tdd-cli 0.6.0__tar.gz → 0.7.0__tar.gz

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to this project are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and the project adheres to [Semantic Versioning](https://semver.org/).
 
+## [Unreleased]
+
+## [0.7.0] - 2026-08-23
+
+### Fixed
+
+- **Concurrent `tdd advance` no longer corrupts a run.** Two `advance` processes
+  racing on the same worktree could both close the same cycle row. Because
+  `close_cycle` unconditionally opened the next ordinal, a double-close forked the
+  run into two parallel cycle chains; every remaining cycle ran twice, the run
+  "completed" with one chain's last row permanently open, and the doubling was
+  invisible from the agent's perspective. `close_cycle` now re-reads `closed_at`
+  before acting; if the row is already closed it returns the currently-open cycle
+  without transitioning or opening anything. `open_cycle` returns the existing open
+  row for an ordinal rather than inserting a duplicate.
+
+### Added
+
+- **Per-worktree advance claim.** `tdd advance` now acquires a `advance_claim` row
+  before dispatching. A second concurrent `advance` is refused immediately with
+  `ok: false`, `reason: "advance_in_flight"`, and metadata (`pid`, `started_at`,
+  `elapsed_s`) that lets the agent confirm the holder is still alive. The claim is
+  released in a `finally` so a raising handler cannot wedge the worktree; a claim
+  held by a dead pid is reclaimed automatically on the next call. Schema version
+  bumped to 3.
+
 ## [0.6.0] - 2026-08-19
 
 ### Added

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tdd-cli
-Version: 0.6.0
+Version: 0.7.0
 Summary: Ledger-backed TDD process controller for autonomous coding agents
 Project-URL: Homepage, https://github.com/geuben/tdd-cli
 Project-URL: Repository, https://github.com/geuben/tdd-cli
@@ -314,6 +314,34 @@ test_paths   = ["src/test/"]
 test_command = "./gradlew testDebugUnitTest"
 ```
 
+The `xctest` adapter drives Swift and Objective-C projects through `xcodebuild`. Test ids
+use xcodebuild's own `-only-testing:` format — `BundleName/ClassName/testMethodName` — so
+a single XCTest can be driven through RED → GREEN without any id translation. Collection
+prefers `xcodebuild test -enumerate-tests` (Xcode 16+) and falls back to grepping
+`class Foo: XCTestCase` / `func testBar()` out of the Swift sources under `test_paths`,
+deriving the bundle name from `-scheme`. As with gradle, a *build* failure maps to
+`not_collected` rather than `failed`, so a stub referencing a missing symbol is not
+mistaken for RED.
+
+`test_command` is required here — the adapter cannot guess the scheme, destination, or
+derived-data path. It appends `-only-testing:` for targeted runs and `-enumerate-tests`
+for collection, and changes nothing else. Simulator runs are serial in practice: give
+them a `lease` so two projects don't drive the same simulator at once.
+
+```toml
+[project.native-ios]
+root         = "native-ios"
+adapter      = "xctest"
+test_paths   = ["AppTests/"]
+test_command = """xcodebuild test \
+  -project App.xcodeproj \
+  -scheme AppTests \
+  -destination 'platform=iOS Simulator,name=App-Unit' \
+  -derivedDataPath /tmp/app-unit-dd"""
+lease        = "ios-simulator"
+timeout      = 900
+```
+
 Third-party adapters register under the
 `tddcli.adapters` entry-point group:
 
@@ -375,14 +403,49 @@ and is never reclassified as a pin.
 | `tdd metrics` | fidelity, attempts, violations, interventions |
 | `tdd fleet [--json]` | all active runs across every worktree; read-only |
 
+## Scoped baseline capture (R9.5c)
+
+`run start` probes only the projects the plan can actually reach: the declared cycle projects
+plus the transitive `consumed_by` closure of artifacts whose producer is in that set. Projects
+outside the reachable set never run during the plan, so their baseline is never subtracted from
+anything — probing them is pure overhead. A `baseline_scoped` integrity event records which
+projects were skipped, so the scoping is auditable.
+
+Pass `--baseline-all` to probe every project in `tdd.toml` regardless:
+
+    tdd run start --plan tasks/plan.md --baseline-all
+
+Use this when a cycle may edit files outside the predicted reachable set and you want every
+project baselined up front rather than hitting the `no_baseline_for_project` escape hatch later.
+
+### When a sweep reaches an un-baselined project (R9.5d)
+
+If an edit during a run touches a file owned by an artifact that was outside the predicted
+reachable set, the close sweep may pull in a project that was never baselined. Its failures are
+unattributable — no baseline exists to subtract — so the sweep replies `resolve_blocker` with
+kind `no_baseline_for_project` rather than mislabelling them as regressions. Recovery:
+
+    tdd blocker --kind no_baseline_for_project --detail "svc pulled in unexpectedly"
+    tdd resume --unblock --accept-failures --note "folding svc sweep failures into baseline"
+
+`--accept-failures` inserts a fresh baseline row for the un-baselined project (recording those
+failures as pre-existing) and records a `baseline_amended` event. The next advance proceeds
+with the project properly baselined.
+
 ## Running a long baseline
 
-`run start` probes every project's suite before a run exists (R9.5a), and on a real project
+`run start` probes the reachable project set (R9.5c) before a run exists, and on a real project
 that can take minutes — well past an agent harness's default Bash timeout. If the command
 appears to hang or time out, **do not re-run it**: the probe is still making progress in the
 background, and a second `run start` against the same worktree is refused with
 `reason: "baseline_in_progress"` — retrying on timeout just stacks refusals on top of a
-baseline that was never stuck. In order of preference:
+baseline that was never stuck.
+
+`tdd advance` is similarly single-flight per worktree. A close sweep (artifact regeneration, full
+suite, lint, typecheck) can run for several minutes. If an advance appears to hang, **do not
+re-run it**: a second `advance` against the same worktree is refused with
+`reason: "advance_in_flight"`. The refusal carries `pid`, `started_at`, and `elapsed_s` so the
+agent can confirm the first process is still alive. Run `tdd status` to see the current run state. In order of preference:
 
 1. **Background it.** Run `tdd run start` in the background if your harness supports it. The
    heartbeat (`baseline_captured` / `project_completed` lines on stderr) lands in the task log

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/README.md

@@ -286,6 +286,34 @@ test_paths   = ["src/test/"]
 test_command = "./gradlew testDebugUnitTest"
 ```
 
+The `xctest` adapter drives Swift and Objective-C projects through `xcodebuild`. Test ids
+use xcodebuild's own `-only-testing:` format — `BundleName/ClassName/testMethodName` — so
+a single XCTest can be driven through RED → GREEN without any id translation. Collection
+prefers `xcodebuild test -enumerate-tests` (Xcode 16+) and falls back to grepping
+`class Foo: XCTestCase` / `func testBar()` out of the Swift sources under `test_paths`,
+deriving the bundle name from `-scheme`. As with gradle, a *build* failure maps to
+`not_collected` rather than `failed`, so a stub referencing a missing symbol is not
+mistaken for RED.
+
+`test_command` is required here — the adapter cannot guess the scheme, destination, or
+derived-data path. It appends `-only-testing:` for targeted runs and `-enumerate-tests`
+for collection, and changes nothing else. Simulator runs are serial in practice: give
+them a `lease` so two projects don't drive the same simulator at once.
+
+```toml
+[project.native-ios]
+root         = "native-ios"
+adapter      = "xctest"
+test_paths   = ["AppTests/"]
+test_command = """xcodebuild test \
+  -project App.xcodeproj \
+  -scheme AppTests \
+  -destination 'platform=iOS Simulator,name=App-Unit' \
+  -derivedDataPath /tmp/app-unit-dd"""
+lease        = "ios-simulator"
+timeout      = 900
+```
+
 Third-party adapters register under the
 `tddcli.adapters` entry-point group:
 
@@ -347,14 +375,49 @@ and is never reclassified as a pin.
 | `tdd metrics` | fidelity, attempts, violations, interventions |
 | `tdd fleet [--json]` | all active runs across every worktree; read-only |
 
+## Scoped baseline capture (R9.5c)
+
+`run start` probes only the projects the plan can actually reach: the declared cycle projects
+plus the transitive `consumed_by` closure of artifacts whose producer is in that set. Projects
+outside the reachable set never run during the plan, so their baseline is never subtracted from
+anything — probing them is pure overhead. A `baseline_scoped` integrity event records which
+projects were skipped, so the scoping is auditable.
+
+Pass `--baseline-all` to probe every project in `tdd.toml` regardless:
+
+    tdd run start --plan tasks/plan.md --baseline-all
+
+Use this when a cycle may edit files outside the predicted reachable set and you want every
+project baselined up front rather than hitting the `no_baseline_for_project` escape hatch later.
+
+### When a sweep reaches an un-baselined project (R9.5d)
+
+If an edit during a run touches a file owned by an artifact that was outside the predicted
+reachable set, the close sweep may pull in a project that was never baselined. Its failures are
+unattributable — no baseline exists to subtract — so the sweep replies `resolve_blocker` with
+kind `no_baseline_for_project` rather than mislabelling them as regressions. Recovery:
+
+    tdd blocker --kind no_baseline_for_project --detail "svc pulled in unexpectedly"
+    tdd resume --unblock --accept-failures --note "folding svc sweep failures into baseline"
+
+`--accept-failures` inserts a fresh baseline row for the un-baselined project (recording those
+failures as pre-existing) and records a `baseline_amended` event. The next advance proceeds
+with the project properly baselined.
+
 ## Running a long baseline
 
-`run start` probes every project's suite before a run exists (R9.5a), and on a real project
+`run start` probes the reachable project set (R9.5c) before a run exists, and on a real project
 that can take minutes — well past an agent harness's default Bash timeout. If the command
 appears to hang or time out, **do not re-run it**: the probe is still making progress in the
 background, and a second `run start` against the same worktree is refused with
 `reason: "baseline_in_progress"` — retrying on timeout just stacks refusals on top of a
-baseline that was never stuck. In order of preference:
+baseline that was never stuck.
+
+`tdd advance` is similarly single-flight per worktree. A close sweep (artifact regeneration, full
+suite, lint, typecheck) can run for several minutes. If an advance appears to hang, **do not
+re-run it**: a second `advance` against the same worktree is refused with
+`reason: "advance_in_flight"`. The refusal carries `pid`, `started_at`, and `elapsed_s` so the
+agent can confirm the first process is still alive. Run `tdd status` to see the current run state. In order of preference:
 
 1. **Background it.** Run `tdd run start` in the background if your harness supports it. The
    heartbeat (`baseline_captured` / `project_completed` lines on stderr) lands in the task log

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/__init__.py

@@ -3,4 +3,4 @@
 State is derived from observed test execution, never asserted by the caller.
 """
 
-__version__ = "0.6.0"
+__version__ = "0.7.0"

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/adapters/xctest_adapter.py

@@ -5,7 +5,7 @@ compose without translation:
 
     BundleName/ClassName/testMethodName
 
-e.g.  CoParentTests/PollCadenceTests/testPollIntervalScalesOnlyUnderE2E
+e.g.  AppTests/PollCadenceTests/testPollIntervalScalesOnlyUnderE2E
 
 A xcodebuild build failure maps to `not_collected` rather than `failed`.
 Swift has no separate collection phase — a test referencing a missing symbol
@@ -27,12 +27,12 @@ Config (`tdd.toml`):
     [project.native-ios]
     root         = "native-ios"
     adapter      = "xctest"
-    test_paths   = ["CoParentTests/"]           # Swift source directories
+    test_paths   = ["AppTests/"]           # Swift source directories
     test_command = "xcodebuild test \\
-      -project CoParent.xcodeproj \\
-      -scheme CoParentTests \\
-      -destination 'platform=iOS Simulator,name=CoParent-Unit' \\
-      -derivedDataPath /tmp/coparent-unit-dd"
+      -project App.xcodeproj \\
+      -scheme AppTests \\
+      -destination 'platform=iOS Simulator,name=App-Unit' \\
+      -derivedDataPath /tmp/app-unit-dd"
 
 `test_command` is required — the adapter cannot know the scheme, destination,
 or derived-data path otherwise.  The adapter appends `-only-testing:` for
@@ -60,14 +60,14 @@ from .base import (
 # Patterns applied to xcodebuild stdout
 # ---------------------------------------------------------------------------
 
-# "Test Case '-[CoParentTests.PollCadenceTests testPollIntervalScalesOnlyUnderE2E]' passed (0.001 seconds)."
+# "Test Case '-[AppTests.PollCadenceTests testPollIntervalScalesOnlyUnderE2E]' passed (0.001 seconds)."
 _CASE_RE = re.compile(r"Test Case '-\[(\w+)\.(\w+) (\w+)\]' (passed|failed)")
 
 # End-of-build marker for a failed build (no tests ran)
 _BUILD_FAILED_RE = re.compile(r"\*\* BUILD FAILED \*\*")
 
 # Lines emitted by xcodebuild test -enumerate-tests (Xcode 16+):
-#   CoParentTests/PollCadenceTests/testPollIntervalScalesOnlyUnderE2E
+#   AppTests/PollCadenceTests/testPollIntervalScalesOnlyUnderE2E
 _ENUMERATE_LINE_RE = re.compile(r"^[ \t]*(\w+)/(\w+)/(test\w+)[ \t]*$", re.MULTILINE)
 
 # Swift source patterns for the per-file grep fallback
@@ -105,7 +105,7 @@ class XCTestAdapter(Adapter):
         """Best-effort: extract the test bundle name from `-scheme <Name>`.
 
         xcodebuild schemes typically share a name with their test bundle
-        (e.g. `-scheme CoParentTests` → bundle `CoParentTests`).  When the
+        (e.g. `-scheme AppTests` → bundle `AppTests`).  When the
         scheme cannot be parsed, fall back to `"Unknown"` — per-file ids will
         still be formed, just unaddressable by `-only-testing:` without the
         real bundle name.
@@ -284,9 +284,9 @@ class XCTestAdapter(Adapter):
         """Capture the assertion lines between 'started' and 'failed' for one test.
 
         xcodebuild interleaves test output like:
-            Test Case '-[CoParentTests.PollCadenceTests testSomething]' started.
+            Test Case '-[AppTests.PollCadenceTests testSomething]' started.
             /path/test.swift:42: error: … XCTAssertEqual failed: …
-            Test Case '-[CoParentTests.PollCadenceTests testSomething]' failed (0.001 seconds).
+            Test Case '-[AppTests.PollCadenceTests testSomething]' failed (0.001 seconds).
         """
         parts = native_id.split("/")
         if len(parts) != 3:

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/advance.py

@@ -310,6 +310,16 @@ def _handle_refactor(engine: Engine, cycle, retried: bool) -> Envelope:
     outcome = engine.sweep(cycle, touched, skip_own=skip_own)
 
     if not outcome.ok:
+        if outcome.unbaselined:
+            projects_list = ", ".join(sorted(outcome.unbaselined))
+            return _reply(
+                engine, cycle, Verb.RESOLVE_BLOCKER,
+                f"Close sweep found failures in un-baselined project(s): {projects_list}. "
+                "These are unattributable — no baseline exists to subtract. "
+                "File: tdd blocker --kind no_baseline_for_project --detail '...', "
+                "then resume --unblock --accept-failures to fold them into the baseline.",
+                unbaselined=outcome.unbaselined, commit=sha,
+            )
         if outcome.failures:
             return _reply(
                 engine, cycle, Verb.FIX_REGRESSION,

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/cli.py

@@ -48,6 +48,9 @@ BLOCKER_KINDS = {
     # Failing, but not caused by this run — a flake, or something the baseline missed.
     # Distinct from `regression`, which records a defect the run introduced.
     "pre_existing_failure",
+    # Failing in a project that was never baselined — not attributable as a regression
+    # (no baseline to subtract) vs. `pre_existing_failure` (baseline exists but missed it).
+    "no_baseline_for_project",
 }
 
 
@@ -489,14 +492,13 @@ def cmd_plan_register(args) -> Envelope:
     )
 
 
-def _probe_projects(cfg, worktree, ledger, on_progress):
-    """Probe every project's baseline (R9.5a): run + collect, timing each, emitting a
-    `baseline_captured` heartbeat, and calling `on_progress(done, name)` — extracted
-    from `cmd_run_start`, which carried claiming, timing, heartbeating and progress
-    updates inline past the point of legibility. Returns `{name: (verdict, collection)}`.
+def _probe_projects(projects, worktree, ledger, on_progress):
+    """Probe a mapping of projects' baselines (R9.5a): run + collect, timing each,
+    emitting a `baseline_captured` heartbeat, and calling `on_progress(done, name)`.
+    Returns `{name: (verdict, collection)}`.
     """
     probes = {}
-    for done, (name, project) in enumerate(cfg.projects.items(), start=1):
+    for done, (name, project) in enumerate(projects.items(), start=1):
         adapter = adapters.build(project, worktree)
         started = time.monotonic()
         verdict = adapter.run(None)
@@ -561,6 +563,15 @@ def cmd_run_start(args) -> Envelope:
     if contract_row["status"] == "undeclared" and not args.allow_undeclared:
         return failure("contract is undeclared; pass --allow-undeclared")
 
+    # R9.5c — scope baseline capture to plan-reachable projects unless opted out.
+    declared_cycles = contract_mod.cycles_from_json(contract_row["declared_cycles"])
+    if declared_cycles and not args.baseline_all:
+        declared_names = [p for c in declared_cycles for p in c.projects]
+        reachable_names = cfg.reachable_projects(declared_names)
+        probe_projects = {n: cfg.projects[n] for n in reachable_names if n in cfg.projects}
+    else:
+        probe_projects = cfg.projects
+
     # Claim the worktree before probing: two `run start` calls against
     # one worktree must not both pass the baseline window. `Ledger.claim`'s `UNIQUE`
     # insert is the lock — do not read-then-write, which is the race this
@@ -576,7 +587,7 @@ def cmd_run_start(args) -> Envelope:
             str(worktree),
             hostname=socket.gethostname(),
             pid=os.getpid(),
-            projects_total=len(cfg.projects),
+            projects_total=len(probe_projects),
         )
     except sqlite3.IntegrityError:
         return failure(
@@ -594,7 +605,7 @@ def cmd_run_start(args) -> Envelope:
         # attempt — and must release the claim too, or the retry it invites is itself
         # refused.
         probes = _probe_projects(
-            cfg,
+            probe_projects,
             worktree,
             ledger,
             on_progress=lambda done, name: ledger.update_claim(
@@ -640,6 +651,9 @@ def cmd_run_start(args) -> Envelope:
         run = ledger.one("SELECT * FROM run WHERE id = ?", (run_id,))
         if blob_changed:
             ledger.event(run_id, None, "plan_blob_changed", rel)
+        skipped = sorted(set(cfg.projects) - set(probe_projects))
+        if skipped:
+            ledger.event(run_id, None, "baseline_scoped", json.dumps(skipped))
 
         # Baselines and the collection snapshot, per project (R9.5, R8.9) — from the
         # probe above, so the suite is not run twice.
@@ -723,7 +737,31 @@ def cmd_advance(args) -> Envelope:
             run={"id": run["id"], "phase": CLOSED},
             next_action=NextAction(Verb.COMPLETE, "All cycles complete."),
         )
-    return do_advance(engine, cycle, retry=args.retry)
+    existing_advance = ledger.active_advance_claim(str(worktree))
+    if existing_advance is not None and existing_advance["stale"]:
+        ledger.release_advance_claim(str(worktree))
+
+    try:
+        ledger.claim_advance(str(worktree), hostname=socket.gethostname(), pid=os.getpid())
+    except sqlite3.IntegrityError:
+        held = ledger.one("SELECT * FROM advance_claim WHERE worktree_path = ?", (str(worktree),))
+        started = datetime.fromisoformat(held["started_at"])
+        if started.tzinfo is None:
+            started = started.replace(tzinfo=timezone.utc)
+        elapsed_s = int((datetime.now(timezone.utc) - started).total_seconds())
+        return failure(
+            "an advance is already in flight for this worktree; do not re-run or kill it"
+            " — wait for its envelope, then run `tdd status` to see where the run stands",
+            reason="advance_in_flight",
+            pid=held["pid"],
+            started_at=held["started_at"],
+            elapsed_s=elapsed_s,
+        )
+    try:
+        result = do_advance(engine, cycle, retry=args.retry)
+    finally:
+        ledger.release_advance_claim(str(worktree))
+    return result
 
 
 def cmd_cycle_skip(args) -> Envelope:
@@ -818,15 +856,27 @@ def _accept_failures_into_baseline(ledger: Ledger, run_id: int) -> dict[str, lis
     }
     accepted: dict[str, list[str]] = {}
     for sweep in latest:
-        row = rows.get(sweep["project"])
+        project = sweep["project"]
+        row = rows.get(project)
+        sweep_failed = sorted(json.loads(sweep["other_failures"]))
         if row is None:
-            continue
-        known = set(json.loads(row["failing"]))
-        new = sorted(set(json.loads(sweep["other_failures"])) - known)
-        if not new:
-            continue
-        ledger.update("baseline", row["id"], failing=json.dumps(sorted(known | set(new))))
-        accepted[sweep["project"]] = new
+            if not sweep_failed:
+                continue
+            ledger.insert(
+                "baseline",
+                run_id=run_id,
+                project=project,
+                failing=json.dumps(sweep_failed),
+                captured_at=now(),
+            )
+            accepted[project] = sweep_failed
+        else:
+            known = set(json.loads(row["failing"]))
+            new = sorted(set(sweep_failed) - known)
+            if not new:
+                continue
+            ledger.update("baseline", row["id"], failing=json.dumps(sorted(known | set(new))))
+            accepted[project] = new
     if accepted:
         ledger.event(run_id, None, "baseline_amended", json.dumps(accepted))
     return accepted
@@ -1140,6 +1190,7 @@ def build_parser() -> argparse.ArgumentParser:
     s.add_argument("--executor", help="human-supplied label; agents must not use this")
     s.add_argument("--allow-dirty", action="store_true")
     s.add_argument("--allow-undeclared", action="store_true")
+    s.add_argument("--baseline-all", action="store_true", help="probe all projects, skipping reachability scoping")
     s.set_defaults(fn=cmd_run_start)
 
     s = sub.add_parser("status")

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/config.py

@@ -212,6 +212,32 @@ class Config:
             seen.add(up)
         return chain
 
+    def _root_project(self, produced_by: str) -> str | None:
+        """Resolve a produced_by value (project name or artifact.<name> chain) to a root project name."""
+        if produced_by.startswith("artifact."):
+            upstream = self.artifacts.get(produced_by.split(".", 1)[1])
+            if upstream is None:
+                return None
+            return self._root_project(upstream.produced_by)
+        return produced_by if produced_by in self.projects else None
+
+    def reachable_projects(self, declared: list[str]) -> list[str]:
+        declared_set = set(declared)
+        reachable = set(declared)
+        changed = True
+        while changed:
+            changed = False
+            for art in self.artifacts.values():
+                root = self._root_project(art.produced_by)
+                if root in reachable:
+                    for consumer in art.consumed_by:
+                        if consumer not in reachable:
+                            proj = self.projects.get(consumer)
+                            if consumer in declared_set or (proj and proj.in_close_sweep):
+                                reachable.add(consumer)
+                                changed = True
+        return sorted(reachable)
+
     def close_sweep_projects(self, cycle_projects: list[str], touched: set[str]) -> list[str]:
         """R9.2 — the cycle's own projects, plus anything downstream of an artifact it touched."""
         names = {n for n in cycle_projects}
@@ -221,14 +247,10 @@ class Config:
         return [n for n in sorted(names) if self.projects[n].in_close_sweep]
 
     def _artifact_touched(self, art: Artifact, touched: set[str]) -> bool:
-        producer = art.produced_by
-        if producer.startswith("artifact."):
-            upstream = self.artifacts.get(producer.split(".", 1)[1])
-            return bool(upstream and self._artifact_touched(upstream, touched))
-        proj = self.projects.get(producer)
-        if proj is None:
+        root = self._root_project(art.produced_by)
+        if root is None:
             return False
-        return any(proj.owns(p) for p in touched)
+        return any(self.projects[root].owns(p) for p in touched)
 
     def full_sweep_projects(self) -> list[str]:
         return sorted(self.projects)

{tdd_cli-0.6.0 → tdd_cli-0.7.0}/src/tddcli/ledger.py

@@ -13,7 +13,7 @@ import sqlite3
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
-SCHEMA_VERSION = 2
+SCHEMA_VERSION = 3
 
 
 class LedgerVersionError(RuntimeError):
@@ -29,6 +29,8 @@ class LedgerVersionError(RuntimeError):
 MIGRATIONS: dict[int, str] = {
     # v1 -> v2 added the baseline_claim table; CREATE TABLE IF NOT EXISTS covers it.
     1: "",
+    # v2 -> v3 added the advance_claim table; CREATE TABLE IF NOT EXISTS covers it.
+    2: "",
 }
 
 SCHEMA = """
@@ -45,6 +47,14 @@ CREATE TABLE IF NOT EXISTS baseline_claim (
     started_at TEXT NOT NULL
 );
 
+CREATE TABLE IF NOT EXISTS advance_claim (
+    id INTEGER PRIMARY KEY,
+    worktree_path TEXT NOT NULL UNIQUE,
+    hostname TEXT NOT NULL,
+    pid INTEGER NOT NULL,
+    started_at TEXT NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS plan_contract (
     id INTEGER PRIMARY KEY,
     plan_path TEXT NOT NULL,
@@ -412,6 +422,54 @@ class Ledger:
         )
         self.db.commit()
 
+    def claim_advance(self, worktree: str, hostname: str, pid: int) -> int:
+        """Insert the advance claim row. The insert is the lock: `worktree_path`
+        carries `UNIQUE`, so a second claim on the same worktree raises
+        `sqlite3.IntegrityError` rather than racing a read-then-write check."""
+        return self.insert(
+            "advance_claim",
+            worktree_path=worktree,
+            hostname=hostname,
+            pid=pid,
+            started_at=now(),
+        )
+
+    def release_advance_claim(self, worktree: str) -> None:
+        self.db.execute("DELETE FROM advance_claim WHERE worktree_path = ?", (worktree,))
+        self.db.commit()
+
+    @staticmethod
+    def _claim_is_stale(hostname: str, pid: int, started_at: str) -> bool:
+        """Staleness rule shared by all claim kinds.
+
+        Same host → liveness via os.kill(pid, 0). Cross-host → age > 60 min
+        (a pid is meaningless from another host; reused pids would make a
+        liveness check actively wrong, so we fall back to age).
+        """
+        if hostname == socket.gethostname():
+            try:
+                os.kill(pid, 0)
+                return False
+            except ProcessLookupError:
+                # Same host, pid no longer running.
+                return True
+            except PermissionError:
+                # Pid exists but owned by someone else — alive.
+                return False
+        started = datetime.fromisoformat(started_at)
+        if started.tzinfo is None:
+            started = started.replace(tzinfo=timezone.utc)
+        return datetime.now(timezone.utc) - started > timedelta(minutes=60)
+
+    def active_advance_claim(self, worktree: str) -> dict | None:
+        """Read-only observer — staleness computed but no row deleted."""
+        row = self.one("SELECT * FROM advance_claim WHERE worktree_path = ?", (worktree,))
+        if row is None:
+            return None
+        claim = dict(row)
+        claim["stale"] = self._claim_is_stale(claim["hostname"], claim["pid"], claim["started_at"])
+        return claim
+
     def active_claim(self, worktree: str) -> dict | None:
         """Read-only, per the store's append-only contract — `cmd_progress` and
         `cmd_status` call this as pure observers. Only `cmd_run_start` acts on the
@@ -420,23 +478,8 @@ class Ledger:
         if row is None:
             return None
         claim = dict(row)
-        if claim["hostname"] == socket.gethostname():
-            try:
-                os.kill(claim["pid"], 0)
-                stale = False
-            except ProcessLookupError:
-                # Same host, pid no longer running (e.g. a `SIGKILL`ed `run start`).
-                stale = True
-            except PermissionError:
-                # Pid exists but is owned by someone else — alive.
-                stale = False
-        else:
-            # A pid is meaningless from another host, and reused pids would make a
-            # host-crossing liveness check actively wrong. Fall back to age: a false
-            # "alive" bricks the worktree, a false "dead" reopens the bug (Decisions).
-            started = datetime.fromisoformat(claim["started_at"])
-            if started.tzinfo is None:
-                started = started.replace(tzinfo=timezone.utc)
-            stale = datetime.now(timezone.utc) - started > timedelta(minutes=60)
-        claim["stale"] = stale
+        # A pid is meaningless from another host, and reused pids would make a
+        # host-crossing liveness check actively wrong. Fall back to age: a false
+        # "alive" bricks the worktree, a false "dead" reopens the bug (Decisions).
+        claim["stale"] = self._claim_is_stale(claim["hostname"], claim["pid"], claim["started_at"])
         return claim