+
+		var warnings []string
+		swapSeams(t)
+		warnf = func(format string, args ...any) {
+			warnings = append(warnings, fmt.Sprintf(format, args...))
+		}
+		if _, err := Cleanup(repo, slug, true); err != nil {
+			t.Fatal(err)
+		}
+
+		if _, err := os.Stat(filepath.Join(sliceA, "src", "a.go")); err != nil {
+			t.Fatalf("worktree reached through a symlinked batch directory was deleted: %v", err)
+		}
+		if tip := gitOk(t, sliceA, "rev-parse", "HEAD"); tip != unrelatedTip {
+			t.Fatalf("salvage committed inside an unrelated repository: tip %s want %s", tip, unrelatedTip)
+		}
+		if joined := strings.Join(warnings, "\n"); !strings.Contains(joined, "worktree_path") {
+			t.Fatalf("expected a warning naming the refused worktree_path, got:\n%s", warnings)
+		}
+	})
+
+	// A symlink that stays inside the scratch root still redirects the delete
+	// onto a directory the lease does not name.
+	t.Run("scratch worktree_path reached through a symlink inside the scratch root", func(t *testing.T) {
+		repo, base := setupRepo(t)
+		if _, err := Create(CreateOpts{
+			Root:    repo,
+			Slug:    slug,
+			BatchID: batch,
+			BaseSHA: base,
+			Slices:  slices,
+		}); err != nil {
+			t.Fatal(err)
+		}
+		sibling := filepath.Join(ScratchRoot(repo), "sibling-batch")
+		keep := filepath.Join(sibling, "slice-a", "keep.txt")
+		if err := os.MkdirAll(filepath.Dir(keep), 0o755); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.WriteFile(keep, []byte("x"), 0o644); err != nil {
+			t.Fatal(err)
+		}
+		batchDir := filepath.Join(ScratchRoot(repo), batch)
+		if err := os.RemoveAll(batchDir); err != nil {
+			t.Fatal(err)
+		}
+		if err := os.Symlink(sibling, batchDir); err != nil {
+			t.Fatal(err)
+		}
+
+		swapSeams(t)
+		warnf = func(string, ...any) {}
+		if _, err := Cleanup(repo, slug, true); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := os.Stat(keep); err != nil {
+			t.Fatalf("directory under an in-scratch symlink was deleted: %v", err)
+		}
+	})
+
+	// Ownership is decided by what git registered when Create ran, not by the
+	// lease. A lease naming a deterministic in-scratch path that Create never
+	// made (and a stray sibling no lease names) must survive a forced cleanup,
+	// while the real worktrees are still removed.
+	t.Run("in-scratch path Create never made", func(t *testing.T) {
+		repo, base := setupRepo(t)
+		lease, err := Create(CreateOpts{
+			Root:    repo,
+			Slug:    slug,
+			BatchID: batch,
+			BaseSHA: base,
+			Slices:  slices,
+		})
+		if err != nil {
+			t.Fatal(err)
+		}
+		forged := WorkerWorktreePath(repo, batch, "slice-x")
+		stray := filepath.Join(ScratchRoot(repo), batch, "stray")
+		for _, d := range []string{forged, stray} {
+			if err := os.MkdirAll(d, 0o755); err != nil {
+				t.Fatal(err)
+			}
+			if err := os.WriteFile(filepath.Join(d, "keep.txt"), []byte("x"), 0o644); err != nil {
+				t.Fatal(err)
+			}
+		}
+		lease.Slices = append(lease.Slices, LeaseSlice{
+			ID:           "slice-x",
+			Paths:        []string{"src/x.go"},
+			WorktreePath: forged,
+			WrightStatus: WrightPending,
+		})
+		lease.N = len(lease.Slices)
+		leasePath, err := LeasePath(repo, slug)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if err := WriteLease(leasePath, lease); err != nil {
+			t.Fatal(err)
+		}
+
+		var warnings []string
+		swapSeams(t)
+		warnf = func(format string, args ...any) {
+			warnings = append(warnings, fmt.Sprintf(format, args...))
+		}
+		if _, err := Cleanup(repo, slug, true); err != nil {
+			t.Fatal(err)
+		}
+		for _, d := range []string{forged, stray} {
+			if _, err := os.Stat(filepath.Join(d, "keep.txt")); err != nil {
+				t.Fatalf("unregistered scratch directory %s was deleted: %v", d, err)
+			}
+		}
+		for _, id := range []string{"slice-a", "slice-b"} {
+			if _, err := os.Stat(WorkerWorktreePath(repo, batch, id)); !os.IsNotExist(err) {
+				t.Fatalf("registered worktree %s was not removed: %v", id, err)
+			}
+		}
+		if joined := strings.Join(warnings, "\n"); !strings.Contains(joined, "not a worktree") {
+			t.Fatalf("expected a warning naming the refused path, got:\n%s", warnings)
+		}
+	})
 }
 
 // TestCleanupFailedSalvageKeepsWorktreeDir proves a salvage error keeps the
@@ -277,6 +478,255 @@ func TestCleanupFailedSalvageKeepsWorktreeDir(t *testing.T) {
 	}
 }
 
+// TestCleanupNamesDirectoryGitDroppedButNotDeleted proves that when git has
+// already dropped a worktree and its directory cannot be deleted, the error
+// names the directory and says a rerun will not delete it, and the rerun does
+// leave it on disk.
+func TestCleanupNamesDirectoryGitDroppedButNotDeleted(t *testing.T) {
+	if os.Geteuid() == 0 || runtime.GOOS == "windows" {
+		t.Skip("directory permissions do not bind root or windows")
+	}
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wt := WorkerWorktreePath(repo, batch, "slice-a")
+	batchDir := filepath.Dir(wt)
+
+	swapSeams(t)
+	warnf = func(string, ...any) {}
+	removeWorktree = func(repo, path string) error {
+		// Like real git: drop the registration, fail to delete the
+		// directory, and exit non-zero.
+		if err := os.RemoveAll(filepath.Join(repo, ".git", "worktrees", filepath.Base(path))); err != nil {
+			return err
+		}
+		if err := os.Chmod(batchDir, 0o500); err != nil {
+			return err
+		}
+		return errors.New("failed to delete '" + path + "': Permission denied")
+	}
+	t.Cleanup(func() { _ = os.Chmod(batchDir, 0o700) })
+
+	_, err := Cleanup(repo, slug, true)
+	if err == nil || !strings.Contains(err.Error(), wt) || !strings.Contains(err.Error(), "remove it by hand") {
+		t.Fatalf("error must name %s and say it needs manual removal, got %v", wt, err)
+	}
+	if err := os.Chmod(batchDir, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatalf("rerun: %v", err)
+	}
+	if _, err := os.Stat(wt); err != nil {
+		t.Fatalf("rerun must leave the unregistered directory in place, stat err=%v", err)
+	}
+}
+
+// TestCleanupFailedListNamesEachEntryOnce proves a slice whose directory
+// removal fails in both the per-slice and the scratch-entry pass is named once,
+// in lease order.
+func TestCleanupFailedListNamesEachEntryOnce(t *testing.T) {
+	if os.Geteuid() == 0 || runtime.GOOS == "windows" {
+		t.Skip("directory permissions do not bind root or windows")
+	}
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	batchDir := filepath.Dir(WorkerWorktreePath(repo, batch, "slice-a"))
+
+	swapSeams(t)
+	warnf = func(string, ...any) {}
+	removeWorktree = func(string, string) error {
+		if err := os.Chmod(batchDir, 0o500); err != nil {
+			return err
+		}
+		return errors.New("simulated stuck worker worktree")
+	}
+	t.Cleanup(func() { _ = os.Chmod(batchDir, 0o700) })
+
+	_, err := Cleanup(repo, slug, true)
+	const want = "cleanup incomplete for slice-a, slice-b; "
+	if err == nil || !strings.HasPrefix(err.Error(), want) {
+		t.Fatalf("failed list must name slice-a and slice-b once each, want prefix %q, got %v", want, err)
+	}
+}
+
+// TestCleanupKeepsRerunGuidanceWhileStillRegistered proves a failed directory
+// delete that leaves git's registration intact is retryable: the error asks for
+// a rerun and does not tell the operator to remove the directory by hand.
+func TestCleanupKeepsRerunGuidanceWhileStillRegistered(t *testing.T) {
+	if os.Geteuid() == 0 || runtime.GOOS == "windows" {
+		t.Skip("directory permissions do not bind root or windows")
+	}
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wt := WorkerWorktreePath(repo, batch, "slice-a")
+	batchDir := filepath.Dir(wt)
+
+	swapSeams(t)
+	warnf = func(string, ...any) {}
+	removeWorktree = func(repo, path string) error {
+		if err := os.Chmod(batchDir, 0o500); err != nil {
+			return err
+		}
+		return errors.New("failed to delete '" + path + "': Permission denied")
+	}
+	t.Cleanup(func() { _ = os.Chmod(batchDir, 0o700) })
+
+	_, err := Cleanup(repo, slug, true)
+	if err == nil || !strings.Contains(err.Error(), "rerun cleanup") {
+		t.Fatalf("error must ask for a rerun, got %v", err)
+	}
+	if strings.Contains(err.Error(), "remove it by hand") {
+		t.Fatalf("a still-registered worktree is retryable, got %v", err)
+	}
+	leasePath, lerr := LeasePath(repo, slug)
+	if lerr != nil {
+		t.Fatal(lerr)
+	}
+	if _, rerr := ReadLease(leasePath); rerr != nil {
+		t.Fatalf("lease must be kept for the rerun: %v", rerr)
+	}
+}
+
+// TestCleanupDoesNotClaimUnregisteredWhenListUnreadable proves that when git's
+// registration cannot be re-read after a failed delete, the error says so
+// instead of claiming git dropped the worktree.
+func TestCleanupDoesNotClaimUnregisteredWhenListUnreadable(t *testing.T) {
+	if os.Geteuid() == 0 || runtime.GOOS == "windows" {
+		t.Skip("directory permissions do not bind root or windows")
+	}
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wt := WorkerWorktreePath(repo, batch, "slice-a")
+	batchDir := filepath.Dir(wt)
+	gitDir := filepath.Join(repo, ".git")
+
+	swapSeams(t)
+	warnf = func(string, ...any) {}
+	removeWorktree = func(repo, path string) error {
+		if err := os.Chmod(batchDir, 0o500); err != nil {
+			return err
+		}
+		if err := os.Chmod(gitDir, 0o000); err != nil {
+			return err
+		}
+		return errors.New("failed to delete '" + path + "': Permission denied")
+	}
+	t.Cleanup(func() {
+		_ = os.Chmod(batchDir, 0o700)
+		_ = os.Chmod(gitDir, 0o755)
+	})
+
+	_, err := Cleanup(repo, slug, true)
+	if err == nil || !strings.Contains(err.Error(), wt) {
+		t.Fatalf("error must name %s, got %v", wt, err)
+	}
+	if strings.Contains(err.Error(), "no longer registers") {
+		t.Fatalf("registration is unknown, must not be called dropped: %v", err)
+	}
+	if !strings.Contains(err.Error(), "could not confirm whether git still registers") {
+		t.Fatalf("error must say registration could not be confirmed, got %v", err)
+	}
+}
+
+// TestCleanupStrandedRealGit runs the real git: an undeletable file inside the
+// worktree makes `git worktree remove --force` unregister it and still fail,
+// so stranding must be decided from git's registration, not the exit code.
+func TestCleanupStrandedRealGit(t *testing.T) {
+	if os.Geteuid() == 0 || runtime.GOOS == "windows" {
+		t.Skip("directory permissions do not bind root or windows")
+	}
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wt := WorkerWorktreePath(repo, batch, "slice-a")
+	locked := filepath.Join(wt, "locked")
+	if err := os.MkdirAll(locked, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(locked, "f"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Chmod(locked, 0o555); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() { _ = os.Chmod(locked, 0o755) })
+
+	swapSeams(t)
+	warnf = func(string, ...any) {}
+	_, err := Cleanup(repo, slug, true)
+	if err == nil || !strings.Contains(err.Error(), wt) || !strings.Contains(err.Error(), "remove it by hand") {
+		t.Fatalf("error must name %s and say it needs manual removal, got %v", wt, err)
+	}
+	if err := os.Chmod(locked, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatalf("rerun: %v", err)
+	}
+	if _, err := os.Stat(wt); err != nil {
+		t.Fatalf("rerun must leave the unregistered directory in place, stat err=%v", err)
+	}
+}
+
 // TestConcurrentRecordGreenKeepsEverySlice proves the feature lock serializes
 // concurrent record-green calls so no sibling's transfer commit is lost to a
 // read-modify-write race on the lease.
@@ -379,15 +829,19 @@ func TestConcurrentCreateSingleWinner(t *testing.T) {
 	}
 }
 
-// TestCleanupWarnsOnFailedBranchCleanup proves Cleanup reports branch cleanup
-// failures instead of erasing the lease while orphans remain.
-func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
+// stuckBranchBatch creates a two-slice batch and stubs worktree removal so
+// cleanup leaves a stale registration behind: Cleanup's own RemoveAll deletes
+// the worktree directory while git still lists the branch as checked out, so
+// deleteBranch refuses. It returns the repo, slug, the stuck branch and the
+// captured warnings.
+func stuckBranchBatch(t *testing.T) (repo, slug, branch string, warnings *[]string) {
+	t.Helper()
 	repo, base := setupRepo(t)
-	slug, batch := "demo-feature", "batch1"
+	slug = "demo-feature"
 	lease, err := Create(CreateOpts{
 		Root:    repo,
 		Slug:    slug,
-		BatchID: batch,
+		BatchID: "batch1",
 		BaseSHA: base,
 		Slices: []SlicePaths{
 			{ID: "slice-a", Paths: []string{"src/a.go"}},
@@ -397,33 +851,45 @@ func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	branchA := lease.Slices[0].Branch
-
 	swapSeams(t)
-	// Removal "fails" without removing; Cleanup's own RemoveAll then deletes
-	// the worktree directory while the stale git registration still lists the
-	// branch as checked out, so deleteBranch refuses and must be reported.
 	removeWorktree = func(string, string) error {
 		return errors.New("simulated stuck worker worktree")
 	}
-	var warnings []string
+	warnings = new([]string)
 	warnf = func(format string, args ...any) {
-		warnings = append(warnings, fmt.Sprintf(format, args...))
+		*warnings = append(*warnings, fmt.Sprintf(format, args...))
 	}
+	return repo, slug, lease.Slices[0].Branch, warnings
+}
 
-	if _, err := Cleanup(repo, slug, true); err != nil {
-		t.Fatalf("cleanup continues after reporting failures: %v", err)
-	}
-	joined := strings.Join(warnings, "\n")
-	if !strings.Contains(joined, branchA) {
-		t.Fatalf("warnings should name the stuck branch %s, got:\n%s", branchA, joined)
+// TestCleanupWarnsOnFailedBranchCleanup proves Cleanup reports branch cleanup
+// failures and keeps the lease so the orphans stay reachable for a rerun.
+func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
+	repo, slug, branchA, warnings := stuckBranchBatch(t)
+
+	if _, err := Cleanup(repo, slug, true); err == nil || !strings.Contains(err.Error(), "slice-a") {
+		t.Fatalf("cleanup must fail naming slice-a, got %v", err)
 	}
 	leasePath, err := LeasePath(repo, slug)
 	if err != nil {
 		t.Fatal(err)
 	}
+	if _, err := os.Stat(leasePath); err != nil {
+		t.Fatalf("lease must survive a failed cleanup, got %v", err)
+	}
+	// The rerun finds the lease and, with the stale registration pruned by the
+	// first pass, completes the removal and clears it.
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatalf("rerun against the kept lease: %v", err)
+	}
 	if _, err := os.Stat(leasePath); !os.IsNotExist(err) {
-		t.Fatalf("cleanup should still clear the lease, got %v", err)
+		t.Fatalf("rerun should clear the lease, got %v", err)
+	}
+	if exists, err := branchExists(repo, branchA); err != nil || exists {
+		t.Fatalf("rerun should delete %s: exists=%v err=%v", branchA, exists, err)
+	}
+	if joined := strings.Join(*warnings, "\n"); !strings.Contains(joined, branchA) {
+		t.Fatalf("warnings should name the stuck branch %s, got:\n%s", branchA, joined)
 	}
 }
 
@@ -454,3 +920,20 @@ func TestControlCommitMessage(t *testing.T) {
 		t.Fatalf("empty summary after strip: %q", got)
 	}
 }
+
+func TestCreateRefusesAncestorOverlap(t *testing.T) {
+	repo, base := setupRepo(t)
+	_, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    "demo",
+		BatchID: "batch1",
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src"}},
+			{ID: "slice-b", Paths: []string{"src/a.go"}},
+		},
+	})
+	if err == nil || !strings.Contains(err.Error(), "overlap") {
+		t.Fatalf("expected overlap refusal, got %v", err)
+	}
+}