devrites 7.2.7 → 7.3.0

package/engine/internal/parallel/landing.go

@@ -0,0 +1,232 @@
+package parallel
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+// landing is written before FF and retained afterward as the exact retry receipt.
+// Worker transfers are rewritten on control; ancestry is not landing evidence.
+type landing struct {
+	BatchID    string       `json:"batch_id"`
+	Controller string       `json:"controller"`
+	Checkout   string       `json:"checkout"`
+	Ref        string       `json:"ref"`
+	PriorTip   string       `json:"prior_tip"`
+	NewTip     string       `json:"new_tip"`
+	Slice      string       `json:"slice,omitempty"`
+	Targets    []LeaseSlice `json:"targets"`
+}
+
+func validateLanding(lease *Lease, record *landing, accepted bool) error {
+	if record == nil {
+		return nil
+	}
+	if record.BatchID != lease.BatchID || validateSlug(record.Controller) != nil || record.Checkout == "" || record.Ref == "" || len(record.PriorTip) != 40 || !shaRE.MatchString(record.PriorTip) || len(record.NewTip) != 40 || !shaRE.MatchString(record.NewTip) || record.PriorTip == record.NewTip || len(record.Targets) == 0 {
+		return fmt.Errorf("invalid landing identity")
+	}
+	if lease.ControlCheckout != record.Checkout || lease.ControlRef != record.Ref {
+		return fmt.Errorf("landing controller identity differs from lease")
+	}
+	seen := map[string]bool{}
+	for _, target := range record.Targets {
+		key := SliceKey(target.Workspace, target.ID)
+		if seen[key] || len(target.TransferCommit) != 40 || !shaRE.MatchString(target.TransferCommit) || target.WrightStatus != WrightGreen {
+			return fmt.Errorf("invalid landing target %s", key)
+		}
+		seen[key] = true
+		found := false
+		for _, sl := range lease.Slices {
+			if SliceKey(sl.Workspace, sl.ID) != key {
+				continue
+			}
+			if accepted {
+				if sl.WrightStatus != WrightIntegrated {
+					return fmt.Errorf("accepted landing target %s is not integrated", key)
+				}
+				sl.WrightStatus = WrightGreen
+			}
+			if !reflect.DeepEqual(sl, target) {
+				return fmt.Errorf("landing target %s changed", key)
+			}
+			found = true
+			break
+		}
+		if !found {
+			return fmt.Errorf("landing target %s missing", key)
+		}
+	}
+	if record.Slice != "" && (len(record.Targets) != 1 || SliceKey(record.Targets[0].Workspace, record.Targets[0].ID) != record.Slice) {
+		return fmt.Errorf("landing selector differs from targets")
+	}
+	if !accepted && !strings.HasPrefix(strings.ToLower(record.PriorTip), strings.ToLower(expectedControl(lease))) {
+		return fmt.Errorf("pending landing prior tip differs from lease")
+	}
+	if accepted && lease.ControlTip != record.NewTip {
+		return fmt.Errorf("accepted landing tip differs from lease")
+	}
+	return nil
+}
+
+func controlIdentity(root string) (string, string, error) {
+	ref, err := git(root, "symbolic-ref", "--quiet", "HEAD")
+	if err != nil {
+		if !strings.Contains(err.Error(), "exit 1") {
+			return "", "", err
+		}
+		ref = "HEAD"
+	}
+	return resolvedPath(root), ref, nil
+}
+
+func ensureControllerIdentity(root string, lease *Lease) error {
+	if lease.ControlCheckout == "" && lease.ControlRef == "" {
+		return nil // Legacy leases have no historical checkout/ref evidence.
+	}
+	checkout, ref, err := controlIdentity(root)
+	if err != nil {
+		return err
+	}
+	if checkout != lease.ControlCheckout || ref != lease.ControlRef {
+		return fmt.Errorf("control checkout/ref changed; expected %s %s, have %s %s", lease.ControlCheckout, lease.ControlRef, checkout, ref)
+	}
+	return nil
+}
+
+// recoverLanding runs under controller + feature locks. Only integrate may
+// perform a prepared FF; abort may cancel exact-prior preparation instead.
+func recoverLanding(root, slug, path string, lease *Lease, resume, cancel bool) (*landing, error) {
+	if err := ensureControllerIdentity(root, lease); err != nil {
+		return nil, err
+	}
+	record := lease.PendingLanding
+	if record == nil {
+		return nil, nil
+	}
+	if record.Controller != slug {
+		return nil, fmt.Errorf("pending landing controller changed")
+	}
+	if err := validateLanding(lease, record, false); err != nil {
+		return nil, err
+	}
+	prior, err := revParse(root, expectedControl(lease))
+	if err != nil {
+		return nil, err
+	}
+	if prior != record.PriorTip {
+		return nil, fmt.Errorf("pending landing resolved prior tip differs from lease")
+	}
+	head, err := headSHA(root)
+	if err != nil {
+		return nil, err
+	}
+	switch head {
+	case record.PriorTip:
+		if cancel {
+			lease.PendingLanding = nil
+			return nil, writeLease(path, lease)
+		}
+		if !resume {
+			return nil, fmt.Errorf("pending landing requires integrate --apply-to-control or abort before mutation")
+		}
+		var paths []string
+		for _, target := range record.Targets {
+			paths = append(paths, target.Paths...)
+		}
+		dirty, err := porcelainDirtyPaths(root, paths)
+		if err != nil {
+			return nil, err
+		}
+		if dirty {
+			return nil, fmt.Errorf("control has uncommitted changes on pending landing paths")
+		}
+		mergeErr := mergeFFOnly(root, record.NewTip)
+		// A post-merge hook may fail after the ref already advanced.
+		head, err = headSHA(root)
+		if err != nil {
+			return nil, err
+		}
+		if err := ensureControllerIdentity(root, lease); err != nil {
+			return nil, err
+		}
+		if head != record.NewTip {
+			return nil, fmt.Errorf("pending landing fast-forward did not reach exact recorded tip (HEAD=%s): %v", head, mergeErr)
+		}
+	case record.NewTip:
+	default:
+		return nil, fmt.Errorf("pending landing refuses external control tip %s; expected exactly %s or %s", head, record.PriorTip, record.NewTip)
+	}
+	for i := range lease.Slices {
+		for _, target := range record.Targets {
+			if SliceKey(lease.Slices[i].Workspace, lease.Slices[i].ID) == SliceKey(target.Workspace, target.ID) {
+				lease.Slices[i].WrightStatus = WrightIntegrated
+			}
+		}
+	}
+	lease.ControlTip = record.NewTip
+	lease.Status = StatusRunning
+	if len(activeSlices(lease)) == 0 {
+		lease.Status = StatusComplete
+	}
+	lease.PendingLanding = nil
+	lease.LastLanding = record
+	if err := writeLease(path, lease); err != nil {
+		return nil, fmt.Errorf("control landed at %s; persist landing recovery before further mutation: %w", record.NewTip, err)
+	}
+	return record, nil
+}
+
+func acceptedRetry(root string, lease *Lease, selector string) (string, error) {
+	record := lease.LastLanding
+	if record == nil || record.Slice != selector {
+		return "", nil
+	}
+	if err := ensureControllerIdentity(root, lease); err != nil {
+		return "", err
+	}
+	if err := ensureControlAtBase(root, record.NewTip); err != nil {
+		return "", err
+	}
+	if err := validateLanding(lease, record, true); err != nil {
+		return "", err
+	}
+	// An all-slice request after refill is new work, not the old all-slice retry.
+	if selector == "" && len(activeSlices(lease)) != 0 {
+		return "", nil
+	}
+	return record.NewTip, nil
+}
+
+func protectRawLease(current, next *Lease) error {
+	if current == nil {
+		if next.PendingLanding != nil || next.LastLanding != nil {
+			return fmt.Errorf("lease-write cannot fabricate landing evidence")
+		}
+		return nil
+	}
+	if current.PendingLanding != nil {
+		if !reflect.DeepEqual(current, next) {
+			return fmt.Errorf("lease-write refuses mutation during pending landing; recover integrate or abort first")
+		}
+		return nil
+	}
+	if next.PendingLanding != nil || !reflect.DeepEqual(current.LastLanding, next.LastLanding) || current.ControlCheckout != next.ControlCheckout || current.ControlRef != next.ControlRef {
+		return fmt.Errorf("lease-write cannot change landing evidence or controller identity")
+	}
+	for _, sl := range current.Slices {
+		if sl.WrightStatus != WrightIntegrated {
+			continue
+		}
+		found := false
+		for _, candidate := range next.Slices {
+			if SliceKey(sl.Workspace, sl.ID) == SliceKey(candidate.Workspace, candidate.ID) && reflect.DeepEqual(sl, candidate) {
+				found = true
+			}
+		}
+		if !found {
+			return fmt.Errorf("lease-write cannot change integrated slice %s", SliceKey(sl.Workspace, sl.ID))
+		}
+	}
+	return nil
+}

package/engine/internal/parallel/lease.go

@@ -26,7 +26,7 @@ const (
 	// control; it no longer holds a parallel slot.
 	WrightIntegrated = "integrated"
 
-	MinParallelSlices = 2
+	MinParallelSlices = 1
 	MaxParallelSlices = 10
 )
 
@@ -46,7 +46,12 @@ type Lease struct {
 	CreatedAt           string       `json:"created_at"`
 	BaseSHA             string       `json:"base_sha"`
 	ControlTip          string       `json:"control_tip,omitempty"`
+	ControlCheckout     string       `json:"control_checkout,omitempty"`
+	ControlRef          string       `json:"control_ref,omitempty"`
+	PendingLanding      *landing     `json:"pending_landing,omitempty"`
+	LastLanding         *landing     `json:"last_landing,omitempty"`
 	N                   int          `json:"n"`
+	Capacity            int          `json:"capacity,omitempty"`
 	Status              string       `json:"status"`
 	ControlPIDOrSession string       `json:"control_pid_or_session"`
 	Slices              []LeaseSlice `json:"slices"`
@@ -57,6 +62,7 @@ type Lease struct {
 // from the original create).
 type LeaseSlice struct {
 	ID             string   `json:"id"`
+	Workspace      string   `json:"workspace,omitempty"`
 	Paths          []string `json:"paths"`
 	WorktreePath   string   `json:"worktree_path"`
 	Branch         string   `json:"branch"`
@@ -87,7 +93,7 @@ func activeSlices(lease *Lease) []SlicePaths {
 	var active []SlicePaths
 	for _, sl := range lease.Slices {
 		if sl.WrightStatus != WrightIntegrated {
-			active = append(active, SlicePaths{ID: sl.ID, Paths: sl.Paths})
+			active = append(active, SlicePaths{ID: sl.ID, Workspace: sl.Workspace, Paths: sl.Paths})
 		}
 	}
 	return active
@@ -112,17 +118,64 @@ func IntegrateBranchName(slug, batchID string) string {
 	return fmt.Sprintf("devrites/parallel/%s/%s/integrate", slug, batchID)
 }
 
-// ownedBranchName reports whether branch is inside this batch's namespace —
-// devrites/parallel/<slug>/<batch>/…. Cleanup deletes only owned branches;
-// a lease naming anything else (e.g. a forged "main") is left alone.
-func ownedBranchName(slug, batchID, branch string) bool {
-	return strings.HasPrefix(branch, fmt.Sprintf("devrites/parallel/%s/%s/", slug, batchID))
-}
-
 func WorkerWorktreePath(repoRoot, batchID, sliceID string) string {
 	return filepath.Join(ScratchRoot(repoRoot), batchID, sliceID)
 }
 
+func workerBranch(slug, batchID, workspace, id string) string {
+	if workspace != "" {
+		return WorkerBranch(slug, batchID, "_workspaces/"+workspace+"/"+id)
+	}
+	return WorkerBranch(slug, batchID, id)
+}
+
+func workerWorktreePath(root, batchID, workspace, id string) string {
+	if workspace != "" {
+		return filepath.Join(ScratchRoot(root), batchID, "_workspaces", workspace, id)
+	}
+	return WorkerWorktreePath(root, batchID, id)
+}
+
+func leaseCapacity(lease *Lease) int {
+	if lease.Capacity == 0 {
+		return MaxParallelSlices
+	}
+	return lease.Capacity
+}
+
+func validateCapacity(capacity int) error {
+	if capacity < 0 || capacity > MaxParallelSlices {
+		return fmt.Errorf("cap must be 1-%d (got %d)", MaxParallelSlices, capacity)
+	}
+	return nil
+}
+
+func normalizeLease(lease *Lease, controller string) error {
+	for i := range lease.Slices {
+		if lease.Slices[i].Workspace == controller {
+			lease.Slices[i].Workspace = ""
+		}
+	}
+	return ValidateLease(lease)
+}
+
+func normalizeSliceRef(controller, ref string) (string, error) {
+	workspace, id, qualified := strings.Cut(ref, "/")
+	if !qualified {
+		return ref, validateSliceID(ref)
+	}
+	if err := validateSlug(workspace); err != nil {
+		return "", err
+	}
+	if err := validateSliceID(id); err != nil {
+		return "", err
+	}
+	if workspace == controller {
+		workspace = ""
+	}
+	return SliceKey(workspace, id), nil
+}
+
 func validateSlug(slug string) error {
 	if !slugRE.MatchString(slug) {
 		return fmt.Errorf("invalid slug %q", slug)
@@ -177,8 +230,11 @@ func ValidateLease(lease *Lease) error {
 	if len(lease.Slices) < MinParallelSlices {
 		return checkParallelSliceCount(len(lease.Slices))
 	}
-	if active := len(activeSlices(lease)); active > MaxParallelSlices {
-		return fmt.Errorf("parallel requires %d-%d slices active at once (got %d)", MinParallelSlices, MaxParallelSlices, active)
+	if err := validateCapacity(lease.Capacity); err != nil {
+		return err
+	}
+	if active := len(activeSlices(lease)); active > leaseCapacity(lease) {
+		return fmt.Errorf("parallel requires %d-%d slices active at once (got %d)", MinParallelSlices, leaseCapacity(lease), active)
 	}
 	if lease.N != len(lease.Slices) {
 		return fmt.Errorf("lease n=%d does not match slices=%d", lease.N, len(lease.Slices))
@@ -188,25 +244,37 @@ func ValidateLease(lease *Lease) error {
 		if err := validateSliceID(sl.ID); err != nil {
 			return fmt.Errorf("slice %d: %w", i, err)
 		}
-		if _, ok := seen[sl.ID]; ok {
-			return fmt.Errorf("duplicate slice id %q", sl.ID)
+		if sl.Workspace != "" {
+			if err := validateSlug(sl.Workspace); err != nil {
+				return fmt.Errorf("slice %d: %w", i, err)
+			}
 		}
-		seen[sl.ID] = struct{}{}
-		if _, err := validateSlicePaths(sl.Paths, fmt.Sprintf("slice %q", sl.ID), ""); err != nil {
+		key := SliceKey(sl.Workspace, sl.ID)
+		if _, ok := seen[key]; ok {
+			return fmt.Errorf("duplicate slice id %q", key)
+		}
+		seen[key] = struct{}{}
+		if _, err := validateSlicePaths(sl.Paths, fmt.Sprintf("slice %q", key), ""); err != nil {
 			return err
 		}
 		switch sl.WrightStatus {
 		case "", WrightPending, WrightGreen, WrightRed, WrightGap, WrightIntegrated:
 		default:
-			return fmt.Errorf("slice %q: invalid wright_status %q", sl.ID, sl.WrightStatus)
+			return fmt.Errorf("slice %q: invalid wright_status %q", key, sl.WrightStatus)
 		}
 		if sl.TransferCommit != "" && !shaRE.MatchString(sl.TransferCommit) {
-			return fmt.Errorf("slice %q: invalid transfer_commit %q", sl.ID, sl.TransferCommit)
+			return fmt.Errorf("slice %q: invalid transfer_commit %q", key, sl.TransferCommit)
 		}
 		if sl.BaseSHA != "" && !shaRE.MatchString(sl.BaseSHA) {
-			return fmt.Errorf("slice %q: invalid base_sha %q", sl.ID, sl.BaseSHA)
+			return fmt.Errorf("slice %q: invalid base_sha %q", key, sl.BaseSHA)
 		}
 	}
+	if err := validateLanding(lease, lease.PendingLanding, false); err != nil {
+		return err
+	}
+	if err := validateLanding(lease, lease.LastLanding, true); err != nil {
+		return err
+	}
 	return nil
 }
 
@@ -228,11 +296,17 @@ func EmitLeaseMarkdown(lease *Lease) (string, error) {
 		fmt.Fprintf(&b, "control_tip: %s\n", yamlQuote(lease.ControlTip))
 	}
 	fmt.Fprintf(&b, "n: %d\n", lease.N)
+	if lease.Capacity != 0 {
+		fmt.Fprintf(&b, "capacity: %d\n", lease.Capacity)
+	}
 	fmt.Fprintf(&b, "status: %s\n", yamlQuote(lease.Status))
 	fmt.Fprintf(&b, "control_pid_or_session: %s\n", yamlQuote(lease.ControlPIDOrSession))
 	b.WriteString("slices:\n")
 	for _, sl := range lease.Slices {
 		fmt.Fprintf(&b, "  - id: %s\n", yamlQuote(sl.ID))
+		if sl.Workspace != "" {
+			fmt.Fprintf(&b, "    workspace: %s\n", yamlQuote(sl.Workspace))
+		}
 		if len(sl.Paths) == 0 {
 			b.WriteString("    paths: []\n")
 		} else {
@@ -299,6 +373,11 @@ func ReadLease(path string) (*Lease, error) {
 }
 
 func ClearLease(path string) error {
+	if lease, err := ReadLease(path); err == nil && lease.PendingLanding != nil {
+		return fmt.Errorf("lease-clear refuses pending landing; recover with integrate --apply-to-control or abort")
+	} else if err != nil && !os.IsNotExist(err) {
+		return err
+	}
 	err := os.Remove(path)
 	if err != nil && !os.IsNotExist(err) {
 		return err