devrites 7.2.8 → 7.3.0

package/engine/internal/acceptance/transcript.go

@@ -1,13 +1,17 @@
 package acceptance
 
 import (
+	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"regexp"
+	"strconv"
 	"strings"
 	"time"
 
+	"github.com/devrites/devrites/internal/fsutil"
 	"github.com/devrites/devrites/internal/secretpattern"
 )
 
@@ -19,7 +23,11 @@ var CandidateDigest func(root, slug string) (string, error)
 // maxTranscriptOutput caps the redacted output a transcript keeps.
 const maxTranscriptOutput = 1 << 20
 
+// Redaction can expand short credentials in metadata as well as output.
+const maxTranscriptBytes = 2*MaxLedgerBytes + maxTranscriptOutput + (64 << 10)
+
 var unsafeNameRE = regexp.MustCompile(`[^A-Za-z0-9._-]`)
+var transcriptDigestRE = regexp.MustCompile(`^[0-9a-f]{64}$`)
 
 func candidateLabel(root, slug string) string {
 	if CandidateDigest == nil {
@@ -27,77 +35,260 @@ func candidateLabel(root, slug string) string {
 	}
 	digest, err := CandidateDigest(root, slug)
 	if err != nil {
-		return "unavailable: " + oneLine(err.Error())
+		return "unavailable: " + transcriptMetadata(err.Error())
 	}
 	return digest
 }
 
-// writeTranscripts records one immutable file per executed or reused gate under
-// <work>/references/gates/<gate-id>/, binding the exact command, cwd, attempt,
-// exit, EXPECT verdict and redacted output to the candidate identity read
-// before and after the run. OUTPUT_SHA256 equals the ledger evidence digest.
+func transcriptMetadata(value string) string {
+	redacted, _ := secretpattern.Redact(oneLine(value))
+	return redacted
+}
+
+func transcriptGateName(id string) string {
+	name := unsafeNameRE.ReplaceAllString(transcriptMetadata(id), "_")
+	if name == "." || name == ".." || name == "" {
+		return "_"
+	}
+	return name
+}
+
+// transcriptDirectory opens each directory without accepting symlink parents.
+// Holding the resulting root also confines publication if a parent is renamed.
+func transcriptDirectory(work, id string, create bool) (*os.Root, error) {
+	root, err := os.OpenRoot(work)
+	if err != nil {
+		return nil, err
+	}
+	for _, name := range []string{"references", "gates", transcriptGateName(id)} {
+		info, err := root.Lstat(name)
+		if errors.Is(err, os.ErrNotExist) && create {
+			if err = root.Mkdir(name, 0o700); err == nil || errors.Is(err, os.ErrExist) {
+				info, err = root.Lstat(name)
+			}
+		}
+		if err != nil || !info.IsDir() {
+			_ = root.Close()
+			if err == nil {
+				err = fmt.Errorf("unsafe transcript directory %s", name)
+			}
+			return nil, err
+		}
+		next, err := root.OpenRoot(name)
+		if err == nil {
+			var opened os.FileInfo
+			opened, err = next.Stat(".")
+			if err == nil && !os.SameFile(info, opened) {
+				err = fmt.Errorf("transcript directory changed: %s", name)
+			}
+		}
+		_ = root.Close()
+		if err != nil {
+			if next != nil {
+				_ = next.Close()
+			}
+			return nil, err
+		}
+		root = next
+	}
+	return root, nil
+}
+
+// writeTranscripts atomically publishes private, complete executed records.
+// Reuse points to the original file, preserving its historical candidate labels.
+// OUTPUT_SHA256 and OUTPUT_BYTES always describe original, not redacted output.
 func writeTranscripts(work string, doc *Document, results []GateResult, before, after string) ([]string, error) {
 	gates := map[string]*Gate{}
 	for _, gate := range doc.Gates {
 		gates[gate.ID] = gate
 	}
 	prefix := "nodigest"
-	if len(before) >= 12 && !strings.HasPrefix(before, "unavailable") {
+	if transcriptDigestRE.MatchString(before) {
 		prefix = before[:12]
 	}
 	var paths []string
 	for _, result := range results {
 		gate := gates[result.ID]
-		if gate == nil || (!result.Ran && !result.Reused) {
+		if gate == nil {
 			continue
 		}
-		name := unsafeNameRE.ReplaceAllString(gate.ID, "_")
-		if name == "." || name == ".." {
-			name = "_"
+		if result.Reused && result.Origin != "" {
+			paths = append(paths, result.Origin)
+			continue
 		}
-		dir := filepath.Join(work, "references", "gates", name)
-		if err := os.MkdirAll(dir, 0o755); err != nil {
-			return paths, err
+		if !result.Ran {
+			continue
 		}
-		var body strings.Builder
-		fmt.Fprintf(&body, "DEVRITES-GATE-TRANSCRIPT v1\nGATE: %s\nTITLE: %s\nCOMMAND: %s\nCWD: %s\n", gate.ID, gate.Title, gate.Check, valueOr(gate.Cwd, "."))
-		fmt.Fprintf(&body, "INPUTS: %s\nINPUTS_SHA256: %s\nCANDIDATE_BEFORE: %s\nCANDIDATE_AFTER: %s\n", valueOr(gate.Inputs, "none"), valueOr(result.Inputs, "none"), before, after)
-		var file string
-		if result.Reused {
-			file = filepath.Join(dir, prefix+"-reused.log")
-			fmt.Fprintf(&body, "RESULT: reused (inputs unchanged; not executed)\nPRIOR_EVIDENCE: %s\n", gate.Evidence)
-		} else {
-			attempt := 1
-			if entries, err := os.ReadDir(dir); err == nil {
-				for _, entry := range entries {
-					if strings.HasPrefix(entry.Name(), prefix+"-a") {
-						attempt++
-					}
-				}
-			}
-			file = filepath.Join(dir, fmt.Sprintf("%s-a%d.log", prefix, attempt))
-			output, masked := secretpattern.Redact(result.Outcome.Output)
-			truncated := len(output) > maxTranscriptOutput
-			if truncated {
-				output = output[:maxTranscriptOutput]
-			}
-			verdict := "fail"
-			if result.Passed {
-				verdict = "pass"
-			}
-			fmt.Fprintf(&body, "ATTEMPT: %d\nSTARTED: %s\nENDED: %s\nEXIT: %s\nEXPECT: %s\nRESULT: %s\n",
-				attempt, result.Started.Format(time.RFC3339Nano), result.Ended.Format(time.RFC3339Nano), exitLabel(result.Outcome), gate.Expect, verdict)
-			fmt.Fprintf(&body, "OUTPUT_SHA256: %s\nOUTPUT_BYTES: %d\nREDACTIONS: %d\nTRUNCATED: %t\n--- OUTPUT ---\n%s\n--- END OUTPUT ---\n",
-				OutputDigest(result.Outcome.Output), result.Outcome.OutputBytes, masked, truncated, output)
+		dir, err := transcriptDirectory(work, gate.ID, true)
+		if err != nil {
+			return paths, err
 		}
-		if err := os.WriteFile(file, []byte(body.String()), 0o644); err != nil {
+		file, err := publishTranscript(dir, gate, result, prefix, before, after)
+		_ = dir.Close()
+		if err != nil {
 			return paths, err
 		}
-		paths = append(paths, file)
+		paths = append(paths, filepath.Join(work, "references", "gates", transcriptGateName(gate.ID), file))
 	}
 	return paths, nil
 }
 
+func publishTranscript(dir *os.Root, gate *Gate, result GateResult, prefix, before, after string) (string, error) {
+	attempt := 1
+	for {
+		file := fmt.Sprintf("%s-a%d.log", prefix, attempt)
+		if _, err := dir.Lstat(file); errors.Is(err, os.ErrNotExist) {
+			break
+		} else if err != nil {
+			return "", err
+		}
+		attempt++
+	}
+	var body strings.Builder
+	fmt.Fprintf(&body, "DEVRITES-GATE-TRANSCRIPT v2\nGATE: %s\nTITLE: %s\nCOMMAND: %s\nCWD: %s\nDEFINITION_SHA256: %s\n",
+		transcriptMetadata(gate.ID), transcriptMetadata(gate.Title), transcriptMetadata(gate.Check), transcriptMetadata(valueOr(gate.Cwd, ".")), DefinitionDigest(gate))
+	fmt.Fprintf(&body, "INPUTS: %s\nINPUTS_SHA256: %s\nCANDIDATE_BEFORE: %s\nCANDIDATE_AFTER: %s\n",
+		transcriptMetadata(valueOr(gate.Inputs, "none")), valueOr(result.Inputs, "none"), transcriptMetadata(before), transcriptMetadata(after))
+	output, masked := secretpattern.Redact(result.Outcome.Output)
+	truncated := len(output) > maxTranscriptOutput
+	if truncated {
+		output = output[:maxTranscriptOutput]
+	}
+	verdict := "fail"
+	if result.Passed && !result.Discarded && result.WriteErr == nil {
+		verdict = "pass"
+	}
+	fmt.Fprintf(&body, "ATTEMPT: %d\nSTARTED: %s\nENDED: %s\nEXIT: %s\nEXPECT: %s\nRESULT: %s\n",
+		attempt, result.Started.Format(time.RFC3339Nano), result.Ended.Format(time.RFC3339Nano), transcriptMetadata(exitLabel(result.Outcome)), transcriptMetadata(gate.Expect), verdict)
+	fmt.Fprintf(&body, "OUTPUT_SHA256: %s\nOUTPUT_BYTES: %d\nREDACTIONS: %d\nTRUNCATED: %t\n--- OUTPUT ---\n%s\n--- END OUTPUT ---\n",
+		OutputDigest(result.Outcome.Output), result.Outcome.OutputBytes, masked, truncated, output)
+	checksum := OutputDigest(body.String())
+	fmt.Fprintf(&body, "TRANSCRIPT_SHA256: %s\n", checksum)
+	file := fmt.Sprintf("%s-a%d.log", prefix, attempt)
+	return file, fsutil.WriteFileAtomicIn(dir, file, []byte(body.String()), 0o600)
+}
+
+// passingOrigin accepts only an executed, complete pass bound to ledger proof.
+// Candidate labels are historical context, not a dependency of scoped INPUTS.
+func passingOrigin(work string, gate *Gate) string {
+	evidence := automaticEvidenceRE.FindStringSubmatch(strings.TrimSpace(gate.Evidence))
+	if evidence == nil || evidence[1] != DefinitionDigest(gate) {
+		return ""
+	}
+	dir, err := transcriptDirectory(work, gate.ID, false)
+	if err != nil {
+		return ""
+	}
+	defer func() { _ = dir.Close() }()
+	listing, err := dir.Open(".")
+	if err != nil {
+		return ""
+	}
+	entries, err := listing.ReadDir(-1)
+	_ = listing.Close()
+	if err != nil {
+		return ""
+	}
+	for _, entry := range entries {
+		if !strings.HasSuffix(entry.Name(), ".log") {
+			continue
+		}
+		raw, err := readTranscript(dir, entry.Name())
+		if err == nil && validOrigin(string(raw), gate, evidence) {
+			return filepath.Join(work, "references", "gates", transcriptGateName(gate.ID), entry.Name())
+		}
+	}
+	return ""
+}
+
+func readTranscript(dir *os.Root, name string) ([]byte, error) {
+	info, err := dir.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() || info.Size() > maxTranscriptBytes {
+		return nil, fmt.Errorf("unsafe or oversized transcript")
+	}
+	file, err := dir.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return nil, err
+	}
+	if !os.SameFile(info, opened) {
+		return nil, fmt.Errorf("transcript changed while opening")
+	}
+	raw, err := io.ReadAll(io.LimitReader(file, maxTranscriptBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	current, err := dir.Lstat(name)
+	if err != nil {
+		return nil, err
+	}
+	if len(raw) > maxTranscriptBytes || !current.Mode().IsRegular() || !os.SameFile(opened, current) || current.Size() != int64(len(raw)) {
+		return nil, fmt.Errorf("transcript changed while reading")
+	}
+	return raw, nil
+}
+
+func validOrigin(raw string, gate *Gate, evidence []string) bool {
+	const footer = "TRANSCRIPT_SHA256: "
+	end := strings.LastIndex(raw, footer)
+	if end < 0 || raw[end:] != footer+OutputDigest(raw[:end])+"\n" {
+		return false
+	}
+	header, output, ok := strings.Cut(raw[:end], "\n--- OUTPUT ---\n")
+	if !ok || !strings.HasSuffix(output, "\n--- END OUTPUT ---\n") {
+		return false
+	}
+	output = strings.TrimSuffix(output, "\n--- END OUTPUT ---\n")
+	lines := strings.Split(header, "\n")
+	if lines[0] != "DEVRITES-GATE-TRANSCRIPT v2" {
+		return false
+	}
+	fields := map[string]string{}
+	for _, line := range lines[1:] {
+		key, value, ok := strings.Cut(line, ": ")
+		if _, duplicate := fields[key]; !ok || duplicate {
+			return false
+		}
+		fields[key] = value
+	}
+	for key, want := range map[string]string{
+		"GATE": transcriptMetadata(gate.ID), "TITLE": transcriptMetadata(gate.Title),
+		"COMMAND": transcriptMetadata(gate.Check), "CWD": transcriptMetadata(valueOr(gate.Cwd, ".")),
+		"EXPECT": transcriptMetadata(gate.Expect), "DEFINITION_SHA256": evidence[1],
+		"INPUTS": transcriptMetadata(valueOr(gate.Inputs, "none")), "INPUTS_SHA256": valueOr(evidence[4], "none"),
+		"RESULT": "pass", "EXIT": "0", "OUTPUT_SHA256": evidence[2], "OUTPUT_BYTES": evidence[3],
+	} {
+		if got, exists := fields[key]; !exists || got != want {
+			return false
+		}
+	}
+	started, err := time.Parse(time.RFC3339Nano, fields["STARTED"])
+	if err != nil || started.IsZero() {
+		return false
+	}
+	ended, err := time.Parse(time.RFC3339Nano, fields["ENDED"])
+	if err != nil || ended.Before(started) {
+		return false
+	}
+	attempt, err := strconv.Atoi(fields["ATTEMPT"])
+	if err != nil || attempt < 1 || fields["CANDIDATE_BEFORE"] == "" || fields["CANDIDATE_AFTER"] == "" {
+		return false
+	}
+	redactions, err := strconv.Atoi(fields["REDACTIONS"])
+	if err != nil || redactions < 0 {
+		return false
+	}
+	truncated, err := strconv.ParseBool(fields["TRUNCATED"])
+	return err == nil && len(output) <= maxTranscriptOutput && (!truncated || len(output) == maxTranscriptOutput)
+}
+
 func exitLabel(outcome RunOutcome) string {
 	switch {
 	case outcome.TimedOut:

package/engine/internal/devritespaths/paths.go

@@ -47,9 +47,13 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 	if raw == "" {
 		return "", nil
 	}
+	absoluteRoot, err := filepath.Abs(root)
+	if err != nil {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
+	}
 	path := raw
 	if !filepath.IsAbs(path) {
-		path = filepath.Join(filepath.Dir(root), path)
+		path = filepath.Join(filepath.Dir(absoluteRoot), path)
 	}
 	abs, err := filepath.Abs(path)
 	if err != nil {
@@ -59,10 +63,10 @@ func WorkspaceOverrideChecked(root, slug string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DEVRITES_WORKSPACE %q: %w", raw, err)
 	}
-	if !safepath.WithinResolved(path, root) {
+	if !safepath.WithinResolved(path, absoluteRoot) {
 		return "", fmt.Errorf("DRV-WORKSPACE-OUTSIDE-ROOT: DEVRITES_WORKSPACE %q is outside %q; run `unset DEVRITES_WORKSPACE`", raw, root)
 	}
-	resolvedRoot, err := safepath.ResolveExisting(root)
+	resolvedRoot, err := safepath.ResolveExisting(absoluteRoot)
 	if err != nil {
 		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: resolve DevRites root %q: %w", root, err)
 	}
@@ -114,6 +118,15 @@ func ExistingFeatureDirChecked(root, slug string) (string, error) {
 		}
 		return ws, nil
 	}
+	return ExistingCanonicalFeatureDirChecked(root, slug)
+}
+
+// ExistingCanonicalFeatureDirChecked resolves an explicit producer workspace
+// inside root without redirecting it through a consumer's workspace override.
+func ExistingCanonicalFeatureDirChecked(root, slug string) (string, error) {
+	if !ValidSlug(slug) {
+		return "", fmt.Errorf("DRV-WORKSPACE-INVALID: %q is not a feature slug", slug)
+	}
 	candidate := filepath.Join(root, "work", slug)
 	resolved, err := checkedCanonicalDir(root, candidate, "work", slug)
 	if err == nil {

package/engine/internal/gate/gate.go

@@ -51,6 +51,12 @@ func Check(kind Kind, root, slug string) (*Result, error) {
 	if err != nil {
 		return nil, fmt.Errorf("gate %s: %w", kind, err)
 	}
+	return CheckObserved(kind, root, observation)
+}
+
+// CheckObserved checks retained facts acquired from root, so a caller can use
+// those same vetted bytes for subsequent admission without rereading the workspace.
+func CheckObserved(kind Kind, root string, observation *state.WorkspaceObservation) (*Result, error) {
 	result, err := checkObservation(kind, observation)
 	if err != nil {
 		return nil, fmt.Errorf("gate %s: %w", kind, err)

package/engine/internal/lib/candidate.go

@@ -38,6 +38,7 @@ type candidateRow struct {
 	executable bool
 	size       int64
 	info       os.FileInfo
+	fileDigest string
 }
 
 type candidateIdentity struct {
@@ -72,7 +73,7 @@ func loadCandidateIdentity(root, slug string) (candidateIdentity, error) {
 	if err := validateCandidateRows(project, rows); err != nil {
 		return candidateIdentity{}, err
 	}
-	digest, err := hashCandidate(project, rows)
+	digest, err := hashCandidate(project, rows, false)
 	if err != nil {
 		return candidateIdentity{}, err
 	}
@@ -407,15 +408,18 @@ func candidatePathInfo(project, name string) (os.FileInfo, bool, error) {
 	return nil, false, errors.New("path is empty")
 }
 
-func hashCandidate(project string, rows []candidateRow) (string, error) {
+func hashCandidate(project string, rows []candidateRow, perFile bool) (string, error) {
 	digest := sha256.New()
 	writeCandidateField(digest, candidateDigestDomain)
 	writeCandidateField(digest, candidateDigestVersion)
 	writeCandidateField(digest, fmt.Sprintf("%d", len(rows)))
-	for _, row := range rows {
+	for i, row := range rows {
 		writeCandidateField(digest, row.state)
 		writeCandidateField(digest, row.path)
 		if row.state == "deleted" {
+			if err := validateCandidateRow(project, &row); err != nil {
+				return "", fmt.Errorf("candidate %q: %w", row.path, err)
+			}
 			writeCandidateField(digest, "absent")
 			writeCandidateField(digest, "0")
 			writeCandidateLength(digest, 0)
@@ -428,9 +432,18 @@ func hashCandidate(project string, rows []candidateRow) (string, error) {
 			writeCandidateField(digest, "0")
 		}
 		writeCandidateLength(digest, uint64(row.size)) // #nosec G115 -- validateCandidateRow bounds size to 0..64 MiB
-		if err := hashCandidateFile(digest, project, row); err != nil {
+		var writer io.Writer = digest
+		var fileDigest hash.Hash
+		if perFile {
+			fileDigest = sha256.New()
+			writer = io.MultiWriter(digest, fileDigest)
+		}
+		if err := hashCandidateFile(writer, project, row); err != nil {
 			return "", fmt.Errorf("candidate %q: %w", row.path, err)
 		}
+		if perFile {
+			rows[i].fileDigest = hex.EncodeToString(fileDigest.Sum(nil))
+		}
 	}
 	return hex.EncodeToString(digest.Sum(nil)), nil
 }
@@ -446,7 +459,7 @@ func writeCandidateLength(writer hash.Hash, size uint64) {
 	_, _ = writer.Write(encoded[:])
 }
 
-func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error {
+func hashCandidateFile(digest io.Writer, project string, row candidateRow) error {
 	if _, exists, err := candidatePathInfo(project, row.path); err != nil || !exists {
 		if err != nil {
 			return err
@@ -464,7 +477,7 @@ func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error
 	if err != nil {
 		return err
 	}
-	if !opened.Mode().IsRegular() || opened.Size() != row.size || (opened.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(row.info, opened) {
+	if !opened.Mode().IsRegular() || opened.Size() != row.size || (opened.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(row.info, opened) || !row.info.ModTime().Equal(opened.ModTime()) {
 		return errors.New("file changed size or type before reading")
 	}
 	written, err := io.CopyN(digest, file, row.size)
@@ -483,7 +496,7 @@ func hashCandidateFile(digest hash.Hash, project string, row candidateRow) error
 	if err != nil {
 		return err
 	}
-	if !exists || !after.Mode().IsRegular() || after.Size() != row.size || (after.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(opened, after) || !os.SameFile(opened, current) {
+	if !exists || !after.Mode().IsRegular() || after.Size() != row.size || current.Size() != row.size || (after.Mode().Perm()&0o111 != 0) != row.executable || (current.Mode().Perm()&0o111 != 0) != row.executable || !os.SameFile(opened, after) || !os.SameFile(opened, current) || !opened.ModTime().Equal(after.ModTime()) || !opened.ModTime().Equal(current.ModTime()) {
 		return errors.New("file changed size or type while reading")
 	}
 	return nil

package/engine/internal/lib/candidate_coverage.go

@@ -1,9 +1,7 @@
 package lib
 
 import (
-	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
 	"regexp"
 	"sort"
@@ -118,7 +116,7 @@ func omissionError(omitted []string) error {
 		len(omitted), strings.Join(shown, ", "), more)
 }
 
-var diffPathRE = regexp.MustCompile(`[A-Za-z0-9_./@+-]+\.(?:diff|patch)\b`)
+var diffPathRE = regexp.MustCompile(`(?:[A-Za-z]:/)?[A-Za-z0-9_./@+-]+\.(?:diff|patch)\b`)
 
 // lintReviewCandidate gates a Review or Seal reviewer wave: the candidate
 // manifest must cover every path the feature's checkpoints changed, and the
@@ -128,20 +126,5 @@ func lintReviewCandidate(root, slug, packet string) error {
 	if err := CheckCandidateCoverage(root, slug); err != nil {
 		return err
 	}
-	raw, err := readBoundedRegularFile(packet, maxContractBytes)
-	if err != nil {
-		return fmt.Errorf("reviewer packet %s: %w", packet, err)
-	}
-	for _, name := range diffPathRE.FindAllString(string(raw), -1) {
-		for _, dir := range []string{projectDir(root), featureDir(root, slug), ""} {
-			candidate := name
-			if dir != "" {
-				candidate = filepath.Join(dir, filepath.FromSlash(name))
-			}
-			if info, err := os.Stat(candidate); err == nil && info.Mode().IsRegular() && info.Size() > 0 {
-				return nil
-			}
-		}
-	}
-	return errors.New("a Review or Seal reviewer packet must name the frozen candidate diff (an existing non-empty .diff or .patch file); reviewers cannot judge a digest alone")
+	return lintPacketDiffs(root, slug, packet, true)
 }

package/engine/internal/lib/closeout.go

@@ -10,6 +10,7 @@ import (
 	"runtime"
 
 	"github.com/devrites/devrites/internal/devritespaths"
+	"github.com/devrites/devrites/internal/parallel"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -78,11 +79,22 @@ func CloseOut(root string, args []string, stdout, stderr io.Writer) int {
 	// re-create work/<slug>. Windows cannot rename a directory that holds an
 	// open file, so there the lock is released just before the rename.
 	code := 1
-	if err := state.WithFeatureLockRelease(dv, slug, func(release func()) error {
-		code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
-		return nil
+	if err := parallel.WithControlLock(dv, func() error {
+		leased, err := parallel.WorkspaceLeased(dv, slug)
+		if err != nil {
+			return err
+		}
+		if leased {
+			fmt.Fprintf(stderr, "state close: BLOCKED: %s is named by a retained parallel lease; finish and clean up the controller lease before archiving\n", slug)
+			code = 3
+			return nil
+		}
+		return state.WithFeatureLockRelease(dv, slug, func(release func()) error {
+			code = closeOutLocked(release, work, arch, archiveDir, archDisplay, active, slug, stdout, stderr)
+			return nil
+		})
 	}); err != nil {
-		fmt.Fprintf(stderr, "state close: cannot lock feature %s: %v\n", slug, err)
+		fmt.Fprintf(stderr, "state close: %v\n", err)
 		return 1
 	}
 	return code