devrites 5.2.3 → 5.3.0

package/engine/internal/parallel/ops_test.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 )
 
@@ -50,15 +51,18 @@ func greenBatch(t *testing.T, repo, base, slug, batch string) *Lease {
 }
 
 type seamRestore struct {
-	origLease  func(string, *Lease) error
-	origRemove func(string, string) error
-	origWarn   func(string, ...any)
+	origLease   func(string, *Lease) error
+	origRemove  func(string, string) error
+	origSalvage func(LeaseSlice, string) (string, error)
+	origWarn    func(string, ...any)
 }
 
 func swapSeams(t *testing.T) {
 	t.Helper()
-	s := seamRestore{origLease: writeLease, origRemove: removeWorktree, origWarn: warnf}
-	t.Cleanup(func() { writeLease, removeWorktree, warnf = s.origLease, s.origRemove, s.origWarn })
+	s := seamRestore{origLease: writeLease, origRemove: removeWorktree, origSalvage: salvage, origWarn: warnf}
+	t.Cleanup(func() {
+		writeLease, removeWorktree, salvage, warnf = s.origLease, s.origRemove, s.origSalvage, s.origWarn
+	})
 }
 
 // TestIntegrateFailedTransitionSurvivesTransientWriteFailure proves the
@@ -162,6 +166,219 @@ func TestIntegrateSurfacesStuckStagingWorktree(t *testing.T) {
 	}
 }
 
+// TestCleanupNeverTouchesForeignWorktreePath proves a lease whose
+// worktree_path points outside the batch scratch layout is never salvaged
+// into nor deleted — the lease field is advisory, not a RemoveAll license.
+func TestCleanupNeverTouchesForeignWorktreePath(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	foreign := filepath.Join(t.TempDir(), "precious")
+	if err := os.MkdirAll(foreign, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(foreign, "keep.txt"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	lease.Slices[0].WorktreePath = foreign
+	// A forged branch outside the batch namespace must survive too.
+	gitOk(t, repo, "branch", "user/topic", base)
+	lease.Slices[0].Branch = "user/topic"
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := WriteLease(leasePath, lease); err != nil {
+		t.Fatal(err)
+	}
+
+	var warnings []string
+	swapSeams(t)
+	warnf = func(format string, args ...any) {
+		warnings = append(warnings, fmt.Sprintf(format, args...))
+	}
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(foreign, "keep.txt")); err != nil {
+		t.Fatalf("foreign path was touched: %v", err)
+	}
+	if tip := gitOk(t, repo, "rev-parse", "user/topic"); tip != base {
+		t.Fatalf("foreign branch user/topic moved to %s, want %s", tip, base)
+	}
+	joined := strings.Join(warnings, "\n")
+	if !strings.Contains(joined, "outside") {
+		t.Fatalf("expected warnings naming foreign path and branch, got:\n%s", warnings)
+	}
+}
+
+// TestCleanupFailedSalvageKeepsWorktreeDir proves a salvage error keeps the
+// worktree on disk as the only remaining copy — the batch-level scratch
+// removal must skip kept slice dirs instead of destroying them.
+func TestCleanupFailedSalvageKeepsWorktreeDir(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wtA := WorkerWorktreePath(repo, batch, "slice-a")
+	wtB := WorkerWorktreePath(repo, batch, "slice-b")
+
+	swapSeams(t)
+	realSalvage := salvage
+	salvage = func(sl LeaseSlice, batchID string) (string, error) {
+		if sl.ID == "slice-a" {
+			return "", errors.New("injected salvage failure")
+		}
+		return realSalvage(sl, batchID)
+	}
+	salvaged, err := Cleanup(repo, slug, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(wtA); err != nil {
+		t.Fatalf("kept worktree was removed: %v", err)
+	}
+	if _, err := os.Stat(wtB); !os.IsNotExist(err) {
+		t.Fatalf("clean slice-b worktree should be removed, stat err=%v", err)
+	}
+	if _, err := git(repo, "rev-parse", "--verify", "devrites/parallel/"+slug+"/"+batch+"/slice-a"); err != nil {
+		t.Fatalf("slice-a branch should be kept: %v", err)
+	}
+	found := false
+	for _, s := range salvaged {
+		if s.SliceID == "slice-a" && s.Worktree == wtA {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("salvage output should report kept worktree for slice-a, got %+v", salvaged)
+	}
+}
+
+// TestConcurrentRecordGreenKeepsEverySlice proves the feature lock serializes
+// concurrent record-green calls so no sibling's transfer commit is lost to a
+// read-modify-write race on the lease.
+func TestConcurrentRecordGreenKeepsEverySlice(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tcA := commitIn(t, lease.Slices[0].WorktreePath, "src/a.go", "A")
+	tcB := commitIn(t, lease.Slices[1].WorktreePath, "src/b.go", "B")
+
+	var wg sync.WaitGroup
+	errs := make(chan error, 2)
+	for _, item := range [][2]string{{"slice-a", tcA}, {"slice-b", tcB}} {
+		wg.Add(1)
+		go func(sliceID, commit string) {
+			defer wg.Done()
+			_, err := RecordGreen(repo, slug, sliceID, commit)
+			errs <- err
+		}(item[0], item[1])
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	onDisk, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := map[string]string{}
+	for _, sl := range onDisk.Slices {
+		got[sl.ID] = sl.TransferCommit
+	}
+	if got["slice-a"] != tcA || got["slice-b"] != tcB {
+		t.Fatalf("lost update: transfer commits %v want a=%s b=%s", got, tcA, tcB)
+	}
+}
+
+// TestConcurrentCreateSingleWinner proves the feature lock serializes create
+// so two racing creates cannot both pass the lease-existence check.
+func TestConcurrentCreateSingleWinner(t *testing.T) {
+	repo, base := setupRepo(t)
+	opts := CreateOpts{
+		Root:    repo,
+		Slug:    "demo-feature",
+		BatchID: "batch1",
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}
+	var wg sync.WaitGroup
+	errs := make(chan error, 2)
+	wins := make(chan *Lease, 2)
+	for i := 0; i < 2; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			lease, err := Create(opts)
+			if err != nil {
+				errs <- err
+				return
+			}
+			wins <- lease
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	close(wins)
+	succeeded := 0
+	for range wins {
+		succeeded++
+	}
+	failed := 0
+	for range errs {
+		failed++
+	}
+	if succeeded != 1 || failed != 1 {
+		t.Fatalf("concurrent create: %d succeeded, %d failed; want exactly 1/1", succeeded, failed)
+	}
+}
+
 // TestCleanupWarnsOnFailedBranchCleanup proves Cleanup reports branch cleanup
 // failures instead of erasing the lease while orphans remain.
 func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
@@ -194,7 +411,7 @@ func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
 		warnings = append(warnings, fmt.Sprintf(format, args...))
 	}
 
-	if err := Cleanup(repo, slug, true); err != nil {
+	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatalf("cleanup continues after reporting failures: %v", err)
 	}
 	joined := strings.Join(warnings, "\n")

package/engine/internal/parallel/parallel_test.go

@@ -112,17 +112,19 @@ func TestCreateAbortCleanup(t *testing.T) {
 		t.Fatalf("control moved after create: %s", head)
 	}
 
-	// Drift control tip, then abort should restore base.
+	// Drift control tip; abort must never rewind external commits — the drift
+	// commit survives and the lease still marks aborted.
 	if err := os.WriteFile(filepath.Join(repo, "README.md"), []byte("drift\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	gitOk(t, repo, "add", "README.md")
 	gitOk(t, repo, "commit", "-m", "drift")
-	if _, err := Abort(repo, slug, true); err != nil {
+	drift := gitOk(t, repo, "rev-parse", "HEAD")
+	if _, err := Abort(repo, slug); err != nil {
 		t.Fatal(err)
 	}
-	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
-		t.Fatalf("abort left control at %s want %s", head, base)
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != drift {
+		t.Fatalf("abort rewound control: head %s want drift tip %s", head, drift)
 	}
 	leasePath, _ := LeasePath(repo, slug)
 	lease, err = ReadLease(leasePath)
@@ -136,7 +138,7 @@ func TestCreateAbortCleanup(t *testing.T) {
 		t.Fatalf("abort should preserve worktree: %v", err)
 	}
 
-	if err := Cleanup(repo, slug, true); err != nil {
+	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
@@ -147,6 +149,88 @@ func TestCreateAbortCleanup(t *testing.T) {
 	}
 }
 
+// TestCleanupSalvagesAbortedWork proves a forced cleanup of an aborted batch
+// never destroys wright work: committed transfers keep their branches and
+// uncommitted allowlisted changes are committed onto the slice branch before
+// the worktree is removed.
+func TestCleanupSalvagesAbortedWork(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go", "src/b_new.go"}},
+			{ID: "slice-c", Paths: []string{"src/c.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	wtA := lease.Slices[0].WorktreePath
+	wtB := lease.Slices[1].WorktreePath
+	wtC := lease.Slices[2].WorktreePath
+
+	// slice-a: committed transfer (red at review — work must survive).
+	tcA := commitIn(t, wtA, "src/a.go", "A")
+	// slice-b: uncommitted WIP — modified tracked file plus a new untracked
+	// file inside the allowlist.
+	if err := os.WriteFile(filepath.Join(wtB, "src", "b.go"), []byte("package main\n\nfunc Bwip() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(wtB, "src", "b_new.go"), []byte("package main\n\nfunc Bnew() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// slice-c: untouched — nothing to salvage, branch should be deleted.
+
+	if _, err := Abort(repo, slug); err != nil {
+		t.Fatal(err)
+	}
+	salvaged, err := Cleanup(repo, slug, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bySlice := map[string]Salvage{}
+	for _, s := range salvaged {
+		bySlice[s.SliceID] = s
+	}
+	if got := bySlice["slice-a"].Commit; got != tcA {
+		t.Fatalf("slice-a salvage commit %s want transfer %s", got, tcA)
+	}
+	sb := bySlice["slice-b"]
+	if sb.Branch == "" || sb.Commit == "" || sb.Commit == base {
+		t.Fatalf("slice-b should salvage WIP onto its branch, got %+v", sb)
+	}
+	if _, ok := bySlice["slice-c"]; ok {
+		t.Fatalf("slice-c carried no work; its branch should be deleted, got %+v", bySlice["slice-c"])
+	}
+
+	// The salvaged WIP commit actually contains the uncommitted changes.
+	if names := gitOk(t, repo, "diff", "--name-only", base, sb.Commit); !strings.Contains(names, "src/b.go") || !strings.Contains(names, "src/b_new.go") {
+		t.Fatalf("salvage commit missing WIP paths: %s", names)
+	}
+	if body := gitOk(t, repo, "show", sb.Commit+":src/b_new.go"); !strings.Contains(body, "Bnew") {
+		t.Fatalf("salvaged file content missing: %q", body)
+	}
+
+	// Worktrees removed, lease cleared, kept branches still resolve.
+	for _, wt := range []string{wtA, wtB, wtC} {
+		if _, err := os.Stat(wt); !os.IsNotExist(err) {
+			t.Fatalf("cleanup should remove worktree %s", wt)
+		}
+	}
+	leasePath, _ := LeasePath(repo, slug)
+	if _, err := os.Stat(leasePath); !os.IsNotExist(err) {
+		t.Fatalf("cleanup should clear lease")
+	}
+	gitOk(t, repo, "rev-parse", "--verify", "refs/heads/"+bySlice["slice-a"].Branch)
+	gitOk(t, repo, "rev-parse", "--verify", "refs/heads/"+sb.Branch)
+}
+
 func TestCreateAcceptsFourSlices(t *testing.T) {
 	t.Parallel()
 	repo, _ := setupRepo(t)
@@ -322,13 +406,20 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	if head != tip {
 		t.Fatalf("control head %s want tip %s", head, tip)
 	}
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
+		t.Fatalf("control should gain exactly one squash commit, got %s", n)
+	}
+	subj := gitOk(t, repo, "log", "-1", "--format=%s")
+	if !strings.HasPrefix(subj, "WIP(demo-feature):") {
+		t.Fatalf("squash subject %q missing WIP(demo-feature): prefix", subj)
+	}
 	a := mustRead(t, filepath.Join(repo, "src", "a.go"))
 	b := mustRead(t, filepath.Join(repo, "src", "b.go"))
 	if !strings.Contains(a, "func A") || !strings.Contains(b, "func B") {
 		t.Fatalf("integrated contents missing: a=%q b=%q", a, b)
 	}
 
-	if err := Cleanup(repo, slug, false); err != nil {
+	if _, err := Cleanup(repo, slug, false); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
@@ -336,6 +427,138 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	}
 }
 
+// TestIntegrateWithoutApplyKeepsLeaseRunning proves a flag-less integrate
+// stages the squash commit on the integrate branch but leaves the lease
+// running and control at base, so a later non-forced cleanup cannot discard
+// the only refs holding the integrated tree.
+func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+
+	tip, lease, err := Integrate(IntegrateOpts{Root: repo, Slug: slug})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if tip == "" || tip == base {
+		t.Fatalf("expected staged squash tip, got %s", tip)
+	}
+	if lease.Status != StatusRunning {
+		t.Fatalf("status=%s want running without --apply-to-control", lease.Status)
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("control moved without apply: %s", head)
+	}
+	ibranch := IntegrateBranchName(slug, batch)
+	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
+		t.Fatalf("integrate branch %s want squash tip %s", got, tip)
+	}
+	if _, err := Cleanup(repo, slug, false); err == nil {
+		t.Fatal("cleanup on running lease must refuse without --force")
+	}
+	// Forced cleanup salvages then removes; the integrate branch holds the
+	// squash tip, so it is kept and reported rather than deleted.
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
+		t.Fatalf("forced cleanup dropped integrate branch: %s want %s", got, tip)
+	}
+}
+
+// TestIntegrateFailedLeaseRepairsAndRetries proves integrate-failed is not a
+// dead end: a repaired transfer re-records on the failed lease and a retried
+// integrate completes into one squash commit on control.
+func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+	realTC := gitOk(t, repo, "rev-parse", WorkerBranch(slug, batch, "slice-a"))
+
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad.Slices[0].TransferCommit = strings.Repeat("deadbeef", 5)
+	if err := WriteLease(leasePath, bad); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err == nil {
+		t.Fatal("expected integrate failure")
+	}
+	onDisk, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if onDisk.Status != StatusIntegrateFailed {
+		t.Fatalf("status=%s want integrate-failed", onDisk.Status)
+	}
+
+	if _, err := RecordGreen(repo, slug, "slice-a", realTC); err != nil {
+		t.Fatalf("record-green on integrate-failed lease: %v", err)
+	}
+	if _, lease, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err != nil {
+		t.Fatalf("integrate retry: %v", err)
+	} else if lease.Status != StatusComplete {
+		t.Fatalf("status=%s want complete", lease.Status)
+	}
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
+		t.Fatalf("expected one squash commit on control, got %s", n)
+	}
+}
+
+// TestIntegrateRefusesDirtyControlOnSlicePaths proves --apply-to-control
+// neither absorbs nor clobbers uncommitted user work on slice paths: overlap
+// refuses with the lease still running, while unrelated dirty files are left
+// alone and the FF proceeds.
+func TestIntegrateRefusesDirtyControlOnSlicePaths(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+
+	if err := os.MkdirAll(filepath.Join(repo, "src"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	userWIP := filepath.Join(repo, "src", "a.go")
+	if err := os.WriteFile(userWIP, []byte("user wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err == nil {
+		t.Fatal("expected dirty-control refusal")
+	}
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lease, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.Status != StatusRunning {
+		t.Fatalf("lease status=%s want running after precondition refusal", lease.Status)
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("control moved despite refusal: %s", head)
+	}
+
+	// Unrelated uncommitted work is not part of the batch and must survive.
+	gitOk(t, repo, "checkout", "--", "src/a.go")
+	keep := filepath.Join(repo, "unrelated.txt")
+	if err := os.WriteFile(keep, []byte("keep me\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err != nil {
+		t.Fatalf("integrate with non-overlapping dirty file: %v", err)
+	}
+	if b, err := os.ReadFile(keep); err != nil || string(b) != "keep me\n" {
+		t.Fatalf("unrelated dirty file lost: err=%v body=%q", err, b)
+	}
+}
+
 func mustRead(t *testing.T, path string) string {
 	t.Helper()
 	b, err := os.ReadFile(path)

package/engine/internal/parallel/pathdisjoint.go

@@ -68,15 +68,30 @@ func validateSlicePaths(paths []string, label, root string) ([]string, error) {
 		if path == ".devrites" || strings.HasPrefix(path, ".devrites/") {
 			return nil, fmt.Errorf("%s: path must not include .devrites: %q", label, path)
 		}
+		// Same for git internals: a transfer commit can never carry .git/**
+		// anyway, and inside a worktree .git is a file, so claiming it is
+		// pure footgun.
+		if path == ".git" || strings.HasPrefix(path, ".git/") {
+			return nil, fmt.Errorf("%s: path must not include .git: %q", label, path)
+		}
 		if _, ok := seen[path]; ok {
 			return nil, fmt.Errorf("%s: duplicate path %q", label, path)
 		}
 		seen[path] = struct{}{}
 		normalized = append(normalized, path)
 		if root != "" {
-			full := filepath.Join(root, filepath.FromSlash(path))
-			if info, err := os.Lstat(full); err == nil && info.Mode()&os.ModeSymlink != 0 {
-				return nil, fmt.Errorf("%s: symlink path is not allowed: %q", label, path)
+			// Check every component, not just the leaf: a symlinked directory
+			// in the chain would let a worktree write outside itself.
+			cur := root
+			for _, seg := range strings.Split(path, "/") {
+				cur = filepath.Join(cur, seg)
+				info, err := os.Lstat(cur)
+				if err != nil {
+					break // missing components are fine; git creates them
+				}
+				if info.Mode()&os.ModeSymlink != 0 {
+					return nil, fmt.Errorf("%s: symlink path is not allowed: %q", label, path)
+				}
 			}
 		}
 	}

package/engine/internal/parallel/pathdisjoint_test.go

@@ -87,6 +87,27 @@ func TestCheckPathDisjointSymlinkRoot(t *testing.T) {
 	}
 }
 
+// A symlinked directory inside a claimed path must also be rejected: the
+// leaf Lstat alone misses it, and a worktree would then write outside itself.
+func TestCheckPathDisjointSymlinkedDir(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	target := filepath.Join(dir, "outside")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(dir, "linkdir")); err != nil {
+		t.Skip("symlinks unavailable")
+	}
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"linkdir/x.go"}},
+		{ID: "b", Paths: []string{"other.go"}},
+	}, dir)
+	if err == nil || !strings.Contains(err.Error(), "symlink") {
+		t.Fatalf("expected symlink error for symlinked dir, got %v", err)
+	}
+}
+
 func TestParseSlicesJSONShapes(t *testing.T) {
 	t.Parallel()
 	a, err := ParseSlicesJSON([]byte(`{"slices":[{"id":"a","paths":["x.go"]},{"id":"b","paths":["y.go"]}]}`))

package/pack/.claude/agents/devrites-plan-drafter.md

@@ -60,6 +60,14 @@ principle-exception questions. List them for the root.
   re-dispatches the rest. A finding blocked on human-owned information goes in
   `blocked_findings` with the needed input named — never `remaining_findings`,
   which is reserved for what another dispatch can complete.
+- In `repair`, before returning, self-attack the delta: probe every clause the
+  hunks touch for the attack classes Vet's reviewers hunt — race/observation
+  windows, identity/alias escapes, durability/ordering gaps,
+  platform-capability gaps, unbounded blocking, happy-path-only coverage.
+  Close each real exposure inside the same delta or return it in
+  `self_attack_exposures` with its bound; never silently drop one. This
+  narrows the next Vet round; it never replaces independent review and never
+  self-approves the repair.
 
 ## Output format
 
@@ -77,6 +85,7 @@ technical_decisions: []
 human_owned_choices: []
 validation_commands: []
 applicability_disposition: []
+self_attack_exposures: []
 ```
 
 The root validates the cross-file bundle and persists accepted content.

package/pack/.claude/agents/devrites-plan-reviewer.md

@@ -104,7 +104,10 @@ criterion, slice, or proof.
 - `/rite-vet` may request one initial pass and one narrow recheck per correction/fingerprint.
 - Label each finding **Critical / Important / Suggestion / Nit / FYI** and include
   the relevant plan or task section, confidence score, and a concrete fix. Do not
-  pad the report with praise.
+  pad the report with praise. In a recheck, also mark each finding
+  `new_failure_mode` or name the already-pinned clause/fingerprint it refines —
+  the packet lists prior repairs; the mark makes alias-detection and
+  `convergence_pressure` eligibility mechanical.
 - When a dimension has no issue, say "strong: <why>" instead of inventing a
   finding.
 - If a claim cannot be verified, such as blast radius without an index, say so and

package/pack/.claude/skills/devrites-api-interface/SKILL.md

@@ -51,7 +51,9 @@ Before standing the interface, run `devrites-doubt`.
 ## Done when
 The contract is complete only when **every** field carries a type + optionality + unit,
 **every** success and error status code is enumerated with its error-body shape, the
-`devrites-doubt` verdict is accept (on reject: revise the contract and re-doubt), and the
+`devrites-doubt` verdict is accept (on reject: revise the contract and re-doubt under
+`devrites-doubt`'s per-fingerprint bounds and distinct-findings ceiling — a contract
+that resists repair becomes a blocker or human gate, not an endless revise loop), and the
 contract + rationale are recorded in `decisions.md`. A contract that pins only the
 happy-path shape is not done.
 

package/pack/.claude/skills/devrites-doubt/SKILL.md

@@ -27,7 +27,7 @@ code · claiming "this is safe", "this scales", or "this matches the spec".
   issues but classify **zero** as actionable, the review is too agreeable. Sharpen the
   prompt or use a fresh reviewer. Accept a clean pass only after a genuine attempt to
   disprove the claim.
-- [ ] **5. STOP**: met a stop condition (only trivial findings, 3 cycles done, or user override). Emit a **binary gate verdict** the orchestrator must clear: **accept** (no valid-&-actionable findings remain) or **reject + the specific required changes**. On reject, the orchestrator loops the wright on those changes before the slice is accepted. Still reject after the 3-cycle cap → classify by decision ownership: human-owned product/risk uncertainty escalates; objective required changes become a technical blocker, never a retry-authorization question.
+- [ ] **5. STOP**: met a stop condition (only trivial findings, no open fingerprint has budget left, the distinct-findings ceiling, or user override). Emit a **binary gate verdict** the orchestrator must clear: **accept** (no valid-&-actionable findings remain) or **reject + the specific required changes**. On reject, the orchestrator loops the wright on those changes before the slice is accepted. Account per finding, not per round: a reject citing a genuinely new defect is progress and the loop continues; a reject re-citing a fingerprint the wright already failed on is no-progress and burns that fingerprint's budget. A finding that only refines a clause a prior cycle already pinned may close as an explicit bounded declared residual. Ceiling: three distinct actionable findings on one decision mean the decision resists repair — classify by decision ownership: human-owned product/risk uncertainty escalates; objective required changes become a technical blocker, never a retry-authorization question.
 
 ## Deletion-test lens (for "is this abstraction load-bearing?" doubts)
 
@@ -72,7 +72,8 @@ real time. Map the verdict to a `questions.md` entry instead of a synchronous pr
   `questions.md` entry with `gate: blocking`, set `state.md` `Status: awaiting_human`,
   fire the `notify:` hook, and STOP. AFK never silently accepts irreversible risk.
 
-The 3-loop limit still applies. After 3 cycles, human-owned uncertainty becomes a blocking
+The same bounds apply in AFK. Once no open fingerprint has budget left or the
+distinct-findings ceiling trips, human-owned uncertainty becomes a blocking
 question; an unresolved objective technical finding becomes `Status: blocked` with its exact
 required changes and `/rite-plan unblock`, regardless of AFK config.