carson 3.28.0 → 3.29.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a58a0b99b9cd8c7e241c6278f9b72fd4a6188cf45a51f22a5cb88bb6a83a703a
-  data.tar.gz: 0203fbacb58d17d33f58e90f4b868ad7065c086d0fb0963100eb0cac7f4d5f51
+  metadata.gz: 9d026cfc1581b568aaa9459ab21faf0d4f52d1026995b5ce62f21dca0072853a
+  data.tar.gz: '08bdaaebab6ccaf1dac6768057f55acf3833ddbe903001b2ca3934551f280bae'
 SHA512:
-  metadata.gz: 356111e22c7bf14aac077ebc02b80554713c1228dc7ab36688abdd8fb199e40e9c9965f1da0398e2736545b1bf9ffb38dee11f36081f8d781acc7c23e11d506e
-  data.tar.gz: 2476eae596465a0f3b7256646a7ed8364c709ed6279a3183da6ea4636dc05129cb7168d9e6dc2eee701ff4f05d56ec13e94a0c86719b0ec0dc82ce967548ab1c
+  metadata.gz: 68d7fd88800a7a2756466ae88e3be1baae2df66b25d285cd54b676b6506d1ee86c69a110bf4f040c8259fc9dc8aa623120b0150b4a73c3081460c080940bfb2b
+  data.tar.gz: 35403e45bad7632031bbc9c56a8aece6e7b3dc7eafa1c36c4f183bc7c6271beb1b39d4b35985373cb9be0baee3b8cc58491920bb2f63dcf852fb20c4198c33ed

data/.github/workflows/carson_policy.yml

@@ -27,13 +27,13 @@ jobs:
 
     steps:
       - name: Checkout host repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: host
           fetch-depth: 0
 
       - name: Checkout Carson runtime
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: wanghailei/carson
           ref: ${{ inputs.carson_ref }}

data/API.md

@@ -52,7 +52,7 @@ All batch commands operate across every governed repository registered in `gover
 | `carson template check --all` | Read-only template drift detection across all governed repos. |
 | `carson housekeep --all [--loop SECONDS]` | Attempt sync, then reap worktrees with strong abandonment evidence, reconcile integrated delivery worktree records from the ledger, and prune across all governed repos. Safe cleanup still runs when sync is blocked. |
 
-`--loop SECONDS` runs the housekeep cycle continuously, sleeping SECONDS between cycles. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` with a cycle count summary.
+`--loop SECONDS` runs the housekeep cycle continuously, sleeping SECONDS between cycles. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` or `SIGTERM` with a cycle count summary.
 
 ### Govern commands
 
@@ -60,7 +60,7 @@ All batch commands operate across every governed repository registered in `gover
 |---|---|
 | `carson govern [--dry-run] [--json] [--loop SECONDS]` | Portfolio-level delivery oversight: assess active deliveries, integrate ready branches, dispatch revisions, and escalate blocked work. Live integrated rows include merge proof. |
 
-`--loop SECONDS` runs the govern cycle continuously, sleeping SECONDS between cycles. The loop isolates errors per cycle — a single failing cycle does not stop the daemon. `Ctrl-C` cleanly exits with a cycle count summary. SECONDS must be a positive integer.
+`--loop SECONDS` runs the govern cycle continuously, sleeping SECONDS between cycles. The loop isolates errors per cycle — a single failing cycle does not stop the daemon. `Ctrl-C` or `SIGTERM` cleanly exits with a cycle count summary. SECONDS must be a positive integer.
 
 Governed integration is fixed to `squash`. Non-squash `govern.merge.method` values are rejected by config validation.
 

data/MANUAL.md

@@ -66,12 +66,12 @@ on:
 
 jobs:
   governance:
-    uses: wanghailei/carson/.github/workflows/carson_policy.yml@v3.28.0
+    uses: wanghailei/carson/.github/workflows/carson_policy.yml@v3.29.0
     secrets:
       CARSON_READ_TOKEN: ${{ secrets.CARSON_READ_TOKEN }}
     with:
-      carson_ref: "v3.28.0"
-      carson_version: "3.28.0"
+      carson_ref: "v3.29.0"
+      carson_version: "3.29.0"
       rubocop_version: "1.81.0"
 ```
 
@@ -209,11 +209,13 @@ carson abandon feature/stale-work
 
 `abandon` closes the PR when it is still open, removes the matching worktree when safe, deletes the local and remote branch refs when allowed, and marks the delivery as failed in Carson's ledger.
 
-**Safety guards** — `worktree remove` blocks when:
+`abandon` is an intentional discard: committed-but-unpushed branch work does not block abandonment. Typing `carson abandon` is explicit consent to discard committed work on that branch.
+
+**Safety guards** — `abandon` blocks when:
 - Shell CWD is inside the worktree (prevents session crash).
-- Branch has unpushed commits with content that differs from main (prevents data loss).
+- Worktree has uncommitted changes (prevents accidental loss of unsaved work).
 
-After squash or rebase merge, the content matches main — removal proceeds without `--force`.
+Committed-but-unpushed work is treated as intentional discard — `abandon` proceeds. The `worktree remove` command retains its own unpushed-commit guard and `--force` override for manual cleanup outside the abandon flow.
 
 **Stale worktree recovery** — if a worktree directory is destroyed externally (for example by a raw GitHub merge/delete flow), `worktree remove`, `worktree list`, `housekeep`, and `prune` handle the stale entry gracefully: they clean up the git registration and delete the branch without error when Carson has enough evidence. Use Carson's delivery and cleanup commands instead of raw `gh pr merge --delete-branch` so the worktree directory stays intact for orderly cleanup.
 
@@ -299,7 +301,7 @@ carson housekeep --all --loop 300   # housekeep every 5 minutes
 
 `refresh --all` checks each repo for safety before operating: repos with active worktrees or uncommitted changes are skipped with clear reasons. Other batch commands attempt each repo and report failures without stopping.
 
-`housekeep --all --loop SECONDS` runs the full housekeep cycle continuously, sleeping SECONDS between passes. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` with a cycle count summary.
+`housekeep --all --loop SECONDS` runs the full housekeep cycle continuously, sleeping SECONDS between passes. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` or `SIGTERM` with a cycle count summary.
 
 **Periodic maintenance:**
 
@@ -319,7 +321,7 @@ carson govern --loop 300 --dry-run    # observe mode, no integration or revision
 
 The loop is built-in and cross-platform — no cron, launchd, or Task Scheduler required. Run it in a terminal, tmux, screen, or as a system service.
 
-Each cycle runs independently: if one cycle fails (network error, GitHub API timeout), the error is logged and the next cycle proceeds normally. Press `Ctrl-C` to stop — Carson exits cleanly with a cycle count summary.
+Each cycle runs independently: if one cycle fails (network error, GitHub API timeout), the error is logged and the next cycle proceeds normally. Press `Ctrl-C` or send `SIGTERM` to stop — Carson exits cleanly with a cycle count summary.
 
 ### Govern and Coding Agents
 

data/RELEASE.md

@@ -5,6 +5,19 @@ Release-note scope rule:
 - `RELEASE.md` records only version deltas, breaking changes, and migration actions.
 - Operational usage guides live in `MANUAL.md` and `API.md`.
 
+## 3.29.0
+
+### What changed
+
+- **Govern and housekeep loops are clearer and safer to run unattended** — `carson govern --loop` now prints per-delivery progress hints and a sleep announcement with the next-cycle timestamp, and both `govern --loop` and `housekeep --all --loop` now stop cleanly on `SIGTERM` as well as `Ctrl-C`.
+- **Govern and worktree creation no longer mutate the user's main worktree behind their back** — govern now fetches instead of syncing/pruning after merges, worktree creation branches from the remote tracking ref instead of pulling on main, and revision dispatch now defers when the target worktree is busy or dirty.
+- **Abandon guidance now matches the actual safety contract** — `carson abandon` no longer suggests an unsupported `--force`, and committed-but-unpushed branch work no longer blocks abandonment; only dirty worktree changes do.
+- **CI and release workflows are hardened for the Node 24 transition** — GitHub Actions checkouts now use `actions/checkout@v6`, Carson includes a dedicated forced-Node-24 probe for the RubyGems credentials action before changing the release path, and the standalone review smoke script now seeds its temporary `main` branch without tripping the shared main-branch commit guard.
+
+### No migration required
+
+- Existing workflows continue to work unchanged.
+
 ## 3.28.0
 
 ### What changed

data/VERSION

@@ -1 +1 @@
-3.28.0
+3.29.0

data/lib/carson/ledger.rb

@@ -274,6 +274,11 @@ module Carson
 		end
 
 		def migrate_legacy_state_if_needed!
+			# Skip lock acquisition entirely when no legacy SQLite file exists.
+			# Read-only file checks are safe without the lock; the migration
+			# itself is idempotent so a narrow race is harmless.
+			return unless state_path_requires_migration?
+
 			with_state_lock do |lock_file|
 				lock_file.flock( File::LOCK_EX )
 				source_path = legacy_sqlite_source_path

data/lib/carson/runtime/abandon.rb

@@ -44,7 +44,7 @@ module Carson
 
 				if worktree
 					remove_exit = with_captured_output do
-						worktree_remove!( worktree_path: worktree.path, json_output: false )
+						worktree_remove!( worktree_path: worktree.path, skip_unpushed: true, json_output: false )
 					end
 					unless remove_exit == EXIT_OK
 						result[ :error ] = "worktree cleanup failed for #{worktree.path}"
@@ -131,29 +131,32 @@ module Carson
 				nil
 			end
 
+			# Abandon is an intentional discard: committed-but-unpushed work
+			# does not block abandonment. Only uncommitted (dirty) worktree
+			# changes block, because those may be accidental.
 			def abandon_preflight_issue( branch:, worktree: )
 				if config.protected_branches.include?( branch )
 					return { exit_code: EXIT_BLOCK, error: "cannot abandon protected branch #{branch}", recovery: "choose a feature branch instead" }
 				end
 
 				if worktree
-					check = Worktree.remove_check( path: worktree.path, runtime: self, force: false )
+					check = Worktree.remove_check( path: worktree.path, runtime: self, force: false, skip_unpushed: true )
 					return nil if check.fetch( :status ) == :ok
 
+					recovery = check.fetch( :recovery )
+					if check.fetch( :error ) == "worktree has uncommitted changes"
+						recovery = "commit or discard the changes, then retry carson abandon #{branch}"
+					end
+
 					return {
 						exit_code: check.fetch( :exit_code ),
 						error: check.fetch( :error ),
-						recovery: check.fetch( :recovery )
+						recovery: recovery
 					}
 				end
 
 				return { exit_code: EXIT_BLOCK, error: "current branch is #{branch}", recovery: "switch to main or a different branch, then retry" } if current_branch == branch
-				return nil unless local_branch_exists?( branch: branch )
-
-				unpushed = Worktree.branch_unpushed_issue( branch: branch, worktree_path: repo_root, runtime: self )
-				return nil if unpushed.nil?
-
-				{ exit_code: EXIT_BLOCK, error: unpushed.fetch( :error ), recovery: unpushed.fetch( :recovery ) }
+				nil
 			end
 
 			def close_pull_request!( number:, result: )

data/lib/carson/runtime/govern.rb

@@ -39,17 +39,17 @@ module Carson
 			end
 
 			def govern_loop!( dry_run:, json_output:, loop_seconds: )
-				cycle_count = 0
-				loop do
-					cycle_count += 1
-					puts_line ""
-					puts_line "cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}"
+				run_signal_aware_loop!(
+					loop_name: "govern",
+					loop_seconds: loop_seconds,
+					cycle_line: ->( cycle_count ) { "cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}" },
+					sleep_line: ->( seconds ) do
+						next_at = Time.now + seconds
+						"sleeping #{seconds}s — next cycle at #{next_at.strftime( '%Y-%m-%d %H:%M:%S %z' )}"
+					end
+				) do
 					govern_cycle!( dry_run: dry_run, json_output: json_output )
-					sleep loop_seconds
 				end
-			rescue Interrupt
-				puts_line "govern loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
-				EXIT_OK
 			end
 
 		private
@@ -85,6 +85,8 @@ module Carson
 				next_to_integrate = reconciled.find( &:ready? )&.key
 
 				reconciled.each do |delivery|
+					hint = delivery_action_hint( delivery: delivery, next_to_integrate: next_to_integrate, dry_run: dry_run )
+					puts_line "  #{delivery.branch} — #{hint}" if hint && !silent
 					delivery_report = scoped_runtime.send(
 						:decide_delivery_action,
 						delivery: delivery,
@@ -246,15 +248,10 @@ module Carson
 						pull_request_draft: false,
 						pull_request_merged_at: Time.now.utc.iso8601
 					)
-					housekeep_result = housekeep_repo!( repo_path: repo_path )
-					proof = if housekeep_result.is_a?( Hash ) && housekeep_result[ :sync_status ] != "ok"
-						merge_proof_unavailable(
-							main_ref: config.main_branch,
-							summary: "proof unavailable — local #{config.main_branch} sync did not complete."
-						)
-					else
-						merge_proof_for_branch( branch: integrated.branch, main_ref: config.main_branch )
-					end
+					# Fetch-only: update the remote tracking ref without mutating the
+					# main worktree. Reap and prune are deferred to explicit housekeep.
+					fetch_for_merge_proof!( repo_path: repo_path )
+					proof = merge_proof_for_remote_ref( branch: integrated.branch )
 					ledger.update_delivery(
 						delivery: integrated,
 						merge_proof: proof
@@ -274,6 +271,27 @@ module Carson
 				return escalate_delivery!( delivery: delivery, reason: "no agent provider available" ) if provider.nil?
 				return escalate_delivery!( delivery: delivery, reason: "worktree missing for revision" ) unless File.directory?( delivery.worktree_path.to_s )
 
+				# Defer if the target worktree is occupied — temporary hold, not failure.
+				worktree = Carson::Worktree.find( path: delivery.worktree_path.to_s, runtime: self )
+				if worktree
+					if worktree.held_by_other_process?
+						return ledger.update_delivery(
+							delivery: delivery,
+							status: "gated",
+							cause: "busy",
+							summary: "worktree held by another process — deferring revision"
+						)
+					end
+					if worktree.dirty?
+						return ledger.update_delivery(
+							delivery: delivery,
+							status: "gated",
+							cause: "busy",
+							summary: "worktree has uncommitted changes — deferring revision"
+						)
+					end
+				end
+
 				objective = revision_objective( cause: delivery.cause )
 				context = evidence( delivery: delivery, repo_path: repo_path, objective: objective )
 				work_order = Adapters::Agent::WorkOrder.new(
@@ -340,7 +358,16 @@ module Carson
 			end
 
 				def held_delivery?( delivery: )
-					[ "merge", "freshness" ].include?( delivery.cause )
+					[ "merge", "freshness", "busy" ].include?( delivery.cause )
+				end
+
+				def delivery_action_hint( delivery:, next_to_integrate:, dry_run: )
+					return nil if dry_run
+					return nil if delivery.superseded? || delivery.integrated? || delivery.failed?
+					return "integrating…" if delivery.ready? && delivery.key == next_to_integrate
+					return nil unless delivery.blocked?
+					return nil if held_delivery?( delivery: delivery )
+					delivery.revision_count >= 3 ? "escalating…" : "revising…"
 				end
 
 			def housekeep_repo!( repo_path: )
@@ -348,6 +375,15 @@ module Carson
 				scoped_runtime.send( :housekeep_one_entry, repo_path: repo_path, silent: true )
 			end
 
+			# Fetch-only helper for post-merge proof generation.
+			# Updates the remote tracking ref without mutating the main worktree.
+			def fetch_for_merge_proof!( repo_path: )
+				scoped = repo_runtime_for( repo_path: repo_path )
+				scoped.send( :git_run, "fetch", scoped.config.git_remote, "--prune" )
+			rescue StandardError
+				# Best-effort — merge proof falls back to unavailable if fetch fails.
+			end
+
 			def select_agent_provider
 				provider = config.govern_agent_provider
 				case provider

data/lib/carson/runtime/housekeep.rb

@@ -81,17 +81,13 @@ module Carson
 			end
 
 			def housekeep_loop!( json_output:, dry_run:, loop_seconds: )
-				cycle_count = 0
-				loop do
-					cycle_count += 1
-					puts_line ""
-					puts_line "housekeep cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}"
+				run_signal_aware_loop!(
+					loop_name: "housekeep",
+					loop_seconds: loop_seconds,
+					cycle_line: ->( cycle_count ) { "housekeep cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}" }
+				) do
 					housekeep_all!( json_output: json_output, dry_run: dry_run )
-					sleep loop_seconds
 				end
-			rescue Interrupt
-				puts_line "housekeep loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
-				EXIT_OK
 			end
 
 			# Prints a dry-run plan for this repo without making any changes.

data/lib/carson/runtime/local/merge_proof.rb

@@ -2,6 +2,24 @@
 module Carson
 	class Runtime
 		module Local
+			# Generates merge proof against the remote tracking ref directly.
+			# Skips the local-main trust check — the caller is responsible for
+			# fetching before calling. Used by govern's post-merge path to avoid
+			# mutating the main worktree.
+			def merge_proof_for_remote_ref( branch:, remote: config.git_remote, main_ref: config.main_branch )
+				remote_ref = "#{remote}/#{main_ref}"
+				return merge_proof_not_applicable( main_ref: main_ref ) if branch.to_s == main_ref.to_s
+
+				candidate = merge_proof_candidate( branch: branch, main_ref: remote_ref )
+				return candidate if candidate.fetch( :basis ) == "unavailable"
+
+				# Normalise display: show the local branch name, not the remote tracking ref.
+				candidate.merge(
+					main_branch: main_ref,
+					summary: candidate.fetch( :summary ).gsub( remote_ref, main_ref )
+				)
+			end
+
 			def merge_proof_for_branch( branch:, main_ref: config.main_branch )
 				return merge_proof_not_applicable( main_ref: main_ref ) if branch.to_s == main_ref.to_s
 

data/lib/carson/runtime/local/worktree.rb

@@ -14,8 +14,8 @@ module Carson
 			end
 
 			# Removes a worktree: directory, git registration, and branch.
-			def worktree_remove!( worktree_path:, force: false, json_output: false )
-				Worktree.remove!( path: worktree_path, runtime: self, force: force, json_output: json_output )
+			def worktree_remove!( worktree_path:, force: false, skip_unpushed: false, json_output: false )
+				Worktree.remove!( path: worktree_path, runtime: self, force: force, skip_unpushed: skip_unpushed, json_output: json_output )
 			end
 
 			# Removes agent-owned worktrees whose branch content is already on main.

data/lib/carson/runtime/loop_runner.rb

@@ -0,0 +1,90 @@
+# Shared loop runner for commands that poll on a schedule.
+module Carson
+	class Runtime
+		module LoopRunner
+			LOOP_STOP_SIGNALS = %w[INT TERM].freeze
+			LOOP_SLEEP_SLICE_SECONDS = 0.25
+
+		private
+
+			def run_signal_aware_loop!( loop_name:, loop_seconds:, cycle_line:, sleep_line: nil )
+				cycle_count = 0
+				stop_requested = false
+				previous_handlers = install_loop_stop_handlers! do
+					stop_requested = true
+				end
+
+				loop do
+					break if stop_requested
+
+					cycle_count += 1
+					puts_line ""
+					puts_line cycle_line.call( cycle_count )
+					yield cycle_count
+					break if stop_requested
+
+					puts_line sleep_line.call( loop_seconds ) if sleep_line
+					loop_runner_wait( seconds: loop_seconds ) { stop_requested }
+				end
+
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			rescue Interrupt
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			rescue SignalException => exception
+				raise unless graceful_loop_signal?( exception )
+
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			ensure
+				restore_loop_stop_handlers!( previous_handlers ) if previous_handlers
+			end
+
+			def install_loop_stop_handlers!
+				LOOP_STOP_SIGNALS.each_with_object( {} ) do |signal_name, handlers|
+					handlers[ signal_name ] = loop_runner_trap( signal_name ) { yield signal_name }
+				end
+			end
+
+			def restore_loop_stop_handlers!( previous_handlers )
+				previous_handlers.each do |signal_name, previous_handler|
+					loop_runner_trap( signal_name, previous_handler )
+				end
+			end
+
+			def graceful_loop_signal?( exception )
+				signo = exception.respond_to?( :signo ) ? exception.signo : nil
+				LOOP_STOP_SIGNALS.any? do |signal_name|
+					Signal.list.fetch( signal_name, nil ) == signo
+				end
+			end
+
+			def loop_runner_wait( seconds: )
+				deadline = loop_runner_monotonic_now + seconds.to_f
+				while ( remaining = deadline - loop_runner_monotonic_now ) > 0
+					break if block_given? && yield
+					loop_runner_sleep( [ remaining, LOOP_SLEEP_SLICE_SECONDS ].min )
+				end
+			end
+
+			def loop_runner_trap( signal_name, handler = nil, &block )
+				if handler
+					Signal.trap( signal_name, handler )
+				else
+					Signal.trap( signal_name, &block )
+				end
+			end
+
+			def loop_runner_monotonic_now
+				Process.clock_gettime( Process::CLOCK_MONOTONIC )
+			end
+
+			def loop_runner_sleep( seconds )
+				sleep seconds
+			end
+		end
+
+		include LoopRunner
+	end
+end

data/lib/carson/runtime.rb

@@ -33,11 +33,17 @@ module Carson
 			@config = Config.load( repo_root: repo_root )
 			@git_adapter = Adapters::Git.new( repo_root: repo_root )
 			@github_adapter = Adapters::GitHub.new( repo_root: repo_root )
-			@ledger = Ledger.new( path: @config.govern_state_path )
 			@template_sync_result = nil
 		end
 
-		attr_reader :template_sync_result, :ledger
+		attr_reader :template_sync_result
+
+		# Lazy ledger: only constructed when a command actually needs delivery state.
+		# Read-only commands (worktree list, audit, prune, sync) never touch the
+		# govern state lock file.
+		def ledger
+			@ledger ||= Ledger.new( path: @config.govern_state_path )
+		end
 
 	private
 
@@ -364,6 +370,7 @@ end
 
 require_relative "runtime/local"
 require_relative "runtime/audit"
+require_relative "runtime/loop_runner"
 require_relative "runtime/housekeep"
 require_relative "runtime/repos"
 require_relative "runtime/review"

data/lib/carson/worktree.rb

@@ -96,12 +96,23 @@ module Carson
 			# Determine the base branch (main branch from config).
 			base = runtime.config.main_branch
 
-			# Sync main from remote before branching so the worktree starts
-			# from the latest code. Prevents stale-base merge conflicts later.
-			# Best-effort — if pull fails (non-ff, offline), continue anyway.
+			# Fetch to update the remote tracking ref without mutating the main worktree.
+			# Best-effort — if fetch fails (no remote, offline), branch from local main.
 			main_root = runtime.main_worktree_root
-			_, _, pull_ok, = Open3.capture3( "git", "-C", main_root, "pull", "--ff-only", runtime.config.git_remote, base )
-			runtime.puts_verbose( pull_ok.success? ? "synced #{base} before branching" : "sync skipped — continuing from local #{base}" ) unless json_output
+			remote = runtime.config.git_remote
+			_, _, fetch_ok, = Open3.capture3( "git", "-C", main_root, "fetch", remote, base )
+			if fetch_ok.success?
+				remote_ref = "#{remote}/#{base}"
+				_, _, ref_ok, = Open3.capture3( "git", "-C", main_root, "rev-parse", "--verify", remote_ref )
+				if ref_ok.success?
+					base = remote_ref
+					runtime.puts_verbose( "branching from #{remote_ref}" ) unless json_output
+				else
+					runtime.puts_verbose( "fetch succeeded but #{remote_ref} not found — branching from local #{runtime.config.main_branch}" ) unless json_output
+				end
+			else
+				runtime.puts_verbose( "fetch skipped — branching from local #{runtime.config.main_branch}" ) unless json_output
+			end
 
 			# Ensure .claude/ is excluded from git status in the host repository.
 			# Uses .git/info/exclude (local-only, never committed) to respect the outsider boundary.
@@ -144,7 +155,7 @@ module Carson
 		# Removes a worktree: directory, git registration, and branch.
 		# Never forces removal — if the worktree has uncommitted changes, refuses unless
 		# the caller explicitly passes force: true via CLI --force flag.
-		def self.remove!( path:, runtime:, force: false, json_output: false )
+		def self.remove!( path:, runtime:, force: false, skip_unpushed: false, json_output: false )
 			fingerprint_status = runtime.block_if_outsider_fingerprints!
 			unless fingerprint_status.nil?
 				if json_output
@@ -158,7 +169,7 @@ module Carson
 				return fingerprint_status
 			end
 
-			check = remove_check( path: path, runtime: runtime, force: force )
+			check = remove_check( path: path, runtime: runtime, force: force, skip_unpushed: skip_unpushed )
 			unless check.fetch( :status ) == :ok
 				return finish(
 					result: { command: "worktree remove", status: check.fetch( :result_status ), name: File.basename( check.fetch( :resolved_path ) ),
@@ -236,7 +247,7 @@ module Carson
 		# Preflight guard for worktree removal. Shared by `worktree remove` and
 		# other runtime flows that need to know whether cleanup is safe before
 		# mutating GitHub or branch state.
-		def self.remove_check( path:, runtime:, force: false )
+		def self.remove_check( path:, runtime:, force: false, skip_unpushed: false )
 			resolved_path = resolve_path( path: path, runtime: runtime )
 
 			if !Dir.exist?( resolved_path ) && registered?( path: resolved_path, runtime: runtime )
@@ -296,7 +307,7 @@ module Carson
 				}
 			end
 
-			unless force
+			unless force || skip_unpushed
 				unpushed = branch_unpushed_issue( branch: branch, worktree_path: resolved_path, runtime: runtime )
 				if unpushed
 					return {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 3.28.0
+  version: 3.29.0
 platform: ruby
 authors:
 - Hailei Wang
@@ -89,6 +89,7 @@ files:
 - lib/carson/runtime/local/sync.rb
 - lib/carson/runtime/local/template.rb
 - lib/carson/runtime/local/worktree.rb
+- lib/carson/runtime/loop_runner.rb
 - lib/carson/runtime/recover.rb
 - lib/carson/runtime/repos.rb
 - lib/carson/runtime/review.rb