Artifact [c06e5fb6da]

Artifact c06e5fb6da0b1b7aa055fb2398bd03844e0dbec67ed97905135db1dffb8a2a14:

• File src/update_test.zig — part of check-in [5ba418801d] at 2026-07-18 23:11:56 on branch release-0.1 — Add zit open: clone→working-tree path, proven by e2e chain and fossil smoke scenario

  `zit clone` builds a repository file and nothing else. The checkout it left behind was the same UNBORN record `init` writes (`version == ""`, branch `trunk`), with no managed set and no files, and there was no way to turn it into a usable tree: `zit update` accepts only a literal 40/64-hex check-in ID, so a freshly cloned tree could not name its own tip. Clone was a dead end.

  `zit open` is the second half of fossil's own clone+open UX. It resolves the tip of the main branch out of this repository's derived state and hands materialization to the SAME `update.applyCheckin` engine every other working-tree move rides — journal-armed, transactional, rollback-safe. Tip resolution is the only work that is open's own; everything else is wiring.

  What changed:

  - `cli.parseOpenArgs` / `OpenArgs` / `OpenResult`: an operand-free surface. `-h`/`--help` is the only accepted token and wins over every other token; a bare `-x` is an unknown option, anything else an extra argument. The verb takes no operand by design — it derives its target from the repository. - `main.runOpen` plus the `open` entries in the `Verb` enum, the dispatch switch, and the `verb_help` table, so the verb is added in one place and the total switch stays total. `runOpen` writes NO checkout record and NO managed set of its own: `init` already wrote the unborn record, an absent managed set already reads as the empty set, and the update engine stays the single writer of the born record. A second writer of that bootstrap state would only be a second thing to keep in sync. - `main.openApplyFail`: one arm per `update.ApplyError` variant and no `else`, so a new variant fails the compile and forces a decision, mirroring `updateApplyFail`. `SymlinkUnsupported` / `InvalidPath` / `ReservedPath` are raised while planning the TARGET manifest and are reachable on a perfectly intact repository, so they get honest prose instead of a corruption claim. - `update.planUpdate`: an UNBORN record now takes the same arm as an absent one. Unborn is the normal state of every fresh repository, so without this the first `update` after a clone handed `""` to `buildPlan`, failed `artifact.validateName("")`, and reported `CurrentStateInvalid` — a clean, correct tree diagnosed as broken. A record that names no check-in but claims a merge parent or a pending special operation stays incoherent and is still `CurrentStateInvalid`. - BORN-ness, not presence, is the "already open" signal. A presence-based gate would have rejected a clone followed by an open on every clone, the primary path the verb exists to serve.

  Test evidence (all run in this worktree after absorbing the sibling P3-F4 commit 281c0ed815, which arrived during this step and was merged by hand in `src/e2e.zig` — both sides had appended the identical P3-F4 block, so the duplicate was dropped):

  - `zig build test` — green, including new `update_test.zig` coverage of the unborn-record arm and its incoherent-record rejections. - `zig build e2e` — green, including the P3-F3 block: clone → open → byte-identical tree → update → commit round-trip; a plain clone's unborn checkout tolerated by `update`; an untracked file in the way failing the open and materializing nothing; re-opening an already-open tree refused with no change; a repository with no check-in reported rather than failed; outside a repository failing with the not-a-repo diagnostic (exit 1); unknown option and positional as usage errors (exit 2); and the verb present in top-level help with one help text behind both `--help` and `help open`. - `zig build smoke` — green, with the new S6 scenario (§3.7/§4): `zit clone` + `zit open` against a REAL fossil server materializes the committed bytes byte-for-byte. This is the cross-implementation proof that the new path produces a working tree fossil itself agrees with. - `zig fmt --check .`, `zig build`, and `zig build dst` (6 seeds x 1000 steps) also green.

  No borrowed technique in this change. No new file: the work lands entirely in existing modules. (user: dmestas, size: 28911) [annotate] [blame] [check-ins using] [more...]

//! Private `update.applyCheckin` contract tests.
//!
//! Tests that require update.zig file-private helpers or fault-injection seams
//! remain inline with that implementation.

const std = @import("std");
const artifact = @import("artifact.zig");
const checkout = @import("checkout.zig");
const logstore = @import("logstore.zig");
const managed = @import("managed.zig");
const storage = @import("storage.zig");
const update = @import("update.zig");
const ApplyError = update.ApplyError;
const applyCheckin = update.applyCheckin;

fn decodeValidatedName(name: []const u8, out: *[logstore.max_hash_len]u8) ApplyError![]const u8 {
    if (!artifact.validateName(name)) return error.InvalidCheckinId;
    const raw = out[0 .. name.len / 2];
    _ = std.fmt.hexToBytes(raw, name) catch return error.InvalidCheckinId;
    return raw;
}

fn completeTestArtifact(gpa: std.mem.Allocator, body: []const u8) ![]u8 {
    var checksum_buf: [32]u8 = undefined;
    const checksum = artifact.selfChecksum(body, &checksum_buf);
    return std.fmt.allocPrint(gpa, "{s}Z {s}\n", .{ body, checksum });
}

fn putTestArtifact(log: *logstore.LogStore, name: []const u8, bytes: []const u8) !void {
    var digest: [logstore.max_hash_len]u8 = undefined;
    const raw = try decodeValidatedName(name, &digest);
    _ = try log.put(raw, bytes);
}

fn putCompleteTestArtifact(
    gpa: std.mem.Allocator,
    log: *logstore.LogStore,
    body: []const u8,
    id_buf: *[64]u8,
) ![]const u8 {
    const bytes = try completeTestArtifact(gpa, body);
    defer gpa.free(bytes);
    const id = artifact.artifactName(.sha1, bytes, id_buf);
    try putTestArtifact(log, id, bytes);
    return id;
}

fn putTestPayload(
    log: *logstore.LogStore,
    bytes: []const u8,
    id_buf: *[64]u8,
) ![]const u8 {
    const id = artifact.artifactName(.sha1, bytes, id_buf);
    try putTestArtifact(log, id, bytes);
    return id;
}

fn putDeltaTestTarget(
    gpa: std.mem.Allocator,
    log: *logstore.LogStore,
    baseline_id: []const u8,
    id_buf: *[64]u8,
) ![]const u8 {
    const body = try std.fmt.allocPrint(gpa, "B {s}\nD 2007-07-21T14:10:00\nF next {s}\n", .{
        baseline_id,
        "a" ** 40,
    });
    defer gpa.free(body);
    return putCompleteTestArtifact(gpa, log, body, id_buf);
}

fn writeFixturePayload(
    io: std.Io,
    root: std.Io.Dir,
    path: []const u8,
    bytes: []const u8,
    mode: artifact.FileMode,
) !void {
    var file = try root.createFile(io, path, .{
        .read = false,
        .exclusive = true,
        .permissions = switch (mode) {
            .regular => .default_file,
            .executable => .executable_file,
            .symlink => unreachable,
        },
        .resolve_beneath = true,
    });
    defer file.close(io);
    try file.writePositionalAll(io, bytes, 0);
    try file.sync(io);
}

fn modeMatches(stat: std.Io.File.Stat, mode: artifact.FileMode) bool {
    if (comptime std.Io.File.Permissions.has_executable_bit) {
        const executable = stat.permissions.toMode() & 0o111 != 0;
        return switch (mode) {
            .regular => !executable,
            .executable => executable,
            .symlink => false,
        };
    }
    return mode != .symlink;
}

fn expectFileState(
    gpa: std.mem.Allocator,
    io: std.Io,
    worktree: std.Io.Dir,
    path: []const u8,
    expected_bytes: []const u8,
    expected_mode: artifact.FileMode,
) !void {
    const stat = try worktree.statFile(io, path, .{ .follow_symlinks = false });
    try std.testing.expectEqual(.file, stat.kind);
    try std.testing.expect(modeMatches(stat, expected_mode));

    var file = try worktree.openFile(io, path, .{
        .allow_directory = false,
        .follow_symlinks = false,
        .resolve_beneath = true,
    });
    defer file.close(io);
    const bytes = try gpa.alloc(u8, stat.size);
    defer gpa.free(bytes);
    const n = try file.readPositionalAll(io, bytes, 0);
    try std.testing.expectEqual(expected_bytes.len, n);
    try std.testing.expectEqualStrings(expected_bytes, bytes);
}

const RootEntrySet = struct {
    names: std.ArrayList([]u8) = .empty,

    fn deinit(self: *RootEntrySet, gpa: std.mem.Allocator) void {
        for (self.names.items) |name| gpa.free(name);
        self.names.deinit(gpa);
        self.* = undefined;
    }

    fn contains(self: *const RootEntrySet, name: []const u8) bool {
        for (self.names.items) |candidate| {
            if (std.mem.eql(u8, candidate, name)) return true;
        }
        return false;
    }
};

fn snapshotRootEntries(gpa: std.mem.Allocator, io: std.Io, worktree: std.Io.Dir) !RootEntrySet {
    var entries = RootEntrySet{};
    errdefer entries.deinit(gpa);
    var iterator = worktree.iterate();
    while (try iterator.next(io)) |entry| {
        const name = try gpa.dupe(u8, entry.name);
        entries.names.append(gpa, name) catch |err| {
            gpa.free(name);
            return err;
        };
    }
    return entries;
}

fn expectSameRootEntries(gpa: std.mem.Allocator, io: std.Io, worktree: std.Io.Dir, expected: *const RootEntrySet) !void {
    var actual = try snapshotRootEntries(gpa, io, worktree);
    defer actual.deinit(gpa);
    try std.testing.expectEqual(expected.names.items.len, actual.names.items.len);
    for (expected.names.items) |name| try std.testing.expect(actual.contains(name));
}

fn seedUntouchedWorktree(gpa: std.mem.Allocator, io: std.Io, worktree: std.Io.Dir) !void {
    try checkout.write(io, worktree, .{ .version = "old-checkout", .branch = "old-branch", .merge_parent = "", .special_op = "" });
    var old_managed = managed.ManagedSet.init(gpa);
    defer old_managed.deinit();
    _ = try old_managed.insert("old-file");
    try old_managed.write(io, worktree);
    try writeFixturePayload(io, worktree, "old-file", "old executable bytes", .executable);
    try writeFixturePayload(io, worktree, "witness", "unmanaged witness bytes", .regular);
}

fn expectUntouchedWorktree(gpa: std.mem.Allocator, io: std.Io, worktree: std.Io.Dir) !void {
    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, worktree, &checkout_buf)).?;
    try std.testing.expectEqualStrings("old-checkout", state.version);
    try std.testing.expectEqualStrings("old-branch", state.branch);

    var current_managed = try managed.ManagedSet.read(gpa, io, worktree);
    defer current_managed.deinit();
    try std.testing.expectEqual(@as(usize, 1), current_managed.iterate().len);
    try std.testing.expect(current_managed.contains("old-file"));
    try expectFileState(gpa, io, worktree, "old-file", "old executable bytes", .executable);
    try expectFileState(gpa, io, worktree, "witness", "unmanaged witness bytes", .regular);
}

fn setupRollbackFailureFixture(
    gpa: std.mem.Allocator,
    io: std.Io,
    worktree: std.Io.Dir,
    log: *logstore.LogStore,
    target_id_buf: *[64]u8,
    old_id_buf: *[64]u8,
) ![]const u8 {
    var payload_id_buf: [64]u8 = undefined;
    const payload_id = artifact.artifactName(.sha1, "", &payload_id_buf);
    try putTestArtifact(log, payload_id, "");

    const old_body = try std.fmt.allocPrint(gpa, "D 2007-07-21T14:09:59\nF old {s}\n", .{payload_id});
    defer gpa.free(old_body);
    const old_bytes = try completeTestArtifact(gpa, old_body);
    defer gpa.free(old_bytes);
    const old_id = artifact.artifactName(.sha1, old_bytes, old_id_buf);
    try putTestArtifact(log, old_id, old_bytes);

    const target_body = try std.fmt.allocPrint(gpa, "D 2007-07-21T14:10:00\nF new {s}\n", .{payload_id});
    defer gpa.free(target_body);
    const target_bytes = try completeTestArtifact(gpa, target_body);
    defer gpa.free(target_bytes);
    const target_id = artifact.artifactName(.sha1, target_bytes, target_id_buf);
    try putTestArtifact(log, target_id, target_bytes);

    try checkout.write(io, worktree, .{ .version = old_id, .branch = "trunk", .merge_parent = "", .special_op = "" });
    var old_managed = managed.ManagedSet.init(gpa);
    defer old_managed.deinit();
    _ = try old_managed.insert("old");
    try old_managed.write(io, worktree);
    try writeFixturePayload(io, worktree, "old", "", .regular);
    return target_id;
}

fn retainedTransactionContainsPrevious(io: std.Io, worktree: std.Io.Dir) !bool {
    var iterator = worktree.iterate();
    while (try iterator.next(io)) |entry| {
        if (entry.kind != .directory or !std.mem.startsWith(u8, entry.name, ".zit-update-txn-")) continue;
        var transaction = try worktree.openDir(io, entry.name, .{ .access_sub_paths = true, .follow_symlinks = false });
        defer transaction.close(io);
        var previous = transaction.openDir(io, "previous", .{ .access_sub_paths = true, .follow_symlinks = false }) catch continue;
        defer previous.close(io);
        const old = previous.statFile(io, "old", .{ .follow_symlinks = false }) catch continue;
        if (old.kind == .file) return true;
    }
    return false;
}

test "update strict target and baseline failures leave the checkout untouched" {
    const t = std.testing;
    const Case = struct {
        kind: enum {
            target_missing,
            target_phantom,
            target_misnamed,
            target_non_manifest,
            baseline_missing,
            baseline_phantom,
            baseline_misnamed,
            baseline_non_manifest,
            baseline_delta,
        },
        expected: ApplyError,
    };
    const cases = [_]Case{
        .{ .kind = .target_missing, .expected = error.CheckinNotFound },
        .{ .kind = .target_phantom, .expected = error.CheckinContentMissing },
        .{ .kind = .target_misnamed, .expected = error.CheckinNameMismatch },
        .{ .kind = .target_non_manifest, .expected = error.TargetNotManifest },
        .{ .kind = .baseline_missing, .expected = error.BaselineNotFound },
        .{ .kind = .baseline_phantom, .expected = error.BaselineContentMissing },
        .{ .kind = .baseline_misnamed, .expected = error.BaselineNameMismatch },
        .{ .kind = .baseline_non_manifest, .expected = error.BaselineNotManifest },
        .{ .kind = .baseline_delta, .expected = error.BaselineIsDelta },
    };

    for (cases) |case| {
        var tmp = t.tmpDir(.{});
        defer tmp.cleanup();
        const io = t.io;
        var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
        defer raw_file.close(io);
        var file_storage = storage.FileStorage.init(io, raw_file, 0);
        var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
        defer log.deinit(t.allocator);
        try seedUntouchedWorktree(t.allocator, io, tmp.dir);
        var root_entries = try snapshotRootEntries(t.allocator, io, tmp.dir);
        defer root_entries.deinit(t.allocator);

        var target_id_buf: [64]u8 = undefined;
        var target_id: []const u8 = undefined;
        switch (case.kind) {
            .target_missing => target_id = "a" ** 40,
            .target_phantom => {
                target_id = "b" ** 40;
                var digest: [logstore.max_hash_len]u8 = undefined;
                _ = try log.intern(try decodeValidatedName(target_id, &digest));
            },
            .target_misnamed => {
                const expected_bytes = try completeTestArtifact(t.allocator, "D 2007-07-21T14:09:59\nF expected aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n");
                defer t.allocator.free(expected_bytes);
                target_id = artifact.artifactName(.sha1, expected_bytes, &target_id_buf);
                const actual_bytes = try completeTestArtifact(t.allocator, "D 2007-07-21T14:10:00\nF actual bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\n");
                defer t.allocator.free(actual_bytes);
                try putTestArtifact(&log, target_id, actual_bytes);
            },
            .target_non_manifest => {
                target_id = try putCompleteTestArtifact(t.allocator, &log, "D 2007-07-21T14:09:59\nT +branch aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa trunk\nU alice\n", &target_id_buf);
            },
            .baseline_missing => {
                target_id = try putDeltaTestTarget(t.allocator, &log, "c" ** 40, &target_id_buf);
            },
            .baseline_phantom => {
                const baseline_id = "d" ** 40;
                var digest: [logstore.max_hash_len]u8 = undefined;
                _ = try log.intern(try decodeValidatedName(baseline_id, &digest));
                target_id = try putDeltaTestTarget(t.allocator, &log, baseline_id, &target_id_buf);
            },
            .baseline_misnamed => {
                const expected_bytes = try completeTestArtifact(t.allocator, "D 2007-07-21T14:09:59\nF expected aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n");
                defer t.allocator.free(expected_bytes);
                var baseline_id_buf: [64]u8 = undefined;
                const baseline_id = artifact.artifactName(.sha1, expected_bytes, &baseline_id_buf);
                const actual_bytes = try completeTestArtifact(t.allocator, "D 2007-07-21T14:10:00\nF actual bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb\n");
                defer t.allocator.free(actual_bytes);
                try putTestArtifact(&log, baseline_id, actual_bytes);
                target_id = try putDeltaTestTarget(t.allocator, &log, baseline_id, &target_id_buf);
            },
            .baseline_non_manifest => {
                var baseline_id_buf: [64]u8 = undefined;
                const baseline_id = try putCompleteTestArtifact(t.allocator, &log, "D 2007-07-21T14:09:59\nT +branch aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa trunk\nU alice\n", &baseline_id_buf);
                target_id = try putDeltaTestTarget(t.allocator, &log, baseline_id, &target_id_buf);
            },
            .baseline_delta => {
                var baseline_id_buf: [64]u8 = undefined;
                const baseline_body = try std.fmt.allocPrint(t.allocator, "B {s}\nD 2007-07-21T14:09:59\nF inherited aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n", .{"e" ** 40});
                defer t.allocator.free(baseline_body);
                const baseline_id = try putCompleteTestArtifact(t.allocator, &log, baseline_body, &baseline_id_buf);
                target_id = try putDeltaTestTarget(t.allocator, &log, baseline_id, &target_id_buf);
            },
        }

        try t.expectError(case.expected, applyCheckin(t.allocator, io, tmp.dir, &log, target_id));
        try expectUntouchedWorktree(t.allocator, io, tmp.dir);
        try expectSameRootEntries(t.allocator, io, tmp.dir, &root_entries);
    }
}

test "update delta applies inherited replacements and deletions across multiple entries" {
    const t = std.testing;
    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    const io = t.io;

    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);

    var inherited_id_buf: [64]u8 = undefined;
    const inherited_id = try putTestPayload(&log, "inherited bytes", &inherited_id_buf);
    var original_id_buf: [64]u8 = undefined;
    const original_id = try putTestPayload(&log, "original bytes", &original_id_buf);
    var removed_id_buf: [64]u8 = undefined;
    const removed_id = try putTestPayload(&log, "removed bytes", &removed_id_buf);
    var replacement_id_buf: [64]u8 = undefined;
    const replacement_id = try putTestPayload(&log, "replacement bytes", &replacement_id_buf);

    const baseline_body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:09:59\nF inherited {s}\nF removed {s}\nF replaced {s}\n", .{
        inherited_id,
        removed_id,
        original_id,
    });
    defer t.allocator.free(baseline_body);
    var baseline_id_buf: [64]u8 = undefined;
    const baseline_id = try putCompleteTestArtifact(t.allocator, &log, baseline_body, &baseline_id_buf);

    const target_body = try std.fmt.allocPrint(t.allocator, "B {s}\nD 2007-07-21T14:10:00\nF removed\nF replaced {s}\nF unmatched\n", .{
        baseline_id,
        replacement_id,
    });
    defer t.allocator.free(target_body);
    var target_id_buf: [64]u8 = undefined;
    const target_id = try putCompleteTestArtifact(t.allocator, &log, target_body, &target_id_buf);

    try applyCheckin(t.allocator, io, tmp.dir, &log, target_id);
    try expectFileState(t.allocator, io, tmp.dir, "inherited", "inherited bytes", .regular);
    try expectFileState(t.allocator, io, tmp.dir, "replaced", "replacement bytes", .regular);
    try t.expectError(error.FileNotFound, tmp.dir.statFile(io, "removed", .{ .follow_symlinks = false }));
    try t.expectError(error.FileNotFound, tmp.dir.statFile(io, "unmatched", .{ .follow_symlinks = false }));

    var current_managed = try managed.ManagedSet.read(t.allocator, io, tmp.dir);
    defer current_managed.deinit();
    try t.expectEqual(@as(usize, 2), current_managed.iterate().len);
    try t.expect(current_managed.contains("inherited"));
    try t.expect(current_managed.contains("replaced"));
    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, tmp.dir, &checkout_buf)).?;
    try t.expectEqualStrings(target_id, state.version);
}

test "update non-ancestor control tags use persisted frame order over RID order" {
    const t = std.testing;
    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    const io = t.io;

    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);

    var target_payload_id_buf: [64]u8 = undefined;
    const target_payload_id = try putTestPayload(&log, "target bytes", &target_payload_id_buf);
    const target_body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:09:59\nF target {s}\n", .{target_payload_id});
    defer t.allocator.free(target_body);
    var target_id_buf: [64]u8 = undefined;
    const target_id = try putCompleteTestArtifact(t.allocator, &log, target_body, &target_id_buf);

    const RID_first_body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:10:00\nT +branch {s} rid-first\nU alice\n", .{target_id});
    defer t.allocator.free(RID_first_body);
    const RID_first_bytes = try completeTestArtifact(t.allocator, RID_first_body);
    defer t.allocator.free(RID_first_bytes);
    var RID_first_id_buf: [64]u8 = undefined;
    const RID_first_id = artifact.artifactName(.sha1, RID_first_bytes, &RID_first_id_buf);
    var RID_first_digest: [logstore.max_hash_len]u8 = undefined;
    const RID_first = try log.intern(try decodeValidatedName(RID_first_id, &RID_first_digest));

    const persisted_first_body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:10:00\nT +branch {s} persisted-first\nU alice\n", .{target_id});
    defer t.allocator.free(persisted_first_body);
    const persisted_first_bytes = try completeTestArtifact(t.allocator, persisted_first_body);
    defer t.allocator.free(persisted_first_bytes);
    var persisted_first_id_buf: [64]u8 = undefined;
    const persisted_first_id = artifact.artifactName(.sha1, persisted_first_bytes, &persisted_first_id_buf);
    try putTestArtifact(&log, persisted_first_id, persisted_first_bytes);
    var persisted_first_digest: [logstore.max_hash_len]u8 = undefined;
    const persisted_first = log.lookup(try decodeValidatedName(persisted_first_id, &persisted_first_digest)).?;
    try t.expect(RID_first < persisted_first);
    try putTestArtifact(&log, RID_first_id, RID_first_bytes);

    try applyCheckin(t.allocator, io, tmp.dir, &log, target_id);
    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, tmp.dir, &checkout_buf)).?;
    try t.expectEqualStrings("persisted-first", state.branch);
}

test "update applyCheckin rejects a non-manifest before checkout mutation" {
    const t = std.testing;
    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    const io = t.io;

    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);

    const payload = "ordinary blob, not a structural artifact";
    var id_buf: [64]u8 = undefined;
    const target_id = artifact.artifactName(.sha1, payload, &id_buf);
    var digest: [logstore.max_hash_len]u8 = undefined;
    const raw_digest = try decodeValidatedName(target_id, &digest);
    _ = try log.put(raw_digest, payload);

    try checkout.write(io, tmp.dir, .{ .version = "old", .branch = "trunk", .merge_parent = "", .special_op = "" });
    try t.expectError(error.TargetNotManifest, applyCheckin(t.allocator, io, tmp.dir, &log, target_id));

    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, tmp.dir, &checkout_buf)).?;
    try t.expectEqualStrings("old", state.version);
    try t.expectEqualStrings("trunk", state.branch);
}

test "update retains the staged rollback tree when inverse rollback fails" {
    const t = std.testing;
    const io = t.io;

    var probe_tmp = t.tmpDir(.{});
    defer probe_tmp.cleanup();
    var probe_raw_file = try probe_tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer probe_raw_file.close(io);
    var probe_storage = storage.FileStorage.init(io, probe_raw_file, 0);
    var probe_log = try logstore.LogStore.open(t.allocator, probe_storage.storageFile(), 0);
    defer probe_log.deinit(t.allocator);
    var probe_target_id_buf: [64]u8 = undefined;
    var probe_old_id_buf: [64]u8 = undefined;
    const probe_target_id = try setupRollbackFailureFixture(t.allocator, io, probe_tmp.dir, &probe_log, &probe_target_id_buf, &probe_old_id_buf);
    var probe_allocator = std.testing.FailingAllocator.init(t.allocator, .{});
    try applyCheckin(probe_allocator.allocator(), io, probe_tmp.dir, &probe_log, probe_target_id);
    const allocation_count = probe_allocator.alloc_index;
    try t.expect(allocation_count > 0);

    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);
    var target_id_buf: [64]u8 = undefined;
    var old_id_buf: [64]u8 = undefined;
    const target_id = try setupRollbackFailureFixture(t.allocator, io, tmp.dir, &log, &target_id_buf, &old_id_buf);

    var failing_allocator = std.testing.FailingAllocator.init(t.allocator, .{ .fail_index = allocation_count - 1 });
    try t.expectError(error.RollbackFailed, applyCheckin(failing_allocator.allocator(), io, tmp.dir, &log, target_id));
    try t.expect(failing_allocator.has_induced_failure);
    try t.expect(try retainedTransactionContainsPrevious(io, tmp.dir));
    try t.expect((try tmp.dir.statFile(io, "old", .{ .follow_symlinks = false })).kind == .file);
    try t.expectError(error.FileNotFound, tmp.dir.statFile(io, "new", .{ .follow_symlinks = false }));

    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, tmp.dir, &checkout_buf)).?;
    try t.expectEqualStrings(old_id_buf[0..40], state.version);
    var restored_managed = try managed.ManagedSet.read(t.allocator, io, tmp.dir);
    defer restored_managed.deinit();
    try t.expect(restored_managed.contains("old"));
}

test "update applyCheckin treats a present-but-unborn checkout record as a clean tree" {
    const t = std.testing;
    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    const io = t.io;

    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);

    const payload = "unborn-tree payload\n";
    var payload_id_buf: [64]u8 = undefined;
    const payload_id = try putTestPayload(&log, payload, &payload_id_buf);
    const body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:10:00\nF only.txt {s}\n", .{payload_id});
    defer t.allocator.free(body);
    var target_id_buf: [64]u8 = undefined;
    const target_id = try putCompleteTestArtifact(t.allocator, &log, body, &target_id_buf);

    // The exact bootstrap `init` writes and `clone` inherits: a checkout record
    // that is PRESENT but names no check-in, with no managed set beside it. The
    // e2e proves this state as clone actually produces it; this pins the
    // semantics at the layer that owns them, so a regression fails fast and
    // locally instead of only through a networked clone.
    try checkout.write(io, tmp.dir, .{ .version = "", .branch = "trunk", .merge_parent = "", .special_op = "" });

    try applyCheckin(t.allocator, io, tmp.dir, &log, target_id);

    try expectFileState(t.allocator, io, tmp.dir, "only.txt", payload, .regular);
    var checkout_buf: [checkout.max_ck_payload + 1]u8 = undefined;
    const state = (try checkout.read(io, tmp.dir, &checkout_buf)).?;
    try t.expectEqualStrings(target_id, state.version);
}

test "update applyCheckin still refuses an unborn record that has a managed set" {
    const t = std.testing;
    var tmp = t.tmpDir(.{});
    defer tmp.cleanup();
    const io = t.io;

    var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
    defer raw_file.close(io);
    var file_storage = storage.FileStorage.init(io, raw_file, 0);
    var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
    defer log.deinit(t.allocator);

    const payload = "unborn-tree payload\n";
    var payload_id_buf: [64]u8 = undefined;
    const payload_id = try putTestPayload(&log, payload, &payload_id_buf);
    const body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:10:00\nF only.txt {s}\n", .{payload_id});
    defer t.allocator.free(body);
    var target_id_buf: [64]u8 = undefined;
    const target_id = try putCompleteTestArtifact(t.allocator, &log, body, &target_id_buf);

    // An unborn record is only "clean" when nothing is managed. A record that
    // names no check-in but claims managed paths is incoherent state, not a
    // fresh clone — the tolerance added for clone must NOT swallow it.
    try checkout.write(io, tmp.dir, .{ .version = "", .branch = "trunk", .merge_parent = "", .special_op = "" });
    var set = managed.ManagedSet.init(t.allocator);
    defer set.deinit();
    _ = try set.insert("stray.txt");
    try set.write(io, tmp.dir);

    try t.expectError(error.WorktreeNotClean, applyCheckin(t.allocator, io, tmp.dir, &log, target_id));
}

test "update applyCheckin refuses an unborn record that claims a pending operation" {
    const t = std.testing;
    const io = t.io;

    // The other half of the unborn coherence rule: a record naming no check-in
    // cannot also carry a merge parent or a special operation, because both
    // describe work in progress against a check-in the record does not name.
    // An empty managed set alone does not make such a record a fresh clone.
    const cases = [_]checkout.CheckoutState{
        .{ .version = "", .branch = "trunk", .merge_parent = "b" ** 64, .special_op = "" },
        .{ .version = "", .branch = "trunk", .merge_parent = "", .special_op = "merge" },
    };
    for (cases) |state| {
        var tmp = t.tmpDir(.{});
        defer tmp.cleanup();

        var raw_file = try tmp.dir.createFile(io, "repo.zit", .{ .read = true });
        defer raw_file.close(io);
        var file_storage = storage.FileStorage.init(io, raw_file, 0);
        var log = try logstore.LogStore.open(t.allocator, file_storage.storageFile(), 0);
        defer log.deinit(t.allocator);

        const payload = "pending-op payload\n";
        var payload_id_buf: [64]u8 = undefined;
        const payload_id = try putTestPayload(&log, payload, &payload_id_buf);
        const body = try std.fmt.allocPrint(t.allocator, "D 2007-07-21T14:10:00\nF only.txt {s}\n", .{payload_id});
        defer t.allocator.free(body);
        var target_id_buf: [64]u8 = undefined;
        const target_id = try putCompleteTestArtifact(t.allocator, &log, body, &target_id_buf);

        try checkout.write(io, tmp.dir, state);
        try t.expectError(
            error.CurrentStateInvalid,
            applyCheckin(t.allocator, io, tmp.dir, &log, target_id),
        );
    }
}