devrites 5.2.4 → 5.3.0

package/engine/internal/parallel/ops_test.go

@@ -6,6 +6,7 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 )
 
@@ -50,15 +51,18 @@ func greenBatch(t *testing.T, repo, base, slug, batch string) *Lease {
 }
 
 type seamRestore struct {
-	origLease  func(string, *Lease) error
-	origRemove func(string, string) error
-	origWarn   func(string, ...any)
+	origLease   func(string, *Lease) error
+	origRemove  func(string, string) error
+	origSalvage func(LeaseSlice, string) (string, error)
+	origWarn    func(string, ...any)
 }
 
 func swapSeams(t *testing.T) {
 	t.Helper()
-	s := seamRestore{origLease: writeLease, origRemove: removeWorktree, origWarn: warnf}
-	t.Cleanup(func() { writeLease, removeWorktree, warnf = s.origLease, s.origRemove, s.origWarn })
+	s := seamRestore{origLease: writeLease, origRemove: removeWorktree, origSalvage: salvage, origWarn: warnf}
+	t.Cleanup(func() {
+		writeLease, removeWorktree, salvage, warnf = s.origLease, s.origRemove, s.origSalvage, s.origWarn
+	})
 }
 
 // TestIntegrateFailedTransitionSurvivesTransientWriteFailure proves the
@@ -162,6 +166,219 @@ func TestIntegrateSurfacesStuckStagingWorktree(t *testing.T) {
 	}
 }
 
+// TestCleanupNeverTouchesForeignWorktreePath proves a lease whose
+// worktree_path points outside the batch scratch layout is never salvaged
+// into nor deleted — the lease field is advisory, not a RemoveAll license.
+func TestCleanupNeverTouchesForeignWorktreePath(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	foreign := filepath.Join(t.TempDir(), "precious")
+	if err := os.MkdirAll(foreign, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(foreign, "keep.txt"), []byte("x"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	lease.Slices[0].WorktreePath = foreign
+	// A forged branch outside the batch namespace must survive too.
+	gitOk(t, repo, "branch", "user/topic", base)
+	lease.Slices[0].Branch = "user/topic"
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := WriteLease(leasePath, lease); err != nil {
+		t.Fatal(err)
+	}
+
+	var warnings []string
+	swapSeams(t)
+	warnf = func(format string, args ...any) {
+		warnings = append(warnings, fmt.Sprintf(format, args...))
+	}
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(filepath.Join(foreign, "keep.txt")); err != nil {
+		t.Fatalf("foreign path was touched: %v", err)
+	}
+	if tip := gitOk(t, repo, "rev-parse", "user/topic"); tip != base {
+		t.Fatalf("foreign branch user/topic moved to %s, want %s", tip, base)
+	}
+	joined := strings.Join(warnings, "\n")
+	if !strings.Contains(joined, "outside") {
+		t.Fatalf("expected warnings naming foreign path and branch, got:\n%s", warnings)
+	}
+}
+
+// TestCleanupFailedSalvageKeepsWorktreeDir proves a salvage error keeps the
+// worktree on disk as the only remaining copy — the batch-level scratch
+// removal must skip kept slice dirs instead of destroying them.
+func TestCleanupFailedSalvageKeepsWorktreeDir(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	if _, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	wtA := WorkerWorktreePath(repo, batch, "slice-a")
+	wtB := WorkerWorktreePath(repo, batch, "slice-b")
+
+	swapSeams(t)
+	realSalvage := salvage
+	salvage = func(sl LeaseSlice, batchID string) (string, error) {
+		if sl.ID == "slice-a" {
+			return "", errors.New("injected salvage failure")
+		}
+		return realSalvage(sl, batchID)
+	}
+	salvaged, err := Cleanup(repo, slug, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := os.Stat(wtA); err != nil {
+		t.Fatalf("kept worktree was removed: %v", err)
+	}
+	if _, err := os.Stat(wtB); !os.IsNotExist(err) {
+		t.Fatalf("clean slice-b worktree should be removed, stat err=%v", err)
+	}
+	if _, err := git(repo, "rev-parse", "--verify", "devrites/parallel/"+slug+"/"+batch+"/slice-a"); err != nil {
+		t.Fatalf("slice-a branch should be kept: %v", err)
+	}
+	found := false
+	for _, s := range salvaged {
+		if s.SliceID == "slice-a" && s.Worktree == wtA {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("salvage output should report kept worktree for slice-a, got %+v", salvaged)
+	}
+}
+
+// TestConcurrentRecordGreenKeepsEverySlice proves the feature lock serializes
+// concurrent record-green calls so no sibling's transfer commit is lost to a
+// read-modify-write race on the lease.
+func TestConcurrentRecordGreenKeepsEverySlice(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tcA := commitIn(t, lease.Slices[0].WorktreePath, "src/a.go", "A")
+	tcB := commitIn(t, lease.Slices[1].WorktreePath, "src/b.go", "B")
+
+	var wg sync.WaitGroup
+	errs := make(chan error, 2)
+	for _, item := range [][2]string{{"slice-a", tcA}, {"slice-b", tcB}} {
+		wg.Add(1)
+		go func(sliceID, commit string) {
+			defer wg.Done()
+			_, err := RecordGreen(repo, slug, sliceID, commit)
+			errs <- err
+		}(item[0], item[1])
+	}
+	wg.Wait()
+	close(errs)
+	for err := range errs {
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	onDisk, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := map[string]string{}
+	for _, sl := range onDisk.Slices {
+		got[sl.ID] = sl.TransferCommit
+	}
+	if got["slice-a"] != tcA || got["slice-b"] != tcB {
+		t.Fatalf("lost update: transfer commits %v want a=%s b=%s", got, tcA, tcB)
+	}
+}
+
+// TestConcurrentCreateSingleWinner proves the feature lock serializes create
+// so two racing creates cannot both pass the lease-existence check.
+func TestConcurrentCreateSingleWinner(t *testing.T) {
+	repo, base := setupRepo(t)
+	opts := CreateOpts{
+		Root:    repo,
+		Slug:    "demo-feature",
+		BatchID: "batch1",
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go"}},
+		},
+	}
+	var wg sync.WaitGroup
+	errs := make(chan error, 2)
+	wins := make(chan *Lease, 2)
+	for i := 0; i < 2; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			lease, err := Create(opts)
+			if err != nil {
+				errs <- err
+				return
+			}
+			wins <- lease
+		}()
+	}
+	wg.Wait()
+	close(errs)
+	close(wins)
+	succeeded := 0
+	for range wins {
+		succeeded++
+	}
+	failed := 0
+	for range errs {
+		failed++
+	}
+	if succeeded != 1 || failed != 1 {
+		t.Fatalf("concurrent create: %d succeeded, %d failed; want exactly 1/1", succeeded, failed)
+	}
+}
+
 // TestCleanupWarnsOnFailedBranchCleanup proves Cleanup reports branch cleanup
 // failures instead of erasing the lease while orphans remain.
 func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
@@ -194,7 +411,7 @@ func TestCleanupWarnsOnFailedBranchCleanup(t *testing.T) {
 		warnings = append(warnings, fmt.Sprintf(format, args...))
 	}
 
-	if err := Cleanup(repo, slug, true); err != nil {
+	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatalf("cleanup continues after reporting failures: %v", err)
 	}
 	joined := strings.Join(warnings, "\n")

package/engine/internal/parallel/parallel_test.go

@@ -112,17 +112,19 @@ func TestCreateAbortCleanup(t *testing.T) {
 		t.Fatalf("control moved after create: %s", head)
 	}
 
-	// Drift control tip, then abort should restore base.
+	// Drift control tip; abort must never rewind external commits — the drift
+	// commit survives and the lease still marks aborted.
 	if err := os.WriteFile(filepath.Join(repo, "README.md"), []byte("drift\n"), 0o644); err != nil {
 		t.Fatal(err)
 	}
 	gitOk(t, repo, "add", "README.md")
 	gitOk(t, repo, "commit", "-m", "drift")
-	if _, err := Abort(repo, slug, true); err != nil {
+	drift := gitOk(t, repo, "rev-parse", "HEAD")
+	if _, err := Abort(repo, slug); err != nil {
 		t.Fatal(err)
 	}
-	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
-		t.Fatalf("abort left control at %s want %s", head, base)
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != drift {
+		t.Fatalf("abort rewound control: head %s want drift tip %s", head, drift)
 	}
 	leasePath, _ := LeasePath(repo, slug)
 	lease, err = ReadLease(leasePath)
@@ -136,7 +138,7 @@ func TestCreateAbortCleanup(t *testing.T) {
 		t.Fatalf("abort should preserve worktree: %v", err)
 	}
 
-	if err := Cleanup(repo, slug, true); err != nil {
+	if _, err := Cleanup(repo, slug, true); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
@@ -147,6 +149,88 @@ func TestCreateAbortCleanup(t *testing.T) {
 	}
 }
 
+// TestCleanupSalvagesAbortedWork proves a forced cleanup of an aborted batch
+// never destroys wright work: committed transfers keep their branches and
+// uncommitted allowlisted changes are committed onto the slice branch before
+// the worktree is removed.
+func TestCleanupSalvagesAbortedWork(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	lease, err := Create(CreateOpts{
+		Root:    repo,
+		Slug:    slug,
+		BatchID: batch,
+		BaseSHA: base,
+		Slices: []SlicePaths{
+			{ID: "slice-a", Paths: []string{"src/a.go"}},
+			{ID: "slice-b", Paths: []string{"src/b.go", "src/b_new.go"}},
+			{ID: "slice-c", Paths: []string{"src/c.go"}},
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	wtA := lease.Slices[0].WorktreePath
+	wtB := lease.Slices[1].WorktreePath
+	wtC := lease.Slices[2].WorktreePath
+
+	// slice-a: committed transfer (red at review — work must survive).
+	tcA := commitIn(t, wtA, "src/a.go", "A")
+	// slice-b: uncommitted WIP — modified tracked file plus a new untracked
+	// file inside the allowlist.
+	if err := os.WriteFile(filepath.Join(wtB, "src", "b.go"), []byte("package main\n\nfunc Bwip() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(wtB, "src", "b_new.go"), []byte("package main\n\nfunc Bnew() {}\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	// slice-c: untouched — nothing to salvage, branch should be deleted.
+
+	if _, err := Abort(repo, slug); err != nil {
+		t.Fatal(err)
+	}
+	salvaged, err := Cleanup(repo, slug, true)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	bySlice := map[string]Salvage{}
+	for _, s := range salvaged {
+		bySlice[s.SliceID] = s
+	}
+	if got := bySlice["slice-a"].Commit; got != tcA {
+		t.Fatalf("slice-a salvage commit %s want transfer %s", got, tcA)
+	}
+	sb := bySlice["slice-b"]
+	if sb.Branch == "" || sb.Commit == "" || sb.Commit == base {
+		t.Fatalf("slice-b should salvage WIP onto its branch, got %+v", sb)
+	}
+	if _, ok := bySlice["slice-c"]; ok {
+		t.Fatalf("slice-c carried no work; its branch should be deleted, got %+v", bySlice["slice-c"])
+	}
+
+	// The salvaged WIP commit actually contains the uncommitted changes.
+	if names := gitOk(t, repo, "diff", "--name-only", base, sb.Commit); !strings.Contains(names, "src/b.go") || !strings.Contains(names, "src/b_new.go") {
+		t.Fatalf("salvage commit missing WIP paths: %s", names)
+	}
+	if body := gitOk(t, repo, "show", sb.Commit+":src/b_new.go"); !strings.Contains(body, "Bnew") {
+		t.Fatalf("salvaged file content missing: %q", body)
+	}
+
+	// Worktrees removed, lease cleared, kept branches still resolve.
+	for _, wt := range []string{wtA, wtB, wtC} {
+		if _, err := os.Stat(wt); !os.IsNotExist(err) {
+			t.Fatalf("cleanup should remove worktree %s", wt)
+		}
+	}
+	leasePath, _ := LeasePath(repo, slug)
+	if _, err := os.Stat(leasePath); !os.IsNotExist(err) {
+		t.Fatalf("cleanup should clear lease")
+	}
+	gitOk(t, repo, "rev-parse", "--verify", "refs/heads/"+bySlice["slice-a"].Branch)
+	gitOk(t, repo, "rev-parse", "--verify", "refs/heads/"+sb.Branch)
+}
+
 func TestCreateAcceptsFourSlices(t *testing.T) {
 	t.Parallel()
 	repo, _ := setupRepo(t)
@@ -322,13 +406,20 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	if head != tip {
 		t.Fatalf("control head %s want tip %s", head, tip)
 	}
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
+		t.Fatalf("control should gain exactly one squash commit, got %s", n)
+	}
+	subj := gitOk(t, repo, "log", "-1", "--format=%s")
+	if !strings.HasPrefix(subj, "WIP(demo-feature):") {
+		t.Fatalf("squash subject %q missing WIP(demo-feature): prefix", subj)
+	}
 	a := mustRead(t, filepath.Join(repo, "src", "a.go"))
 	b := mustRead(t, filepath.Join(repo, "src", "b.go"))
 	if !strings.Contains(a, "func A") || !strings.Contains(b, "func B") {
 		t.Fatalf("integrated contents missing: a=%q b=%q", a, b)
 	}
 
-	if err := Cleanup(repo, slug, false); err != nil {
+	if _, err := Cleanup(repo, slug, false); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := os.Stat(wtA); !os.IsNotExist(err) {
@@ -336,6 +427,138 @@ func TestIntegrateDivergentSiblings(t *testing.T) {
 	}
 }
 
+// TestIntegrateWithoutApplyKeepsLeaseRunning proves a flag-less integrate
+// stages the squash commit on the integrate branch but leaves the lease
+// running and control at base, so a later non-forced cleanup cannot discard
+// the only refs holding the integrated tree.
+func TestIntegrateWithoutApplyKeepsLeaseRunning(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+
+	tip, lease, err := Integrate(IntegrateOpts{Root: repo, Slug: slug})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if tip == "" || tip == base {
+		t.Fatalf("expected staged squash tip, got %s", tip)
+	}
+	if lease.Status != StatusRunning {
+		t.Fatalf("status=%s want running without --apply-to-control", lease.Status)
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("control moved without apply: %s", head)
+	}
+	ibranch := IntegrateBranchName(slug, batch)
+	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
+		t.Fatalf("integrate branch %s want squash tip %s", got, tip)
+	}
+	if _, err := Cleanup(repo, slug, false); err == nil {
+		t.Fatal("cleanup on running lease must refuse without --force")
+	}
+	// Forced cleanup salvages then removes; the integrate branch holds the
+	// squash tip, so it is kept and reported rather than deleted.
+	if _, err := Cleanup(repo, slug, true); err != nil {
+		t.Fatal(err)
+	}
+	if got := gitOk(t, repo, "rev-parse", ibranch); got != tip {
+		t.Fatalf("forced cleanup dropped integrate branch: %s want %s", got, tip)
+	}
+}
+
+// TestIntegrateFailedLeaseRepairsAndRetries proves integrate-failed is not a
+// dead end: a repaired transfer re-records on the failed lease and a retried
+// integrate completes into one squash commit on control.
+func TestIntegrateFailedLeaseRepairsAndRetries(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+	realTC := gitOk(t, repo, "rev-parse", WorkerBranch(slug, batch, "slice-a"))
+
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad.Slices[0].TransferCommit = strings.Repeat("deadbeef", 5)
+	if err := WriteLease(leasePath, bad); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err == nil {
+		t.Fatal("expected integrate failure")
+	}
+	onDisk, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if onDisk.Status != StatusIntegrateFailed {
+		t.Fatalf("status=%s want integrate-failed", onDisk.Status)
+	}
+
+	if _, err := RecordGreen(repo, slug, "slice-a", realTC); err != nil {
+		t.Fatalf("record-green on integrate-failed lease: %v", err)
+	}
+	if _, lease, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err != nil {
+		t.Fatalf("integrate retry: %v", err)
+	} else if lease.Status != StatusComplete {
+		t.Fatalf("status=%s want complete", lease.Status)
+	}
+	if n := gitOk(t, repo, "rev-list", "--count", base+"..HEAD"); n != "1" {
+		t.Fatalf("expected one squash commit on control, got %s", n)
+	}
+}
+
+// TestIntegrateRefusesDirtyControlOnSlicePaths proves --apply-to-control
+// neither absorbs nor clobbers uncommitted user work on slice paths: overlap
+// refuses with the lease still running, while unrelated dirty files are left
+// alone and the FF proceeds.
+func TestIntegrateRefusesDirtyControlOnSlicePaths(t *testing.T) {
+	repo, base := setupRepo(t)
+	slug, batch := "demo-feature", "batch1"
+	greenBatch(t, repo, base, slug, batch)
+
+	if err := os.MkdirAll(filepath.Join(repo, "src"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	userWIP := filepath.Join(repo, "src", "a.go")
+	if err := os.WriteFile(userWIP, []byte("user wip\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err == nil {
+		t.Fatal("expected dirty-control refusal")
+	}
+	leasePath, err := LeasePath(repo, slug)
+	if err != nil {
+		t.Fatal(err)
+	}
+	lease, err := ReadLease(leasePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if lease.Status != StatusRunning {
+		t.Fatalf("lease status=%s want running after precondition refusal", lease.Status)
+	}
+	if head := gitOk(t, repo, "rev-parse", "HEAD"); head != base {
+		t.Fatalf("control moved despite refusal: %s", head)
+	}
+
+	// Unrelated uncommitted work is not part of the batch and must survive.
+	gitOk(t, repo, "checkout", "--", "src/a.go")
+	keep := filepath.Join(repo, "unrelated.txt")
+	if err := os.WriteFile(keep, []byte("keep me\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if _, _, err := Integrate(IntegrateOpts{Root: repo, Slug: slug, ApplyToControl: true}); err != nil {
+		t.Fatalf("integrate with non-overlapping dirty file: %v", err)
+	}
+	if b, err := os.ReadFile(keep); err != nil || string(b) != "keep me\n" {
+		t.Fatalf("unrelated dirty file lost: err=%v body=%q", err, b)
+	}
+}
+
 func mustRead(t *testing.T, path string) string {
 	t.Helper()
 	b, err := os.ReadFile(path)

package/engine/internal/parallel/pathdisjoint.go

@@ -68,15 +68,30 @@ func validateSlicePaths(paths []string, label, root string) ([]string, error) {
 		if path == ".devrites" || strings.HasPrefix(path, ".devrites/") {
 			return nil, fmt.Errorf("%s: path must not include .devrites: %q", label, path)
 		}
+		// Same for git internals: a transfer commit can never carry .git/**
+		// anyway, and inside a worktree .git is a file, so claiming it is
+		// pure footgun.
+		if path == ".git" || strings.HasPrefix(path, ".git/") {
+			return nil, fmt.Errorf("%s: path must not include .git: %q", label, path)
+		}
 		if _, ok := seen[path]; ok {
 			return nil, fmt.Errorf("%s: duplicate path %q", label, path)
 		}
 		seen[path] = struct{}{}
 		normalized = append(normalized, path)
 		if root != "" {
-			full := filepath.Join(root, filepath.FromSlash(path))
-			if info, err := os.Lstat(full); err == nil && info.Mode()&os.ModeSymlink != 0 {
-				return nil, fmt.Errorf("%s: symlink path is not allowed: %q", label, path)
+			// Check every component, not just the leaf: a symlinked directory
+			// in the chain would let a worktree write outside itself.
+			cur := root
+			for _, seg := range strings.Split(path, "/") {
+				cur = filepath.Join(cur, seg)
+				info, err := os.Lstat(cur)
+				if err != nil {
+					break // missing components are fine; git creates them
+				}
+				if info.Mode()&os.ModeSymlink != 0 {
+					return nil, fmt.Errorf("%s: symlink path is not allowed: %q", label, path)
+				}
 			}
 		}
 	}

package/engine/internal/parallel/pathdisjoint_test.go

@@ -87,6 +87,27 @@ func TestCheckPathDisjointSymlinkRoot(t *testing.T) {
 	}
 }
 
+// A symlinked directory inside a claimed path must also be rejected: the
+// leaf Lstat alone misses it, and a worktree would then write outside itself.
+func TestCheckPathDisjointSymlinkedDir(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	target := filepath.Join(dir, "outside")
+	if err := os.MkdirAll(target, 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(target, filepath.Join(dir, "linkdir")); err != nil {
+		t.Skip("symlinks unavailable")
+	}
+	_, err := CheckPathDisjoint([]SlicePaths{
+		{ID: "a", Paths: []string{"linkdir/x.go"}},
+		{ID: "b", Paths: []string{"other.go"}},
+	}, dir)
+	if err == nil || !strings.Contains(err.Error(), "symlink") {
+		t.Fatalf("expected symlink error for symlinked dir, got %v", err)
+	}
+}
+
 func TestParseSlicesJSONShapes(t *testing.T) {
 	t.Parallel()
 	a, err := ParseSlicesJSON([]byte(`{"slices":[{"id":"a","paths":["x.go"]},{"id":"b","paths":["y.go"]}]}`))

package/pack/.claude/skills/rite-autocomplete/SKILL.md

@@ -83,9 +83,8 @@ executable controller/harness/bundle bytes or a missing writer, read
 3. **Arm AFK once.** Apply the loop's
    [one-write AFK contract](reference/loop.md#arm-afk-once): preserve valid
    existing bytes or create the bounded advisory-only sentinel once; never
-   rewrite it after Vet. Preserve an existing sentinel byte-for-byte. Touch
-   `.devrites/CHECKPOINT` so proven slices get local crash-survivable WIP
-   checkpoints for Ship to collapse. **Completion:** valid read-only AFK and checkpoint sentinels exist.
+   rewrite it after Vet. Preserve an existing sentinel byte-for-byte.
+   **Completion:** a valid read-only AFK sentinel exists.
 4. **Drive phases.** Follow [the loop](reference/loop.md): `/rite-spec` →
    `/rite-clarify` → `/rite-temper` → `/rite-define` → `/rite-vet` →
    `/rite-build` × pending slices → `/rite-prove` → `/rite-polish` →

package/pack/.claude/skills/rite-build/SKILL.md

@@ -58,9 +58,13 @@ Wright applies anti-slop; root verifies returns and never patches source.
 ## `--parallel N` (opt-in)
 
 Omitted/`1` ≡ serial; `2`–`10` → path-disjoint fan-out when eligible; else hard refuse.
-All-green serial integrate; one red/gap aborts. Abort with agent-owned plan
-gaps continues via Spec Drift Guard (batch sweep, one folded plan repair + one
-vet recheck inline); do not emit a human `Fix`. AFK charges after integrate only. Running lease blocks another
+All-green serial integrate; a red/gap sibling gets a bounded repair round in
+its own worktree — never rebuilt from scratch while budget remains.
+Plan-owned gaps still route through Spec Drift Guard (batch sweep, one folded
+plan repair + one vet recheck inline); do not emit a human `Fix`. Exhausted
+repair blocks and preserves everything; `cleanup --force` (human discard
+path only) salvages slice branches before removing worktrees.
+AFK charges after integrate only. Running lease blocks another
 `/rite-build`. Details: `parallel-batch.md`.
 
 ## Execute and reply

package/pack/.claude/skills/rite-build/reference/checkpoint.md

@@ -1,13 +1,8 @@
-# Checkpoint: crash-survivable WIP commits (opt-in)
+# Checkpoint: proven slices land as local WIP commits
 
-`.devrites/` markdown survives compaction, but a slice's source normally stays
-uncommitted until `/rite-ship`. A crash during unattended Build can lose that source.
-Checkpoint mode commits each proven slice as a local `WIP`, so it survives the session.
-
-## When it's on
-Opt in with `.devrites/CHECKPOINT`, the mirror of `.devrites/AFK`. When absent,
-`/rite-build` makes no checkpoint. Autocomplete sets it for long unattended runs.
-**Local-only:** never push a checkpoint or let scratch work trigger CI.
+A slice's source never stays uncommitted after its gates are green: at RECORD
+the orchestrator commits the proven slice as a local `WIP`, so the working
+tree stays clean and the work survives a crash or compaction.
 
 ## The checkpoint commit: orchestrator, at RECORD, after gates are green
 A checkpoint records a **proven** slice only after its gates are green. Stage the exact
@@ -16,7 +11,6 @@ Never stage `touched-files.md`, a directory, glob, unrelated path, or user chang
 Verify the staged set, then commit locally with a `[devrites-context]` body:
 
 ```bash
-[ -f .devrites/CHECKPOINT ] || exit 0   # sentinel absent → no-op, silent
 git commit -m "WIP(<slug>): <slice>" -m "$(cat <<'BODY'
 [devrites-context]
 decisions: <one-line delta this slice added to decisions.md>
@@ -26,6 +20,10 @@ BODY
 )"
 ```
 
+When host reconciliation already landed the isolated transfer commit, nothing
+is staged and the step no-ops. **Local-only:** never push a checkpoint or let
+scratch work trigger CI.
+
 ## Restore
 After a crash, a fresh session may read the last `WIP(<slug>)` body as crash context.
 Authoritative state remains in `.devrites/`: validate the body against that workspace;
@@ -39,8 +37,8 @@ one atomic feature commit before the Conventional-Commit ladder: see the collaps
 [git-ship.md](../../rite-ship/reference/git-ship.md). Result: one clean commit, bisect
 stays green.
 
-## Autocomplete clean-baseline use
-`/rite-autocomplete` may arm checkpoints after verifying a clean or accepted baseline.
-They authorize neither red-gate continuation nor Ship. Each wright returns after one
-slice; HITL stops, while explicit `.devrites/AFK` lets the controlling Build root chain
-another green slice only under its cap and pause rules.
+## Autocomplete
+Checkpoints are unconditional; `/rite-autocomplete` needs no sentinel arming.
+Each wright returns after one slice; HITL stops, while explicit `.devrites/AFK`
+lets the controlling Build root chain another green slice only under its cap
+and pause rules.