update-machine: accept a daemon on a later main that contains the release

[m4ttheweric]

v2.12.0's rt release update-machine halted on the daemon leg. Main had moved three commits past the tag, and the dev daemon runs the shared checkout, so it reported acf3442fa instead of the tag's 6acb57807.

What changed

Source-rev check (lib/release/update-machine.ts, daemonRevCheck)

• An exact or prefix match passes as before.
• Otherwise the leg asks GitHub's compare API: ahead or identical passes ("daemon restarted on acf3442, which contains v2.12.0").
• behind, diverged, a failed compare call, or a source rev that isn't a sha all fail closed, naming the reason.
• The verify sweep uses the same check.

Verification

• bun test lib/release commands/__tests__/release-update-machine.test.ts: 217/217, including new cases for ahead, behind, diverged and a failed compare.
• A live rt release update-machine --verify-only --tag v2.12.0 on this Mac (daemon on acf3442fa) now reads clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_017A8MG18FT27cFsiEWiKGHD

[coderabbitai]

Warning

Review limit reached

Next included review available in 57 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 83 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f9278a80-b31d-43df-b701-aec94e2c6862

📥 Commits

Reviewing files that changed from the base of the PR and between acf3442 and 7fc908d.

📒 Files selected for processing (2)

• lib/release/__tests__/update-machine.test.ts
• lib/release/update-machine.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[m4ttheweric]

Review of record (Opus; CodeRabbit rate limited). No blockers; all five findings are fixed.

• should-fix: a pushed lane branch rebased onto the release contains it without being merged. The check now also requires compare/<rev>...main to report ahead or identical ("is not on main" otherwise).
• should-fix: no test pinned the non-sha guard. v2.12.0-dirty and ../x now fail as "not a commit sha", with no compare call made.
• nit: the verify-leg mismatch test now runs through the real "does not contain" reason.
• nit: the behind, diverged and failed-compare tests also assert that the verify leg errors.
• nit: a compare 404 now adds "commit not on GitHub; is the shared checkout on an unpushed commit?".

Also confirmed by the reviewer: the compare direction (live gh api gives ahead one way and behind the other), abbreviated shas resolving, and fail-closed behavior on 404, rate limits and network errors.

bun test lib/release commands/__tests__/release-update-machine.test.ts: 220/220. A live --verify-only --tag v2.12.0 on this Mac (daemon on acf3442fa, which is on main) reads clean.