Beagle SCM

JGET-002: jab get has no fast-forward/ancestry gate — silently clobbers committed local commits

A jab get re-syncing from a remote that is BEHIND or DIVERGENT from the local tip silently discards committed local history: it unconditionally appends the incoming tip to the wtlog and resets the worktree, with NO ancestor/fast-forward check anywhere in the seed. Native be get refuses a non-fast-forward (local tip not an ancestor of the incoming tip) and keeps local work. VERIFIED from evidence: case 28 jab wt regressed version B→version A (local commit dropped); case 58 jab wt = peer sibling peer-D (local clone-C clobbered). Part of JGET-001; method Issues.

Input

Context

• Native cases beagle/test/get/{27-ff-refuse, 28-linear-ahead-preserved, 58-divergent-refused-trunk}; spec wiki/GET.mkd "FF-only on the local tip".
• Repro (28): clone @A via jab get be:$SRC/.be?/src; be post B locally (remote stays @A); jab get be:$SRC/.be?/src → jab prints upd hello.c, resets wt B→A, trunk regresses. Evidence ~/todo/JS096-probe1/ff_ahead/{wt_j,wt_n}.
• Repro (58): clone + peer both commit siblings C/D off A; jab get of the peer overwrites C with D. Evidence ~/todo/JS096-probe1/c58final/{wt_j,wt_n}.
• Root: get.js seedRemote/seedLocal/seedCached (121-196) + fanoutWholeTree (278) append the new tip + reset with no dag.aheadBehind/ancestor refusal.

Goals

• jab get refuses when the local branch tip is NOT an ancestor of the incoming tip (behind OR divergent), leaves the wt + wtlog + tip untouched, exits nonzero with a native-style "not a fast-forward" diagnostic.
• A genuine fast-forward (local tip IS an ancestor) still advances as today.

Constraints

• Use dag/graf ancestry already in be/shared/dag.js; no new DAG walk if one exists. Repro-first; port cases 27/28/58 into be/test/get as the gate.

WIP

Design decisions

• Add the ancestor check at the seed commit-point (before appendWtlog + the reset fan-out): if oldTip is set and !dag.isAncestor(k, oldTip, tip) → refuse. A fresh clone (no oldTip) and an exact-equal tip stay no-ops.
• Decide the refusal taxonomy: behind → refuse; divergent → refuse (native may offer a ?back park — out of scope here, refuse is the safe floor).

TODOs

• Repro test: behind-remote + divergent-peer, assert wt/tip unchanged + nonzero (spec gate in be/test/get, getrepro.sh style — native oracle retired by TEST-003).
• Add the ancestor gate BEFORE the wtlog appends: seedLocal get.js:192, seedRemote get.js:232, seedCached get.js:259 all appendWtlog unconditionally; hook = relate.verdict already computed at get.js:410-412 ("rel exposed for a future FF gate (JGET-002)") but only AFTER the append — move/duplicate the check ahead.
• Confirm a genuine FF still advances; then the be/test/get gate (cases 27/28/58 shapes, spec-based).

Blockers and bummers

• Most severe of JGET-001: silently destroys committed work; fix before any jab get is used against a shared remote.

Outcome

• (open) Filed 2026-06-29.