zit 0.3.31

zit 0.3.31 makes landing accept merge exactly one branch tip, and lets a caller refuse the accept if that tip isn't the one it checked.

No artifact, tag namespace, sync message, or on-disk repository format changed.

landing accept merges the tip it read, once

A forge checks a landing — CI, a preflight — against a particular branch tip and then calls zit landing accept. If someone pushes to the branch in between, the accept merged the new tip, which nothing had checked.

That window was wider than the caller's side of it. accept read the branch tip up to three times: once to see whether it was already landed, once to probe whether it merged cleanly, and once more when the merge itself resolved the branch by name. So even a caller that re-read the tip immediately before calling could have a push arrive mid-accept and be merged without having been probed.

accept now reads the tip once, at the start, and merges that exact check-in by hash — from a checkout and on a bare store with -R alike. Later pushes stay on the branch, unlanded. This protects every caller, whether or not it uses the new flag.

--expect-tip HASH

A caller that checked a tip names it:

zit landing accept ID -R store --user NAME --expect-tip HASH

If the branch isn't at HASH, the accept is refused with exit status 6 and nothing is written:

zit landing: branch feat/x is at CURRENT, not HASH; nothing was written

Exit 6 is its own status so a caller can tell "the branch moved; check the new tip and ask again" apart from exit 5 (conflicts, which need a human) and exit 1 (an error). The flag is refused on the other landing subcommands. Without it, accept behaves as before, except that it now merges a single tip read.

zit merge needs no such flag: it already accepts an exact hash as NAME.

Compatibility

• No on-disk repository or wire format changed; Fossil RFC revision 00 remains the target.
• zit landing accept gains --expect-tip HASH and exit status 6.
• A push that lands on a branch while it is being accepted is no longer merged by that accept; it stays on the branch.

Qualification

zig fmt --check, zig build test, e2e, smoke, git-import-e2e, git-export-e2e, and dst, plus the three-runner CI battery.