feat: detect externally squash-merged slots at harvest preview

[Steel-tech]

Closes a documented sharp edge from the plan's deferred follow-up list: a slot the user squash- or cherry-pick-merged themselves used to show as pending and conflict on re-merge, with "skip it by hand" as the only guidance.

Harvest preview now proves content containment with git merge-tree --write-tree (git >= 2.38): if merging the clean slot's tip into base would change nothing, the slot is reported as squash_merged and marked merged — never re-merged. Conflicts and older gits exit the containment check nonzero and fall through to the previous behavior, so nothing regresses where the proof is unavailable.

Deliberately unchanged: prune still keeps squash-merged branches. Its deletion authority is the ancestry test against the recorded base, which cannot see squashes, and deleting on a weaker signal is not its contract. The README sharp-edge entry now explains exactly that.

• scripts/harvest-step.sh — squash_merged_into_base helper + preview branch (after the ancestry-based external_merged check, clean slots only)
• bin/renderer.mjs — squash_merged routes to archive like the other terminal states
• Tests: positive detection, and a false-positive guard (a slot with unlanded commits after a partial squash stays clean); renderer terminal-state loop extended
• README sharp edge rewritten, CHANGELOG entry added

229 tests pass on Linux and macOS; shellcheck clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LSffk4LorDDDit18ENESsj

---

Generated by Claude Code

[coderabbitai]

Warning

Review limit reached

@Steel-tech, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 45 minutes

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 16aa698b-38dd-47a5-895a-b4168058bd32

📥 Commits

Reviewing files that changed from the base of the PR and between c0a12cd and 1de3d2e.

📒 Files selected for processing (6)

• CHANGELOG.md
• README.md
• bin/renderer.mjs
• scripts/harvest-step.sh
• tests/harvest.test.mjs
• tests/renderer.test.mjs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Steel-tech]

🤖 Lab Code Review (draft opinion)

• scripts/harvest-step.sh:311: squash_merged_into_base uses git -C "$REPO_ROOT" but REPO_ROOT is undefined; should use "$PWD" or pass repo path. Fix: replace "$REPO_ROOT" with "$PWD" (assuming called from repo root) or add REPO_ROOT definition.
• scripts/harvest-step.sh:385: manifest_update_slot call lacks error handling; if it fails, function returns 0 incorrectly. Fix: check return value and propagate error: manifest_update_slot ... || return 1.
• bin/renderer.mjs:926: p.state === "squash_merged" condition is correct but relies on preview setting state; ensure no typo in state string (matches preview output). No change needed if consistent.
• tests/harvest.test.mjs:1737: test assumes run.slotRow(1).status updates to "merged"; verify manifest update logic in preview sets status correctly. No change needed if implementation matches.
• CHANGELOG.md:11: Claim "Prune still deliberately keeps such branches" is accurate but could clarify why (ancestry test limitation). No code change; doc is sufficient.

[Steel-tech]

Verified each draft finding against the code — no changes needed:

1. REPO_ROOT undefined — it is bound before any verb runs, at scripts/harvest-step.sh:93 (IFS="$US" read -r RUN_ID REPO_ROOT BASE_REF FORK_SHA <<<"$CTX"), the same binding every other git -C "$REPO_ROOT" call in the file relies on (base_sha, swap_base, do_preview). The new tests run preview against real repositories from an arbitrary cwd and would fail immediately if it were unset.
2. manifest_update_slot error handling — both calls this PR adds are manifest_update_slot "$1" '{"status":"merged"}' || return 1 (lines 381/393), matching every other call site in the file.
   3–4. Agreed, consistent as written — the squash_merged string is emitted in one place and consumed in one place, both covered by the new tests.
3. The CHANGELOG entry already carries the rationale: "Prune still deliberately keeps such branches — its ancestry test cannot see squashes."

---

Generated by Claude Code