hive-c0re: a deploy request for a rev applied/main already contains is a no-op

advance_applied_main refused every rev that does not descend from
applied/main, including an ancestor of it. Ancestors arrive in normal
operation: swarm-controller queues each merge's TriggerDeploy as an
independent node with no resource or edge between them and spawns each
runnable node on its own task, so two merges of one agent can publish in
either order; the meta-update cascade fast-forwards applied/main to the
forge's main on its own; and the webhook handler does not dedup a
redelivered merge event. Since a refusal now logs at ERROR and fires the
`hh-config-rev-refused` alert, each of those would page as a refusal.

An ancestor is now RevAdvance::Superseded, logged at info, nothing queued.
Only a rev that has diverged (neither descendant nor ancestor) is refused.

Refs #4851

hive-c0re/src/actions.rs

@@ -30,6 +30,11 @@ pub(crate) enum RevAdvance {
     AlreadyApplied,
     /// `applied/main` was fast-forwarded to the rev.
     Advanced,
+    /// The rev is an ancestor of `applied/main`, so a later commit already
+    /// carries it and there is nothing to deploy. Deploy requests are not
+    /// ordered: two merges' requests can arrive in either order, and a
+    /// meta-update cascade fast-forwards `main` to the forge's on its own.
+    Superseded,
 }
 
 /// Fast-forward `agent`'s `applied/main` to `rev`, a commit the swarm asks
@@ -40,8 +45,8 @@ pub(crate) enum RevAdvance {
 ///
 /// # Errors
 ///
-/// Returns an error if the forge fetch fails, if `rev` does not descend from
-/// `applied/main`, or if `main` moved during the fast-forward. `main` does not
+/// Returns an error if the forge fetch fails, if `rev` has diverged from
+/// `applied/main` (neither descendant nor ancestor), or if `main` moved during the fast-forward. `main` does not
 /// move in any of these.
 pub(crate) async fn advance_applied_to_rev(agent: &str, rev: &str) -> Result<RevAdvance> {
     advance_applied_main(
@@ -75,6 +80,12 @@ async fn advance_applied_main<T>(
         return Ok(RevAdvance::AlreadyApplied);
     }
     if !descends {
+        let contained = lifecycle::git_is_ancestor(applied_dir, rev, &main)
+            .await
+            .map_err(|e| anyhow::anyhow!("ancestry check {rev}..{main}: {e:#}"))?;
+        if contained {
+            return Ok(RevAdvance::Superseded);
+        }
         bail!(
             "{rev} does not descend from applied/main ({main}); fast-forwarding to it would \
              discard commits"
@@ -211,6 +222,14 @@ mod tests {
         assert_eq!(main_of(&dir).await, b);
     }
 
+    #[tokio::test]
+    async fn an_ancestor_of_main_is_superseded_not_refused() {
+        let (dir, [a, b, _]) = repo().await;
+        let outcome = advance_applied_main(dir.path(), &a, async { anyhow::Ok(()) }).await;
+        assert_eq!(outcome.expect("no-op"), RevAdvance::Superseded);
+        assert_eq!(main_of(&dir).await, b);
+    }
+
     #[tokio::test]
     async fn a_descendant_rev_fast_forwards_main() {
         let (dir, [a, b, _]) = repo().await;

hive-c0re/src/swarm_status.rs

@@ -328,6 +328,10 @@ async fn apply_rev(agent: &str, rev: &str) -> bool {
             tracing::info!(%agent, %rev, "swarm events: deploy requested for the applied rev; nothing queued");
             false
         }
+        Ok(crate::actions::RevAdvance::Superseded) => {
+            tracing::info!(%agent, %rev, "swarm events: deploy requested for a rev applied/main already contains; nothing queued");
+            false
+        }
         Err(e) => {
             tracing::error!(%agent, %rev, error = %format!("{e:#}"), "swarm events: rev not applied; nothing queued");
             false