Beagle SCM

GET-040: non-force get DELETES untracked files — only get! may clean

A plain (non-force) jab get must MERGE dirty tracked files and LEAVE UNTRACKED files alone; only jab get! may clean the worktree (GET wiki: "be get! resets the worktree to a clean state, all local changes discarded"). It does not: a non-force get that recurses into a submodule RESET the sub and SILENTLY DELETED every UNTRACKED file in it. Verified this session: in a beagle-ext worktree, test/ is the beagle-ext-tests store-backed submodule; a non-force jab get swept 7 dirs of untracked, newly-authored test files (left empty), while tracked files survived — silent data loss. Suspected locus: get's del-sweep / prune (verbs/get/get.js fanoutWholeTree + delSweep) unlinks worktree paths absent from newTree WITHOUT checking they were TRACKED (in oldTree), and/or the submodule recursion does a wholesale clean re-checkout of the sub (should be read-only, DIS-058). JS only (be/, via jab). Evidence: cost the GIT-016 T1–T4 tests. Method: work; siblings JGET-001/DIS-058/JGET-013.

Input

Context

• Repro-shaped evidence (this session): in a beagle-ext worktree test/ is a SEPARATE store-backed submodule (beagle-ext-tests, own .be). A NON-force jab get (recursing) reset that sub and DELETED all UNTRACKED files under it — 7 test dirs emptied; the 40+ TRACKED test files survived.
• verbs/get/get.js fanoutWholeTree(ctx, r, wt, force): noPrune = !!force || (sameTip && !r.fresh); a del-sweep BARRIER (DELSWEEP/delSweep) folds delete leaves; if (!force) dirtyOverlapCheck(...) (get.js ~L382). The prune/del-sweep is what removes worktree files during a switch/update.
• GET wiki: only be get! (force) "resets the worktree to a clean state, all local changes discarded" — so a non-force get must NOT discard untracked (or dirty tracked) content.
• An UNTRACKED file = a worktree path in NEITHER oldTree NOR newTree. A tracked deletion = a path in oldTree but gone from newTree. Only the latter may be unlinked, and only when not dirty.

Goals

• A non-force jab get (switch / update / re-get / FF) NEVER deletes an untracked worktree path (in neither tree); it merges dirty tracked files and only removes TRACKED deletions.
• jab get! keeps its clean-reset (may remove untracked/dirty) — force is the SOLE cleaning path.
• The invariant holds THROUGH submodule recursion: reconciling / re-getting a sub must not sweep the sub's untracked files (coordinate with DIS-058: sub recursion is read-only).

Constraints

• JS only, be/, run via jab. Do NOT run native be; do NOT open beagle/.
• Repro-first (a silent-data-loss bug): make the failing case before the fix; verify untracked files survive a non-force get.
• ABC/JS norms: ≤2-line GET-040 comments, greppable, ticket-coded ≤64-char commit. No new deps.
• Do NOT regress get! (still cleans), dirty-tracked merge, tracked-deletion sweep, or the get/dirty/restore buckets.

WIP

Design decisions

• The del-sweep must gate each unlink on "the path was TRACKED in oldTree"; a path in neither tree is untracked → LEAVE IT. Never unlink by "absent from newTree" alone.
• Force (get!) is the only mode that may remove untracked/dirty; everything non-force is merge-or-leave.

TODOs

• T1 — repro landed: test/sub/untracked/run.sh (sub + nested untracked + dirty tracked preserved non-force; force arm cleans). Top-level untracked is safe by construction: the tree-reconcile enumerates only tree entries and a delete leaf fires only with an oldSha (get.js leaf/reconcileDir).
• T2 — del-sweep/prune fixed: shared/checkout.js apply gates unlinks on the OLD baseline tree (oldMap) — non-force unlinks only tracked deletions, preserves dirty edits (mrg). 0092271c.
• T3 — submodule path fixed: shared/submount.js threads the sub's PRIOR pin as oldTip + the global ambient force flag into checkout.apply; recursion no longer clean-resets the sub. 0092271c.
• T4 — regression: get! clean-reset asserted by test/sub/untracked arm 2; suite green per d80bdb5c "js tests pass, no native use" (2026-07-06 audit: not re-run, read-only).

Blockers and bummers

• Determine the exact sweep locus (top-level del-sweep vs the submodule re-checkout) — the repro decides; both may need the tracked-only guard.
• Interacts with DIS-058 (sub recursion should be read-only) and JGET-013 (--force orphan sweep); coordinate so force still cleans and non-force never does.

Outcome

• LANDED be 0092271c "GET-040: fix recursion bug (submodule reset)": FORCE (get!) is the sole clean-reset; NON-force (re)writes only missing/clean tracked files, preserves dirty edits, and unlinks ONLY a tracked deletion — an untracked path (in neither tree) is never touched (shared/checkout.js apply oldTip/oldMap model; shared/submount.js passes the sub's prior pin + the global force flag).
• Repro/regression test/sub/untracked/run.sh (two arms: non-force preserve, force clean-reset).
• Audit 2026-07-07: guards verified present in the current tree (checkout.js/submount.js as of 50e90012); suite not re-run (read-only audit) — green per d80bdb5c.

Regression 2026-07-31 (incident //DIS-082-jab, evidence tree frozen)

• A 10:59 post ?#5d31a147 moved the base, so the 11:32 bare jab get '///jab/' ran the DIVERGED path; verbs/get/get.js treats ANY diverged non-force get as a GET-048 switch-reset — deletes ours-only files, resurrects ours-deletes, clean-overwrites clean-vs-local-head files to theirs. Correct for an explicit ?br switch, data loss for a track UPDATE. The 0092271c guards are intact and were never the locus.
• FIX STAGED in //GET-040 (get.js only, NOT landed): a diverged non-force TRACK UPDATE (trackUpdate flag: bare get, wt-operand/cross-source update, track re-fetch) 3-way merges against the MERGE-BASE tree — local-only adds stay, ours-deleted+theirs-unchanged stays deleted, theirs-unchanged keeps ours, theirs' changes weave. Explicit ?br/?sha/pin switches keep GET-048 reset.
• Also hardened oldTipOf() (get.js:145): only get/post rows move the base — a staged sub pin put dog#<sha> could read back as the parent's old tip.
• Repro test/get/divergent-track-update/run.sh RED pre-fix, GREEN after; ctest 328/328 (orchestrator re-ran the divergent bucket 6/6).
• RECOVERY: commit 5d31a147 is intact in the main jab store (jab cat verified cfold.hpp, test/weave.js, test/bass.js bytes; weave.hpp correctly absent); dog sub commit e118a411 + pin and all 17 put/delete rows still sit in the incident wt's ulog — that ground is GET-053's.
• RULING NEEDED before merge: GET-053 rules bare get FF-only, under which a DIVERGED bare get would REFUSE, not merge — accept this 3-way merge now or hold for the FF-only redesign.
• Suggested commit: GET-040: diverged track update merges vs merge base, never resets