carson 3.18.0 → 3.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c18ffa310a6fdb0b0e1581eba83b9ab7dcb8c88a546c391f83200871e17d7f6
-  data.tar.gz: 77c0d6e97438a1f9512e3dbef51a22981caf1b6b0126ffe8ab3bdbf3c7ec3bbb
+  metadata.gz: 0e7fdc44d330fd415b8f6d9ee479d5256d6fc860e5d63c7c9287f28ebbdb2ba4
+  data.tar.gz: 19056bd376bcab3b7077e38ba4e42f2b9f5a3ffbf2c8027f0aa6626bb70587fb
 SHA512:
-  metadata.gz: 5ac7c43bd96d94c1013c5ade599bd906dbda305b3c0216c184093b62292de30c93d7b8f7bd0e090ffe13fd272e97345d6adb30b321df3188f48b2e5ef50913d6
-  data.tar.gz: 00da3a36874c8dca3ade2736e2e0d5852018cbe13c7a68cb0af746a59cbcbda51b4f992ebe862a88cf855824d7388c2a3b09b04d5950da385f3bdcf6ff09af12
+  metadata.gz: 13f0d5ac83272711329d435a935dd940afc461c5c3b10e20d23842492e8e53f7032cf34a8b027d70db80563af148cda5f99c2c8e7ec4025b94f4d72609ea9d1d
+  data.tar.gz: b1903c6a8f8682adc7b942e49b553579d014d56c0bb65587465568119d41583a14e0cb4a7b00bc61b9165fac79094567395dbf2b39191e3c9d673dc0750dc4f5

data/RELEASE.md

@@ -5,6 +5,28 @@ Release-note scope rule:
 - `RELEASE.md` records only version deltas, breaking changes, and migration actions.
 - Operational usage guides live in `MANUAL.md` and `API.md`.
 
+## 3.20.0
+
+### What changed
+
+- **Cross-process CWD guard for worktree removal** — `worktree_remove!` and `sweep_stale_worktrees!` now detect when another process (e.g. an agent session) has its working directory inside a worktree before attempting removal. Uses `lsof -d cwd` to scan for cross-process CWD holds. Blocks removal with a clear recovery message instead of silently destroying the directory and crashing the other session's shell.
+- **Code quality sweep** — fixed indentation errors in `deliver.rb` (`check_pr_ci` method). Converted single-parameter blocks to Ruby 3.4 `it` implicit parameter across `deliver.rb`, `govern.rb`, `setup.rb`, and all review submodules (`gate_support.rb`, `sweep_support.rb`, `utility.rb`). Added file-level purpose comments to review submodules (`gate_support.rb`, `sweep_support.rb`, `utility.rb`, `data_access.rb`, `query_text.rb`).
+
+### UX improvement
+
+- Worktree removal is now safe across process boundaries. Previously, Carson only checked if the *current* process's CWD was inside the worktree. A separate cleanup process (hook, batch sweep, or another agent) could still remove a worktree while another session's shell was inside it, permanently crashing that shell. The new guard detects this scenario and refuses removal with actionable recovery advice. Fails safe: if `lsof` is unavailable, removal proceeds as before.
+
+## 3.19.0
+
+### What changed
+
+- **Persistent pending tracking for batch operations** — repos skipped during `--all` operations (due to active worktrees, uncommitted changes, or path errors) are now recorded in `~/.carson/cache/batch_pending.json`. On the next run, pending repos are reported and automatically retried. `carson status --all` shows pending operations per repo with attempt count and timestamp.
+- **Ruby 3.4+ `it` implicit parameter** — single-parameter blocks where the parameter is the receiver now use `it` instead of named block variables (e.g. `.map { it.fetch( :name ) }` instead of `.map { |e| e.fetch( :name ) }`). Guard clause early returns replace `elsif` chains in `remote_sync_status`.
+
+### UX improvement
+
+- Batch operations are now self-healing: repos that can't be reached on one run aren't silently forgotten. They're logged with reasons and retried on the next invocation. `carson status --all` makes pending operations visible so the user always knows what needs attention.
+
 ## 3.18.0
 
 ### What changed

data/VERSION

@@ -1 +1 @@
-3.18.0
+3.20.0

data/lib/carson/runtime/audit.rb

@@ -72,7 +72,7 @@ module Carson
 					fail_n = checks.fetch( :failing_count )
 					pend_n = checks.fetch( :pending_count )
 					total = checks.fetch( :required_total )
-					fail_names = checks.fetch( :failing ).map { |e| e.fetch( :name ) }.join( ", " )
+					fail_names = checks.fetch( :failing ).map { it.fetch( :name ) }.join( ", " )
 					if fail_n.positive? && pend_n.positive?
 						audit_concise_problems << "Checks: #{fail_n} failing (#{fail_names}), #{pend_n} pending of #{total} required."
 					elsif fail_n.positive?
@@ -89,11 +89,11 @@ module Carson
 				if baseline_st == "block"
 					parts = []
 					if default_branch_baseline.fetch( :failing_count ).positive?
-						names = default_branch_baseline.fetch( :failing ).map { |e| e.fetch( :name ) }.join( ", " )
+						names = default_branch_baseline.fetch( :failing ).map { it.fetch( :name ) }.join( ", " )
 						parts << "#{default_branch_baseline.fetch( :failing_count )} failing (#{names})"
 					end
 					if default_branch_baseline.fetch( :pending_count ).positive?
-						names = default_branch_baseline.fetch( :pending ).map { |e| e.fetch( :name ) }.join( ", " )
+						names = default_branch_baseline.fetch( :pending ).map { it.fetch( :name ) }.join( ", " )
 						parts << "#{default_branch_baseline.fetch( :pending_count )} pending (#{names})"
 					end
 					parts << "no check-runs for active workflows" if default_branch_baseline.fetch( :no_check_evidence )
@@ -101,11 +101,11 @@ module Carson
 				elsif baseline_st == "attention"
 					parts = []
 					if default_branch_baseline.fetch( :advisory_failing_count ).positive?
-						names = default_branch_baseline.fetch( :advisory_failing ).map { |e| e.fetch( :name ) }.join( ", " )
+						names = default_branch_baseline.fetch( :advisory_failing ).map { it.fetch( :name ) }.join( ", " )
 						parts << "#{default_branch_baseline.fetch( :advisory_failing_count )} advisory failing (#{names})"
 					end
 					if default_branch_baseline.fetch( :advisory_pending_count ).positive?
-						names = default_branch_baseline.fetch( :advisory_pending ).map { |e| e.fetch( :name ) }.join( ", " )
+						names = default_branch_baseline.fetch( :advisory_pending ).map { it.fetch( :name ) }.join( ", " )
 						parts << "#{default_branch_baseline.fetch( :advisory_pending_count )} advisory pending (#{names})"
 					end
 					audit_concise_problems << "Baseline (#{default_branch_baseline.fetch( :default_branch, config.main_branch )}): #{parts.join( ', ' )}."
@@ -176,6 +176,7 @@ module Carson
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
 						puts_line "#{repo_name}: FAIL (path not found)"
+						record_batch_skip( command: "audit", repo_path: repo_path, reason: "path not found" )
 						failed += 1
 						next
 					end
@@ -186,16 +187,19 @@ module Carson
 						case status
 						when EXIT_OK
 							puts_line "#{repo_name}: ok" unless verbose?
+							clear_batch_success( command: "audit", repo_path: repo_path )
 							passed += 1
 						when EXIT_BLOCK
 							puts_line "#{repo_name}: BLOCK" unless verbose?
 							blocked += 1
 						else
 							puts_line "#{repo_name}: FAIL" unless verbose?
+							record_batch_skip( command: "audit", repo_path: repo_path, reason: "audit failed" )
 							failed += 1
 						end
 					rescue StandardError => e
 						puts_line "#{repo_name}: FAIL (#{e.message})"
+						record_batch_skip( command: "audit", repo_path: repo_path, reason: e.message )
 						failed += 1
 					end
 				end
@@ -208,20 +212,20 @@ module Carson
 		private
 			def pr_and_check_report
 				report = {
-				generated_at: Time.now.utc.iso8601,
-				branch: current_branch,
-				status: "ok",
-				skip_reason: nil,
-				pr: nil,
-				checks: {
-				status: "unknown",
-				skip_reason: nil,
-				required_total: 0,
-				failing_count: 0,
-				pending_count: 0,
-				failing: [],
-				pending: []
-				}
+					generated_at: Time.now.utc.iso8601,
+					branch: current_branch,
+					status: "ok",
+					skip_reason: nil,
+					pr: nil,
+					checks: {
+						status: "unknown",
+						skip_reason: nil,
+						required_total: 0,
+						failing_count: 0,
+						pending_count: 0,
+						failing: [],
+						pending: []
+					}
 				}
 				unless gh_available?
 					report[ :status ] = "skipped"
@@ -239,11 +243,11 @@ module Carson
 				end
 				pr_data = JSON.parse( pr_stdout )
 				report[ :pr ] = {
-				number: pr_data[ "number" ],
-				title: pr_data[ "title" ].to_s,
-				url: pr_data[ "url" ].to_s,
-				state: pr_data[ "state" ].to_s,
-				review_decision: blank_to( value: pr_data[ "reviewDecision" ], default: "NONE" )
+					number: pr_data[ "number" ],
+					title: pr_data[ "title" ].to_s,
+					url: pr_data[ "url" ].to_s,
+					state: pr_data[ "state" ].to_s,
+					review_decision: blank_to( value: pr_data[ "reviewDecision" ], default: "NONE" )
 				}
 				puts_verbose "pr: ##{report.dig( :pr, :number )} #{report.dig( :pr, :title )}"
 				puts_verbose "url: #{report.dig( :pr, :url )}"
@@ -258,7 +262,7 @@ module Carson
 					return report
 				end
 				checks_data = JSON.parse( checks_stdout )
-				pending = checks_data.select { |entry| entry[ "bucket" ].to_s == "pending" }
+				pending = checks_data.select { it[ "bucket" ].to_s == "pending" }
 				failing = checks_data.select { |entry| check_entry_failing?( entry: entry ) }
 				report[ :checks ][ :status ] = checks_success ? "ok" : ( checks_exit == 8 ? "pending" : "attention" )
 				report[ :checks ][ :required_total ] = checks_data.count
@@ -283,22 +287,22 @@ module Carson
 			# Evaluates default-branch CI health so stale workflow drift blocks before merge.
 			def default_branch_ci_baseline_report
 				report = {
-				status: "ok",
-				skip_reason: nil,
-				repository: nil,
-				default_branch: nil,
-				head_sha: nil,
-				workflows_total: 0,
-				check_runs_total: 0,
-				failing_count: 0,
-				pending_count: 0,
-				advisory_failing_count: 0,
-				advisory_pending_count: 0,
-				no_check_evidence: false,
-				failing: [],
-				pending: [],
-				advisory_failing: [],
-				advisory_pending: []
+					status: "ok",
+					skip_reason: nil,
+					repository: nil,
+					default_branch: nil,
+					head_sha: nil,
+					workflows_total: 0,
+					check_runs_total: 0,
+					failing_count: 0,
+					pending_count: 0,
+					advisory_failing_count: 0,
+					advisory_pending_count: 0,
+					no_check_evidence: false,
+					failing: [],
+					pending: [],
+					advisory_failing: [],
+					advisory_pending: []
 				}
 				unless gh_available?
 					report[ :status ] = "skipped"
@@ -309,30 +313,30 @@ module Carson
 				owner, repo = repository_coordinates
 				report[ :repository ] = "#{owner}/#{repo}"
 				repository_data = gh_json_payload!(
-				"api", "repos/#{owner}/#{repo}",
-				"--method", "GET",
-				fallback: "unable to read repository metadata for #{owner}/#{repo}"
+					"api", "repos/#{owner}/#{repo}",
+					"--method", "GET",
+					fallback: "unable to read repository metadata for #{owner}/#{repo}"
 				)
 				default_branch = blank_to( value: repository_data[ "default_branch" ], default: config.main_branch )
 				report[ :default_branch ] = default_branch
 				branch_data = gh_json_payload!(
-				"api", "repos/#{owner}/#{repo}/branches/#{CGI.escape( default_branch )}",
-				"--method", "GET",
-				fallback: "unable to read default branch #{default_branch}"
+					"api", "repos/#{owner}/#{repo}/branches/#{CGI.escape( default_branch )}",
+					"--method", "GET",
+					fallback: "unable to read default branch #{default_branch}"
 				)
 				head_sha = branch_data.dig( "commit", "sha" ).to_s.strip
 				raise "default branch #{default_branch} has no commit SHA" if head_sha.empty?
 				report[ :head_sha ] = head_sha
 				workflow_entries = default_branch_workflow_entries(
-				owner: owner,
-				repo: repo,
-				default_branch: default_branch
+					owner: owner,
+					repo: repo,
+					default_branch: default_branch
 				)
 				report[ :workflows_total ] = workflow_entries.count
 				check_runs_payload = gh_json_payload!(
-				"api", "repos/#{owner}/#{repo}/commits/#{head_sha}/check-runs",
-				"--method", "GET",
-				fallback: "unable to read check-runs for #{default_branch}@#{head_sha}"
+					"api", "repos/#{owner}/#{repo}/commits/#{head_sha}/check-runs",
+					"--method", "GET",
+					fallback: "unable to read check-runs for #{default_branch}@#{head_sha}"
 				)
 				check_runs = Array( check_runs_payload[ "check_runs" ] )
 				failing, pending = partition_default_branch_check_runs( check_runs: check_runs )
@@ -395,15 +399,15 @@ module Carson
 			# Reads workflow files from default branch; missing workflow directory is valid and returns none.
 			def default_branch_workflow_entries( owner:, repo:, default_branch: )
 				stdout_text, stderr_text, success, = gh_run(
-				"api", "repos/#{owner}/#{repo}/contents/.github/workflows",
-				"--method", "GET",
-				"-f", "ref=#{default_branch}"
+					"api", "repos/#{owner}/#{repo}/contents/.github/workflows",
+					"--method", "GET",
+					"-f", "ref=#{default_branch}"
 				)
 				unless success
 					error_text = gh_error_text(
-					stdout_text: stdout_text,
-					stderr_text: stderr_text,
-					fallback: "unable to read workflow files for #{default_branch}"
+						stdout_text: stdout_text,
+						stderr_text: stderr_text,
+						fallback: "unable to read workflow files for #{default_branch}"
 					)
 					return [] if error_text.match?( /\b404\b/ )
 					raise error_text
@@ -470,10 +474,10 @@ module Carson
 						blank_to( value: entry[ "status" ], default: "UNKNOWN" )
 					end
 					{
-					workflow: blank_to( value: entry.dig( "app", "name" ), default: "workflow" ),
-					name: blank_to( value: entry[ "name" ], default: "check" ),
-					state: state.upcase,
-					link: entry[ "html_url" ].to_s
+						workflow: blank_to( value: entry.dig( "app", "name" ), default: "workflow" ),
+						name: blank_to( value: entry[ "name" ], default: "check" ),
+						state: state.upcase,
+						link: entry[ "html_url" ].to_s
 					}
 				end
 			end

data/lib/carson/runtime/deliver.rb

@@ -210,27 +210,27 @@ module Carson
 
 			# Generates a default PR title from the branch name.
 			def default_pr_title( branch: )
-				branch.tr( "-", " " ).gsub( "/", ": " ).sub( /\A\w/ ) { |c| c.upcase }
+				branch.tr( "-", " " ).gsub( "/", ": " ).sub( /\A\w/ ) { it.upcase }
 			end
 
 			# Checks CI status on a PR. Returns :pass, :fail, :pending, or :none.
-# Uses the `bucket` field (pass/fail/pending) from `gh pr checks --json`.
-def check_pr_ci( number: )
-	stdout, _, success, = gh_run(
-		"pr", "checks", number.to_s,
-		"--json", "name,bucket"
-	)
-	return :none unless success
-
-	checks = JSON.parse( stdout ) rescue []
-	return :none if checks.empty?
-
-	buckets = checks.map { |c| c[ "bucket" ].to_s.downcase }
-	return :fail if buckets.include?( "fail" )
-	return :pending if buckets.include?( "pending" )
-
-	:pass
-end
+			# Uses the `bucket` field (pass/fail/pending) from `gh pr checks --json`.
+			def check_pr_ci( number: )
+				stdout, _, success, = gh_run(
+					"pr", "checks", number.to_s,
+					"--json", "name,bucket"
+				)
+				return :none unless success
+
+				checks = JSON.parse( stdout ) rescue []
+				return :none if checks.empty?
+
+				buckets = checks.map { it[ "bucket" ].to_s.downcase }
+				return :fail if buckets.include?( "fail" )
+				return :pending if buckets.include?( "pending" )
+
+				:pass
+			end
 
 			# Checks review decision on a PR. Returns :approved, :changes_requested, :review_required, or :none.
 			def check_pr_review( number: )
@@ -298,8 +298,8 @@ end
 			def compute_post_merge_next_step!( result: )
 				main_root = main_worktree_root
 				cwd = realpath_safe( Dir.pwd )
-				current_wt = worktree_list.select { |wt| wt.fetch( :path ) != realpath_safe( main_root ) }
-					.find { |wt| cwd == wt.fetch( :path ) || cwd.start_with?( File.join( wt.fetch( :path ), "" ) ) }
+				current_wt = worktree_list.select { it.fetch( :path ) != realpath_safe( main_root ) }
+					.find { cwd == it.fetch( :path ) || cwd.start_with?( File.join( it.fetch( :path ), "" ) ) }
 
 				if current_wt
 					wt_name = File.basename( current_wt.fetch( :path ) )

data/lib/carson/runtime/govern.rb

@@ -208,10 +208,10 @@ module Carson
 				checks = Array( pr[ "statusCheckRollup" ] )
 				return :green if checks.empty?
 
-				has_failure = checks.any? { |c| check_state_failing?( state: c[ "state" ].to_s ) || check_conclusion_failing?( conclusion: c[ "conclusion" ].to_s ) }
+				has_failure = checks.any? { check_state_failing?( state: it[ "state" ].to_s ) || check_conclusion_failing?( conclusion: it[ "conclusion" ].to_s ) }
 				return :red if has_failure
 
-				has_pending = checks.any? { |c| check_state_pending?( state: c[ "state" ].to_s ) }
+				has_pending = checks.any? { check_state_pending?( state: it[ "state" ].to_s ) }
 				return :pending if has_pending
 
 				:green

data/lib/carson/runtime/housekeep.rb

@@ -34,10 +34,18 @@ module Carson
 				end
 
 				results = []
-				repos.each { |repo_path| results << housekeep_one_entry( repo_path: repo_path, silent: json_output ) }
+				repos.each do |repo_path|
+					entry = housekeep_one_entry( repo_path: repo_path, silent: json_output )
+					if entry[ :status ] == "ok"
+						clear_batch_success( command: "housekeep", repo_path: repo_path )
+					else
+						record_batch_skip( command: "housekeep", repo_path: repo_path, reason: entry[ :error ] || "housekeep failed" )
+					end
+					results << entry
+				end
 
-				succeeded = results.count { |r| r[ :status ] == "ok" }
-				failed = results.count { |r| r[ :status ] != "ok" }
+				succeeded = results.count { it[ :status ] == "ok" }
+				failed = results.count { it[ :status ] != "ok" }
 				result = { command: "housekeep", status: failed.zero? ? "ok" : "partial", repos: results, succeeded: succeeded, failed: failed }
 				housekeep_finish( result: result, exit_code: failed.zero? ? EXIT_OK : EXIT_ERROR, json_output: json_output, results: results, succeeded: succeeded, failed: failed )
 			end

data/lib/carson/runtime/local/onboard.rb

@@ -1,3 +1,7 @@
+# Repository onboarding and refresh lifecycle.
+# Onboard: detect remote, install hooks, apply templates, run initial audit.
+# Refresh: re-apply hooks and templates after Carson upgrade.
+# Refresh all: batch refresh across governed portfolio with safety checks.
 module Carson
 	class Runtime
 		module Local
@@ -44,7 +48,7 @@ module Carson
 					hook_status = prepare!
 					return hook_status unless hook_status == EXIT_OK
 
-					drift_count = template_results.count { |entry| entry.fetch( :status ) != "ok" }
+					drift_count = template_results.count { it.fetch( :status ) != "ok" }
 					template_status = template_apply!
 					return template_status unless template_status == EXIT_OK
 
@@ -64,7 +68,7 @@ module Carson
 				return hook_status unless hook_status == EXIT_OK
 				puts_line "Hooks installed (#{config.managed_hooks.count} hooks)."
 
-				template_drift_count = template_results.count { |entry| entry.fetch( :status ) != "ok" }
+				template_drift_count = template_results.count { it.fetch( :status ) != "ok" }
 				template_status = with_captured_output { template_apply! }
 				return template_status unless template_status == EXIT_OK
 				if template_drift_count.positive?
@@ -82,7 +86,7 @@ module Carson
 
 			# Re-applies hooks, templates, and audit across all governed repositories.
 			# Checks each repo for safety (active worktrees, uncommitted changes) and
-			# skips unsafe repos to avoid disrupting active work.
+			# marks unsafe repos as pending to avoid disrupting active work.
 			def refresh_all!
 				repos = config.govern_repos
 				if repos.empty?
@@ -91,24 +95,32 @@ module Carson
 					return EXIT_ERROR
 				end
 
+				pending_before = pending_repos_for( command: "refresh" )
+				if pending_before.any?
+					puts_line "#{pending_before.length} repo#{plural_suffix( count: pending_before.length )} pending from previous run"
+				end
+
 				puts_line ""
 				puts_line "Refresh all (#{repos.length} repo#{plural_suffix( count: repos.length )})"
 				refreshed = 0
-				skipped = 0
+				pending = 0
 				failed = 0
 
 				repos.each do |repo_path|
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
 						puts_line "#{repo_name}: FAIL (path not found)"
+						record_batch_skip( command: "refresh", repo_path: repo_path, reason: "path not found" )
 						failed += 1
 						next
 					end
 
 					safety = portfolio_repo_safety( repo_path: repo_path )
 					unless safety.fetch( :safe )
-						puts_line "#{repo_name}: SKIP (#{safety.fetch( :reasons ).join( ', ' )})"
-						skipped += 1
+						reason = safety.fetch( :reasons ).join( ", " )
+						puts_line "#{repo_name}: PENDING (#{reason})"
+						record_batch_skip( command: "refresh", repo_path: repo_path, reason: reason )
+						pending += 1
 						next
 					end
 
@@ -116,16 +128,17 @@ module Carson
 					if status == EXIT_ERROR
 						failed += 1
 					else
+						clear_batch_success( command: "refresh", repo_path: repo_path )
 						refreshed += 1
 					end
 				end
 
 				puts_line ""
 				parts = [ "#{refreshed} refreshed" ]
-				parts << "#{skipped} skipped" if skipped.positive?
+				parts << "#{pending} still pending (will retry on next run)" if pending.positive?
 				parts << "#{failed} failed" if failed.positive?
 				puts_line "Refresh all complete: #{parts.join( ', ' )}."
-				failed.zero? && skipped.zero? ? EXIT_OK : EXIT_ERROR
+				failed.zero? && pending.zero? ? EXIT_OK : EXIT_ERROR
 			end
 
 			def prune_all!
@@ -145,6 +158,7 @@ module Carson
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
 						puts_line "#{repo_name}: FAIL (path not found)"
+						record_batch_skip( command: "prune", repo_path: repo_path, reason: "path not found" )
 						failed += 1
 						next
 					end
@@ -158,9 +172,16 @@ module Carson
 							summary = buf.string.lines.last.to_s.strip
 							puts_line "#{repo_name}: #{summary.empty? ? 'OK' : summary}"
 						end
-						status == EXIT_ERROR ? ( failed += 1 ) : ( succeeded += 1 )
+						if status == EXIT_ERROR
+							record_batch_skip( command: "prune", repo_path: repo_path, reason: "prune failed" )
+							failed += 1
+						else
+							clear_batch_success( command: "prune", repo_path: repo_path )
+							succeeded += 1
+						end
 					rescue StandardError => e
 						puts_line "#{repo_name}: FAIL (#{e.message})"
+						record_batch_skip( command: "prune", repo_path: repo_path, reason: e.message )
 						failed += 1
 					end
 				end
@@ -227,7 +248,7 @@ module Carson
 				return hook_status unless hook_status == EXIT_OK
 				puts_line "Hooks installed (#{config.managed_hooks.count} hooks)."
 
-				template_drift_count = template_results.count { |entry| entry.fetch( :status ) != "ok" }
+				template_drift_count = template_results.count { it.fetch( :status ) != "ok" }
 				template_status = with_captured_output { template_apply! }
 				return template_status unless template_status == EXIT_OK
 				if template_drift_count.positive?

data/lib/carson/runtime/local/sync.rb

@@ -60,6 +60,7 @@ module Carson
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
 						puts_line "#{repo_name}: FAIL (path not found)"
+						record_batch_skip( command: "sync", repo_path: repo_path, reason: "path not found" )
 						failed += 1
 						next
 					end
@@ -69,13 +70,16 @@ module Carson
 						status = rt.sync!
 						if status == EXIT_OK
 							puts_line "#{repo_name}: ok" unless verbose?
+							clear_batch_success( command: "sync", repo_path: repo_path )
 							synced += 1
 						else
 							puts_line "#{repo_name}: FAIL" unless verbose?
+							record_batch_skip( command: "sync", repo_path: repo_path, reason: "sync failed" )
 							failed += 1
 						end
 					rescue StandardError => e
 						puts_line "#{repo_name}: FAIL (#{e.message})"
+						record_batch_skip( command: "sync", repo_path: repo_path, reason: e.message )
 						failed += 1
 					end
 				end

data/lib/carson/runtime/local/template.rb

@@ -18,8 +18,8 @@ module Carson
 				puts_verbose "[Template Sync Check]"
 				results = template_results
 				stale = template_superseded_present
-				drift_count = results.count { |entry| entry.fetch( :status ) == "drift" }
-				error_count = results.count { |entry| entry.fetch( :status ) == "error" }
+				drift_count = results.count { it.fetch( :status ) == "drift" }
+				error_count = results.count { it.fetch( :status ) == "error" }
 				stale_count = stale.count
 				results.each do |entry|
 					puts_verbose "template_file: #{entry.fetch( :file )} status=#{entry.fetch( :status )} reason=#{entry.fetch( :reason )}"
@@ -32,7 +32,7 @@ module Carson
 						summary_parts << "#{drift_count} of #{results.count} drifted" if drift_count.positive?
 						summary_parts << "#{stale_count} stale" if stale_count.positive?
 						puts_line "Templates: #{summary_parts.join( ", " )}"
-						results.select { |entry| entry.fetch( :status ) == "drift" }.each { |entry| puts_line "  #{entry.fetch( :file )}" }
+						results.select { it.fetch( :status ) == "drift" }.each { |entry| puts_line "  #{entry.fetch( :file )}" }
 						stale.each { |file| puts_line "  #{file} — superseded" }
 					else
 						puts_line "Templates: #{results.count} files in sync"
@@ -62,6 +62,7 @@ module Carson
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
 						puts_line "#{repo_name}: FAIL (path not found)"
+						record_batch_skip( command: "template_check", repo_path: repo_path, reason: "path not found" )
 						failed += 1
 						next
 					end
@@ -71,6 +72,7 @@ module Carson
 						status = rt.template_check!
 						if status == EXIT_OK
 							puts_line "#{repo_name}: in sync" unless verbose?
+							clear_batch_success( command: "template_check", repo_path: repo_path )
 							in_sync += 1
 						else
 							puts_line "#{repo_name}: DRIFT" unless verbose?
@@ -78,6 +80,7 @@ module Carson
 						end
 					rescue StandardError => e
 						puts_line "#{repo_name}: FAIL (#{e.message})"
+						record_batch_skip( command: "template_check", repo_path: repo_path, reason: e.message )
 						failed += 1
 					end
 				end
@@ -124,7 +127,7 @@ module Carson
 					removed += 1
 				end
 
-				error_count = results.count { |entry| entry.fetch( :status ) == "error" }
+				error_count = results.count { it.fetch( :status ) == "error" }
 				puts_verbose "template_apply_summary: updated=#{applied} removed=#{removed} error=#{error_count}"
 				unless verbose?
 					if applied.positive? || removed.positive?

data/lib/carson/runtime/local/worktree.rb

@@ -1,7 +1,8 @@
 # Safe worktree lifecycle management for coding agents.
 # Two operations: create and remove. Create auto-syncs main before branching.
-# Remove is safe by default — guards against CWD-inside-worktree and unpushed
-# commits. Content-aware: allows removal after squash/rebase merge without --force.
+# Remove is safe by default — guards against CWD-inside-worktree, cross-process
+# CWD holds, and unpushed commits. Content-aware: allows removal after
+# squash/rebase merge without --force.
 # Supports --json for machine-readable structured output with recovery commands.
 module Carson
 	class Runtime
@@ -78,12 +79,12 @@ module Carson
 				resolved_path = resolve_worktree_path( worktree_path: worktree_path )
 
 				# Missing directory: worktree was destroyed externally (e.g. gh pr merge
-			# --delete-branch). Clean up the stale git registration and delete the branch.
-			if !Dir.exist?( resolved_path ) && worktree_registered?( path: resolved_path )
-				return worktree_remove_missing!( resolved_path: resolved_path, json_output: json_output )
-			end
+				# --delete-branch). Clean up the stale git registration and delete the branch.
+				if !Dir.exist?( resolved_path ) && worktree_registered?( path: resolved_path )
+					return worktree_remove_missing!( resolved_path: resolved_path, json_output: json_output )
+				end
 
-			unless worktree_registered?( path: resolved_path )
+				unless worktree_registered?( path: resolved_path )
 					return worktree_finish(
 						result: { command: "worktree remove", status: "error", name: File.basename( resolved_path ),
 							error: "#{resolved_path} is not a registered worktree",
@@ -104,6 +105,18 @@ module Carson
 					)
 				end
 
+				# Safety: refuse if another process has its CWD inside the worktree.
+				# Protects against cross-process CWD crashes (e.g. an agent session
+				# removed by a separate cleanup process while the agent's shell is inside).
+				if worktree_held_by_other_process?( worktree_path: resolved_path )
+					return worktree_finish(
+						result: { command: "worktree remove", status: "block", name: File.basename( resolved_path ),
+							error: "another process has its working directory inside this worktree",
+							recovery: "wait for the other session to finish, then retry" },
+						exit_code: EXIT_BLOCK, json_output: json_output
+					)
+				end
+
 				branch = worktree_branch( path: resolved_path )
 				puts_verbose "worktree_remove: path=#{resolved_path} branch=#{branch} force=#{force}"
 
@@ -195,6 +208,7 @@ module Carson
 					next unless branch
 					next unless agent_prefixes.any? { |prefix| path.start_with?( prefix ) }
 					next if cwd_inside_worktree?( worktree_path: path )
+					next if worktree_held_by_other_process?( worktree_path: path )
 					next unless branch_absorbed_into_main?( branch: branch )
 
 					# Remove the worktree (no --force: refuses if dirty working tree).
@@ -303,6 +317,35 @@ module Carson
 				false
 			end
 
+			# Checks whether any other process has its working directory inside the worktree.
+			# Uses lsof to query CWD file descriptors system-wide, then matches against
+			# the worktree path. Catches the cross-process CWD crash scenario: a cleanup
+			# process removing a worktree while another session's shell is still inside it.
+			# Fails safe: returns false if lsof is unavailable or any error occurs.
+			def worktree_held_by_other_process?( worktree_path: )
+				canonical = realpath_safe( worktree_path )
+				return false if canonical.nil? || canonical.empty?
+				return false unless Dir.exist?( canonical )
+
+				stdout, _, status = Open3.capture3( "lsof", "-d", "cwd" )
+				return false unless status.success?
+
+				normalised = File.join( canonical, "" )
+				my_pid = Process.pid
+				stdout.lines.drop( 1 ).any? do |line|
+					fields = line.strip.split( /\s+/ )
+					next false unless fields.length >= 9
+					next false if fields[ 1 ].to_i == my_pid
+					name = fields[ 8.. ].join( " " )
+					name == canonical || name.start_with?( normalised )
+				end
+			rescue Errno::ENOENT
+				# lsof not installed.
+				false
+			rescue StandardError
+				false
+			end
+
 			# Checks whether a branch has unpushed commits that would be lost on removal.
 			# Content-aware: after squash/rebase merge, SHAs differ but tree content may match main. Compares content, not SHAs.
 			# Returns nil if safe, or { error:, recovery: } hash if unpushed work exists.

data/lib/carson/runtime/review/data_access.rb

@@ -1,3 +1,4 @@
+# GraphQL data access: PR details, pagination, and normalisation for review gate and sweep.
 module Carson
 	class Runtime
 		module Review

data/lib/carson/runtime/review/gate_support.rb

@@ -1,3 +1,4 @@
+# Review gate logic: snapshot convergence, disposition acknowledgements, and merge-readiness checks.
 module Carson
 	class Runtime
 		module Review
@@ -30,7 +31,7 @@ module Carson
 					unresolved_threads = unresolved_thread_entries( details: details )
 					actionable_top_level = actionable_top_level_items( details: details, pr_author: pr_author )
 					acknowledgements = disposition_acknowledgements( details: details, pr_author: pr_author )
-					unacknowledged_actionable = actionable_top_level.reject { |item| acknowledged_by_disposition?( item: item, acknowledgements: acknowledgements ) }
+					unacknowledged_actionable = actionable_top_level.reject { acknowledged_by_disposition?( item: it, acknowledgements: acknowledgements ) }
 					{
 						latest_activity: latest_review_activity( details: details ),
 						unresolved_threads: unresolved_threads,
@@ -44,8 +45,8 @@ module Carson
 				def review_gate_signature( snapshot: )
 					{
 						latest_activity: snapshot.fetch( :latest_activity ).to_s,
-						unresolved_urls: snapshot.fetch( :unresolved_threads ).map { |entry| entry.fetch( :url ) }.sort,
-						unacknowledged_urls: snapshot.fetch( :unacknowledged_actionable ).map { |entry| entry.fetch( :url ) }.sort
+						unresolved_urls: snapshot.fetch( :unresolved_threads ).map { it.fetch( :url ) }.sort,
+						unacknowledged_urls: snapshot.fetch( :unacknowledged_actionable ).map { it.fetch( :url ) }.sort
 					}
 				end
 
@@ -67,7 +68,7 @@ module Carson
 				end
 
 				def bot_username?( author: )
-					config.review_bot_usernames.any? { |bot| bot.downcase == author.to_s.downcase }
+					config.review_bot_usernames.any? { it.downcase == author.to_s.downcase }
 				end
 
 				def unresolved_thread_entries( details: )
@@ -78,7 +79,7 @@ module Carson
 						comments = thread.fetch( :comments )
 						first_comment = comments.first || {}
 						next if bot_username?( author: first_comment.fetch( :author, "" ) )
-						latest_time = comments.map { |entry| entry.fetch( :created_at ) }.max.to_s
+						latest_time = comments.map { it.fetch( :created_at ) }.max.to_s
 						{
 							url: blank_to( value: first_comment.fetch( :url, "" ), default: "#{details.fetch( :url )}#thread-#{index + 1}" ),
 							author: first_comment.fetch( :author, "" ),
@@ -130,7 +131,7 @@ module Carson
 					sources = []
 					sources.concat( Array( details.fetch( :comments ) ) )
 					sources.concat( Array( details.fetch( :reviews ) ) )
-					sources.concat( Array( details.fetch( :review_threads ) ).flat_map { |thread| thread.fetch( :comments ) } )
+					sources.concat( Array( details.fetch( :review_threads ) ).flat_map { it.fetch( :comments ) } )
 					sources.map do |entry|
 						next unless entry.fetch( :author, "" ) == pr_author
 						body = entry.fetch( :body, "" ).to_s
@@ -151,7 +152,7 @@ module Carson
 				# True when any disposition acknowledgement references the specific finding URL.
 				def acknowledged_by_disposition?( item:, acknowledgements: )
 					acknowledgements.any? do |ack|
-						Array( ack.fetch( :target_urls ) ).any? { |url| url == item.fetch( :url ) }
+						Array( ack.fetch( :target_urls ) ).any? { it == item.fetch( :url ) }
 					end
 				end
 
@@ -159,10 +160,10 @@ module Carson
 				def latest_review_activity( details: )
 					timestamps = []
 					timestamps << details.fetch( :updated_at )
-					timestamps.concat( Array( details.fetch( :comments ) ).map { |entry| entry.fetch( :created_at ) } )
-					timestamps.concat( Array( details.fetch( :reviews ) ).map { |entry| entry.fetch( :created_at ) } )
-					timestamps.concat( Array( details.fetch( :review_threads ) ).flat_map { |thread| thread.fetch( :comments ) }.map { |entry| entry.fetch( :created_at ) } )
-					timestamps.map { |text| parse_time_or_nil( text: text ) }.compact.max&.utc&.iso8601
+					timestamps.concat( Array( details.fetch( :comments ) ).map { it.fetch( :created_at ) } )
+					timestamps.concat( Array( details.fetch( :reviews ) ).map { it.fetch( :created_at ) } )
+					timestamps.concat( Array( details.fetch( :review_threads ) ).flat_map { it.fetch( :comments ) }.map { it.fetch( :created_at ) } )
+					timestamps.map { parse_time_or_nil( text: it ) }.compact.max&.utc&.iso8601
 				end
 
 				# Writes review gate artefacts using fixed report names in global report output.
@@ -208,7 +209,7 @@ module Carson
 					if report.fetch( :block_reasons ).empty?
 						lines << "- none"
 					else
-						report.fetch( :block_reasons ).each { |reason| lines << "- #{reason}" }
+						report.fetch( :block_reasons ).each { lines << "- #{it}" }
 					end
 					lines << ""
 					lines << "## Unresolved Threads"

data/lib/carson/runtime/review/query_text.rb

@@ -1,3 +1,4 @@
+# GraphQL query templates for pull request review data retrieval.
 module Carson
 	class Runtime
 		module Review

data/lib/carson/runtime/review/sweep_support.rb

@@ -1,3 +1,4 @@
+# Review sweep: late-event detection, tracking issue management, and sweep reporting.
 module Carson
 	class Runtime
 		module Review
@@ -59,7 +60,7 @@ module Carson
 						)
 					end
 
-					Array( details.fetch( :review_threads ) ).flat_map { |thread| thread.fetch( :comments ) }.each do |comment|
+					Array( details.fetch( :review_threads ) ).flat_map { it.fetch( :comments ) }.each do |comment|
 						next if comment.fetch( :author ) == pr_author
 						next if bot_username?( author: comment.fetch( :author ) )
 						hits = matched_risk_keywords( text: comment.fetch( :body ) )
@@ -152,7 +153,7 @@ module Carson
 					stdout_text, stderr_text, success, = gh_run( "issue", "list", "--repo", repo_slug, "--state", "all", "--limit", "100", "--json", "number,title,state,url,labels" )
 					raise gh_error_text( stdout_text: stdout_text, stderr_text: stderr_text, fallback: "unable to list issues for review sweep" ) unless success
 					issues = Array( JSON.parse( stdout_text ) )
-					node = issues.find { |entry| entry[ "title" ].to_s == config.review_tracking_issue_title }
+					node = issues.find { it[ "title" ].to_s == config.review_tracking_issue_title }
 					return nil if node.nil?
 					{
 						number: node[ "number" ],

data/lib/carson/runtime/review/utility.rb

@@ -1,3 +1,4 @@
+# Review utilities: risk keyword matching, disposition parsing, URL extraction, and deduplication.
 module Carson
 	class Runtime
 		module Review
@@ -24,7 +25,7 @@ module Carson
 
 				# GitHub URL extraction for mapping disposition acknowledgements to finding URLs.
 				def extract_github_urls( text: )
-					text.to_s.scan( %r{https://github\.com/[^\s\)\]]+} ).map { |value| value.sub( /[.,;:]+$/, "" ) }.uniq
+					text.to_s.scan( %r{https://github\.com/[^\s\)\]]+} ).map { it.sub( /[.,;:]+$/, "" ) }.uniq
 				end
 
 				# Parse RFC3339 timestamps and return nil on blank/invalid values.

data/lib/carson/runtime/setup.rb

@@ -137,7 +137,7 @@ module Carson
 					{ label: "branch — enforce PR-only merges (default)", value: "branch" },
 					{ label: "trunk — commit directly to main", value: "trunk" }
 				]
-				default_index = options.index { |o| o.fetch( :value ) == current } || 0
+				default_index = options.index { it.fetch( :value ) == current } || 0
 				prompt_choice( options: options, default: default_index )
 			end
 
@@ -151,7 +151,7 @@ module Carson
 					{ label: "rebase — linear history, individual commits", value: "rebase" },
 					{ label: "merge — merge commits", value: "merge" }
 				]
-				default_index = options.index { |o| o.fetch( :value ) == current } || 0
+				default_index = options.index { it.fetch( :value ) == current } || 0
 				prompt_choice( options: options, default: default_index )
 			end
 
@@ -219,7 +219,7 @@ module Carson
 						others << entry
 					end
 				end
-				well_known.sort_by { |e| WELL_KNOWN_REMOTES.index( e.fetch( :name ) ) || 999 } + others.sort_by { |e| e.fetch( :name ) }
+				well_known.sort_by { WELL_KNOWN_REMOTES.index( it.fetch( :name ) ) || 999 } + others.sort_by { it.fetch( :name ) }
 			end
 
 			# Normalises a remote URL so SSH and HTTPS variants of the same host/path compare equal.
@@ -295,7 +295,7 @@ module Carson
 
 			def detect_git_remote
 				remotes = list_git_remotes
-				remote_names = remotes.map { |entry| entry.fetch( :name ) }
+				remote_names = remotes.map { it.fetch( :name ) }
 				return nil if remote_names.empty?
 
 				return config.git_remote if remote_names.include?( config.git_remote )

data/lib/carson/runtime/status.rb

@@ -49,6 +49,7 @@ module Carson
 				puts_line "Carson #{Carson::VERSION} — Portfolio (#{repos.length} repo#{plural_suffix( count: repos.length )})"
 				puts_line ""
 
+				all_pending = load_batch_pending
 				repos.each do |repo_path|
 					repo_name = File.basename( repo_path )
 					unless Dir.exist?( repo_path )
@@ -68,6 +69,10 @@ module Carson
 						parts << "#{worktrees.count} worktree#{plural_suffix( count: worktrees.count )}" if worktrees.any?
 						parts << "templates #{gov.fetch( :templates )}" unless gov.fetch( :templates ) == :in_sync
 						puts_line "#{repo_name}: #{parts.join( '  ' )}"
+
+						# Show pending operations for this repo.
+						repo_pending = status_pending_for_repo( all_pending: all_pending, repo_path: repo_path )
+						repo_pending.each { |desc| puts_line "  pending: #{desc}" }
 					rescue StandardError => e
 						puts_line "#{repo_name}: FAIL (#{e.message})"
 					end
@@ -78,6 +83,21 @@ module Carson
 
 		private
 
+			# Returns an array of human-readable pending descriptions for a repo.
+			def status_pending_for_repo( all_pending:, repo_path: )
+				descriptions = []
+				all_pending.each do |command, repos|
+					next unless repos.is_a?( Hash ) && repos.key?( repo_path )
+
+					info = repos[ repo_path ]
+					attempts = info.fetch( "attempts", 0 )
+					skipped_at = info.fetch( "skipped_at", nil )
+					time_part = skipped_at ? ", since #{skipped_at[ 11..15 ]}" : ""
+					descriptions << "#{command} (#{attempts} attempt#{attempts == 1 ? '' : 's'}#{time_part})"
+				end
+				descriptions
+			end
+
 			# Collects all status facets into a structured hash.
 			def gather_status
 				data = {
@@ -129,15 +149,10 @@ module Carson
 				ahead = parts[ 0 ].to_i
 				behind = parts[ 1 ].to_i
 
-				if ahead.zero? && behind.zero?
-					:in_sync
-				elsif ahead.positive? && behind.zero?
-					:ahead
-				elsif ahead.zero? && behind.positive?
-					:behind
-				else
-					:diverged
-				end
+				return :in_sync if ahead.zero? && behind.zero?
+				return :ahead if behind.zero?
+				return :behind if ahead.zero?
+				:diverged
 			end
 
 			# Lists all worktrees with branch name.
@@ -147,7 +162,7 @@ module Carson
 				# Filter out the main worktree (the repository root itself).
 				# Use realpath for comparison — git returns canonical paths that may differ from repo_root.
 				canonical_root = realpath_safe( repo_root )
-				entries.reject { |wt| wt.fetch( :path ) == canonical_root }.map do |wt|
+				entries.reject { it.fetch( :path ) == canonical_root }.map do |wt|
 					{
 						path: wt.fetch( :path ),
 						name: File.basename( wt.fetch( :path ) ),
@@ -185,9 +200,9 @@ module Carson
 				entries = Array( rollup )
 				return :none if entries.empty?
 
-				states = entries.map { |c| c[ "conclusion" ].to_s.upcase }
-				return :fail if states.any? { |s| s == "FAILURE" || s == "CANCELLED" || s == "TIMED_OUT" }
-				return :pending if states.any? { |s| s == "" || s == "PENDING" || s == "QUEUED" || s == "IN_PROGRESS" }
+				states = entries.map { it[ "conclusion" ].to_s.upcase }
+				return :fail if states.any? { it == "FAILURE" || it == "CANCELLED" || it == "TIMED_OUT" }
+				return :pending if states.any? { it == "" || it == "PENDING" || it == "QUEUED" || it == "IN_PROGRESS" }
 
 				:pass
 			end

data/lib/carson/runtime.rb

@@ -213,6 +213,70 @@ module Carson
 			github_adapter.run( *args )
 		end
 
+		# --- Batch pending tracking (shared by all --all commands) ---
+
+		# Path to the persistent pending log for batch operations.
+		def batch_pending_path
+			File.join( report_dir_path, "batch_pending.json" )
+		end
+
+		# Reads and parses the pending log. Returns empty hash if missing or corrupt.
+		def load_batch_pending
+			path = batch_pending_path
+			return {} unless File.file?( path )
+
+			JSON.parse( File.read( path ) )
+		rescue StandardError
+			{}
+		end
+
+		# Writes the pending log atomically.
+		def save_batch_pending( data )
+			path = batch_pending_path
+			FileUtils.mkdir_p( File.dirname( path ) )
+			tmp = "#{path}.tmp"
+			File.write( tmp, JSON.pretty_generate( data ) )
+			File.rename( tmp, path )
+		end
+
+		# Adds or updates an entry in the pending log, incrementing attempts.
+		def record_batch_skip( command:, repo_path:, reason: )
+			data = load_batch_pending
+			data[ command ] ||= {}
+			existing = data[ command ][ repo_path ]
+			attempts = existing ? existing.fetch( "attempts", 0 ) + 1 : 1
+			data[ command ][ repo_path ] = {
+				"skipped_at" => Time.now.utc.iso8601,
+				"reason" => reason,
+				"attempts" => attempts
+			}
+			save_batch_pending( data )
+		end
+
+		# Removes an entry from the pending log after successful completion.
+		def clear_batch_success( command:, repo_path: )
+			data = load_batch_pending
+			return unless data.key?( command )
+
+			data[ command ].delete( repo_path )
+			data.delete( command ) if data[ command ].empty?
+			save_batch_pending( data )
+		end
+
+		# Returns array of pending repo info hashes for a command.
+		def pending_repos_for( command: )
+			data = load_batch_pending
+			entries = data.fetch( command, {} )
+			entries.map do |path, info|
+				{
+					path: path,
+					reason: info.fetch( "reason", "unknown" ),
+					skipped_at: info.fetch( "skipped_at", nil ),
+					attempts: info.fetch( "attempts", 0 )
+				}
+			end
+		end
+
 		# --- Portfolio helpers (shared by all --all commands) ---
 
 		# Checks whether a governed repo is safe for batch operations.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 3.18.0
+  version: 3.20.0
 platform: ruby
 authors:
 - Hailei Wang