[brettheap]

Closes #113, #114, #115

Lane openRepoTools-4's PR for the three findings #97's sixth Copilot round filed rather than took. Lane 4 took them over from lane openRepoTools-3, with its consent, at 2026-10-18T13:35Z (the TAKEOVER comments on each issue). Opened on main 87a5e9d. Main babd9fe was merged in, and later main 55aae16, which holds #246, #214 and #219. Brett Heap's word for this PR decides the merge.

Commits:

1. 6924ecf (A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115) — a sidecar of the current schema is read and replaced only when it is whole;
2. 97be67a (set-lane-tree's fence accepts a poll from a finished operation, and its observation check accepts a partial one it completes with clean-looking defaults #114) — set-lane-tree's fence refuses a poll filed under a finalized operation;
3. b389d0c (The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113) — lane-reconcile keeps the status of every read it rests on;
4. 469fc2c — the tests;
5. 33515f8 — the manual, design.md decisions 26–28, and tasks.md section 7;
6. 0dfd8be — a normal merge of main babd9fe (clean), which brought session_ids_of_lane / session_ids_local_of_lane don't distinguish "no row" from "register unreadable", so every caller that treats an empty id set as a fact is fail-open on that read #67's session_ids_checked;
7. d727834 (The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113) — lane-reconcile reads the holder ids through session_ids_of_lane / session_ids_local_of_lane don't distinguish "no row" from "register unreadable", so every caller that treats an empty id set as a fact is fail-open on that read #67's session_ids_checked, and the copy of that read commit 3 had written (lane_session_ids_read) is gone;
8. 36520b9 (The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113) — a failed registrations read is named in lane-worktrees' words, so lane-end still relays lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5's reason (see CI below);
9. e95d072 (A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115, review r1) — the validator asks the snapshot's arm first, so a control root under a directory named trees keeps its snapshot; set-lane-tree refuses a blank field with 64 before the lock; lane_no_repository asks git in the C locale;
10. f80542e — tests for those three, each red at 36520b9;
11. 3ffefce — the manual's main exit table (10 and 64), the malformed row's kept path, and decision 28 (the validator's order, and why a record's lane: is not compared);
12. e3acbea — a normal merge of main 55aae16 (clean): Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 (T018), lanes-edit.sh: a write with nothing staged still publishes the local commits origin lacks, so the RECOVERY's re-run of commit pushes the edit it stranded, and the conflict RECOVERY warns that reset --hard drops a peer's commits #214 and lanes-index follow-ups of #166 and #173: export reads one snapshot, history --index says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation #219's lanes-index reader are now under this branch;
13. e6a41b4 (A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115, lanes-index follow-ups of #166 and #173: export reads one snapshot, history --index says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation #219) — lanes-index follow-ups of #166 and #173: export reads one snapshot, history --index says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation #219's two path-less sidecar cases in tests/test_lanes_index.py now assert A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115's rule (see "Merged with main" below).

#115 comes first because #114's refusal message reads the validator's LSS_WHY. Each commit's lanes-edit.sh parses on its own (bash -n on all thirteen).

#113 — the lifecycle's remaining fail-open reads

item	before	now	where (head)
1. holder ids	session_ids_of_lane … || : and the local read || :, so an unreadable register gave an empty id set, live_holder answered 8 for it, and the verdict read ungraceful-stop/interrupted-swap	lane_reconcile reads the ids through #67's session_ids_checked. That answers 1 where the published register (or, with none published, the working tree's) or this checkout's own copy cannot be read, and 8 only where both were read and give no id. A 1 gives HOLDER unknown and verdict indeterminate. #67's comment now counts three callers	lanes-edit.sh:13929, :13931, :14320
2. unreadable sidecar	taken in 8.12: an <unreadable> row, reported as unreadable-sidecar	unchanged. What 8.12 left: lane_reconcile still read lane_trees_list with || :, so its 10 for a trees/ it cannot list (#157 4e) dropped the whole inventory and the verdict could be resumable. That 10 is now indeterminate	:14003, :14006
3. branch.<b>.remote	|| :, so a failed read became the fabricated upstream ./<merge>	the case its merge sibling already has. A failed read is 3: lane-tree-now exits 1 and set-lane-tree (reading the tree itself) refuses	:13822
4. git worktree list --porcelain	|| :, so registrations nobody could list read as none	the status is kept, and a failure makes the verdict indeterminate and names it in lane-worktrees' words: the worktree registrations of <dir> could not be read (git worktree list exited N). A recorded directory that is no repository at all is still an absence, by lane-worktrees' no_repository rule (#170 G5). lane_no_repository asks git in the C locale, as lane-worktrees' git_env does, so a translated git cannot turn that absence into a failed read. The on-disk half of the same sweep gets the same treatment: a lane worktree root that cannot be listed or searched is indeterminate too	:14152, :14155, :13841, :13844, :14255; verdict :14359

The line between a row and a verdict is the one T018 draws for an unreadable leg: a per-record failure is a row counted toward recovery, and a read that leaves paths unread makes the verdict indeterminate.

#114 — set-lane-tree's fence

item	now	where
1. a poll from a finished operation	a fenced set-lane-tree reads the lane's state with its generation and operation, under the same mutex, and is refused with 7 where the lane is SWAPPED	:18285, :18302
2. a partial observation	a 64 since 8.12, unchanged	—

Why SWAPPED and not "require SWAPPING" (the issue's first option): the shell suite's repoRC-5, section 11(c), files a fenced observation under a RUNNING lane's current generation and operation and expects 0. Every transition but SWAPPED advances the generation, so SWAPPED is the one state in which a matching pair names a finished operation. The other option, invalidating the operation at finalization, would change what SWAPPED writes, which lane-handoff's finalizer reads back. An observation filed under no transition is still an unfenced set-lane-tree.

#115 — a sidecar is valid only when it is whole

what	where
lane_sidecar_schema_ok: same name, same callers. A record of the current schema must also carry every key its writer writes, not empty: a snapshot's state one of the four words, every generation a number, a tree's dirty a number and unpushed a number or unknown, its path absolute, and its tree the id its file name gives it. Both writers have written exactly these keys since #97 landed (git log -L shows lane_state_put and lane_tree_put unchanged since b1015f4). Which kind a file is comes from where it is filed, and the snapshot's */lane-state.yaml is asked first: a case pattern's * matches /, so a tree's */trees/*.yaml would also match a snapshot under any directory named trees (review r1's MUST). No tree file is named lane-state.yaml, since a tree id is c<cksum>-…	:13197, :13211
the writers' temporary file is asked the same question before the rename, so a half record is removed, never renamed into place	:13289
lane_state_read → 10; lane-state says which of the two 10s it is	:13348, :18026
lane-reconcile: STATE MALFORMED, verdict indeterminate	:13907, :14333
lane-trees: a row named by its file, schema <malformed>, keeping the path the record names (which may be relative) and every other field empty; lane-reconcile reports it as malformed-sidecar (counted toward recovery); worktrees lists it as malformed sidecar	:13680, :14035, :14524
every writer refuses with 1, as for an unknown schema: set-lane-state, set-lane-tree (the snapshot and the tree record), and the follow-up to a STARTED/RESUMED/ENDED/RETIRED line	:18091, :18281, :18313, :13465
set-lane-tree --dirty/--unpushed that is not a count, or a --branch, --head, --upstream, --checkout or --writer that is only blanks: 64, before the lock, so no writer files a record its readers refuse	:18233, :18237, :18243

Both exit tables in lanes-edit.sh are updated (the header's EXIT CODES: 7 and 10; the lifecycle arms' table: 1, 7, 10 and 64), as are docs/README-lanes.md (its main exit table's 10 and 64 too) and design.md decisions 26–28.

Red at 87a5e9d, green at head

tests/test_lifecycle_fail_open_113_114_115.py, 44 cases, in the lane-start sandbox of test_lane_start_claude_current.py. Failed reads are injected by a git on PATH that passes everything through except the one call a case names.

• At 87a5e9d (a git archive of it plus this one file): the 37 cases written with the fix: 37 failed of 37, each at the assertion under test. That is 9 refusals that were writes, 7 verdicts that were clearances, 7 tree rows read as records, 6 snapshot reads that answered 0, 4 bad counts filed, 2 finished-operation polls filed, 1 holder none, and 1 follow-up that replaced the snapshot. For example, The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113 item 3's lane-tree-now printed main␟<sha>␟./main␟0␟unknown and exited 0.
• The 7 cases from review r1 (a control root under trees, the five blank fields, the C-locale read) test what the review found in this PR, so their red is at 36520b9: 7 failed, 37 passed there, each at its own assertion. The blank fields exit 1 instead of 64, the C-locale read is indeterminate instead of resumable, and lane-start wrote no snapshot.
• At head e6a41b4, after the merge of main: 534 passed across the new file, test_lanes_index.py, test_repo_hygiene.py, both test_triad_lane_tooling files and both test_lane_worktrees files (see "Merged with main").
• At 3ffefce: 44 passed of 44, and together with test_repo_hygiene.py (189), test_deferred_97_findings_157.py (9) and the seven lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5 and lane-root cases of test_lane_worktrees.py: 249 passed.
• At 36520b9: 37 passed of 37, and together with test_repo_hygiene.py (189 cases), the seven lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5 and lane-root cases of test_lane_worktrees.py, and the two scratch checks under CI below: 235 passed.
• Mutants: 27 of 27 killed. The review round's three ran at 3ffefce. m25 (the tree arm asked first again) fails the trees case at "lane-start wrote no snapshot". m26 (no LC_ALL=C) fails the C-locale case with indeterminate instead of resumable. m27 (the blank check off) fails all five blank cases with 1 instead of 64. Before that, 24 of 24 were killed, each by an AssertionError in the cases that cover the mutated code. m01–m10 ran at 33515f8, and m02 and m09–m24 at d727834, so m02, m09 and m10 also ran after the merge of main. m01's code (lane_session_ids_read) went away in d727834.
• Beside it:
  • at 33515f8, the new file with test_deferred_97_findings_157.py and test_repo_hygiene.py: 229 passed. At d727834, the same set gave 234 passed and 1 setup error: a TimeoutExpired in Findings deferred from #97: fetch-first reads, the live-swap takeover, a hand-written RESUMED, and the five of the 8c5958f round #157's fixture, where lane-start took over 120 s at load 134. That case rerun alone: 1 passed.
  • at 33515f8, test_lane_worktrees.py, test_lane_worktrees_report.py, test_lanes_index.py and test_supervised_restart_regressions.py: 381 passed, 2 failed. Both failures are test_completed_observer_cleanup_never_signals_saved_pid, which gives lane-handoff --supervise 20 s to reach state: ready. The host's load average went from 33 to above 200 during these runs. The same scenario timed at 87a5e9d took 21.6, 28.4 and 26.4 s, past the deadline. Run side by side, head and base timed the same: 41.4 and 40.5 s, 52.5 and 52.6, 45.9 and 43.1, 60.4 and 63.1 (head first). It is the host's load, not this change.
• Shell suite: not run locally (CI is the suite of record). I read its repoRC section's assertions against the change. The refusal texts it checks are kept: records schema 999, schema this helper does not write, it could not be read, R22 and superseded reading. The suite's hand-written snapshot (section 11(b)) is whole. Its corrupt-HEAD worktree (11(f)) does not make git worktree list --porcelain fail: git 2.43 lists it and exits 0. I missed the lane-end gate's lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5 cases, which CI caught (below).
• bash 3.2 and awk: bash -n lanes-edit.sh at e6a41b4, 3ffefce and 36520b9 exits 0 with empty stderr under bash 3.2.57, and so do lane-handoff, lane-start and lane-end at e6a41b4. The blank test (*[![:space:]]*) and the validator's arm order were also run under it. That is the bash:3.2 image's own binary, run through its musl loader because Docker could not start a container. Empty stderr matters here, because 3.2's -n exits 0 on an unterminated array. A harness of 16 records (whole, cut short, each shape, a wrong id, a backslash in an id, a dangling link) gives identical answers under mawk 1.3.4, one-true-awk 20231127 (macOS's awk, Debian's original-awk) and BusyBox awk under bash 3.2. The id goes to awk through ENVIRON, not awk -v.

CI

• Run 39141918371 on 33515f8: failed, in the shell suite only. test_lane_helpers.sh gave 4626 passed and 3 failed, the same three in both the tests and tests-no-submodule jobs. All three are lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5's cases: a lane checkout whose .git is mode 000 (cg14), and one whose .git file points nowhere (cg15). The sweep still refused (2), and lane-end --dry-run still refused on it. But the reason was this PR's. The sweep asks lane-reconcile first and keeps the first refusal, and lane-reconcile now refuses on the failed registrations read. It said the worktrees git registers in <dir> could not be listed, where the suite pins the worktree registrations of <dir> could not be read. 36520b9 uses those words. Locally, a scratch check (not committed, since the shell suite's cg14 and cg15 cases already pin this) runs lane-worktrees sweep --dry-run over a mode-000 .git and over an injected git worktree list failure. Both fail at d727834's lanes-edit.sh on the missing phrase, with exit 2 kept, and pass at 36520b9.
• Run 39146268828 on d727834: cancelled. 36520b9 superseded it before it finished.
• Run 39290974968 on e6a41b4, after the merge of main: in progress when this was written.
• Run 39163679712 on 3ffefce, before the merge of main: success (tests, tests-no-submodule and guard-launch-mode).
• Run 39146711605 on 36520b9: success. tests (job 117731920768) and tests-no-submodule (job 117731920712) both passed.

Merged with main: #219's reader and #115's whole-record rule

Lane 4 pre-tested 3ffefce merged onto main 55aae16 (run 39272923228), and onto lane 3's queue (run 39272890984). Both failed the same two tests of #219 (a7f09bd) in tests/test_lanes_index.py, and nothing else, in every job of both runs (2 failed, 1995 passed in 39272923228's tests job, 2 failed, 2306 passed in 39272890984's).

• The cause. Both tests plant a current-schema sidecar with no path:, and assert that its branch (feat/x, feat/y, or unreadable inventory (forged by hand)) appears in lanes-edit.sh worktrees and the index. Since A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115 (this PR) such a record is not whole. The listing reads no field of it, and names its row malformed sidecar, by the path it records or, with none, by its file (lane 3's ruling: the row keeps its path).
• No collision with lanes-index follow-ups of #166 and #173: export reads one snapshot, history --index says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation #219's reader. Its marker is its key, <lane>:<US>unread, and the rows were still trees: counted, held over, and never NOT READ. The index reader is unchanged. The only difference is the branch text, which A lane sidecar passes validation on its schema: line alone, so a truncated schema: 1 record is read AND replaced #115 deliberately no longer reads.
• The fix is in the two tests (e6a41b4), each with its reason in its docstring:
  • test_a_tree_with_no_path_is_a_tree_and_not_an_unread_marker asserts the path-less record as a malformed row named by its file. Its second record keeps the path of the lane's whole tree (it lacks only upstream:), so "two trees of one lane with one path are two rows" is still exercised. The source can no longer give a tree an empty path.
  • test_a_tree_whose_branch_reads_like_a_marker_is_a_tree carries the forged branch on a whole record (it gains a path:), so the branch is read and still makes no marker.
• Reproduced and fixed locally. At e3acbea (a git archive of it, through tests/run.sh -k on the two names): 2 failed, at the same assertions as CI (tests/test_lanes_index.py:2403 and :2441). At e6a41b4, through tests/run.sh -k 'lifecycle_fail_open or lanes_index or repo_hygiene or triad_lane_tooling or lane_worktrees', a selection confirmed with --collect-only at 534 cases (the new file 44, test_lanes_index.py 82, test_repo_hygiene.py 235, test_triad_lane_tooling.py 21 and test_triad_lane_tooling_handoff.py 14, test_lane_worktrees.py 118 and test_lane_worktrees_report.py 20): 534 passed.

Lane 3's constraints, and how they were kept

• The sidecar arms' lock lines are untouched. No changed line names acquire_lock, release_lock, lock_try or LOCK_HELD. The file's 73 such lines are byte-identical and in the same order at main 55aae16 and at head (md5 97878eb1… of both). 87a5e9d had 71; the 72nd and 73rd are main's own. The five existing if ! lane_sidecar_schema_ok … lines are byte-identical too. The two added calls are in readers, not in a lock arm: lane_sidecar_put's temporary file and lane_trees_list's rows. What changed beside a lock call is the refusal message lines next to a release_lock: set-lane-state (:18091), set-lane-tree (:18281, :18313) and lane_state_follow (:13465). The review round's blank-field check sits with the other 64s, before set-lane-tree's acquire_lock (:18243 before :18277). Act 2's rebase may meet those as adjacent-line conflicts; each is a one-line message.
• lane-handoff is not changed (git diff 55aae16 HEAD -- lane-handoff is empty: what differs from 87a5e9d is main's own). Its SIGPIPE flake stays lane-handoff skips the swap lifecycle when its lane-state read dies of SIGPIPE (pipefail + awk exit) #245's.
• Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 (T018, landed by lane 1). I read its diff before designing. It landed on main as 55aae16, and e3acbea merges it in with no conflict. My lane_reconcile changes sit between its hunks. Its unreadable-leg row stays TREE … unreadable, requiring recovery, with its own lrc_legwhy verdict and its own leg wording. Mine follow the same split. For the lane's own checkout, the reason now uses lane-worktrees' lane-worktrees: review findings deferred from #168/#169 (incl. five --yes data-loss paths found after the two-round cap) #170 G5 words rather than Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246's leg words, because lane-end relays that reason and the shell suite pins it. Review r1 found one clash with no textual conflict: Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246's lane-handoff:2274-2275 (on main) counts a lane-trees row as unreadable only when its path is empty, and the <malformed> row keeps its path (as the unknown-schema row already does). Lane 3's answer is option (a): a lane-3 follow-up on Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246's inventory reader that names every row whose schema column (13) is not 1. Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252 is unchanged for it.
• Main. e3acbea merges main 55aae16 (clean), which holds Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246, lanes-edit.sh: a write with nothing staged still publishes the local commits origin lacks, so the RECOVERY's re-run of commit pushes the edit it stranded, and the conflict RECOVERY warns that reset --hard drops a peer's commits #214 (9b94a59) and lanes-index follow-ups of #166 and #173: export reads one snapshot, history --index says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation #219 (a7f09bd), as lane 3's consent asked once Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 had landed. Its CI found the one interaction described under "Merged with main" above.
• Act 2 moves those locks to one workstation-wide lock. Nothing here restructures how an arm takes its lock, and the validator keeps its name, so act 2's call sites are unchanged.

Review r1 and lane 3's answers

The independent Opus review r1 of 36520b9 came back FIX, with one MUST:

finding	what was done
MUST 1: a snapshot under a directory named trees was validated as a tree record, so lane-start wrote none, set-lane-state exited 1 and lane-reconcile said no-state	fixed in e95d072: the snapshot's arm first. Tested by test_115_a_control_root_under_a_directory_named_trees_keeps_its_snapshot, red at 36520b9; the swap-back mutant m25 is killed
SHOULD 2: the clash with #246's unreadable-row test	lane 3: option (a), a follow-up on #246's reader. #252 unchanged
SHOULD 3: the manual's main exit table did not name the malformed snapshot under 10	fixed in 3ffefce (and its 64 row names the lifecycle arms' own)
SHOULD 4: the OpenSpec hunks (decisions 26–28, the tasks.md notes) in lane 3's change	acknowledged by lane 3
SHOULD 5: #113 item 2 is closed by decision 26's remedy (a row counted toward recovery), not the issue's indeterminate	lane 3 leans toward accepting decision 26, and will confirm before "Closes #113" takes effect
SHOULD 6: an unreadable .git under a lane root	filed as #258
NIT 7: lane_no_repository matched git's English without LC_ALL=C	fixed in e95d072; tested, mutant m26 killed
NIT 8: the manual said a malformed row has every field empty, and worktree_rows' note said a path always begins with /	fixed in 3ffefce and e95d072: the row keeps the recorded path, which may be relative
NIT 9: set-lane-tree --branch ' ' exited 1 at the rename	fixed in e95d072: 64 before the lock, for --branch, --head, --upstream, --checkout and --writer; tested, mutant m27 killed
NIT 10: decision 28 did not say why a record's lane: is not compared	fixed in 3ffefce: rename-lane leaves it naming the old lane until the next write

Lane 3's answers were given at 19:5xZ as leans that become final when lane 3 resumes.

What is left, and why

• The published half of The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113 item 1 can't be observed through the CLI. lane_reconcile's step 0 (the managed seam) already answers indeterminate for a published register it cannot read, before the holder is read. The holder check is there so step 2 does not rest on step 0, and no test can make that half red. The local half is tested.
• A dangling lanes/LANES.md link is refused by the dispatcher's "registry not found" guard before any read, at base and head alike. So item 1's case uses a permission instead, and skips under root.
• A directory under a lane root whose .git git cannot read is still passed over by lane-reconcile's on-disk sweep: a worktree whose admin directory is gone, or a mode-000 .git outside any repository. lane-worktrees names both. That is not one of The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113's four reads, and it is filed as lane-reconcile's on-disk sweep passes over a directory under a lane root whose .git git cannot read: a worktree whose gitdir is gone is never named, where lane-worktrees names it #258, a follow-up.
• The same session_ids_of_lane … || : pattern elsewhere in the file (live_holder's own fallback, idle_holders, lane_forks, guard_run, retire_rows, rename-lane, lane-holders) is outside these issues and not changed. session_ids_of_lane / session_ids_local_of_lane don't distinguish "no row" from "register unreadable", so every caller that treats an empty id set as a fact is fail-open on that read #67 moved holder_is_dead and duplicate_holder_pids to the checked read, and this PR moves lane_reconcile.

🤖 Generated with Claude Code

Summary by Sourcery

Make lane lifecycle reconciliation fail closed, fence finalized operations, and require complete valid sidecars before reading or writing lane state.

Bug Fixes:

• Preserve failed lifecycle and worktree reads as explicit failures instead of treating them as empty results or clearances.
• Prevent lifecycle observations from being recorded after their operation has reached the SWAPPED state.
• Reject incomplete or malformed current-schema lane sidecars and preserve them for diagnosis instead of replacing them.

Enhancements:

• Validate sidecar completeness, field shapes, and tree identity across lifecycle and inventory readers and writers.
• Distinguish malformed sidecars from unreadable and unknown-schema records in reconciliation output.
• Reject invalid tree observations before locking or writing, and align repository detection with the worktree tooling's rules.
• Document the new lifecycle failure semantics, fencing behavior, validation rules, and exit codes.

Documentation:

• Update lane lifecycle documentation and design decisions for failed reads, finalized-operation fencing, and whole sidecar validation.

Tests:

• Add comprehensive regression coverage for lifecycle fail-open reads, finalized-operation polls, malformed sidecars, invalid observations, locale handling, and unreadable worktree roots.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 5 days and 9 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR hardens lane lifecycle safety by making failed reads and malformed sidecars fail closed, preventing finalized-operation inventory writes, and adding comprehensive regression tests and documentation for the new validation, verdict, and exit-code semantics.

Sequence diagram for finalized-operation inventory fence

sequenceDiagram
    participant Observer
    participant SetLaneTree as set-lane-tree
    participant Mutex
    participant Snapshot as lane-state.yaml
    participant Inventory as tree sidecar
    Observer->>SetLaneTree: set-lane-tree --generation G --operation O
    SetLaneTree->>Mutex: acquire_lock
    SetLaneTree->>Snapshot: lane_sidecar_schema_ok
    Snapshot-->>SetLaneTree: state SWAPPED, generation G, operation O
    SetLaneTree->>SetLaneTree: compare fence
    SetLaneTree->>Mutex: release_lock
    SetLaneTree-->>Observer: refuse with exit 7
    SetLaneTree--xInventory: no write

Loading

Flow diagram for fail-closed lane reconciliation

flowchart TD
    A[lane_reconcile] --> B[lane_state_read]
    A --> C[lane_session_ids_read]
    A --> D[lane_trees_list]
    A --> E[git worktree list --porcelain]
    A --> F[lane root sweep]
    B --> G{Read succeeded and record is whole?}
    C --> H{Register read succeeded?}
    D --> I{Inventory read succeeded?}
    E --> J{Registration read succeeded?}
    F --> K{Root can be listed?}
    G -- No --> L[indeterminate]
    H -- No --> L
    I -- No --> L
    J -- No --> L
    K -- No --> L
    G -- Yes --> M[Continue lifecycle verdict]
    H -- Yes --> M
    I -- Yes --> M
    J -- Yes --> M
    K -- Yes --> M

Loading

Flow diagram for whole sidecar validation

flowchart TD
    A[lane_sidecar_put] --> B[write temporary sidecar]
    B --> C[lane_sidecar_schema_ok]
    C --> D{Current schema?}
    D -- No --> E[remove temporary file]
    D -- Yes --> F{All required keys and shapes valid?}
    F -- No --> E
    F -- Yes --> G{Tree id matches filename?}
    G -- No --> E
    G -- Yes --> H[mv temporary file into place]
    E --> I[writer refuses with exit 1]
    H --> J[whole sidecar becomes visible]

Loading

File-Level Changes

Change	Details	Files
Makes lifecycle reconciliation fail closed by preserving read failures instead of interpreting them as empty or healthy results.	Propagates holder-register, remote-config, inventory-listing, worktree-registration, and lane-root read failures. Reports unreadable paths and promotes affected reconciliation verdicts to indeterminate. Preserves the distinction between a missing repository and a repository whose worktrees cannot be inspected.	lanes-edit.sh docs/README-lanes.md openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md
Closes the set-lane-tree operation fence after an operation reaches SWAPPED.	Reads state, generation, and operation under the existing mutex. Rejects matching fenced polls for finalized SWAPPED operations with exit 7 while retaining unfenced writes.	lanes-edit.sh docs/README-lanes.md openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md
Validates current-schema sidecars as complete, type-correct, and identity-consistent records before reading or replacing them.	Requires all writer-produced keys and validates state, generation, path, tree id, dirty, and unpushed values. Treats malformed snapshots as exit 10/MALFORMED and malformed tree records as malformed-sidecar rows requiring recovery. Validates temporary files before atomic rename and rejects invalid dirty or unpushed command-line values with exit 64.	lanes-edit.sh docs/README-lanes.md openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md
Adds focused regression coverage for all three findings and documents the resulting decisions and exit-code behavior.	Adds 37 tests covering injected Git failures, permission failures, finalized-operation polls, malformed snapshots and tree sidecars, and invalid counts. Updates lifecycle documentation, design decisions 26–28, task status, and refusal/read-error messaging.	tests/test_lifecycle_fail_open_113_114_115.py docs/README-lanes.md openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#113	Do not treat failed holder-register reads as an empty session-ID set or pronounce a crash from an unanswered liveness question.	✅
#113	Preserve unreadable tree-sidecar and inventory failures in reconciliation, and make the verdict indeterminate when an inventory cannot be read.	✅
#113	Propagate failures from both Git reads—the branch remote configuration read and the worktree-registration sweep—instead of fabricating an upstream or treating failed registrations as absent.	✅

Possibly linked issues

• Findings deferred from #97: fetch-first reads, the live-swap takeover, a hand-written RESUMED, and the five of the 8c5958f round #157: Link: PR The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113 makes an unreadable trees directory produce an indeterminate reconciliation verdict, fixing issue section 4e.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[brettheap]

Lane openRepoTools-3, 2026-10-18T20:1xZ: the three decisions lane 4's review left to lane 3, final. They replace the leans lane 3 sent at 19:5xZ, unchanged.

1. Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 and Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252's semantic clash: (a), in a lane-3 follow-up. Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252 does not change for it.
   • The fix: Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246's inventory reader (lane-handoff:2210-2211 at 5dd0df07) will treat as unreadable every lane-trees row whose schema, column 13, is not 1. That covers today's unknown-schema row, Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252's <malformed> row, and any marker added later.
   • Why not (b): Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252's malformed row keeps the recorded path. That path tells a person which tree the broken record is about, and emptying it would cost the sweep that information and report the tree twice.
   • Timing: Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 stays at 5dd0df07. The reader runs only in an assembly, a checkout with a project.yaml, and no checkout has one before the cutover. So the gap is latent today, and the follow-up must land before the cutover.
   • One follow-up: it also takes openRepoShape-2's provisional SHOULD on Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 (6253899644), where a leg directory the user cannot search reads as absent, so both "a failed read is never an empty one" gaps close together.
2. The OpenSpec hunks are acknowledged by the change's owner (proposal.md:31).
   • Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252 may carry decisions 26 to 28, and the "taken in decision N" notes in openspec/changes/add-crash-consistent-lane-worktree-recovery/{design,tasks}.md. They record Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252's own behaviour, and a decision belongs where it is made.
   • Whether they are correct stays with Lifecycle reads that failed are no longer answers, set-lane-tree's fence closes with its operation, and a lane sidecar is valid only when whole #252's review.
3. Decision 26 is accepted as The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113 item 2's answer. "Closes The lifecycle's remaining fail-open reads: an unreadable register becomes 'no holder', an unreadable sidecar becomes no tree, and two git reads become fabricated values #113" may retire the item.
   • What the item asked for: an existing record nobody can read must never fall into the same silence as a record that is not there. Today it vanishes, and where it is the lane's only sidecar, lane_trees_list answers 8, this lane owns no worktree, about an inventory nobody read.
   • What decision 26 does: the unreadable record gets a row of its own, unreadable-sidecar. lane-reconcile and lane-start name it, and it counts toward recovery ("1 require recovery"). lane-worktrees refuses it, so no writer is launched over it.
   • Why the verdict stays resumable: every other tree was read. Only a failure that leaves trees nobody read makes the verdict indeterminate: an inventory directory that cannot be listed, git worktree list failing, or a lane root that cannot be searched. That is the same per-record line Make the lane tools look inside a triad's legs and paired feature trees, so the sweep, lane-end's gate, lane-handoff, lane-reconcile and the daily report can see a lane's work there, and change nothing a checkout with no project.yaml does #246 (T018) draws for an unreadable leg, and the issue's own "a row of its own" is met.

#252 still waits for #246, as lane 4 described. Lane 3 lands nothing on main until lane 4's HOLD RELEASED.

Lane: openRepoTools-3

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud