carson 3.28.0 → 3.29.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a58a0b99b9cd8c7e241c6278f9b72fd4a6188cf45a51f22a5cb88bb6a83a703a
-  data.tar.gz: 0203fbacb58d17d33f58e90f4b868ad7065c086d0fb0963100eb0cac7f4d5f51
+  metadata.gz: bdb70b55b0dddf63dd2e96b68d060472e3abfd10ae6c55010df2d43ad766c7b8
+  data.tar.gz: 122ef3005263475ce82fce1177037ddd4f017662a5a74bbee16ada7a464e0fc6
 SHA512:
-  metadata.gz: 356111e22c7bf14aac077ebc02b80554713c1228dc7ab36688abdd8fb199e40e9c9965f1da0398e2736545b1bf9ffb38dee11f36081f8d781acc7c23e11d506e
-  data.tar.gz: 2476eae596465a0f3b7256646a7ed8364c709ed6279a3183da6ea4636dc05129cb7168d9e6dc2eee701ff4f05d56ec13e94a0c86719b0ec0dc82ce967548ab1c
+  metadata.gz: f526c974bf821f31a025e5a7c2a09644d3ef814c04f62a5d7021c0c6d102a9a883320c16ab20ab559159a95eee0198a26dfdec37c5684fd09936a13cbd7d081e
+  data.tar.gz: 6e7b04be1bf3a96d607599af821f38b4fb9cbaadea9c54f69407bf5d5d90bd4f10b46eec1e9254b4bbc6f1fa0c3e3bd673e9be8343a3b6e4006fe3a3291b8913

data/.github/workflows/carson_policy.yml

@@ -27,13 +27,13 @@ jobs:
 
     steps:
       - name: Checkout host repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           path: host
           fetch-depth: 0
 
       - name: Checkout Carson runtime
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: wanghailei/carson
           ref: ${{ inputs.carson_ref }}

data/API.md

@@ -52,7 +52,7 @@ All batch commands operate across every governed repository registered in `gover
 | `carson template check --all` | Read-only template drift detection across all governed repos. |
 | `carson housekeep --all [--loop SECONDS]` | Attempt sync, then reap worktrees with strong abandonment evidence, reconcile integrated delivery worktree records from the ledger, and prune across all governed repos. Safe cleanup still runs when sync is blocked. |
 
-`--loop SECONDS` runs the housekeep cycle continuously, sleeping SECONDS between cycles. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` with a cycle count summary.
+`--loop SECONDS` runs the housekeep cycle continuously, sleeping SECONDS between cycles. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` or `SIGTERM` with a cycle count summary.
 
 ### Govern commands
 
@@ -60,7 +60,7 @@ All batch commands operate across every governed repository registered in `gover
 |---|---|
 | `carson govern [--dry-run] [--json] [--loop SECONDS]` | Portfolio-level delivery oversight: assess active deliveries, integrate ready branches, dispatch revisions, and escalate blocked work. Live integrated rows include merge proof. |
 
-`--loop SECONDS` runs the govern cycle continuously, sleeping SECONDS between cycles. The loop isolates errors per cycle — a single failing cycle does not stop the daemon. `Ctrl-C` cleanly exits with a cycle count summary. SECONDS must be a positive integer.
+`--loop SECONDS` runs the govern cycle continuously, sleeping SECONDS between cycles. The loop isolates errors per cycle — a single failing cycle does not stop the daemon. `Ctrl-C` or `SIGTERM` cleanly exits with a cycle count summary. SECONDS must be a positive integer.
 
 Governed integration is fixed to `squash`. Non-squash `govern.merge.method` values are rejected by config validation.
 

data/MANUAL.md

@@ -66,12 +66,12 @@ on:
 
 jobs:
   governance:
-    uses: wanghailei/carson/.github/workflows/carson_policy.yml@v3.28.0
+    uses: wanghailei/carson/.github/workflows/carson_policy.yml@v3.29.0
     secrets:
       CARSON_READ_TOKEN: ${{ secrets.CARSON_READ_TOKEN }}
     with:
-      carson_ref: "v3.28.0"
-      carson_version: "3.28.0"
+      carson_ref: "v3.29.0"
+      carson_version: "3.29.0"
       rubocop_version: "1.81.0"
 ```
 
@@ -209,11 +209,13 @@ carson abandon feature/stale-work
 
 `abandon` closes the PR when it is still open, removes the matching worktree when safe, deletes the local and remote branch refs when allowed, and marks the delivery as failed in Carson's ledger.
 
-**Safety guards** — `worktree remove` blocks when:
+`abandon` is an intentional discard: committed-but-unpushed branch work does not block abandonment. Typing `carson abandon` is explicit consent to discard committed work on that branch.
+
+**Safety guards** — `abandon` blocks when:
 - Shell CWD is inside the worktree (prevents session crash).
-- Branch has unpushed commits with content that differs from main (prevents data loss).
+- Worktree has uncommitted changes (prevents accidental loss of unsaved work).
 
-After squash or rebase merge, the content matches main — removal proceeds without `--force`.
+Committed-but-unpushed work is treated as intentional discard — `abandon` proceeds. The `worktree remove` command retains its own unpushed-commit guard and `--force` override for manual cleanup outside the abandon flow.
 
 **Stale worktree recovery** — if a worktree directory is destroyed externally (for example by a raw GitHub merge/delete flow), `worktree remove`, `worktree list`, `housekeep`, and `prune` handle the stale entry gracefully: they clean up the git registration and delete the branch without error when Carson has enough evidence. Use Carson's delivery and cleanup commands instead of raw `gh pr merge --delete-branch` so the worktree directory stays intact for orderly cleanup.
 
@@ -299,7 +301,7 @@ carson housekeep --all --loop 300   # housekeep every 5 minutes
 
 `refresh --all` checks each repo for safety before operating: repos with active worktrees or uncommitted changes are skipped with clear reasons. Other batch commands attempt each repo and report failures without stopping.
 
-`housekeep --all --loop SECONDS` runs the full housekeep cycle continuously, sleeping SECONDS between passes. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` with a cycle count summary.
+`housekeep --all --loop SECONDS` runs the full housekeep cycle continuously, sleeping SECONDS between passes. It requires `--all`, accepts only positive integers, and exits cleanly on `Ctrl-C` or `SIGTERM` with a cycle count summary.
 
 **Periodic maintenance:**
 
@@ -319,7 +321,7 @@ carson govern --loop 300 --dry-run    # observe mode, no integration or revision
 
 The loop is built-in and cross-platform — no cron, launchd, or Task Scheduler required. Run it in a terminal, tmux, screen, or as a system service.
 
-Each cycle runs independently: if one cycle fails (network error, GitHub API timeout), the error is logged and the next cycle proceeds normally. Press `Ctrl-C` to stop — Carson exits cleanly with a cycle count summary.
+Each cycle runs independently: if one cycle fails (network error, GitHub API timeout), the error is logged and the next cycle proceeds normally. Press `Ctrl-C` or send `SIGTERM` to stop — Carson exits cleanly with a cycle count summary.
 
 ### Govern and Coding Agents
 

data/RELEASE.md

@@ -5,6 +5,29 @@ Release-note scope rule:
 - `RELEASE.md` records only version deltas, breaking changes, and migration actions.
 - Operational usage guides live in `MANUAL.md` and `API.md`.
 
+## 3.29.1
+
+### What changed
+
+- **Delivery output now shows the remote target explicitly** — `Delivery: branch → github/main` instead of the ambiguous `→ main`, making it clear the target is the remote branch, not local.
+
+### No migration required
+
+- Existing workflows continue to work unchanged.
+
+## 3.29.0
+
+### What changed
+
+- **Govern and housekeep loops are clearer and safer to run unattended** — `carson govern --loop` now prints per-delivery progress hints and a sleep announcement with the next-cycle timestamp, and both `govern --loop` and `housekeep --all --loop` now stop cleanly on `SIGTERM` as well as `Ctrl-C`.
+- **Govern and worktree creation no longer mutate the user's main worktree behind their back** — govern now fetches instead of syncing/pruning after merges, worktree creation branches from the remote tracking ref instead of pulling on main, and revision dispatch now defers when the target worktree is busy or dirty.
+- **Abandon guidance now matches the actual safety contract** — `carson abandon` no longer suggests an unsupported `--force`, and committed-but-unpushed branch work no longer blocks abandonment; only dirty worktree changes do.
+- **CI and release workflows are hardened for the Node 24 transition** — GitHub Actions checkouts now use `actions/checkout@v6`, Carson includes a dedicated forced-Node-24 probe for the RubyGems credentials action before changing the release path, and the standalone review smoke script now seeds its temporary `main` branch without tripping the shared main-branch commit guard.
+
+### No migration required
+
+- Existing workflows continue to work unchanged.
+
 ## 3.28.0
 
 ### What changed

data/VERSION

@@ -1 +1 @@
-3.28.0
+3.29.1

data/carson.gemspec

@@ -37,7 +37,6 @@ Gem::Specification.new do |spec|
 		"RELEASE.md",
 		"VERSION",
 		"LICENSE",
-		"SKILL.md",
 		"icon.svg",
 		"carson.gemspec"
 	]

data/lib/carson/ledger.rb

@@ -274,6 +274,11 @@ module Carson
 		end
 
 		def migrate_legacy_state_if_needed!
+			# Skip lock acquisition entirely when no legacy SQLite file exists.
+			# Read-only file checks are safe without the lock; the migration
+			# itself is idempotent so a narrow race is harmless.
+			return unless state_path_requires_migration?
+
 			with_state_lock do |lock_file|
 				lock_file.flock( File::LOCK_EX )
 				source_path = legacy_sqlite_source_path

data/lib/carson/runtime/abandon.rb

@@ -44,7 +44,7 @@ module Carson
 
 				if worktree
 					remove_exit = with_captured_output do
-						worktree_remove!( worktree_path: worktree.path, json_output: false )
+						worktree_remove!( worktree_path: worktree.path, skip_unpushed: true, json_output: false )
 					end
 					unless remove_exit == EXIT_OK
 						result[ :error ] = "worktree cleanup failed for #{worktree.path}"
@@ -131,29 +131,32 @@ module Carson
 				nil
 			end
 
+			# Abandon is an intentional discard: committed-but-unpushed work
+			# does not block abandonment. Only uncommitted (dirty) worktree
+			# changes block, because those may be accidental.
 			def abandon_preflight_issue( branch:, worktree: )
 				if config.protected_branches.include?( branch )
 					return { exit_code: EXIT_BLOCK, error: "cannot abandon protected branch #{branch}", recovery: "choose a feature branch instead" }
 				end
 
 				if worktree
-					check = Worktree.remove_check( path: worktree.path, runtime: self, force: false )
+					check = Worktree.remove_check( path: worktree.path, runtime: self, force: false, skip_unpushed: true )
 					return nil if check.fetch( :status ) == :ok
 
+					recovery = check.fetch( :recovery )
+					if check.fetch( :error ) == "worktree has uncommitted changes"
+						recovery = "commit or discard the changes, then retry carson abandon #{branch}"
+					end
+
 					return {
 						exit_code: check.fetch( :exit_code ),
 						error: check.fetch( :error ),
-						recovery: check.fetch( :recovery )
+						recovery: recovery
 					}
 				end
 
 				return { exit_code: EXIT_BLOCK, error: "current branch is #{branch}", recovery: "switch to main or a different branch, then retry" } if current_branch == branch
-				return nil unless local_branch_exists?( branch: branch )
-
-				unpushed = Worktree.branch_unpushed_issue( branch: branch, worktree_path: repo_root, runtime: self )
-				return nil if unpushed.nil?
-
-				{ exit_code: EXIT_BLOCK, error: unpushed.fetch( :error ), recovery: unpushed.fetch( :recovery ) }
+				nil
 			end
 
 			def close_pull_request!( number:, result: )

data/lib/carson/runtime/deliver.rb

@@ -16,6 +16,7 @@ module Carson
 				result = {
 					command: "deliver",
 					branch: branch_name,
+					git_remote: remote_name,
 					watch_window_seconds: config.govern_check_wait.to_i,
 					waited_seconds: 0,
 					merge_attempted: false
@@ -948,8 +949,10 @@ module Carson
 
 				if result[ :delivery ]
 					branch = result[ :branch ]
+					remote = result[ :git_remote ] || "github"
 					main = result[ :main_branch ] || "main"
-					puts_line "Delivery: #{branch} → #{main}"
+					remote_main = "#{remote}/#{main}"
+					puts_line "Delivery: #{branch} → #{remote_main}"
 				end
 				if result[ :commit ]
 					puts_line "Committed: #{result.dig( :commit, :summary )}"
@@ -961,9 +964,9 @@ module Carson
 					summary = result[ :summary ]
 					if outcome == "integrated" || status == "integrated"
 						if result[ :merge_method ]
-							puts_line "Merged into #{main} with #{result[ :merge_method ]}."
+							puts_line "Merged into #{remote_main} with #{result[ :merge_method ]}."
 						else
-							puts_line "Merged into #{main}."
+							puts_line "Merged into #{remote_main}."
 						end
 						if result[ :synced ] == false
 							puts_line "Local #{main} sync failed — #{result[ :sync_error ]}."

data/lib/carson/runtime/govern.rb

@@ -39,17 +39,17 @@ module Carson
 			end
 
 			def govern_loop!( dry_run:, json_output:, loop_seconds: )
-				cycle_count = 0
-				loop do
-					cycle_count += 1
-					puts_line ""
-					puts_line "cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}"
+				run_signal_aware_loop!(
+					loop_name: "govern",
+					loop_seconds: loop_seconds,
+					cycle_line: ->( cycle_count ) { "cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}" },
+					sleep_line: ->( seconds ) do
+						next_at = Time.now + seconds
+						"sleeping #{seconds}s — next cycle at #{next_at.strftime( '%Y-%m-%d %H:%M:%S %z' )}"
+					end
+				) do
 					govern_cycle!( dry_run: dry_run, json_output: json_output )
-					sleep loop_seconds
 				end
-			rescue Interrupt
-				puts_line "govern loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
-				EXIT_OK
 			end
 
 		private
@@ -85,6 +85,8 @@ module Carson
 				next_to_integrate = reconciled.find( &:ready? )&.key
 
 				reconciled.each do |delivery|
+					hint = delivery_action_hint( delivery: delivery, next_to_integrate: next_to_integrate, dry_run: dry_run )
+					puts_line "  #{delivery.branch} — #{hint}" if hint && !silent
 					delivery_report = scoped_runtime.send(
 						:decide_delivery_action,
 						delivery: delivery,
@@ -246,15 +248,10 @@ module Carson
 						pull_request_draft: false,
 						pull_request_merged_at: Time.now.utc.iso8601
 					)
-					housekeep_result = housekeep_repo!( repo_path: repo_path )
-					proof = if housekeep_result.is_a?( Hash ) && housekeep_result[ :sync_status ] != "ok"
-						merge_proof_unavailable(
-							main_ref: config.main_branch,
-							summary: "proof unavailable — local #{config.main_branch} sync did not complete."
-						)
-					else
-						merge_proof_for_branch( branch: integrated.branch, main_ref: config.main_branch )
-					end
+					# Fetch-only: update the remote tracking ref without mutating the
+					# main worktree. Reap and prune are deferred to explicit housekeep.
+					fetch_for_merge_proof!( repo_path: repo_path )
+					proof = merge_proof_for_remote_ref( branch: integrated.branch )
 					ledger.update_delivery(
 						delivery: integrated,
 						merge_proof: proof
@@ -274,6 +271,27 @@ module Carson
 				return escalate_delivery!( delivery: delivery, reason: "no agent provider available" ) if provider.nil?
 				return escalate_delivery!( delivery: delivery, reason: "worktree missing for revision" ) unless File.directory?( delivery.worktree_path.to_s )
 
+				# Defer if the target worktree is occupied — temporary hold, not failure.
+				worktree = Carson::Worktree.find( path: delivery.worktree_path.to_s, runtime: self )
+				if worktree
+					if worktree.held_by_other_process?
+						return ledger.update_delivery(
+							delivery: delivery,
+							status: "gated",
+							cause: "busy",
+							summary: "worktree held by another process — deferring revision"
+						)
+					end
+					if worktree.dirty?
+						return ledger.update_delivery(
+							delivery: delivery,
+							status: "gated",
+							cause: "busy",
+							summary: "worktree has uncommitted changes — deferring revision"
+						)
+					end
+				end
+
 				objective = revision_objective( cause: delivery.cause )
 				context = evidence( delivery: delivery, repo_path: repo_path, objective: objective )
 				work_order = Adapters::Agent::WorkOrder.new(
@@ -340,7 +358,16 @@ module Carson
 			end
 
 				def held_delivery?( delivery: )
-					[ "merge", "freshness" ].include?( delivery.cause )
+					[ "merge", "freshness", "busy" ].include?( delivery.cause )
+				end
+
+				def delivery_action_hint( delivery:, next_to_integrate:, dry_run: )
+					return nil if dry_run
+					return nil if delivery.superseded? || delivery.integrated? || delivery.failed?
+					return "integrating…" if delivery.ready? && delivery.key == next_to_integrate
+					return nil unless delivery.blocked?
+					return nil if held_delivery?( delivery: delivery )
+					delivery.revision_count >= 3 ? "escalating…" : "revising…"
 				end
 
 			def housekeep_repo!( repo_path: )
@@ -348,6 +375,15 @@ module Carson
 				scoped_runtime.send( :housekeep_one_entry, repo_path: repo_path, silent: true )
 			end
 
+			# Fetch-only helper for post-merge proof generation.
+			# Updates the remote tracking ref without mutating the main worktree.
+			def fetch_for_merge_proof!( repo_path: )
+				scoped = repo_runtime_for( repo_path: repo_path )
+				scoped.send( :git_run, "fetch", scoped.config.git_remote, "--prune" )
+			rescue StandardError
+				# Best-effort — merge proof falls back to unavailable if fetch fails.
+			end
+
 			def select_agent_provider
 				provider = config.govern_agent_provider
 				case provider

data/lib/carson/runtime/housekeep.rb

@@ -81,17 +81,13 @@ module Carson
 			end
 
 			def housekeep_loop!( json_output:, dry_run:, loop_seconds: )
-				cycle_count = 0
-				loop do
-					cycle_count += 1
-					puts_line ""
-					puts_line "housekeep cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}"
+				run_signal_aware_loop!(
+					loop_name: "housekeep",
+					loop_seconds: loop_seconds,
+					cycle_line: ->( cycle_count ) { "housekeep cycle #{cycle_count} at #{Time.now.utc.strftime( '%Y-%m-%d %H:%M:%S UTC' )}" }
+				) do
 					housekeep_all!( json_output: json_output, dry_run: dry_run )
-					sleep loop_seconds
 				end
-			rescue Interrupt
-				puts_line "housekeep loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
-				EXIT_OK
 			end
 
 			# Prints a dry-run plan for this repo without making any changes.

data/lib/carson/runtime/local/merge_proof.rb

@@ -2,6 +2,24 @@
 module Carson
 	class Runtime
 		module Local
+			# Generates merge proof against the remote tracking ref directly.
+			# Skips the local-main trust check — the caller is responsible for
+			# fetching before calling. Used by govern's post-merge path to avoid
+			# mutating the main worktree.
+			def merge_proof_for_remote_ref( branch:, remote: config.git_remote, main_ref: config.main_branch )
+				remote_ref = "#{remote}/#{main_ref}"
+				return merge_proof_not_applicable( main_ref: main_ref ) if branch.to_s == main_ref.to_s
+
+				candidate = merge_proof_candidate( branch: branch, main_ref: remote_ref )
+				return candidate if candidate.fetch( :basis ) == "unavailable"
+
+				# Normalise display: show the local branch name, not the remote tracking ref.
+				candidate.merge(
+					main_branch: main_ref,
+					summary: candidate.fetch( :summary ).gsub( remote_ref, main_ref )
+				)
+			end
+
 			def merge_proof_for_branch( branch:, main_ref: config.main_branch )
 				return merge_proof_not_applicable( main_ref: main_ref ) if branch.to_s == main_ref.to_s
 

data/lib/carson/runtime/local/worktree.rb

@@ -14,8 +14,8 @@ module Carson
 			end
 
 			# Removes a worktree: directory, git registration, and branch.
-			def worktree_remove!( worktree_path:, force: false, json_output: false )
-				Worktree.remove!( path: worktree_path, runtime: self, force: force, json_output: json_output )
+			def worktree_remove!( worktree_path:, force: false, skip_unpushed: false, json_output: false )
+				Worktree.remove!( path: worktree_path, runtime: self, force: force, skip_unpushed: skip_unpushed, json_output: json_output )
 			end
 
 			# Removes agent-owned worktrees whose branch content is already on main.

data/lib/carson/runtime/loop_runner.rb

@@ -0,0 +1,90 @@
+# Shared loop runner for commands that poll on a schedule.
+module Carson
+	class Runtime
+		module LoopRunner
+			LOOP_STOP_SIGNALS = %w[INT TERM].freeze
+			LOOP_SLEEP_SLICE_SECONDS = 0.25
+
+		private
+
+			def run_signal_aware_loop!( loop_name:, loop_seconds:, cycle_line:, sleep_line: nil )
+				cycle_count = 0
+				stop_requested = false
+				previous_handlers = install_loop_stop_handlers! do
+					stop_requested = true
+				end
+
+				loop do
+					break if stop_requested
+
+					cycle_count += 1
+					puts_line ""
+					puts_line cycle_line.call( cycle_count )
+					yield cycle_count
+					break if stop_requested
+
+					puts_line sleep_line.call( loop_seconds ) if sleep_line
+					loop_runner_wait( seconds: loop_seconds ) { stop_requested }
+				end
+
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			rescue Interrupt
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			rescue SignalException => exception
+				raise unless graceful_loop_signal?( exception )
+
+				puts_line "#{loop_name} loop stopped after #{cycle_count} cycle#{plural_suffix( count: cycle_count )}"
+				EXIT_OK
+			ensure
+				restore_loop_stop_handlers!( previous_handlers ) if previous_handlers
+			end
+
+			def install_loop_stop_handlers!
+				LOOP_STOP_SIGNALS.each_with_object( {} ) do |signal_name, handlers|
+					handlers[ signal_name ] = loop_runner_trap( signal_name ) { yield signal_name }
+				end
+			end
+
+			def restore_loop_stop_handlers!( previous_handlers )
+				previous_handlers.each do |signal_name, previous_handler|
+					loop_runner_trap( signal_name, previous_handler )
+				end
+			end
+
+			def graceful_loop_signal?( exception )
+				signo = exception.respond_to?( :signo ) ? exception.signo : nil
+				LOOP_STOP_SIGNALS.any? do |signal_name|
+					Signal.list.fetch( signal_name, nil ) == signo
+				end
+			end
+
+			def loop_runner_wait( seconds: )
+				deadline = loop_runner_monotonic_now + seconds.to_f
+				while ( remaining = deadline - loop_runner_monotonic_now ) > 0
+					break if block_given? && yield
+					loop_runner_sleep( [ remaining, LOOP_SLEEP_SLICE_SECONDS ].min )
+				end
+			end
+
+			def loop_runner_trap( signal_name, handler = nil, &block )
+				if handler
+					Signal.trap( signal_name, handler )
+				else
+					Signal.trap( signal_name, &block )
+				end
+			end
+
+			def loop_runner_monotonic_now
+				Process.clock_gettime( Process::CLOCK_MONOTONIC )
+			end
+
+			def loop_runner_sleep( seconds )
+				sleep seconds
+			end
+		end
+
+		include LoopRunner
+	end
+end

data/lib/carson/runtime.rb

@@ -33,11 +33,17 @@ module Carson
 			@config = Config.load( repo_root: repo_root )
 			@git_adapter = Adapters::Git.new( repo_root: repo_root )
 			@github_adapter = Adapters::GitHub.new( repo_root: repo_root )
-			@ledger = Ledger.new( path: @config.govern_state_path )
 			@template_sync_result = nil
 		end
 
-		attr_reader :template_sync_result, :ledger
+		attr_reader :template_sync_result
+
+		# Lazy ledger: only constructed when a command actually needs delivery state.
+		# Read-only commands (worktree list, audit, prune, sync) never touch the
+		# govern state lock file.
+		def ledger
+			@ledger ||= Ledger.new( path: @config.govern_state_path )
+		end
 
 	private
 
@@ -364,6 +370,7 @@ end
 
 require_relative "runtime/local"
 require_relative "runtime/audit"
+require_relative "runtime/loop_runner"
 require_relative "runtime/housekeep"
 require_relative "runtime/repos"
 require_relative "runtime/review"

data/lib/carson/worktree.rb

@@ -96,12 +96,23 @@ module Carson
 			# Determine the base branch (main branch from config).
 			base = runtime.config.main_branch
 
-			# Sync main from remote before branching so the worktree starts
-			# from the latest code. Prevents stale-base merge conflicts later.
-			# Best-effort — if pull fails (non-ff, offline), continue anyway.
+			# Fetch to update the remote tracking ref without mutating the main worktree.
+			# Best-effort — if fetch fails (no remote, offline), branch from local main.
 			main_root = runtime.main_worktree_root
-			_, _, pull_ok, = Open3.capture3( "git", "-C", main_root, "pull", "--ff-only", runtime.config.git_remote, base )
-			runtime.puts_verbose( pull_ok.success? ? "synced #{base} before branching" : "sync skipped — continuing from local #{base}" ) unless json_output
+			remote = runtime.config.git_remote
+			_, _, fetch_ok, = Open3.capture3( "git", "-C", main_root, "fetch", remote, base )
+			if fetch_ok.success?
+				remote_ref = "#{remote}/#{base}"
+				_, _, ref_ok, = Open3.capture3( "git", "-C", main_root, "rev-parse", "--verify", remote_ref )
+				if ref_ok.success?
+					base = remote_ref
+					runtime.puts_verbose( "branching from #{remote_ref}" ) unless json_output
+				else
+					runtime.puts_verbose( "fetch succeeded but #{remote_ref} not found — branching from local #{runtime.config.main_branch}" ) unless json_output
+				end
+			else
+				runtime.puts_verbose( "fetch skipped — branching from local #{runtime.config.main_branch}" ) unless json_output
+			end
 
 			# Ensure .claude/ is excluded from git status in the host repository.
 			# Uses .git/info/exclude (local-only, never committed) to respect the outsider boundary.
@@ -144,7 +155,7 @@ module Carson
 		# Removes a worktree: directory, git registration, and branch.
 		# Never forces removal — if the worktree has uncommitted changes, refuses unless
 		# the caller explicitly passes force: true via CLI --force flag.
-		def self.remove!( path:, runtime:, force: false, json_output: false )
+		def self.remove!( path:, runtime:, force: false, skip_unpushed: false, json_output: false )
 			fingerprint_status = runtime.block_if_outsider_fingerprints!
 			unless fingerprint_status.nil?
 				if json_output
@@ -158,7 +169,7 @@ module Carson
 				return fingerprint_status
 			end
 
-			check = remove_check( path: path, runtime: runtime, force: force )
+			check = remove_check( path: path, runtime: runtime, force: force, skip_unpushed: skip_unpushed )
 			unless check.fetch( :status ) == :ok
 				return finish(
 					result: { command: "worktree remove", status: check.fetch( :result_status ), name: File.basename( check.fetch( :resolved_path ) ),
@@ -236,7 +247,7 @@ module Carson
 		# Preflight guard for worktree removal. Shared by `worktree remove` and
 		# other runtime flows that need to know whether cleanup is safe before
 		# mutating GitHub or branch state.
-		def self.remove_check( path:, runtime:, force: false )
+		def self.remove_check( path:, runtime:, force: false, skip_unpushed: false )
 			resolved_path = resolve_path( path: path, runtime: runtime )
 
 			if !Dir.exist?( resolved_path ) && registered?( path: resolved_path, runtime: runtime )
@@ -296,7 +307,7 @@ module Carson
 				}
 			end
 
-			unless force
+			unless force || skip_unpushed
 				unpushed = branch_unpushed_issue( branch: branch, worktree_path: resolved_path, runtime: runtime )
 				if unpushed
 					return {

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 3.28.0
+  version: 3.29.1
 platform: ruby
 authors:
 - Hailei Wang
@@ -51,7 +51,6 @@ files:
 - MANUAL.md
 - README.md
 - RELEASE.md
-- SKILL.md
 - VERSION
 - carson.gemspec
 - exe/carson
@@ -89,6 +88,7 @@ files:
 - lib/carson/runtime/local/sync.rb
 - lib/carson/runtime/local/template.rb
 - lib/carson/runtime/local/worktree.rb
+- lib/carson/runtime/loop_runner.rb
 - lib/carson/runtime/recover.rb
 - lib/carson/runtime/repos.rb
 - lib/carson/runtime/review.rb

data/SKILL.md

@@ -1,99 +0,0 @@
-# Carson Skill
-
-You are working in a repository governed by Carson — an autonomous git strategist and repositories governor. Carson handles git hooks, PR triage, agent dispatch, merge, and cleanup. You provide the intelligence; Carson provides the infrastructure.
-
-## When to use Carson commands
-
-| User intent | Command | What happens |
-|---|---|---|
-| "Check if my code is ready" | `carson audit` | Scope, boundary checks. Exit 0 = clean. Exit 2 = policy block. |
-| "Is my PR mergeable?" | `carson review gate` | Polls for unresolved review threads and actionable comments. Blocks until resolved. |
-| "What's happening across my repos?" | `carson govern --dry-run` | Classifies every open PR without taking action. Read the summary. |
-| "Run governance continuously" | `carson govern --loop 300` | Triage-dispatch-merge cycle every 300 seconds. Ctrl-C to stop. |
-| "Merge ready PRs and dispatch fixes" | `carson govern` | Full autonomous cycle: merge, dispatch agents, escalate. |
-| "Set up Carson for a repo" | `carson onboard /path/to/repo` | Installs hooks, syncs templates, runs first audit. |
-| "Refresh after upgrading Carson" | `carson refresh` | Re-applies hooks and templates for the current version. |
-| "Update my local main" | `carson sync` | Fast-forward local main from remote. Blocks if tree is dirty. |
-| "Clean up stale branches" | `carson prune` | Removes local branches whose upstream is gone. |
-| "Check template drift" | `carson template check` then `carson template apply` | Detect and fix .github/* drift. |
-| "Remove Carson from a repo" | `carson offboard /path/to/repo` | Removes hooks and managed files. |
-| "What version?" | `carson version` | Prints installed version with ⧓ badge. |
-
-## Exit codes
-
-- `0` — success, all clear.
-- `1` — runtime or configuration error. Read the error message.
-- `2` — policy block. Something must be fixed before proceeding (unresolved review, boundary breach).
-
-When you see exit 2, do NOT bypass it. Read the output, fix the root cause, and re-run.
-
-## Interpreting audit output
-
-Carson audit output is structured as labelled key-value lines prefixed with ⧓. Key sections:
-
-- **Working Tree** — staged/unstaged status.
-- **Main Sync Status** — whether local main matches remote. If ahead, reset drift before committing.
-- **Scope Integrity Guard** — checks that commits stay within a single business intent and scope group.
-- **Audit Result** — final verdict: `status: ok` (clean), `status: attention` (advisory, not blocking), `status: block` (must fix).
-
-## Interpreting govern output
-
-`carson govern --dry-run` classifies each PR:
-
-- **ready** → would merge. All gates pass.
-- **ci_failing** → would dispatch agent to fix CI.
-- **review_blocked** → would dispatch agent to address review comments.
-- **pending** → skip. Checks still running (within check_wait window).
-- **needs_attention** → escalate. Needs human judgement.
-
-The summary line: `govern_summary: repos=N prs=N ready=N blocked=N`
-
-## Configuration
-
-Single config file: `~/.carson/config.json`. Key settings:
-
-```json
-{
-  "govern": {
-    "repos": ["~/Dev/repo-a", "~/Dev/repo-b"],
-    "merge": { "method": "rebase" },
-    "agent": { "provider": "auto" }
-  },
-  "review": {
-    "bot_usernames": ["gemini-code-assist"]
-  }
-}
-```
-
-- `govern.merge.method` — must match GitHub branch protection. Use `rebase` if linear history is required.
-- `govern.repos` — list of repo paths for portfolio-level governance. Empty = current repo only.
-- `govern.agent.provider` — `auto` (tries codex then claude), `codex`, or `claude`.
-- `review.bot_usernames` — bot logins to ignore in review gate. Use GraphQL login format (no `[bot]` suffix).
-
-Environment overrides take precedence over config file. Common ones:
-- `CARSON_GOVERN_MERGE_METHOD`
-- `CARSON_REVIEW_BOT_USERNAMES`
-- `CARSON_GOVERN_CHECK_WAIT`
-
-## Common scenarios
-
-**Commit blocked by audit:**
-Run `carson audit`, read the block reason, fix it, then `git add` and `git commit` again. Do not skip the hook.
-
-**Review gate blocked:**
-Run `carson review gate` to see which comments need disposition. Respond to each with the required prefix (default: `Disposition:`), then re-run.
-
-**Local main drifted ahead of remote:**
-This means a commit was made to main that couldn't be pushed (branch protection). Reset: `git checkout main && git reset --hard github/main`.
-
-**Hooks out of date after upgrade:**
-Run `carson refresh` to re-apply hooks and templates for the current version.
-
-**Govern merge fails:**
-Check that `govern.merge.method` in config matches what GitHub allows. If the repo enforces linear history, only `rebase` works.
-
-## Boundaries
-
-- Carson never lives inside governed repositories. No `.carson.yml`, no `bin/carson`, no `.tools/carson/`.
-- Carson-managed files in repos are limited to `.github/*` templates.
-- Carson's hooks live at `~/.carson/hooks/<version>/`, never in `.git/hooks/`.