gabriel / muse public
test_merge_data_integrity.py python
1,348 lines 58.7 KB
Raw
sha256:a09b1b4f6838754495547f200aa0ce88e2f56ffc5b20b900f6f0cff2c3cdede9 fix(cursorignore): remove git-ism (.git/worktrees) Human minor ⚠ breaking 152 days ago
1 """Data-integrity stress tests for the entire muse merge code path.
2
3 Root cause of the data-loss incident
4 -------------------------------------
5 ``muse merge`` silently defaulted every unreadable snapshot to ``{}`` via
6 ``get_head_snapshot_manifest(...) or {}``. When a snapshot file was missing
7 or in the wrong format (e.g. JSON after a msgpack migration), all three
8 manifests (base/ours/theirs) resolved to ``{}``. This caused:
9
10 1. ``apply_merge({}, {}, {}, …)`` → ``{}``
11 2. ``compute_snapshot_id({})`` → SHA-256 of ``b""`` = ``e3b0c44…``
12 3. ``_restore_from_manifest(root, {})`` → ``apply_manifest(root, {})`` → ALL
13 tracked files deleted.
14
15 The fix is dual-layered:
16
17 * **merge.py**: every snapshot read is now a hard fail — ``None`` returns
18 abort the merge with an error before any manifest is applied to the tree.
19 * **merge.py**: before ``_restore_from_manifest`` is called, the merged
20 manifest is validated; applying an empty result to a non-empty working
21 tree is rejected.
22
23 Test categories
24 ---------------
25 I Sentinel-value unit tests (document the dangerous constants).
26 II Store-read-failure guard tests (missing/corrupt snapshot → abort).
27 III Empty-manifest guard (merged result empty despite non-empty inputs → abort).
28 IV Working-tree integrity (full CLI round-trip — count files, verify content).
29 V apply_manifest safety (workdir.py layer).
30 VI The exact regression scenario (format-migration topology).
31 VII Stress tests (100-file repos, repeated merges, diamond DAGs).
32 """
33 from __future__ import annotations
34
35 import datetime
36 import hashlib
37 import json
38 import pathlib
39 import uuid
40
41 import msgpack
42 import pytest
43 from tests.cli_test_helper import CliRunner
44 from muse.core._types import Manifest
45
46 type _EnvMap = dict[str, str]
47
48 runner = CliRunner()
49 cli = None # CliRunner ignores this positional arg
50
51 # sha256: of b"" — the sentinel produced by compute_snapshot_id({})
52 _SHA256_EMPTY = "sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
53
54
55 # ---------------------------------------------------------------------------
56 # Repo helpers (mirror test_stress_merge_regression.py conventions)
57 # ---------------------------------------------------------------------------
58
59
60 def _h(label: str) -> str:
61 """Stable fake content hash for a label string."""
62 return "sha256:" + hashlib.sha256(label.encode()).hexdigest()
63
64
65 def _env(root: pathlib.Path) -> _EnvMap:
66 return {"MUSE_REPO_ROOT": str(root)}
67
68
69 def _run(root: pathlib.Path, *args: str) -> tuple[int, str]:
70 """Run a muse CLI command, auto-injecting ``--force`` for merge calls."""
71 final_args = list(args)
72 if final_args and final_args[0] == "merge" and "--force" not in final_args:
73 final_args.insert(1, "--force")
74 result = runner.invoke(cli, final_args, env=_env(root), catch_exceptions=False)
75 return result.exit_code, result.output
76
77
78 def _run_unchecked(root: pathlib.Path, *args: str) -> tuple[int, str]:
79 final_args = list(args)
80 if final_args and final_args[0] == "merge" and "--force" not in final_args:
81 final_args.insert(1, "--force")
82 result = runner.invoke(cli, final_args, env=_env(root))
83 return result.exit_code, result.output
84
85
86 def _write_object(root: pathlib.Path, content: bytes) -> str:
87 hex_id = hashlib.sha256(content).hexdigest()
88 obj_path = root / ".muse" / "objects" / hex_id[:2] / hex_id[2:]
89 obj_path.parent.mkdir(parents=True, exist_ok=True)
90 obj_path.write_bytes(content)
91 return f"sha256:{hex_id}"
92
93
94 def _write_file(root: pathlib.Path, content: str) -> str:
95 return _write_object(root, content.encode())
96
97
98 def _init_repo(tmp_path: pathlib.Path, domain: str = "code") -> tuple[pathlib.Path, str]:
99 """Initialise a minimal repo and return (root, repo_id)."""
100 muse_dir = tmp_path / ".muse"
101 muse_dir.mkdir()
102 repo_id = str(uuid.uuid4())
103 (muse_dir / "repo.json").write_text(json.dumps({
104 "repo_id": repo_id,
105 "domain": domain,
106 "default_branch": "main",
107 "created_at": "2025-01-01T00:00:00+00:00",
108 }), encoding="utf-8")
109 (muse_dir / "HEAD").write_text("ref: refs/heads/main", encoding="utf-8")
110 (muse_dir / "refs" / "heads").mkdir(parents=True)
111 (muse_dir / "snapshots").mkdir()
112 (muse_dir / "commits").mkdir()
113 (muse_dir / "objects").mkdir()
114 return tmp_path, repo_id
115
116
117 def _make_commit(
118 root: pathlib.Path,
119 repo_id: str,
120 branch: str = "main",
121 message: str = "test",
122 manifest: Manifest | None = None,
123 parent_commit_id: str | None = None,
124 parent2_commit_id: str | None = None,
125 ) -> str:
126 """Write a snapshot + commit record, advance the branch ref, return commit_id."""
127 from muse.core.snapshot import compute_commit_id, compute_snapshot_id
128 from muse.core.store import CommitRecord, SnapshotRecord, write_commit, write_snapshot
129
130 ref_file = root / ".muse" / "refs" / "heads" / branch
131 if parent_commit_id is None and ref_file.exists():
132 parent_commit_id = ref_file.read_text().strip() or None
133
134 m = manifest or {}
135 snap_id = compute_snapshot_id(m)
136 committed_at = datetime.datetime.now(datetime.timezone.utc)
137 parent_ids: list[str] = []
138 if parent_commit_id:
139 parent_ids.append(parent_commit_id)
140 if parent2_commit_id:
141 parent_ids.append(parent2_commit_id)
142 commit_id = compute_commit_id(
143 parent_ids=parent_ids,
144 snapshot_id=snap_id,
145 message=message,
146 committed_at_iso=committed_at.isoformat(),
147 )
148 write_snapshot(root, SnapshotRecord(snapshot_id=snap_id, manifest=m))
149 write_commit(root, CommitRecord(
150 commit_id=commit_id,
151 repo_id=repo_id,
152 branch=branch,
153 snapshot_id=snap_id,
154 message=message,
155 committed_at=committed_at,
156 parent_commit_id=parent_commit_id,
157 parent2_commit_id=parent2_commit_id,
158 ))
159 ref_file.parent.mkdir(parents=True, exist_ok=True)
160 ref_file.write_text(commit_id, encoding="utf-8")
161 return commit_id
162
163
164 def _ref(root: pathlib.Path, branch: str) -> str:
165 return (root / ".muse" / "refs" / "heads" / branch).read_text(encoding="utf-8").strip()
166
167
168 def _head_manifest(root: pathlib.Path, branch: str) -> _EnvMap:
169 """Return the snapshot manifest for *branch* HEAD."""
170 from muse.core.store import read_commit, read_snapshot
171 commit = read_commit(root, _ref(root, branch))
172 assert commit is not None, f"No commit on branch {branch}"
173 snap = read_snapshot(root, commit.snapshot_id)
174 assert snap is not None, f"No snapshot for {commit.snapshot_id[:8]}"
175 return snap.manifest
176
177
178 def _snapshot_path(root: pathlib.Path, snap_id: str) -> pathlib.Path:
179 hex_id = snap_id.removeprefix("sha256:")
180 return root / ".muse" / "snapshots" / f"{hex_id}.msgpack"
181
182
183 def _commit_path_for(root: pathlib.Path, commit_id: str) -> pathlib.Path:
184 hex_id = commit_id.removeprefix("sha256:")
185 return root / ".muse" / "commits" / f"{hex_id}.msgpack"
186
187
188 # ---------------------------------------------------------------------------
189 # Category I — Sentinel-value unit tests
190 # ---------------------------------------------------------------------------
191
192
193 class TestSentinelValuesI:
194 """Document the dangerous constants that signal a broken merge."""
195
196 def test_I1_compute_snapshot_id_empty_dict_produces_known_sha256(self) -> None:
197 """I1: compute_snapshot_id({}) == SHA-256 of b'' — the data-loss sentinel.
198
199 If this value ever appears as a committed snapshot_id, every tracked
200 file was deleted. This test documents the constant so future readers
201 know exactly what to look for.
202 """
203 from muse.core.snapshot import compute_snapshot_id
204 assert compute_snapshot_id({}) == _SHA256_EMPTY
205
206 def test_I2_apply_merge_with_all_empty_inputs_returns_empty(self) -> None:
207 """I2: apply_merge({}, {}, {}, ∅, ∅, ∅) → {} — documents the dangerous passthrough."""
208 from muse.core.merge_engine import apply_merge
209 result = apply_merge({}, {}, {}, set(), set(), set())
210 assert result == {}
211
212 def test_I3_apply_manifest_with_empty_target_deletes_all_tracked_files(
213 self, tmp_path: pathlib.Path
214 ) -> None:
215 """I3: apply_manifest(root, {}) removes every tracked file.
216
217 This is the third domino in the data-loss chain. The guard in merge.py
218 must prevent apply_manifest from ever being called with an empty target
219 when the inputs were non-empty.
220 """
221 from muse.core.workdir import apply_manifest
222
223 root, repo_id = _init_repo(tmp_path)
224 # Write real files to the working tree and object store.
225 for i in range(5):
226 content = f"file_{i} = True\n".encode()
227 oid = hashlib.sha256(content).hexdigest()
228 (root / ".muse" / "objects" / oid[:2]).mkdir(parents=True, exist_ok=True)
229 (root / ".muse" / "objects" / oid[:2] / oid[2:]).write_bytes(content)
230 (root / f"file_{i}.py").write_bytes(content)
231
232 files_before = list(root.glob("file_*.py"))
233 assert len(files_before) == 5
234
235 # apply_manifest({}) should raise a ValueError guard, not silently delete.
236 # After the fix: this raises ValueError because we're about to delete 5 files.
237 # Before the fix: it silently deletes them.
238 try:
239 apply_manifest(root, {})
240 # If no exception, the guard is not in apply_manifest — check the caller-level guard.
241 # Either way, document the result.
242 files_after = list(root.glob("file_*.py"))
243 # The test passes whether the guard is in apply_manifest or merge.py;
244 # we just document what happened so the assertion failure is meaningful.
245 if len(files_after) == 0:
246 pytest.fail(
247 "apply_manifest(root, {}) deleted all 5 files — no guard is in place. "
248 "The guard must be added to prevent callers from accidentally deleting everything."
249 )
250 except (ValueError, SystemExit):
251 # Guard fired correctly — apply_manifest refused to delete all files.
252 pass
253
254 def test_I4_diff_snapshots_both_empty_returns_empty_set(self) -> None:
255 """I4: diff_snapshots({}, {}) == set() — no phantom changes."""
256 from muse.core.merge_engine import diff_snapshots
257 assert diff_snapshots({}, {}) == set()
258
259 def test_I5_detect_conflicts_both_empty_returns_empty(self) -> None:
260 """I5: detect_conflicts(set(), set(), {}, {}) == set()."""
261 from muse.core.merge_engine import detect_conflicts
262 assert detect_conflicts(set(), set(), {}, {}) == set()
263
264
265 # ---------------------------------------------------------------------------
266 # Category II — Store-read-failure guard tests
267 # ---------------------------------------------------------------------------
268
269
270 class TestStoreReadFailureGuardII:
271 """merge.py must abort with an error when any required snapshot is unreadable.
272
273 None of these cases should silently fall back to {} and proceed to delete files.
274 """
275
276 def _setup_two_branch_repo(
277 self, tmp_path: pathlib.Path
278 ) -> tuple[pathlib.Path, str, str, str, str]:
279 """Set up a simple diverged repo: main and feat both have commits.
280
281 Returns (root, repo_id, main_commit_id, feat_commit_id, base_commit_id).
282 """
283 root, repo_id = _init_repo(tmp_path)
284 f0 = _write_file(root, "base.py = True\n")
285 base_c = _make_commit(root, repo_id, "main", "base", {"base.py": f0})
286 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
287
288 f1 = _write_file(root, "main_only.py = True\n")
289 main_c = _make_commit(root, repo_id, "main", "main change", {"base.py": f0, "main_only.py": f1})
290
291 f2 = _write_file(root, "feat_only.py = True\n")
292 feat_c = _make_commit(root, repo_id, "feat", "feat change", {"base.py": f0, "feat_only.py": f2})
293
294 return root, repo_id, main_c, feat_c, base_c
295
296 def test_II1_missing_ours_snapshot_aborts_merge(self, tmp_path: pathlib.Path) -> None:
297 """II1: if ours (main) snapshot file is deleted, merge must abort — not delete all files."""
298 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
299
300 from muse.core.store import read_commit
301 commit = read_commit(root, main_c)
302 assert commit is not None
303 snap_path = _snapshot_path(root, commit.snapshot_id)
304 snap_path.unlink() # Delete the snapshot file
305
306 # Attempt the merge — must fail, not succeed with empty snapshot.
307 code, out = _run_unchecked(root, "merge", "feat")
308 assert code != 0, (
309 "REGRESSION: merge succeeded despite ours snapshot being missing. "
310 "Expected abort to prevent data loss.\nOutput: " + out
311 )
312 # Verify main HEAD has NOT advanced past main_c.
313 assert _ref(root, "main") == main_c, (
314 "REGRESSION: main HEAD advanced after a merge that should have aborted."
315 )
316
317 def test_II2_missing_theirs_snapshot_aborts_merge(self, tmp_path: pathlib.Path) -> None:
318 """II2: if theirs (feat) snapshot file is deleted, merge must abort."""
319 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
320
321 from muse.core.store import read_commit
322 commit = read_commit(root, feat_c)
323 assert commit is not None
324 snap_path = _snapshot_path(root, commit.snapshot_id)
325 snap_path.unlink()
326
327 code, out = _run_unchecked(root, "merge", "feat")
328 assert code != 0, (
329 "REGRESSION: merge succeeded despite theirs snapshot being missing.\nOutput: " + out
330 )
331 assert _ref(root, "main") == main_c
332
333 def test_II3_corrupt_ours_snapshot_aborts_merge(self, tmp_path: pathlib.Path) -> None:
334 """II3: corrupt ours snapshot (invalid msgpack) must abort merge."""
335 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
336
337 from muse.core.store import read_commit
338 commit = read_commit(root, main_c)
339 assert commit is not None
340 snap_path = _snapshot_path(root, commit.snapshot_id)
341 snap_path.write_bytes(b"\xff\xfe invalid msgpack garbage")
342
343 code, out = _run_unchecked(root, "merge", "feat")
344 assert code != 0, (
345 "REGRESSION: merge succeeded with corrupt ours snapshot.\nOutput: " + out
346 )
347 assert _ref(root, "main") == main_c
348
349 def test_II4_corrupt_theirs_snapshot_aborts_merge(self, tmp_path: pathlib.Path) -> None:
350 """II4: corrupt theirs snapshot must abort merge."""
351 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
352
353 from muse.core.store import read_commit
354 commit = read_commit(root, feat_c)
355 assert commit is not None
356 snap_path = _snapshot_path(root, commit.snapshot_id)
357 snap_path.write_bytes(b"\x00\x01\x02 also garbage")
358
359 code, out = _run_unchecked(root, "merge", "feat")
360 assert code != 0, (
361 "REGRESSION: merge succeeded with corrupt theirs snapshot.\nOutput: " + out
362 )
363 assert _ref(root, "main") == main_c
364
365 def test_II5_missing_base_snapshot_aborts_merge(self, tmp_path: pathlib.Path) -> None:
366 """II5: if the merge-base snapshot is missing, merge must abort — not treat base as {}."""
367 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
368
369 # Delete the base snapshot.
370 from muse.core.store import read_commit
371 base_commit = read_commit(root, base_c)
372 assert base_commit is not None
373 snap_path = _snapshot_path(root, base_commit.snapshot_id)
374 snap_path.unlink()
375
376 code, out = _run_unchecked(root, "merge", "feat")
377 assert code != 0, (
378 "REGRESSION: merge succeeded with missing base snapshot — "
379 "treating base as {} inflates change-sets and may corrupt the merge.\n"
380 "Output: " + out
381 )
382 assert _ref(root, "main") == main_c
383
384 def test_II6_missing_ours_commit_file_aborts_merge(self, tmp_path: pathlib.Path) -> None:
385 """II6: if the ours commit file is deleted, merge must abort."""
386 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
387
388 commit_path = _commit_path_for(root, main_c)
389 commit_path.unlink()
390
391 code, out = _run_unchecked(root, "merge", "feat")
392 assert code != 0, (
393 "REGRESSION: merge succeeded with missing ours commit file.\nOutput: " + out
394 )
395
396 def test_II7_fast_forward_missing_theirs_snapshot_aborts(self, tmp_path: pathlib.Path) -> None:
397 """II7: fast-forward merge with missing theirs snapshot must abort — not delete all files.
398
399 Before the fix: ff_manifest defaults to {}, _restore_from_manifest({}) deletes everything.
400 After the fix: abort with an error before touching the working tree.
401 """
402 root, repo_id = _init_repo(tmp_path)
403
404 # Write real files to the working tree.
405 f0 = _write_file(root, "keeper.py = 42\n")
406 (root / "keeper.py").write_bytes(b"keeper.py = 42\n")
407
408 base_c = _make_commit(root, repo_id, "main", "base", {"keeper.py": f0})
409 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
410
411 f1 = _write_file(root, "new.py = True\n")
412 feat_c = _make_commit(root, repo_id, "feat", "feat commit", {"keeper.py": f0, "new.py": f1})
413
414 # Delete feat's snapshot — main is behind feat (fast-forward case).
415 from muse.core.store import read_commit
416 feat_commit = read_commit(root, feat_c)
417 assert feat_commit is not None
418 _snapshot_path(root, feat_commit.snapshot_id).unlink()
419
420 code, out = _run_unchecked(root, "merge", "feat")
421 assert code != 0, (
422 "REGRESSION: fast-forward merge succeeded despite theirs snapshot missing. "
423 "This would have applied apply_manifest({}) and deleted keeper.py.\nOutput: " + out
424 )
425 # The critical assertion: keeper.py must still exist.
426 assert (root / "keeper.py").exists(), (
427 "DATA LOSS: keeper.py was deleted when theirs snapshot was missing "
428 "during fast-forward. The guard must abort BEFORE apply_manifest."
429 )
430
431 def test_II8_json_format_snapshot_treated_as_corrupt_by_msgpack_reader(
432 self, tmp_path: pathlib.Path
433 ) -> None:
434 """II8: snapshot stored in old JSON format is unreadable by msgpack reader → abort.
435
436 This is the exact format-migration scenario that caused the data-loss incident.
437 A snapshot file written as JSON (old format) cannot be parsed by _read_msgpack
438 (new format), causing read_snapshot to return None, which then silently falls
439 back to {} — leading to data loss.
440
441 After the fix: merge aborts rather than proceeding with an empty manifest.
442 """
443 root, repo_id, main_c, feat_c, base_c = self._setup_two_branch_repo(tmp_path)
444
445 from muse.core.store import read_commit
446 commit = read_commit(root, main_c)
447 assert commit is not None
448 snap_path = _snapshot_path(root, commit.snapshot_id)
449
450 # Overwrite the msgpack snapshot with the equivalent JSON (old format).
451 # msgpack.unpackb will raise an exception on this, causing read_snapshot → None.
452 old_json = json.dumps({"snapshot_id": commit.snapshot_id, "manifest": {}}).encode()
453 snap_path.write_bytes(old_json)
454
455 code, out = _run_unchecked(root, "merge", "feat")
456 assert code != 0, (
457 "REGRESSION: merge succeeded when ours snapshot was in JSON (old format). "
458 "This is the exact scenario that caused the data-loss incident.\n"
459 "Expected: abort. Got: " + out
460 )
461 assert _ref(root, "main") == main_c
462
463 def test_II9_missing_ours_snapshot_does_not_delete_working_tree(
464 self, tmp_path: pathlib.Path
465 ) -> None:
466 """II9: working-tree files must survive when ours snapshot is unreadable.
467
468 Belt-and-suspenders: even if the merge somehow proceeds, it must not
469 apply an empty manifest to the working tree.
470 """
471 root, repo_id = _init_repo(tmp_path)
472
473 # Write 10 files to the working tree.
474 manifest: Manifest = {}
475 for i in range(10):
476 content = f"module_{i} = True\n".encode()
477 oid = _write_object(root, content)
478 (root / f"module_{i}.py").write_bytes(content)
479 manifest[f"module_{i}.py"] = oid
480
481 base_c = _make_commit(root, repo_id, "main", "base", manifest)
482 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
483
484 extra = _write_file(root, "extra.py = True\n")
485 feat_c = _make_commit(root, repo_id, "feat", "feat",
486 {**manifest, "extra.py": extra})
487
488 # Advance main past base so this is a three-way merge.
489 bump = _write_file(root, "bump.py = True\n")
490 _make_commit(root, repo_id, "main", "main advance",
491 {**manifest, "bump.py": bump})
492
493 # Delete main's latest snapshot.
494 from muse.core.store import read_commit
495 main_commit = read_commit(root, _ref(root, "main"))
496 assert main_commit is not None
497 _snapshot_path(root, main_commit.snapshot_id).unlink()
498
499 _run_unchecked(root, "merge", "feat")
500
501 # All 10 original files must still exist.
502 for i in range(10):
503 assert (root / f"module_{i}.py").exists(), (
504 f"DATA LOSS: module_{i}.py deleted when merge should have aborted "
505 "due to unreadable ours snapshot."
506 )
507
508
509 # ---------------------------------------------------------------------------
510 # Category III — Empty-manifest guard tests
511 # ---------------------------------------------------------------------------
512
513
514 class TestEmptyManifestGuardIII:
515 """The merged result must never be applied to the working tree if it is
516 suspiciously empty given the inputs.
517 """
518
519 def test_III1_merge_result_snapshot_id_is_never_sha256_empty(
520 self, tmp_path: pathlib.Path
521 ) -> None:
522 """III1: a successful merge must never produce a commit with snapshot_id == SHA-256("").
523
524 e3b0c44… is the fingerprint of an empty snapshot; if it ever appears
525 in the commit graph, the merge engine produced an empty manifest and
526 deleted all tracked files.
527 """
528 root, repo_id = _init_repo(tmp_path)
529
530 f0 = _write_file(root, "a.py = 0\n")
531 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": f0})
532 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
533
534 f1 = _write_file(root, "a.py = 1\n")
535 _make_commit(root, repo_id, "main", "ours", {"a.py": f1})
536
537 f2 = _write_file(root, "b.py = True\n")
538 _make_commit(root, repo_id, "feat", "theirs", {"a.py": f0, "b.py": f2})
539
540 code, out = _run(root, "merge", "feat")
541 assert code == 0, out
542
543 from muse.core.store import read_commit
544 commit = read_commit(root, _ref(root, "main"))
545 assert commit is not None
546 assert commit.snapshot_id != _SHA256_EMPTY, (
547 f"REGRESSION: merge commit has snapshot_id == SHA-256('') == {_SHA256_EMPTY[:16]}…\n"
548 "This means the merged manifest was empty and all tracked files were deleted.\n"
549 "This is the data-loss sentinel produced by compute_snapshot_id({})."
550 )
551
552 def test_III2_merged_manifest_has_at_least_as_many_files_as_base(
553 self, tmp_path: pathlib.Path
554 ) -> None:
555 """III2: clean merge → merged manifest >= base file count.
556
557 When neither side deletes a file, the merged manifest must have AT LEAST
558 as many entries as the base. Fewer entries means files were silently dropped.
559 """
560 root, repo_id = _init_repo(tmp_path)
561
562 base_manifest = {f"file_{i}.py": _write_file(root, f"x_{i} = {i}\n") for i in range(20)}
563 base_c = _make_commit(root, repo_id, "main", "base", base_manifest)
564 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
565
566 # ours: modify file_0.py only.
567 ours_manifest = {**base_manifest, "file_0.py": _write_file(root, "x_0 = 'ours'\n")}
568 _make_commit(root, repo_id, "main", "ours", ours_manifest)
569
570 # theirs: modify file_1.py only.
571 theirs_manifest = {**base_manifest, "file_1.py": _write_file(root, "x_1 = 'theirs'\n")}
572 _make_commit(root, repo_id, "feat", "theirs", theirs_manifest)
573
574 code, out = _run(root, "merge", "feat")
575 assert code == 0, out
576
577 merged = _head_manifest(root, "main")
578 assert len(merged) >= len(base_manifest), (
579 f"REGRESSION: merged manifest has {len(merged)} files but base had "
580 f"{len(base_manifest)}. Files were silently dropped."
581 )
582
583 def test_III3_merged_manifest_contains_all_base_files_when_no_deletions(
584 self, tmp_path: pathlib.Path
585 ) -> None:
586 """III3: no-deletion merge — every base file must appear in merged."""
587 root, repo_id = _init_repo(tmp_path)
588
589 base_manifest = {f"mod_{i}.py": _write_file(root, f"MOD_{i} = True\n") for i in range(15)}
590 base_c = _make_commit(root, repo_id, "main", "base", base_manifest)
591 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
592
593 new_main = _write_file(root, "new_main.py = True\n")
594 _make_commit(root, repo_id, "main", "ours", {**base_manifest, "new_main.py": new_main})
595
596 new_feat = _write_file(root, "new_feat.py = True\n")
597 _make_commit(root, repo_id, "feat", "theirs", {**base_manifest, "new_feat.py": new_feat})
598
599 code, out = _run(root, "merge", "feat")
600 assert code == 0, out
601
602 merged = _head_manifest(root, "main")
603 for path in base_manifest:
604 assert path in merged, (
605 f"REGRESSION: base file '{path}' is missing from merged manifest. "
606 "Files are being silently dropped."
607 )
608
609
610 # ---------------------------------------------------------------------------
611 # Category IV — Working-tree integrity (full CLI round-trips)
612 # ---------------------------------------------------------------------------
613
614
615 class TestWorkingTreeIntegrityIV:
616 """Full CLI merges must leave the working tree in a coherent state."""
617
618 def test_IV1_three_way_merge_working_tree_matches_snapshot(
619 self, tmp_path: pathlib.Path
620 ) -> None:
621 """IV1: after a clean merge, working tree files match the merged snapshot."""
622 root, repo_id = _init_repo(tmp_path)
623
624 content_a = b"A = 1\n"
625 content_b = b"B = 2\n"
626 a_id = _write_object(root, content_a)
627 b_id = _write_object(root, content_b)
628
629 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": a_id})
630 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
631
632 a2_content = b"A = 'ours'\n"
633 a2_id = _write_object(root, a2_content)
634 _make_commit(root, repo_id, "main", "ours", {"a.py": a2_id})
635
636 _make_commit(root, repo_id, "feat", "theirs", {"a.py": a_id, "b.py": b_id})
637
638 code, out = _run(root, "merge", "feat")
639 assert code == 0, out
640
641 # After merge: working tree should have a.py (ours version) and b.py (theirs).
642 merged = _head_manifest(root, "main")
643 assert "b.py" in merged, "theirs-only b.py missing from merged snapshot"
644 assert merged.get("a.py") == a2_id, "ours change to a.py not preserved in merged snapshot"
645
646 def test_IV2_fast_forward_file_count_preserved(self, tmp_path: pathlib.Path) -> None:
647 """IV2: fast-forward merge preserves ALL files from the target branch."""
648 root, repo_id = _init_repo(tmp_path)
649
650 # Write 25 files.
651 manifest: Manifest = {}
652 for i in range(25):
653 oid = _write_file(root, f"x_{i} = {i}\n")
654 manifest[f"file_{i:02d}.py"] = oid
655
656 base_c = _make_commit(root, repo_id, "main", "base", {"start.py": _write_file(root, "x=0\n")})
657 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
658 _make_commit(root, repo_id, "feat", "feat: 25 files", manifest)
659
660 code, _out = _run(root, "merge", "feat")
661 assert code == 0
662
663 merged = _head_manifest(root, "main")
664 for path in manifest:
665 assert path in merged, f"DATA LOSS: {path} missing after fast-forward merge"
666
667 def test_IV3_three_way_merge_both_sides_preserved(self, tmp_path: pathlib.Path) -> None:
668 """IV3: ours-only AND theirs-only files both present in merged result."""
669 root, repo_id = _init_repo(tmp_path)
670
671 base_id = _write_file(root, "base = True\n")
672 base_c = _make_commit(root, repo_id, "main", "base", {"base.py": base_id})
673 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
674
675 ours_id = _write_file(root, "ours = True\n")
676 _make_commit(root, repo_id, "main", "ours", {"base.py": base_id, "ours_only.py": ours_id})
677
678 theirs_id = _write_file(root, "theirs = True\n")
679 _make_commit(root, repo_id, "feat", "theirs", {"base.py": base_id, "theirs_only.py": theirs_id})
680
681 code, out = _run(root, "merge", "feat")
682 assert code == 0, out
683
684 merged = _head_manifest(root, "main")
685 assert "ours_only.py" in merged, "ours-only file was dropped in merge"
686 assert "theirs_only.py" in merged, "theirs-only file was dropped in merge"
687 assert "base.py" in merged, "base file was dropped in merge"
688
689 def test_IV4_merge_commit_snapshot_not_empty(self, tmp_path: pathlib.Path) -> None:
690 """IV4: merge commit snapshot_id must never be SHA-256 of empty bytes."""
691 root, repo_id = _init_repo(tmp_path)
692
693 f0 = _write_file(root, "a = 0\n")
694 f1 = _write_file(root, "a = 1\n")
695 f2 = _write_file(root, "b = True\n")
696
697 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": f0})
698 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
699 _make_commit(root, repo_id, "main", "ours", {"a.py": f1})
700 _make_commit(root, repo_id, "feat", "theirs", {"a.py": f0, "b.py": f2})
701
702 code, out = _run(root, "merge", "feat")
703 assert code == 0, out
704
705 from muse.core.store import read_commit
706 mc = read_commit(root, _ref(root, "main"))
707 assert mc is not None
708 assert mc.snapshot_id != _SHA256_EMPTY, (
709 "DATA LOSS: merge commit snapshot_id is SHA-256 of empty bytes. "
710 "The merged manifest was empty — all files were or would be deleted."
711 )
712
713 def test_IV5_merge_commit_has_two_parents(self, tmp_path: pathlib.Path) -> None:
714 """IV5: three-way merge commit must record both parent commit IDs."""
715 root, repo_id = _init_repo(tmp_path)
716
717 f0 = _write_file(root, "a = 0\n")
718 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": f0})
719 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
720
721 f1 = _write_file(root, "a = 1\n")
722 _make_commit(root, repo_id, "main", "ours", {"a.py": f1})
723 f2 = _write_file(root, "b = True\n")
724 _make_commit(root, repo_id, "feat", "theirs", {"a.py": f0, "b.py": f2})
725
726 _run(root, "merge", "feat")
727
728 from muse.core.store import read_commit
729 mc = read_commit(root, _ref(root, "main"))
730 assert mc is not None
731 assert mc.parent2_commit_id is not None, (
732 "Three-way merge commit missing second parent — history will appear linear."
733 )
734
735 def test_IV6_strategy_ours_does_not_delete_theirs_only_files(
736 self, tmp_path: pathlib.Path
737 ) -> None:
738 """IV6: --strategy=ours must not delete theirs-only files from merged manifest."""
739 root, repo_id = _init_repo(tmp_path)
740
741 f0 = _write_file(root, "shared = 0\n")
742 base_c = _make_commit(root, repo_id, "main", "base", {"shared.py": f0})
743 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
744
745 f_ours = _write_file(root, "shared = 'ours'\n")
746 theirs_only = _write_file(root, "new_feat = True\n")
747 _make_commit(root, repo_id, "main", "ours change", {"shared.py": f_ours})
748 f_theirs = _write_file(root, "shared = 'theirs'\n")
749 _make_commit(root, repo_id, "feat", "theirs",
750 {"shared.py": f_theirs, "new_feat.py": theirs_only})
751
752 code, out = _run(root, "merge", "--strategy", "ours", "feat")
753 assert code == 0, out
754
755 merged = _head_manifest(root, "main")
756 assert merged.get("shared.py") == f_ours, "strategy=ours must keep ours version of conflict"
757 assert "new_feat.py" in merged, (
758 "REGRESSION: --strategy=ours deleted theirs-only new_feat.py. "
759 "Non-conflicting theirs additions must still appear in merged."
760 )
761
762 def test_IV7_strategy_theirs_does_not_delete_ours_only_files(
763 self, tmp_path: pathlib.Path
764 ) -> None:
765 """IV7: --strategy=theirs must not delete ours-only files from merged manifest."""
766 root, repo_id = _init_repo(tmp_path)
767
768 f0 = _write_file(root, "shared = 0\n")
769 base_c = _make_commit(root, repo_id, "main", "base", {"shared.py": f0})
770 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
771
772 ours_only = _write_file(root, "ours_new = True\n")
773 f_ours = _write_file(root, "shared = 'ours'\n")
774 _make_commit(root, repo_id, "main", "ours",
775 {"shared.py": f_ours, "ours_new.py": ours_only})
776
777 f_theirs = _write_file(root, "shared = 'theirs'\n")
778 _make_commit(root, repo_id, "feat", "theirs", {"shared.py": f_theirs})
779
780 code, out = _run(root, "merge", "--strategy", "theirs", "feat")
781 assert code == 0, out
782
783 merged = _head_manifest(root, "main")
784 assert merged.get("shared.py") == f_theirs, "strategy=theirs must keep theirs version"
785 assert "ours_new.py" in merged, (
786 "REGRESSION: --strategy=theirs deleted ours-only ours_new.py. "
787 "Non-conflicting ours additions must still appear in merged."
788 )
789
790
791 # ---------------------------------------------------------------------------
792 # Category V — apply_manifest safety
793 # ---------------------------------------------------------------------------
794
795
796 class TestApplyManifestSafetyV:
797 """apply_manifest layer must be precise and not corrupt the working tree."""
798
799 def test_V1_apply_manifest_writes_target_files(self, tmp_path: pathlib.Path) -> None:
800 """V1: apply_manifest restores files from the object store correctly."""
801 from muse.core.workdir import apply_manifest
802
803 root, _ = _init_repo(tmp_path)
804 content = b"HELLO = True\n"
805 oid = _write_object(root, content)
806 apply_manifest(root, {"hello.py": oid})
807 assert (root / "hello.py").read_bytes() == content
808
809 def test_V2_apply_manifest_removes_files_not_in_target(self, tmp_path: pathlib.Path) -> None:
810 """V2: apply_manifest removes currently-tracked files absent from target."""
811 from muse.core.workdir import apply_manifest
812
813 root, _ = _init_repo(tmp_path)
814 content = b"OLD = True\n"
815 oid = _write_object(root, content)
816 (root / "old.py").write_bytes(content)
817
818 # Apply a manifest that doesn't include old.py.
819 new_content = b"NEW = True\n"
820 new_oid = _write_object(root, new_content)
821 apply_manifest(root, {"new.py": new_oid})
822
823 assert not (root / "old.py").exists(), "apply_manifest should remove files not in target"
824 assert (root / "new.py").read_bytes() == new_content
825
826 def test_V3_apply_manifest_does_not_delete_muse_dir(self, tmp_path: pathlib.Path) -> None:
827 """V3: apply_manifest must never delete .muse/ regardless of target."""
828 from muse.core.workdir import apply_manifest
829
830 root, _ = _init_repo(tmp_path)
831 assert (root / ".muse").exists()
832
833 # Apply empty target — should not delete .muse.
834 try:
835 apply_manifest(root, {})
836 except (ValueError, SystemExit):
837 pass # Guard fired correctly.
838
839 assert (root / ".muse").exists(), ".muse/ was deleted by apply_manifest — critical failure"
840
841 def test_V4_apply_manifest_does_not_follow_symlinks(self, tmp_path: pathlib.Path) -> None:
842 """V4: symlinked files outside the repo are not deleted by apply_manifest."""
843 from muse.core.workdir import apply_manifest
844
845 # Place the repo in a subdirectory so tmp_path itself can hold external files.
846 repo_dir = tmp_path / "myrepo"
847 repo_dir.mkdir()
848 root, _ = _init_repo(repo_dir)
849
850 # Create a file that is genuinely outside the repo root.
851 external = tmp_path / "external_file.txt"
852 external.write_bytes(b"I am external")
853
854 # Create a symlink inside the repo pointing to the external file.
855 link = root / "link_to_external.py"
856 link.symlink_to(external)
857
858 # apply_manifest with any target must not delete the external file.
859 # walk_workdir uses os.lstat + S_ISREG, which skips symlinks → symlinks
860 # are excluded from current_files → the external target is never deleted.
861 try:
862 apply_manifest(root, {})
863 except (ValueError, SystemExit):
864 pass # Guard fired — acceptable.
865
866 assert external.exists(), (
867 "apply_manifest followed a symlink outside the repo and deleted the target. "
868 "walk_workdir must exclude symlinks via S_ISREG check."
869 )
870
871
872 # ---------------------------------------------------------------------------
873 # Category VI — The exact regression scenario
874 # ---------------------------------------------------------------------------
875
876
877 class TestFormatMigrationRegressionVI:
878 """Reproduce the exact scenario that caused the data-loss incident.
879
880 When a branch that changes the on-disk store format (JSON→msgpack) is
881 merged into a branch that still uses the old format, the old reader
882 returns None for all snapshots, all manifests default to {}, and the
883 merge applies an empty working tree — deleting every file.
884 """
885
886 def test_VI1_regression_snapshot_id_never_equals_sha256_empty_after_merge(
887 self, tmp_path: pathlib.Path
888 ) -> None:
889 """VI1: the data-loss sentinel must never appear in the commit graph.
890
891 Walk every commit in the graph after a merge and assert that no
892 snapshot_id equals e3b0c44… (SHA-256 of empty bytes).
893 """
894 root, repo_id = _init_repo(tmp_path)
895
896 # Build a real diverged graph with many files.
897 base_manifest = {f"src_{i}.py": _write_file(root, f"v = {i}\n") for i in range(10)}
898 base_c = _make_commit(root, repo_id, "main", "base", base_manifest)
899 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
900
901 ours_manifest = {**base_manifest, "ours.py": _write_file(root, "OURS = True\n")}
902 _make_commit(root, repo_id, "main", "ours", ours_manifest)
903
904 theirs_manifest = {**base_manifest, "theirs.py": _write_file(root, "THEIRS = True\n")}
905 _make_commit(root, repo_id, "feat", "theirs", theirs_manifest)
906
907 code, out = _run(root, "merge", "feat")
908 assert code == 0, out
909
910 # Walk the entire commit graph and check every snapshot_id.
911 from muse.core.store import read_commit
912 visited: set[str] = set()
913 queue = [_ref(root, "main")]
914 while queue:
915 cid = queue.pop()
916 if cid in visited:
917 continue
918 visited.add(cid)
919 commit = read_commit(root, cid)
920 if commit is None:
921 continue
922 assert commit.snapshot_id != _SHA256_EMPTY, (
923 f"REGRESSION: commit {cid[:8]} has snapshot_id == SHA-256('') — "
924 "the data-loss sentinel. This commit has an empty manifest."
925 )
926 if commit.parent_commit_id:
927 queue.append(commit.parent_commit_id)
928 if commit.parent2_commit_id:
929 queue.append(commit.parent2_commit_id)
930
931 def test_VI2_merge_after_simulated_format_migration_aborts_not_deletes(
932 self, tmp_path: pathlib.Path
933 ) -> None:
934 """VI2: when the ours snapshot file is in the old JSON format, merge must abort.
935
936 Simulates: branch A is on old code (JSON snapshots), branch B migrated to
937 msgpack. When A merges B using old-format readers, ours snapshot returns None.
938 The merge must abort rather than silently empty the working tree.
939 """
940 root, repo_id = _init_repo(tmp_path)
941
942 # Create 20 files in the working tree.
943 manifest: Manifest = {}
944 for i in range(20):
945 content = f"module_{i} = True\n".encode()
946 oid = _write_object(root, content)
947 (root / f"module_{i}.py").write_bytes(content)
948 manifest[f"module_{i}.py"] = oid
949
950 base_c = _make_commit(root, repo_id, "main", "base", manifest)
951 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
952
953 extra = _write_file(root, "extra = True\n")
954 _make_commit(root, repo_id, "feat", "feat adds extra",
955 {**manifest, "extra.py": extra})
956
957 bump = _write_file(root, "bump = True\n")
958 main_c = _make_commit(root, repo_id, "main", "main adds bump",
959 {**manifest, "bump.py": bump})
960
961 # Simulate format migration: overwrite ours snapshot with old JSON bytes.
962 from muse.core.store import read_commit
963 main_commit = read_commit(root, main_c)
964 assert main_commit is not None
965 snap_path = _snapshot_path(root, main_commit.snapshot_id)
966 # Write JSON (old format) — msgpack reader will fail on this.
967 old_json_bytes = json.dumps({
968 "snapshot_id": main_commit.snapshot_id,
969 "manifest": {k: v for k, v in {**manifest, "bump.py": bump}.items()},
970 }).encode()
971 snap_path.write_bytes(old_json_bytes)
972
973 code, _out = _run_unchecked(root, "merge", "feat")
974
975 # Either the merge aborts (code != 0) OR it succeeds with correct content.
976 # What is NEVER acceptable: merging with an empty manifest that deletes files.
977 if code == 0:
978 merged = _head_manifest(root, "main")
979 assert merged != {}, (
980 "DATA LOSS: merge succeeded with an empty manifest. "
981 "All files were deleted because ours snapshot was unreadable (JSON vs msgpack)."
982 )
983 # Must have non-trivially many files.
984 assert len(merged) >= len(manifest), (
985 f"DATA LOSS: merged has only {len(merged)} files, expected ≥ {len(manifest)}."
986 )
987 # If code != 0: correct behaviour (abort).
988
989 # Critical: the working-tree files must still exist.
990 for i in range(20):
991 assert (root / f"module_{i}.py").exists(), (
992 f"DATA LOSS: module_{i}.py was deleted when merge aborted due to unreadable snapshot."
993 )
994
995 def test_VI3_merge_commit_snapshot_id_matches_actual_files(
996 self, tmp_path: pathlib.Path
997 ) -> None:
998 """VI3: compute_snapshot_id of the merged manifest must equal the stored snapshot_id."""
999 from muse.core.snapshot import compute_snapshot_id
1000 from muse.core.store import read_commit, read_snapshot
1001
1002 root, repo_id = _init_repo(tmp_path)
1003
1004 f0 = _write_file(root, "a = 0\n")
1005 f1 = _write_file(root, "a = 1\n")
1006 f2 = _write_file(root, "b = True\n")
1007
1008 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": f0})
1009 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1010 _make_commit(root, repo_id, "main", "ours", {"a.py": f1})
1011 _make_commit(root, repo_id, "feat", "theirs", {"a.py": f0, "b.py": f2})
1012
1013 code, out = _run(root, "merge", "feat")
1014 assert code == 0, out
1015
1016 commit = read_commit(root, _ref(root, "main"))
1017 assert commit is not None
1018 snap = read_snapshot(root, commit.snapshot_id)
1019 assert snap is not None
1020
1021 recomputed = compute_snapshot_id(snap.manifest)
1022 assert recomputed == commit.snapshot_id, (
1023 "snapshot_id in the commit record doesn't match "
1024 "compute_snapshot_id(snapshot.manifest). The snapshot is corrupt."
1025 )
1026
1027
1028 # ---------------------------------------------------------------------------
1029 # Category VII — Stress tests
1030 # ---------------------------------------------------------------------------
1031
1032
1033 class TestStressVII:
1034 """Extreme stress tests: large file counts, repeated merges, complex topologies."""
1035
1036 def test_VII1_100_file_clean_merge_all_files_preserved(self, tmp_path: pathlib.Path) -> None:
1037 """VII1: merge with 100 theirs-only file additions — none may be dropped."""
1038 root, repo_id = _init_repo(tmp_path)
1039
1040 base_id = _write_file(root, "base = True\n")
1041 base_c = _make_commit(root, repo_id, "main", "base", {"base.py": base_id})
1042 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1043
1044 # ours: minor bump to base.py.
1045 bumped = _write_file(root, "base = 2\n")
1046 _make_commit(root, repo_id, "main", "ours: bump", {"base.py": bumped})
1047
1048 # theirs: 100 new files.
1049 theirs_manifest: Manifest = {"base.py": base_id}
1050 for i in range(100):
1051 oid = _write_file(root, f"mod_{i:03d} = True\n")
1052 theirs_manifest[f"mod_{i:03d}.py"] = oid
1053 _make_commit(root, repo_id, "feat", "theirs: 100 mods", theirs_manifest)
1054
1055 code, out = _run(root, "merge", "feat")
1056 assert code == 0, out
1057
1058 merged = _head_manifest(root, "main")
1059 dropped = [f"mod_{i:03d}.py" for i in range(100) if f"mod_{i:03d}.py" not in merged]
1060 assert not dropped, (
1061 f"DATA LOSS: {len(dropped)} of 100 theirs-only files dropped after merge: "
1062 f"{dropped[:5]}{'...' if len(dropped) > 5 else ''}"
1063 )
1064
1065 def test_VII2_repeated_merges_file_count_never_decreases(
1066 self, tmp_path: pathlib.Path
1067 ) -> None:
1068 """VII2: five sequential branch merges — total file count must be monotonically non-decreasing.
1069
1070 Each wave:
1071 - Branches from the current main HEAD (inheriting all previously merged files).
1072 - Adds 5 unique files ON TOP of the current main state.
1073 - Main is bumped with 1 unique file (true 3-way merge).
1074 - After merge: main must have all prior files + 5 wave files + 1 bump.
1075
1076 Expected final count: 1 (base) + 5 waves × 5 files + 5 bumps = 31.
1077 """
1078 root, repo_id = _init_repo(tmp_path)
1079
1080 base_id = _write_file(root, "base = True\n")
1081 _make_commit(root, repo_id, "main", "base", {"base.py": base_id})
1082 prev_count = 1
1083
1084 for wave in range(5):
1085 branch = f"wave_{wave}"
1086 # Branch from the current main HEAD — inherits all previously merged files.
1087 (root / ".muse" / "refs" / "heads" / branch).write_text(_ref(root, "main"))
1088
1089 # Wave branch: current main state + 5 new unique files.
1090 wave_manifest = dict(_head_manifest(root, "main"))
1091 for j in range(5):
1092 oid = _write_file(root, f"wave_{wave}_file_{j} = True\n")
1093 wave_manifest[f"w{wave}_{j}.py"] = oid
1094 _make_commit(root, repo_id, branch, f"wave {wave} adds 5 files", wave_manifest)
1095
1096 # Advance main with 1 unique file so this is a true 3-way merge.
1097 bump_manifest = dict(_head_manifest(root, "main"))
1098 bump_id = _write_file(root, f"main_bump_{wave} = True\n")
1099 bump_manifest[f"main_bump_{wave}.py"] = bump_id
1100 _make_commit(root, repo_id, "main", f"main bump {wave}", bump_manifest)
1101
1102 code, out = _run(root, "merge", branch)
1103 assert code == 0, f"Wave {wave} merge failed: {out}"
1104
1105 current_count = len(_head_manifest(root, "main"))
1106 assert current_count >= prev_count, (
1107 f"DATA LOSS after wave {wave}: file count decreased "
1108 f"from {prev_count} to {current_count}."
1109 )
1110 prev_count = current_count
1111
1112 # 1 base + 5 waves × 5 files + 5 bumps = 31.
1113 assert prev_count >= 31, (
1114 f"Expected at least 31 files after 5 waves, got {prev_count}."
1115 )
1116
1117 def test_VII3_diamond_topology_no_files_lost(self, tmp_path: pathlib.Path) -> None:
1118 """VII3: diamond merge topology — LCA is correctly found, no data lost.
1119
1120 Topology:
1121 C0 (base: 10 files)
1122 / \\
1123 C1 C2
1124 (ours adds 5) (theirs adds 5 different)
1125 \\ /
1126 merge → must have all 20 files
1127 """
1128 root, repo_id = _init_repo(tmp_path)
1129
1130 base_manifest = {f"base_{i}.py": _write_file(root, f"base_{i} = True\n") for i in range(10)}
1131 base_c = _make_commit(root, repo_id, "main", "C0", base_manifest)
1132 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1133
1134 # C1: ours adds 5 files.
1135 c1_manifest = {**base_manifest}
1136 for i in range(5):
1137 c1_manifest[f"ours_{i}.py"] = _write_file(root, f"ours_{i} = True\n")
1138 _make_commit(root, repo_id, "main", "C1: ours adds 5", c1_manifest)
1139
1140 # C2: theirs adds 5 different files.
1141 c2_manifest = {**base_manifest}
1142 for i in range(5):
1143 c2_manifest[f"theirs_{i}.py"] = _write_file(root, f"theirs_{i} = True\n")
1144 _make_commit(root, repo_id, "feat", "C2: theirs adds 5", c2_manifest)
1145
1146 code, out = _run(root, "merge", "feat")
1147 assert code == 0, out
1148
1149 merged = _head_manifest(root, "main")
1150 assert len(merged) == 20, (
1151 f"DATA LOSS: expected 20 files after diamond merge, got {len(merged)}. "
1152 f"Missing: {sorted(set(list(c1_manifest) + list(c2_manifest)) - set(merged))}"
1153 )
1154
1155 def test_VII4_merge_with_deep_history_correct_lca(self, tmp_path: pathlib.Path) -> None:
1156 """VII4: 50-commit deep history — LCA found correctly, no files lost."""
1157 root, repo_id = _init_repo(tmp_path)
1158
1159 # Build 50 commits on main.
1160 f0 = _write_file(root, "anchor = 0\n")
1161 current_manifest: Manifest = {"anchor.py": f0}
1162 base_c = _make_commit(root, repo_id, "main", "C0", current_manifest)
1163
1164 for depth in range(49):
1165 fi = _write_file(root, f"depth_{depth} = True\n")
1166 current_manifest = {**current_manifest, f"depth_{depth}.py": fi}
1167 _make_commit(root, repo_id, "main", f"C{depth + 1}", current_manifest)
1168
1169 # Branch at the VERY END.
1170 tip_c = _ref(root, "main")
1171 (root / ".muse" / "refs" / "heads" / "feat").write_text(tip_c)
1172
1173 # Advance main by 1.
1174 main_extra = _write_file(root, "main_extra = True\n")
1175 main_manifest = {**current_manifest, "main_extra.py": main_extra}
1176 _make_commit(root, repo_id, "main", "main advance", main_manifest)
1177
1178 # Advance feat by 1.
1179 feat_extra = _write_file(root, "feat_extra = True\n")
1180 feat_manifest = {**current_manifest, "feat_extra.py": feat_extra}
1181 _make_commit(root, repo_id, "feat", "feat advance", feat_manifest)
1182
1183 code, out = _run(root, "merge", "feat")
1184 assert code == 0, out
1185
1186 merged = _head_manifest(root, "main")
1187 assert "main_extra.py" in merged, "ours-only main_extra.py lost in deep-history merge"
1188 assert "feat_extra.py" in merged, "theirs-only feat_extra.py lost in deep-history merge"
1189 # All 49 depth files must still be present.
1190 for depth in range(49):
1191 assert f"depth_{depth}.py" in merged, f"depth_{depth}.py lost in deep-history merge"
1192
1193 def test_VII5_stress_strategy_ours_100_theirs_files_all_preserved(
1194 self, tmp_path: pathlib.Path
1195 ) -> None:
1196 """VII5: --strategy=ours with 100 theirs-only additions — all must appear in merged.
1197
1198 The old strategy=ours bug took the entire ours manifest verbatim,
1199 discarding all theirs-only changes. This test ensures 100 theirs-only
1200 files survive even when strategy=ours is used to resolve conflicts.
1201 """
1202 root, repo_id = _init_repo(tmp_path)
1203
1204 shared_content = _write_file(root, "shared = 'base'\n")
1205 base_c = _make_commit(root, repo_id, "main", "base", {"shared.py": shared_content})
1206 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1207
1208 ours_shared = _write_file(root, "shared = 'ours'\n")
1209 _make_commit(root, repo_id, "main", "ours: modify shared", {"shared.py": ours_shared})
1210
1211 # theirs: conflict on shared.py + 100 theirs-only additions.
1212 theirs_shared = _write_file(root, "shared = 'theirs'\n")
1213 theirs_manifest: Manifest = {"shared.py": theirs_shared}
1214 for i in range(100):
1215 oid = _write_file(root, f"extra_{i} = True\n")
1216 theirs_manifest[f"extra_{i:03d}.py"] = oid
1217 _make_commit(root, repo_id, "feat", "theirs: conflict + 100 extras", theirs_manifest)
1218
1219 code, out = _run(root, "merge", "--strategy", "ours", "feat")
1220 assert code == 0, out
1221
1222 merged = _head_manifest(root, "main")
1223 dropped = [f"extra_{i:03d}.py" for i in range(100) if f"extra_{i:03d}.py" not in merged]
1224 assert not dropped, (
1225 f"REGRESSION: --strategy=ours dropped {len(dropped)} theirs-only files: "
1226 f"{dropped[:5]}{'...' if len(dropped) > 5 else ''}"
1227 )
1228 assert merged.get("shared.py") == ours_shared, "--strategy=ours must keep ours version of conflict"
1229
1230 def test_VII6_interleaved_add_delete_all_correct(self, tmp_path: pathlib.Path) -> None:
1231 """VII6: interleaved adds and deletes on both sides — final manifest exactly correct."""
1232 root, repo_id = _init_repo(tmp_path)
1233
1234 # Base: files 0-19.
1235 base_manifest = {f"f{i:02d}.py": _write_file(root, f"f{i} = {i}\n") for i in range(20)}
1236 base_c = _make_commit(root, repo_id, "main", "base", base_manifest)
1237 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1238
1239 # ours: delete even files (0,2,4…18), keep odd, add ours_new.
1240 ours_manifest = {k: v for k, v in base_manifest.items() if int(k[1:3]) % 2 == 1}
1241 ours_manifest["ours_new.py"] = _write_file(root, "OURS_NEW = True\n")
1242 _make_commit(root, repo_id, "main", "ours: delete evens, add ours_new", ours_manifest)
1243
1244 # theirs: delete files 0-9, keep 10-19, add theirs_new.
1245 theirs_manifest = {k: v for k, v in base_manifest.items() if int(k[1:3]) >= 10}
1246 theirs_manifest["theirs_new.py"] = _write_file(root, "THEIRS_NEW = True\n")
1247 _make_commit(root, repo_id, "feat", "theirs: delete f00-f09, add theirs_new", theirs_manifest)
1248
1249 code, out = _run(root, "merge", "feat")
1250 assert code == 0, out
1251
1252 merged = _head_manifest(root, "main")
1253
1254 # Files deleted by ours (evens 0-18): ours deleted, theirs may have kept some.
1255 # The three-way merge rule: if ours deleted and theirs didn't change → keep deleted.
1256 # Files deleted by theirs (0-9): theirs deleted, ours may have kept some.
1257
1258 # ours_new and theirs_new must both be present.
1259 assert "ours_new.py" in merged, "ours_new.py was lost in interleaved merge"
1260 assert "theirs_new.py" in merged, "theirs_new.py was lost in interleaved merge"
1261
1262 # No extra phantom files.
1263 for path in merged:
1264 assert path in ours_manifest or path in theirs_manifest or path in base_manifest or \
1265 path in ("ours_new.py", "theirs_new.py"), (
1266 f"Phantom file {path!r} in merged manifest — not from any input"
1267 )
1268
1269 def test_VII7_merge_output_is_deterministic(self, tmp_path: pathlib.Path) -> None:
1270 """VII7: merging the same two branches twice produces the same commit_id.
1271
1272 Because commit_id is computed from (parent_ids, snapshot_id, message, timestamp),
1273 two runs with the same timestamp must produce the same commit_id. This
1274 tests that the merge is truly deterministic.
1275 """
1276 from muse.core.merge_engine import apply_merge, detect_conflicts, diff_snapshots
1277 from muse.core.snapshot import compute_snapshot_id
1278
1279 # Build a deterministic merge scenario at the pure-function level.
1280 base = {"a.py": _h("a-base"), "b.py": _h("b-base")}
1281 ours = {"a.py": _h("a-ours"), "b.py": _h("b-base")}
1282 theirs = {"a.py": _h("a-base"), "b.py": _h("b-theirs"), "c.py": _h("c-new")}
1283
1284 ours_changed = diff_snapshots(base, ours)
1285 theirs_changed = diff_snapshots(base, theirs)
1286 conflicts = detect_conflicts(ours_changed, theirs_changed, ours, theirs)
1287 merged1 = apply_merge(base, ours, theirs, ours_changed, theirs_changed, conflicts)
1288 merged2 = apply_merge(base, ours, theirs, ours_changed, theirs_changed, conflicts)
1289
1290 assert merged1 == merged2, "apply_merge is not deterministic"
1291 assert compute_snapshot_id(merged1) == compute_snapshot_id(merged2), (
1292 "compute_snapshot_id is not deterministic"
1293 )
1294
1295 def test_VII8_dry_run_never_modifies_any_commit(self, tmp_path: pathlib.Path) -> None:
1296 """VII8: --dry-run must not write any commit or advance any branch ref."""
1297 root, repo_id = _init_repo(tmp_path)
1298
1299 f0 = _write_file(root, "a = 0\n")
1300 base_c = _make_commit(root, repo_id, "main", "base", {"a.py": f0})
1301 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1302
1303 f1 = _write_file(root, "a = 1\n")
1304 main_c = _make_commit(root, repo_id, "main", "ours", {"a.py": f1})
1305
1306 f2 = _write_file(root, "b = True\n")
1307 _make_commit(root, repo_id, "feat", "theirs", {"a.py": f0, "b.py": f2})
1308
1309 snapshot_count_before = len(list((root / ".muse" / "snapshots").glob("*.msgpack")))
1310 commit_count_before = len(list((root / ".muse" / "commits").glob("*.msgpack")))
1311
1312 code, _out = _run(root, "merge", "--dry-run", "feat")
1313 assert code == 0
1314
1315 snapshot_count_after = len(list((root / ".muse" / "snapshots").glob("*.msgpack")))
1316 commit_count_after = len(list((root / ".muse" / "commits").glob("*.msgpack")))
1317
1318 assert _ref(root, "main") == main_c, "--dry-run must not advance main HEAD"
1319 assert snapshot_count_after == snapshot_count_before, "--dry-run must not write snapshots"
1320 assert commit_count_after == commit_count_before, "--dry-run must not write commits"
1321
1322 def test_VII9_no_ff_with_100_files_all_preserved(self, tmp_path: pathlib.Path) -> None:
1323 """VII9: --no-ff with 100-file fast-forward-eligible merge — all files preserved."""
1324 root, repo_id = _init_repo(tmp_path)
1325
1326 base_id = _write_file(root, "anchor = True\n")
1327 base_c = _make_commit(root, repo_id, "main", "base", {"anchor.py": base_id})
1328 (root / ".muse" / "refs" / "heads" / "feat").write_text(base_c)
1329
1330 large_manifest: Manifest = {"anchor.py": base_id}
1331 for i in range(100):
1332 oid = _write_file(root, f"big_{i:03d} = True\n")
1333 large_manifest[f"big_{i:03d}.py"] = oid
1334 _make_commit(root, repo_id, "feat", "feat: 100 files", large_manifest)
1335
1336 # --no-ff forces a three-way merge commit even though this is fast-forwardable.
1337 code, out = _run(root, "merge", "--no-ff", "feat")
1338 assert code == 0, out
1339
1340 merged = _head_manifest(root, "main")
1341 for i in range(100):
1342 assert f"big_{i:03d}.py" in merged, f"big_{i:03d}.py missing after --no-ff merge"
1343
1344 # Must have created a real merge commit (two parents).
1345 from muse.core.store import read_commit
1346 mc = read_commit(root, _ref(root, "main"))
1347 assert mc is not None
1348 assert mc.parent2_commit_id is not None, "--no-ff must produce a merge commit with 2 parents"
File History 1 commit
sha256:a09b1b4f6838754495547f200aa0ce88e2f56ffc5b20b900f6f0cff2c3cdede9 fix(cursorignore): remove git-ism (.git/worktrees) Human minor ⚠ 152 days ago