dorfl 0.1.1 → 0.2.0

package/src/integrator.ts

@@ -1,6 +1,8 @@
 import type {IntegrationMode} from './config.js';
 import {git, run} from './git.js';
-import {isAncestor} from './gc.js';
+import {isAncestor, isProvablyMergedForReap} from './gc.js';
+import {parseWorkBranchRef} from './slug-namespace.js';
+import type {SidecarType} from './sidecar.js';
 import type {BackoffOptions, Sleep} from './retry-backoff.js';
 import {pushProposeBranchWithStaleLeaseRetry} from './continue-branch.js';
 
@@ -135,7 +137,7 @@ export interface OpenRequestInput {
 	 * When present a provider passes it verbatim (e.g. `gh pr create --body`)
 	 * instead of `--fill`'s empty/commit-derived description. Typically the build
 	 * agent's final summary, optionally under a runner-scaffolded header (a pointer
-	 * to `work/done/<slug>.md` + the prd/ADR it serves). Absent ⇒ today's `--fill`
+	 * to `work/done/<slug>.md` + the spec/ADR it serves). Absent ⇒ today's `--fill`
 	 * (no regression). This is the BODY-AT-OPEN surface; a follow-up PR COMMENT is
 	 * a separate provider method.
 	 */
@@ -681,13 +683,24 @@ function deleteMergedHeadBranch(input: IntegrateInput): void {
 	);
 	const headSha = parseLsRemoteSha(ls.stdout);
 	if (headSha !== undefined) {
-		const isMerged = run(
-			'git',
-			['merge-base', '--is-ancestor', headSha, `refs/remotes/${arbiter}/main`],
-			input.cwd,
-			{env},
-		);
-		if (isMerged.status !== 0) {
+		// Provably-merged-for-reap = fast-path ancestor OR squash-aware fallback
+		// (durable done/dropped record on <arbiter>/main + branch carries nothing
+		// main lacks). The SAME predicate the `gc.ts` worktree reaper and the
+		// `reap-branches.ts` remote sweep use — do not fork it.
+		const parsed = parseWorkBranchRef(branch);
+		const arbiterMainRef = `refs/remotes/${arbiter}/main`;
+		const provablyMerged =
+			parsed === undefined
+				? isAncestor(input.cwd, headSha, arbiterMainRef, env)
+				: isProvablyMergedForReap({
+						cwd: input.cwd,
+						tip: headSha,
+						arbiterMain: arbiterMainRef,
+						namespace: parsed.namespace as SidecarType,
+						slug: parsed.slug,
+						env,
+					});
+		if (!provablyMerged) {
 			return; // NOT provably merged (a racing un-merged amend) — never reap.
 		}
 	}

package/src/isolation.ts

@@ -111,11 +111,11 @@ export interface PrepareInput {
 	/** The work slug being processed (→ branch `work/<type>-<slug>`). */
 	slug: string;
 	/**
-	 * The item TYPE — `'task'` for a build (intake/`do task:`), `'prd'` for a
-	 * prd-tasking run (`do prd:`). It NAMESPACES the work branch via
-	 * {@link workBranchRef} so a same-slug task and prd never collide on the
+	 * The item TYPE — `'task'` for a build (intake/`do task:`), `'spec'` for a
+	 * spec-tasking run (`do spec:`). It NAMESPACES the work branch via
+	 * {@link workBranchRef} so a same-slug task and spec never collide on the
 	 * arbiter branch. Defaults to `'task'` (the overwhelmingly-common build
-	 * path); the prd-tasking path passes `'prd'` explicitly.
+	 * path); the spec-tasking path passes `'spec'` explicitly.
 	 */
 	type?: SlugNamespace;
 	/**
@@ -394,6 +394,15 @@ export function inPlaceStrategy(options: {
  * path uses before force-resetting the work branch onto the claim commit. A
  * not-yet-fetched or rolled-back arbiter main that does NOT reach the claim must
  * fail fast here, never silently build on a stale base.
+ *
+ * DELIBERATELY the RAW `--is-ancestor` predicate, NOT the squash-aware
+ * `isProvablyMergedForReap` (task `reap-squash-merged-remote-work-branches`,
+ * ratified): this is a claim-REACHABILITY guard, not reap-safety. It demands
+ * GENUINE ancestry of the claim commit; a done-record-on-main match would
+ * defeat its whole purpose (refusing to build on a stale base). The
+ * squash-aware helper is scoped to reap-safety ONLY; this module's reap-lane
+ * (`reapJob` → `evaluateDeletionSafety`) is where it belongs. See
+ * work/notes/observations/reap-squash-helper-scope-2026-07-10.md.
  */
 function assertClaimCommitReachable(
 	checkout: string,

package/src/issue-provider.ts

@@ -9,7 +9,7 @@ import {brand} from './brand.js';
 
 /**
  * The single provider-native PROCESSING LOCK label (task `intake-processing-lock`,
- * prd `issue-intake` US #10): a TRANSIENT concurrency mutex — added on start (the
+ * spec `issue-intake` US #10): a TRANSIENT concurrency mutex — added on start (the
  * winner only), removed on finish — that serialises two concurrent `intake` runs on
  * the SAME issue. It is namespaced under the brand (`dorfl:processing`) so it
  * cannot collide with a user's own labels. It carries NO `work/` state — it is NOT a
@@ -19,7 +19,7 @@ import {brand} from './brand.js';
 export const PROCESSING_LOCK_LABEL = `${brand.base}:processing`;
 
 /**
- * The **issue seam** (prd `issue-intake`, task `intake-tracer-slice-outcome`):
+ * The **issue seam** (spec `issue-intake`, task `intake-tracer-slice-outcome`):
  * the provider-pluggable surface `intake <N>` reads an issue + its comment thread
  * through, and posts a clarifying comment back onto. It is the SIBLING of the
  * review-request `ReviewProvider` (`integrator.ts` / `github.ts`): both name a
@@ -33,7 +33,7 @@ export const PROCESSING_LOCK_LABEL = `${brand.base}:processing`;
  * `intake-closes-issue-on-bounce`) is the ATOMIC close used on a BOUNCE — a
  * terminal outcome, so intake closes the issue directly (comment + `not planned`
  * + close in ONE call). It is ALSO the method CI's future close-job uses for the
- * task/prd path; only the BOUNCE close is intake's.
+ * task/spec path; only the BOUNCE close is intake's.
  *
  * The label ops are a TRANSIENT CONCURRENCY MUTEX carrying NO `work/` state — ONE
  * lock label, added-on-start / removed-on-finish. They are NOT a label
@@ -295,7 +295,7 @@ export interface IssueProvider {
 	 * reason IN THE SAME atomic operation (`gh issue close <N> [--comment <body>]
 	 * [--reason "not planned"]`). Used on a BOUNCE (terminal: comment + `not
 	 * planned` + close in ONE call — no post-then-close partial-failure window) and,
-	 * later, by CI's task/prd close-job. The RUNNER calls this; the agent stays
+	 * later, by CI's task/spec close-job. The RUNNER calls this; the agent stays
 	 * seam-free. NEVER throws — a missing/unauthenticated `gh` DEGRADES, surfacing
 	 * the REAL `gh` stderr via {@link CloseIssueResult.reason} (NOT a hard-coded
 	 * guess), so the terminal outcome is unchanged and the cause stays diagnosable.