[brettheap]

Refs #138 (items 1, 2, 4, 5, 7, 8, 9, 10, 11, 12, 17, 18 — the lanes-edit.sh items)
Refs #157 (item 4b)

The register sweeps (retire-rows, archive-rows, migrate-state-cells) and the reads behind the DORMANT class, next-free and add-row now refuse, or decline to classify, where a read failed or a path is not what it looks like. Before, each of those cases was read as "nothing there". Every fixed item was re-proved on main first, against a throwaway register in a local bare repository. Each one has a proving test in the new tests/test_register_scan_hardening_138.py that fails on the code before it and passes here. The branch carries main up to babd9fe as normal merge commits.

Each commit carries one item. Line ranges are on this branch's head.

Item	Status	Before (re-proved)	Function, lines	Test
#157 4b	fixed	a refusal in the scan left a LANES(pre-existing@…) commit: HEAD moved by 1 for retire-rows ("named twice"), archive-rows ("no RETIRED row") and migrate-state-cells ("nothing to migrate")	migrate_state_cells 10845–10851 and 11100–11112; retire_rows 11639–11641 and 11868–11870; archive_rows 11943 and 12080–12083: handle_preexisting moves from before the scan to the head of each write. The lock is still taken before the scan.	test_a_refusal_in_the_scan_commits_no_peer_edit[×3], test_a_sweep_that_writes_still_captures_the_peer_edit_as_its_own_commit
1	already fixed for a failed show; see 18 for an unreadable blob	with the published register's show failing, the sweep exits 1 ("is UNKNOWN") before refusal 1 runs, because managed_seam_refuse (from #97) reads the published register and this checkout's row with their status. With the blob unreadable, the probe read this checkout's copy instead and the sweep was published (exit 0); item 18's register_published closes that.	none (see 18)	test_item_1_… (pins it); test_item_18_the_seam_refuses_…
2	fixed: refuse, the issue's second option	archive outside the checkout (skip-worktree): a new one-row archive was created and the register deletion staged, then git add failed with exit 6	archive_rows 11972–11985	test_item_2_…
4	fixed	a lane whose only log is local was classed dormant once lanes/log could not be listed; and lane-end --retire-dormant then said "nothing to do" (exit 8)	lanes_rows 7483–7492 and 7703–7713; lane-end 723–728 (review of #230)	test_item_4_…, test_item_4_the_sweep_refuses_… (both skipped as root)
5	fixed	next-free offered a position over a zero-byte register and over a broken symlink; a directory was already refused, because -s is true for one	lane_position_rows 8011–8018	test_item_5_…[zero bytes, broken symlink]
7	fixed	next-free offered position 4 over a local archive that is a directory, a broken symlink or a FIFO	archive_text and the new archive_local_text 3315–3329; retired_identity_hits 3340	test_item_7_…[×3]
8	fixed: read the local cell, the issue's first option	the RETIRED line carried the published (older) id where the writer's newest id was committed here and not pushed	retire_rows 11612–11621	test_item_8_…
9	fixed	an unlistable log directory passed the scan, and the run failed inside the write loop with exit 5	log_files_named_ci 2621–2632; retire_rows 11801–11804	test_item_9_… (skipped as root)
10	fixed	the row left the repository: removed from the register, pushed, and appended through a tracked symlink to a file outside it	archive_rows 11963–11971	test_item_10_…
11	fixed	an IDLE lane whose published log git show could not read was shown NO LOG / dormant and named in lane-end --retire-dormant's preview	remote_log_events 3087–3097; lanes_rows 7384–7402 and 7703–7713; lane-end 723–728 for the no-warnings-file case	test_item_11_…
12	fixed	the RETIRED line was written through a tracked symlink to a file outside the repository, then committed and pushed (exit 0)	retire_rows 11756–11763	test_item_12_…
17	fixed	with the published log's blob unreadable, the scan passed and wrote a RETIRED line, then git add failed with exit 6	retire_rows 11720–11737: ls-tree of the path replaces cat-file -e	test_item_17_…
18	fixed (completed over two review rounds)	a row a peer had published, and this checkout had not pulled, was added again: two repoX-5 rows landed on origin. Where git refused cat-file -e and show, or the blob was deleted, register_text read this checkout's copy: add-row exited 0 (two rows) or 3 (the duplicate committed here), next-free offered a position, and the seam published a sweep. Re-review: the listing then dropped the rows and lane-end --retire-dormant said "nothing to do" (exit 8). archive_text had the same cat-file -e, so a published archive git could not read reissued retired repoX-4 (next-free offered it, add-row committed it).	the new register_published [<path>] 3260–3276 asks ls-tree, never cat-file -e; register_text 3238–3251 (returns 1, caches nothing); archive_text 3296–3310 (asks it of the archive); lane_position_rows 8018–8030; lanes_rows 7403–7412 (checks register_text once and withholds the class); rows_named_ci 4670–4682 (keeps both statuses); add-row 13866–13872	test_item_18_… (×8: add-row under a refused show; add-row in both review modes; next-free; the seam; the withheld class; the archive in both modes)

Two choices between the issue's options

• Item 2. I took the refusal, not seeding the archive from origin. git 2.43 will not stage a skip-worktree path (measured), so a seeded archive would still fail at the commit, after the rows had left the register here.
• Item 8. I took reading the local cell ($LANES_SESSION, else the last id of this checkout's row, else the published row's), not requiring LANES_SESSION. Requiring it would break the documented LANES_LANE=<lane> … retire-rows call. A checkout behind origin is refused anyway, so the local row is never the older of the two.

Merged with #221 (babd9fe, register_text_checked)

#221 landed first. Merge 2765929 resolved the one conflict, register_text.

• register_text_checked is A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221's text with one change: the published-or-not probe is register_published (0 → show, 8 → this checkout's cat, 1 → a failed read), not cat-file -e. A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221's shape stays: text plus status, a failed read printed and never cached.
• register_text stays A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221's register_text_checked || :. No existing caller's own return code changes.
• The three Register sweeps and reads refuse what they could not read: retire-rows, archive-rows, migrate-state-cells, the DORMANT class, next-free and add-row (#138 lanes-edit.sh items, #157 item 4b) #230 readers that need the status call register_text_checked directly: rows_named_ci (add-row's refusal), lanes_rows' one check (the withheld DORMANT class) and lane_position_rows (next-free).

#221's session_ids_checked is untouched.

How this combines with #210 (fix/wrapper-hardening-138)

git merge-tree --write-tree of the head before the #221 merge with #210's ae1b37b was clean. The combined lane-end block has #210's capture, which is always made and refuses when it cannot be made or read back, followed by the two refusal arms: "session records could not be read", and this PR's "no row is classed DORMANT here".

Scope and neighbours

• Item 11 covers the read lane-end --retire-dormant uses: lanes --closed --prefix, through state_events. --lane <name> and --index reads are unchanged.
• Status changes. register_text, rows_named_ci and log_files_named_ci now return 1 on a failed read. Every existing caller other than the ones named above takes them through $( ) or || :, so their behaviour is unchanged.
• Other writers' regions are untouched: commit_push, rename publication, managed-projection, lane_trees_list, history --index. Lane 5's The listing never reads the row's current-state phrase, so a migrated PAUSED row shows as NO LOG (#82 round 3, suppressed) #89 works in lanes_rows ~7500–7507 (main), and my lanes_rows hunks sit outside it.
• Three hardenings Copilot round 5 raised on #93, filed rather than taken: the register rewrite's unchecked status, the sweep's weakened published-path preflight, and retire-rows' wrong exit for an already-closed log #120 and add-row's archive scan treats an unparseable archive row as a non-row, so a retired position can be reissued — and the obvious refusal would fire on the archive's own header (#93 round 6, filed rather than taken) #122 are not touched. Three hardenings Copilot round 5 raised on #93, filed rather than taken: the register rewrite's unchecked status, the sweep's weakened published-path preflight, and retire-rows' wrong exit for an already-closed log #120 covers delete_lines/replace_line and the rr_pub clause; add-row's archive scan treats an unparseable archive row as a non-row, so a retired position can be reissued — and the obvious refusal would fire on the archive's own header (#93 round 6, filed rather than taken) #122 covers the archive-row awk in retired_identity_hits. Item 7 replaces only the ri_local read just above that awk.
• Traps. No traps and no new environment-inherited temp paths are added.
• Manual. docs/README-lanes.md names the new refusals in the sweep and archive sections.
• Left for Three reads left after #230 still turn a failure into an answer: remote_log_events' ls-tree, a present skip-worktree archive, and log_files_named_ci's other callers #248 (filed, with the re-review's two further notes: the other cat-file -e probes and have_remote_ref):
  • item 11's residual at remote_log_events (an ls-tree that fails is still silent);
  • item 2's residual (a skip-worktree archive that IS present here leaves a staged deletion);
  • the other log_files_named_ci callers (migrate_state_cells, ensure_log, log_path_ci), which do not read its new status.

Tests

• Local proof, round 1 (2026-10-17T22:21Z, under the shared lock): against main's lanes-edit.sh, 18 failed, 1 passed; against 2d45849, 19 passed. The one that passed on main is the guard that the capture still happens.
• Local proof, review round (2026-10-18T08:44Z, under the shared lock, every LANES_* and TMUX* unset). The round's tests run against 2d45849's lanes-edit.sh and lane-end: 5 failed, 1 passed. All five new cases fail: add-row in both review modes, next-free, the seam, and lane-end's refusal. The one that passes is round 1's item 18 test, already fixed at 2d45849. This file plus tests/test_repo_hygiene.py on a284f71: 213 passed.
• Local proof, re-review round (2026-10-18T09:48Z, under the shared lock, every LANES_* and TMUX* unset). The round's tests against a284f71's lanes-edit.sh and lane-end: 3 failed out of 3 (the withheld class, and the archive in both modes). This file plus tests/test_repo_hygiene.py on 19ecf54: 216 passed.
• After the A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221 merge (2026-10-18T16:29Z, under the shared lock): this file plus tests/test_repo_hygiene.py at 2765929: 216 passed. A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221's own cases are in tests/test_lane_helpers.sh, which runs whole in CI's tests job.
• CI: after the A register that could not be read no longer reads as a lane with no session ids, so the dead-lane --force check and duplicate-holder fail closed (#67) #221 merge, run 39144678037 at 2765929: tests (whole shell suite included), tests-no-submodule and guard-launch-mode all passed. Re-review round, run 39116781592 at 19ecf54: all three passed. Round 1, run 39072846177 at 2d45849: tests, tests-no-submodule and guard-launch-mode all passed. Review round, run 39112269636 at a284f71: all three passed. The Linux tests job is the suite of record.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 2 hours and 53 minutes by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

The PR hardens register sweeps, lane classification, next-free, and add-row to fail closed whenever required register, archive, log, or Git reads are unreadable or structurally unsafe, while preserving successful peer-edit capture semantics; a comprehensive isolated regression suite proves each issue item.

Sequence diagram for fail-closed register sweep

sequenceDiagram
    participant Operator
    participant Sweep
    participant Git
    participant Register
    participant Logs
    participant Archive

    Operator->>Sweep: retire_rows()
    Sweep->>Git: acquire_lock()
    Sweep->>Git: ls-tree published log path
    Git-->>Sweep: path exists or read failure
    alt required read fails or path is unsafe
        Sweep-->>Operator: refuse, nothing written
    else reads succeed
        Sweep->>Register: register_text()
        Sweep->>Logs: log_files_named_ci()
        Sweep->>Archive: archive_local_text()
        Sweep->>Git: handle_preexisting()
        Sweep-->>Operator: commit and publish sweep
    end

Loading

Flow diagram for fail-closed lane classification

flowchart TD
    A[lanes_rows] --> B[Read published logs with remote_log_events]
    B --> C{Log or log directory readable?}
    C -- No --> D[Record unreadable log warning]
    D --> E[Do not classify lane as DORMANT]
    C -- Yes --> F[Read local log listing and state facts]
    F --> G{All required reads succeeded?}
    G -- No --> H[Leave lane unclassified]
    G -- Yes --> I[Classify eligible lane as DORMANT]

Loading

Flow diagram for safe next-free and add-row reads

flowchart TD
    A[next-free or add-row] --> B[Inspect local register or archive path]
    B --> C{Path exists and has expected type?}
    C -- No --> D[Refuse or report unreadable source]
    C -- Yes --> E[Read published register/archive]
    E --> F{Git read succeeded?}
    F -- No --> G[Refuse; do not treat as empty]
    F -- Yes --> H[Use rows and retired identities]
    H --> I[Offer position or add one row]

Loading

File-Level Changes

Change	Details	Files
Make register, archive, log, and published-object reads fail closed instead of treating unreadable or malformed paths as absent.	Propagate failures from register, row, log-directory, archive, and remote log reads. Reject zero-byte registers, broken symlinks, non-regular archive/log targets, unreadable published blobs, and missing local copies of published archives. Prevent DORMANT classification and next-free position reuse when required state cannot be read.	lanes-edit.sh
Harden sweep and add-row write paths against unsafe filesystem state and stale or incomplete reads.	Validate published paths with tree metadata before reading blobs. Refuse writes through symlinks or non-regular files and refuse archive moves when the published archive is unavailable locally. Read the writer's newest local session identifier and detect duplicate published rows before add-row.	lanes-edit.sh
Move pre-existing register-edit capture until after sweep validation and immediately before writes.	Keep the lock before scans while avoiding commits when a scan refuses. Preserve capture as a separate commit for successful writes across migrate-state-cells, retire-rows, and archive-rows.	lanes-edit.sh
Add regression coverage for all listed register-scan hardening cases and commit-boundary behavior.	Build isolated bare-repository fixtures and simulate unreadable Git paths, permissions, symlinks, FIFOs, sparse/skip-worktree files, and peer edits. Verify refusal status, unchanged HEAD/register contents, no unsafe external writes, correct DORMANT/next-free behavior, and local session IDs.	tests/test_register_scan_hardening_138.py

Possibly linked issues

• Amendment 19: a closed or dormant lane leaves the listing, one sweep retires a repository's dormant rows on a word, and a retired position is never reissued #93: Link: the PR implements issue items 2, 4, 5, 7–12, 17, and 18, plus item 1's existing safeguard.
• Findings deferred from #97: fetch-first reads, the live-swap takeover, a hand-written RESUMED, and the five of the 8c5958f round #157: The PR fixes issue section 4b by moving handle_preexisting after scan refusals in retire-rows, archive-rows, and migrate-state-cells.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud