[servicememeai]

Problem

2026-10-23 DEV: repeated library name/description PUTs created orphan metadata commits and repeatedly attempted Branch/master FOR UPDATE. An ACL-protected library has no file-tree delta for metadata-only commits; native final ACL verification rejects it, but edit_repo() and revert_on_server() retried every negative publication result without bounds. The C file-commit path could also retry SQL failures as if they were HEAD conflicts.

Minimal fix

• Return a distinct SEAF_BRANCH_UPDATE_HEAD_CONFLICT (-3) only for the confirmed old-HEAD mismatch; preserve the fail-closed ACL rejection (-2) and SQL/transaction failure (-1).
• In edit_repo(), skip identical name/description without creating a commit; retain caller-supplied metadata/actor across a HEAD-conflict retry; retry only confirmed HEAD conflicts, up to 3 times with bounded randomized delay.
• Apply the same retry boundary and error cleanup to revert_on_server() (including its abort lifecycle event).
• In gen_new_commit_guarded(), stop on unexpected/SQL failures; correct strict no-op error mapping.
• Add cheap C source-contract regression tests.

Scope

No database tables, ACL policy semantics, authentication, or EAP synchronization changes. The EAP stop-rename/stop-automatic-replay patch jcetech/etech-eap@bb347dde is already in its dev branch. This PR deliberately does not authorize metadata changes on an ACL-protected repo; those operations still fail closed, but terminate promptly until explicit admin metadata authorization is designed.

Validation / merge gates

• Source contract test: python3 -m unittest tests.test_cf_branch_retry_contract.
• Before merge, verify with disposable C Server + MariaDB + Hub: identical rename keeps HEAD unchanged; protected changed rename returns promptly without repeated commits; ACL 403/503 and SQL lock timeouts never retry; genuine concurrent HEAD update retries max 3; revert denial publishes no commit and reports ABORTED.
• Not built/deployed on DEV/PROD; no runtime environment was contacted.