Beagle SCM

GET-018: make be get's worktree update atomic — stage-to-temp + atomic swap (or journal+rollback) so a mid-write failure leaves ref/wtlog/tree all unchanged

Split from GET-016 Part 1. be get's COMMIT POINT (sniff/GET.c:1338-1429) advances the local branch ref + wtlog BEFORE the non-crash-safe worktree write (WALKTreeLazy + drains + sub loop), deliberately — the comment documents replay-via-be get --force ?<cur> as the recovery, and test/get/09-refuse-no-commit + test/get/10-partial-recovery pin that model (get/10 asserts the wtlog GROWS after a failing write and that --force replay is the fix). So the literal "advance the ref only after the write succeeds" reorder is rejected: it breaks that documented crash-safety model and both tests. True all-or-nothing atomicity needs a redesign — stage the wt mutation to a scratch area then atomically swap + advance the ref, or journal each mutation and roll back on failure. GET-016 Part 2 (the --force full-reset that makes the replay recovery actually work) landed separately. See GET, GET-016, CLAUDE.

Repro (target behaviour)

• Inject a mid-WALKTreeLazy write failure during be get onto a new tip; today the ref + wtlog advance while the tree is left partial (recoverable only by a manual be get --force ?<cur>).
• Target: after the failed get, the branch ref, the wtlog, AND the on-disk tree are byte-identical to their pre-get state — no partial application, no manual replay needed.

Design fork (decide first — this is why GET-016 split it out)

• Reorder (advance ref after the write): simplest, but breaks test/get/10's documented "wtlog grows on failure → --force replay recovery" model; only viable if that model is deliberately abandoned and 09/10 rewritten.
• Stage-to-temp + atomic swap (preferred): materialise the new tree into a scratch dir, fsync, then a single swap/commit + ref advance; a partial failure discards the scratch and the live tree is untouched.
• Journal + rollback: record an undo entry per wt mutation; on failure replay it backwards. More invasive; handles in-place edits without a full second copy.

Design ruling (2026-07-11, gritzko-approved): PLAN/APPLY split + begin/seal rows (JS first)

The JS impl (be/verbs/get/get.js) is the live surface and had two incidents on 2026-07-11 proving the amplifier is actively lossy, not theoretical: GET-043 (conflict-abort dropped queued leaves in 3 worktrees) and the journal/be self-update crash (tip appended, zero files written, then a same-tip re-get CEMENTED the stale files as phantom "local edits" via weave3's theirs==base keep-ours). Ruling:

• Plan/apply split: get becomes two passes. PLAN is read-only — pruned reconcile walk, classify every leaf (new/upd/del/mrg/con), compute the weaves for dirty files, run GETOVRL and the tip-has-no-tree check, prefetch sub packs. Any refusal fires BEFORE the first mutation (post's POST-017 pattern). APPLY then writes files (per-file write-temp+rename hygiene) and finishes the wtlog.
• Begin/seal rows: keep the early tip append as the INTENT row (preserves the wtlog-grows replay model 09/10 pin), append a terminal SEAL row after apply; curTip() and every last-#sha reader honor only SEALED tips. An unsealed tail = interrupted apply; the next get plans against the last SEALED baseline, and a partial apply self-heals through weave3's ours==theirs early-out (files-ahead skew is convergent, tip-ahead was lossy).
• Backward compat: wtlogs without seal rows read as before (every tip row sealed) — old trees must not regress.
• Skew-direction note for the record: files-ahead-of-baseline self-heals; tip-ahead-of-files self-hides and loses data. All ordering choices must respect this asymmetry.
• Stale-detection (leaf recognizes on-disk == blob@prior-tip as stale, not edited) is a composable follow-up — own ticket if not folded here.

Constraints

Must not regress the crash-safety property test/get/09/10 protect — either preserve replay-recovery as a fallback, or migrate those tests to the new no-drift model as a deliberate, reviewed step.

Planned

• Design pass first: choose swap-vs-journal, write it up here, then fork.
• Repro-first (CLAUDE §17): a test that injects a mid-write failure and asserts ref + wtlog + tree all unchanged afterwards.
• Implement; reconcile test/get/09 + 10 to the chosen model.

WIP

TODOs

• JS: plan/apply split + hoists — work/GET-018 (get.js, checkout.js temp+rename), uncommitted; verified RED/GREEN.
• JS: seal verb row + seal-gated wtlog.tip()/oldTipOf/currentSubPin; legacy logs read unchanged; conflicted-but-materialised gets DO seal.
• JS repro: test/get/atomic (3 properties) — RED on pre-change tree (refuse appended; cement kept stale bytes), GREEN on the fix; 12 suites + tip-reader verb suites green.
• Design pass: choose stage-to-temp+swap vs journal+rollback; write the ruling here. Audit 2026-07-07: no GET-018 commit landed; commit-point-before-write model unchanged; the JS side now has its own atomicity notes (shared/submount.js GET-037 sub-anchor drop) — align the two.
• Repro: inject a mid-WALKTreeLazy failure; assert ref + wtlog + tree unchanged.
• Implement; reconcile test/get/09/10 to the chosen model (do not silently break the replay-recovery property).