@aperant/framework 0.6.4 → 0.6.6

package/skills/apt-watch-ci/SKILL.md

@@ -0,0 +1,163 @@
+---
+name: apt:watch-ci
+description: "Post-ship CI watcher — polls PR checks, auto-fixes red, pushes, reschedules"
+apt-skill-version: {{APT_VERSION}}
+stage: ship
+intent: x-watch-ci
+when_to_use: "A PR has been shipped and CI is running. Use to watch its checks on a recurring tick, auto-fix red checks from first red, push fixes, and reschedule until green / merged / closed / 5 attempts / 4h wall."
+user_invocable: true
+internal: false
+spawns_agent: false
+agent_name: null
+task_context: require-existing
+default_execution_mode: auto
+execution_modes:
+  - auto
+  - step
+allowed-tools: "Bash, Read, Write, Edit, Grep, Glob"
+argument-hint: "apt:watch-ci [--pr N | --tick --pr N | --stop --pr N | --resume --pr N]"
+gates: []
+config_keys:
+  - ci_watch.after_ship
+  - ci_watch.auto_merge_on_green
+---
+
+# /apt:watch-ci — Post-ship CI Watcher
+
+You are a **post-ship CI watcher**. After a PR has been opened by `/apt:ship`, you watch its checks on a recurring tick, auto-fix red checks from the first red, push the fix, and reschedule yourself until the PR is green / merged / closed, or you hit the 5-attempt / 4h wall budget.
+
+This skill is **one-tick-per-invocation** (D-01). It MUST NOT enter a polling loop. The recurring beat is delivered externally — by Claude Code's `CronCreate` on cron-capable hosts, by Pi's `pi-schedule-prompt` on Pi, or by the user re-invoking `/apt:watch-ci --tick --pr N` on non-cron hosts. Each invocation does at most one of: poll + classify + maybe-fix + push + reschedule, then exits.
+
+The locked decisions backing every section are in `.aperant/context/notes/framework-post-ship-ci-watcher.md` (D-01..D-08).
+
+---
+
+## Your environment
+
+- **Working directory:** the task's worktree (or the project root if this is a non-worktree task).
+- **State files:** `.aperant/ci-watches/{pr}.json` (per-PR state, D-04); `.aperant/ci-watches/{pr}.lock` (per-PR atomic lock, D-05). Both ephemeral — they are NOT committed.
+- **Events:** every tick appends a `ci-watch.tick` event to `.aperant/events/{today}.jsonl`; `start` appends `ci-watch.armed`; the fix-and-push path appends `ci-watch.fix-pushed`; terminal actions append `ci-watch.stopped` with a `reason`.
+- **CLI surface:** `apt-tools ci-watch start|stop|status|tick --pr N`. The skill body shells out to those subcommands — DO NOT re-implement the classifier in your prompt; the cmd already does it.
+
+---
+
+## §1. Resolve mode
+
+Parse the flags:
+- No flag → "start a watch for the active task's PR" (resolve PR number from `.aperant/state.json` active task's `pr_url` field).
+- `--tick --pr N` → run one tick for PR N. This is the cron payload's invocation form.
+- `--stop --pr N` → tear down the watch.
+- `--resume --pr N` → clear the `paused: true` flag and return to normal tick.
+
+If no PR can be resolved (no active task, no `pr_url`), print an error and exit — there is nothing to watch.
+
+---
+
+## §2. Lock acquire
+
+For everything except `status`, the imperative work happens inside `apt-tools ci-watch tick`, which acquires the per-PR lock itself. If `tick` returns exit code 2 with `{status:"busy", reason:"lock-held"}`, another invocation is already running for this PR. Print:
+
+```
+Watcher already running for PR {N} (held by sessionId={x}, pid={y}); exiting.
+```
+
+…and exit. Do NOT block, retry, or kill the holder.
+
+---
+
+## §3. One-tick semantics (the heart of D-01)
+
+For the `--tick` mode, execute exactly the following sequence — once — inside this single skill invocation:
+
+1. **Poll.** Call `gh pr checks <N> --json name,bucket,state,conclusion,detailsUrl` and `gh pr view <N> --json state,reviewDecision`. On any `gh` failure, write the captured stderr to a temp file and let the cmd's `tick` route to `infra-backoff` (it surfaces the same action when the gh payload is unavailable).
+2. **Classify + state update.** Call `apt-tools ci-watch tick {worktree} --pr {N}`. The cmd internally:
+   - acquires the per-PR lock (BUSY → exit 2 → step §2);
+   - reads the per-PR state file;
+   - runs the stop-matrix classifier (`packages/framework/src/cli/ci-watch/stop-matrix.mjs`);
+   - applies the action's state mutation (attempts++, last_status fingerprint, paused, etc.);
+   - releases the lock;
+   - returns `{status, action, attempts_used, next_tick_at, reason}`.
+3. **Branch on `action`** — see §4 (terminal), §5 (fix), §6 (non-counting), §7 (pause/resume).
+4. **Reschedule (next tick).** On Claude Code: refresh the `CronCreate` entry's next-fire timestamp (CronCreate is idempotent on the same payload). On Pi: do the equivalent via `pi-schedule-prompt`. On other hosts: print `Next tick: run /apt:watch-ci --tick --pr {N} when you return.` Do NOT register a cron on a non-cron host — the framework would be lying.
+5. **Emit event.** `apt-tools event append . --type ci-watch.tick --data '{...}'` with the cmd's envelope as the data payload. Non-fatal if it fails.
+
+---
+
+## §4. Terminal branches (green / merged / closed / *-cap / identical-log)
+
+When `action ∈ {green, merged, closed, attempts-cap, wall-cap, identical-log}`:
+
+- **green** — print "CI green for PR {N}." If `ci_watch.auto_merge_on_green` is `true` in `.aperant/config.json`, run `gh pr merge {N} --auto --squash` then suggest `/apt:close-task`. Else print the exact D-08 text:
+
+  ```
+  ✅ CI green — merge in browser or run /apt:close-task post-merge
+  ```
+
+- **merged** / **closed** — print a one-line summary. No PR comment needed.
+
+- **attempts-cap** / **wall-cap** / **identical-log** — these are bail conditions. Leave a PR comment via `gh pr comment {N} --body "<summary>"` describing why the watcher stopped (attempt count, deadline, fingerprint). The user comes back to find a structured note in the PR.
+
+In all terminal cases:
+- Stop the host scheduler (`CronDelete` on Claude Code, `pi schedule remove` on Pi, no-op elsewhere).
+- The cmd already deleted the state file when it returned `status: 'stopped'`. Do NOT re-delete it.
+- Emit `ci-watch.stopped` event with the matching `reason`.
+
+---
+
+## §5. Fix-and-push (D-02 — the auto-fix path)
+
+When `action === 'fix'` (or `diverged-rebased`/`diverged-bailed`):
+
+1. **Fetch the failed-check log.** From the gh payload, find the failed check's `detailsUrl` and call `gh run view {runId} --log` to capture the log into a temp file.
+2. **Shell out to the host CLI** to fix it. The watcher does NOT inline a custom fix prompt; it hands the worktree + failed-log to the same CLI binary that's running this skill (detected by `apt-tools host-detect`). Pseudocode:
+
+   ```bash
+   <host-cli-bin> --print "Fix this CI failure for PR {N}. The failed-run log is at {log_path}. Use the worktree at {worktree}. Land + push a commit with the fix." \
+     --cwd {worktree}
+   ```
+
+   The fix-CLI is responsible for the actual edits + verification + commit + push. This is a clean shell-out boundary — the watcher trusts the fix-CLI to land a commit (or to bail with a non-zero exit code, which the watcher treats as "no progress made this tick").
+3. **Did the fix change anything?** Run `git -C {worktree} status --porcelain`. If empty, the fixer made no changes → the next tick's classifier will see the same failure log and emit `identical-log`. Do NOT push.
+4. **Push.** `git -C {worktree} push origin {branch}`. On push failure, the next tick will route through `infra-backoff`.
+5. **Emit event.** `apt-tools event append . --type ci-watch.fix-pushed --data '{pr, attempts, commit_sha}'`.
+6. **Reschedule** per §3 step 4.
+
+For `diverged-rebased`: the cmd already returned the verb; the orchestrator runs `git -C {worktree} fetch && git rebase origin/{base}` BEFORE the fix step. On conflict the action becomes `diverged-bailed` and the watcher exits with a PR comment summarizing the conflict.
+
+---
+
+## §6. Non-counting branches (flake-skip / infra-backoff)
+
+When `action === 'flake-skip'` or `'infra-backoff'`:
+
+- **flake-skip:** Skip the fix path entirely. Reschedule at the normal interval. No PR comment.
+- **infra-backoff:** Same skip — but the next tick interval is doubled by the cmd (it wrote `next_tick_interval_ms *= 2` to state). The cron host re-invocation reads it. After one retry, if the same infra signal persists, post a PR comment marking the failure as `infra-incident`; do NOT keep doubling forever.
+
+---
+
+## §7. --stop / --resume flags
+
+- `--stop --pr N` — releases scheduler handle (`CronDelete` on CC, `pi schedule remove` on Pi, no-op elsewhere), deletes state file, emits `ci-watch.stopped` event with `reason:"user-stop"`. Idempotent — calling `--stop` on a PR with no active watch is fine.
+- `--resume --pr N` — only valid when state has `paused: true` (set by `reviewer-pause`). Clears the flag, returns to normal tick. Error envelope if no paused state for the PR.
+
+When the classifier returns `reviewer-pause`, the state's `paused: true` is set by the cmd, but the scheduler is NOT removed — the cron payload keeps firing, and each tick the cmd checks `paused` and exits early with action `reviewer-pause`. Cheaper than re-registering on `--resume`.
+
+---
+
+## §8. Single-execution-mode contract
+
+Reiterating because this is the most easily-broken invariant:
+
+- One tick = one invocation. **Do not** wrap the §3 sequence in a `while`/`until` loop.
+- **Do not** sleep + re-invoke yourself inside a single session.
+- The recurring beat is delivered by host cron OR by the user re-invoking the skill manually. The watcher's value comes from the host scheduler — it does not impersonate one.
+
+If you find yourself wanting to add "and then wait 5 minutes and run again," STOP. The skill is finished after one tick. Exit.
+
+---
+
+## Notes for the orchestrator
+
+- All gh CLI calls run with the host's existing auth. The watcher introduces no new secret material (per task `dimensions_covered.token-encryption.crossed: false`).
+- `auto_merge_on_green` is snapshotted from `.aperant/config.json` at `start` time (state file's `auto_merge_on_green` field). Changing the config mid-watch does NOT retroactively affect armed watches — re-run `start` to pick up the new value.
+- The fix-CLI shell-out is the cleanest abstraction we have for portability. It's NOT a sub-agent. On Claude Code that means another `claude` invocation; on Codex/Gemini/OpenCode/Pi, the equivalent binary. Detection lives in `apt-tools host-detect`'s `cli` field.

package/skills/apt-zoom-out/SKILL.md

@@ -0,0 +1,130 @@
+---
+name: apt:zoom-out
+description: "Orient yourself in an unfamiliar area of the codebase — load CONTEXT.md, map modules + callers, output a one-page orientation"
+apt-skill-version: {{APT_VERSION}}
+stage: plan
+intent: investigate
+when_to_use: "The user is dropped into a part of the codebase they don't know and wants a one-page architectural orientation before planning or editing. Natural-language triggers: 'give me a broader picture of X', 'I'm lost in this area', 'explain how this fits'."
+user_invocable: true
+internal: false
+spawns_agent: false
+agent_name: null
+task_context: none
+default_track: STANDARD
+default_execution_mode: auto
+execution_modes:
+  - auto
+  - step
+allowed-tools: "Bash, Read, Grep, Glob"
+argument-hint: "apt:zoom-out [area-name]"
+gates: []
+---
+
+# Zoom-Out — One-page Architectural Orientation
+
+Tiny skill. High signal. The user named an area; you produce a one-page
+orientation so they (or a future agent) can plan or edit without
+re-learning the codebase from scratch.
+
+**Pocock adoption note.** This skill descends from Matt Pocock's `zoom-out`
+discipline. Aperant's router is dynamic and LLM-driven, so unlike Pocock's
+upstream this skill is **router-invocable** (no `disable-model-invocation:
+true` flag). The work-intent — "give me a broader picture of X" — is
+genuine and the router resolves natural-language triggers without forcing
+the user to remember the verb name.
+
+## When to Use
+
+- Dropped into a new module / package / area of the monorepo
+- About to plan a feature that crosses an unfamiliar boundary
+- The codebase has CONTEXT.md (Pocock glossary) and you want to load it
+  alongside the structural map
+
+## When Not to Use
+
+- The area is one you know well — `/apt:plan` already does targeted
+  investigation
+- You need to lock decisions (use `/apt:discuss` with the
+  `appendices/grill-discipline.md` posture loader instead)
+- The user wants to refactor proactively — that's `/apt:improve`
+
+## Process
+
+### 1. Parse the area name
+
+Extract the area from `$ARGUMENTS`. The area is a noun phrase, not a
+file path: e.g., `"chat session lifecycle"`, `"sparring engine"`,
+`"feature registry"`. If the argument is a file path, narrow the
+orientation to the file's enclosing module.
+
+### 2. Load CONTEXT.md (if present)
+
+If `CONTEXT.md` exists at the project root, read it and pre-load any
+term-blocks whose `Term` matches keywords in the area name (or whose
+`Aliases to avoid` field hints at the area). Carry these terms forward
+into the orientation report so the reader sees the vocabulary the
+codebase actually uses.
+
+If `CONTEXT.md` does not exist, skip silently — orientation still works,
+just without the glossary anchor.
+
+### 3. Map modules and callers
+
+Run Glob + Grep to identify:
+
+- **Entry points** — files in the area that other modules import (high
+  fan-in: many `import`-ers).
+- **State owners** — files that declare the area's persistent
+  state (Zustand stores, Convex queries, libSQL tables).
+- **External boundaries** — files that touch external systems (HTTP,
+  IPC, native modules, child processes).
+- **Known fragile areas** — search for `// TODO`, `// FIXME`, `// HACK`
+  comments + any recent commits touching the area (last 30 days).
+
+### 4. Emit the one-page orientation
+
+Output to stdout (no file written — this is a read-only orientation):
+
+```markdown
+# Orientation: {area name}
+
+## Purpose
+{One paragraph: what does this area exist to do?}
+
+## Entry points
+- `{path}` — {one-line role}
+- `{path}` — {one-line role}
+
+## State owners
+- `{path}` — {one-line: what state, what scope}
+
+## External boundaries
+- `{path}` — {one-line: which external system, what direction}
+
+## Known fragile areas
+- `{path}:{line}` — `// TODO` / `// FIXME` summary + age
+- {recent-commit-shortlog one-liner if relevant}
+
+## Glossary (from CONTEXT.md)
+- **{Term}** — definition + aliases-to-avoid
+- {…}
+
+## Pointers for the next agent
+- {one-line: where to start reading}
+- {one-line: which test file to read first}
+- {one-line: which CONTEXT.md term resolves the most ambiguity}
+```
+
+The orientation MUST fit on one screen. If it doesn't, you've gone too
+deep — re-scope the area name and try again.
+
+## Output contract
+
+- **Read-only.** This skill never writes files. It is a context-loader,
+  not a planner.
+- **Stops at orientation.** Do NOT pivot into `/apt:plan` automatically.
+  The user invokes `/apt:plan` (or `/apt:improve`) as a follow-up if the
+  orientation surfaces a planning opportunity.
+- **No grill posture.** This skill does NOT load
+  `apt-discuss/appendices/grill-discipline.md` — orientation is
+  descriptive, not normative. Locking decisions is `apt:discuss`'s job.

package/src/cli/ci-watch/lock.mjs

@@ -0,0 +1,178 @@
+/**
+ * ci-watch/lock.mjs — per-PR O_EXCL atomic lock (D-05).
+ *
+ * Mirrors Claude Code's `cronTasksLock.ts`: a per-PR `.aperant/ci-watches/{pr}.lock`
+ * file created with `openSync(..., 'wx')` (O_EXCL). Two concurrent callers
+ * cannot both create the file; the loser reads the existing lock and decides
+ * whether to declare BUSY or recover a stale lock.
+ *
+ * Stale-recovery (spec.md §8): a lock is recoverable iff
+ *   (a) holder PID is dead (`!isPidAlive`), AND
+ *   (b) `Date.now() - acquiredAt > ttl_seconds*1000`.
+ * Live PID alone is NEVER recoverable, even past TTL — TTL alone is not
+ * enough. Per D-05: PID-based stale recovery.
+ *
+ * Lock file shape (spec.md §8):
+ *   { sessionId, pid, acquiredAt, ttl_seconds }
+ *
+ * Return shapes:
+ *   acquireLock → { status: 'ok', lock: {...} }
+ *              OR { status: 'busy', holder: {...} }
+ *   releaseLock → boolean (true on release, false if owner mismatch / missing)
+ *   readLock   → lock object or null
+ */
+
+import {
+	closeSync,
+	existsSync,
+	mkdirSync,
+	openSync,
+	readFileSync,
+	unlinkSync,
+	writeSync,
+} from 'node:fs'
+import { join, resolve } from 'node:path'
+import { isPidAlive } from '../lock/pid.mjs'
+
+const TTL_SECONDS = 1800 // 30 min — D-05
+
+function watchesDir(root) {
+	return join(resolve(root), '.aperant', 'ci-watches')
+}
+
+function lockPath(root, pr) {
+	return join(watchesDir(root), `${pr}.lock`)
+}
+
+/**
+ * @param {string} root
+ * @param {number|string} pr
+ */
+export function readLock(root, pr) {
+	const path = lockPath(root, pr)
+	if (!existsSync(path)) return null
+	try {
+		return JSON.parse(readFileSync(path, 'utf-8'))
+	} catch {
+		// A corrupted lock is treated as no lock — re-acquire will overwrite.
+		return null
+	}
+}
+
+function writeLockFile(path, payload) {
+	mkdirSync(resolve(path, '..'), { recursive: true })
+	const fd = openSync(path, 'wx')
+	try {
+		writeSync(fd, `${JSON.stringify(payload, null, 2)}\n`, 0, 'utf-8')
+	} finally {
+		closeSync(fd)
+	}
+}
+
+/**
+ * Try to acquire the per-PR lock. On EEXIST, parse the existing lock — if the
+ * holder PID is dead AND TTL has elapsed, unlink + retry once. Otherwise
+ * return `{status:'busy', holder}`.
+ *
+ * @param {string} root
+ * @param {number|string} pr
+ * @param {string} sessionId
+ * @param {number} [pid=process.pid]
+ */
+export function acquireLock(root, pr, sessionId, pid = process.pid) {
+	const path = lockPath(root, pr)
+	const payload = {
+		sessionId,
+		pid,
+		acquiredAt: new Date().toISOString(),
+		ttl_seconds: TTL_SECONDS,
+	}
+
+	try {
+		writeLockFile(path, payload)
+		return { status: 'ok', lock: payload }
+	} catch (err) {
+		if (err.code !== 'EEXIST') throw err
+	}
+
+	// Lock file exists — inspect.
+	const existing = readLock(root, pr)
+	if (!existing) {
+		// Corrupted lock — treat as recoverable, unlink + retry once.
+		try {
+			unlinkSync(path)
+		} catch {
+			/* race — another caller cleaned up */
+		}
+		try {
+			writeLockFile(path, payload)
+			return { status: 'ok', lock: payload }
+		} catch (err) {
+			if (err.code === 'EEXIST') {
+				return { status: 'busy', holder: readLock(root, pr) }
+			}
+			throw err
+		}
+	}
+
+	if (isStale(existing)) {
+		try {
+			unlinkSync(path)
+		} catch {
+			/* race — another caller cleaned up */
+		}
+		try {
+			writeLockFile(path, payload)
+			return { status: 'ok', lock: payload }
+		} catch (err) {
+			if (err.code === 'EEXIST') {
+				return { status: 'busy', holder: readLock(root, pr) }
+			}
+			throw err
+		}
+	}
+
+	return { status: 'busy', holder: existing }
+}
+
+/**
+ * Release the per-PR lock. Owner must match (`sessionId` equality). Returns
+ * `true` if released, `false` if the lock is missing or owned by someone
+ * else.
+ *
+ * @param {string} root
+ * @param {number|string} pr
+ * @param {string} sessionId
+ */
+export function releaseLock(root, pr, sessionId) {
+	const path = lockPath(root, pr)
+	if (!existsSync(path)) return false
+	const existing = readLock(root, pr)
+	if (!existing) {
+		// Corrupted — fail open (let next caller clean up).
+		return false
+	}
+	if (existing.sessionId !== sessionId) return false
+	try {
+		unlinkSync(path)
+		return true
+	} catch {
+		return false
+	}
+}
+
+/**
+ * Is the given lock stale (i.e., recoverable by a new caller)? Per D-05,
+ * BOTH conditions are required: dead PID AND past TTL.
+ *
+ * Exposed for unit tests; the orchestrator does not call this directly.
+ *
+ * @param {{ pid: number, acquiredAt: string, ttl_seconds: number }} lockData
+ */
+export function isStale(lockData) {
+	if (!lockData || typeof lockData !== 'object') return false
+	const ttlMs = (lockData.ttl_seconds || TTL_SECONDS) * 1000
+	const age = Date.now() - new Date(lockData.acquiredAt).getTime()
+	if (age <= ttlMs) return false
+	return !isPidAlive(lockData.pid)
+}

package/src/cli/ci-watch/state.mjs

@@ -0,0 +1,103 @@
+/**
+ * ci-watch/state.mjs — per-PR state-file primitives for the /apt:watch-ci
+ * post-ship watcher (D-04).
+ *
+ * Storage shape (`.aperant/ci-watches/{pr}.json`), spec.md §8:
+ *
+ *   {
+ *     pr, task_id, host, scheduler_handle | null,
+ *     attempts, started_at, deadline, last_poll,
+ *     last_status | null, next_tick_interval_ms,
+ *     paused, auto_merge_on_green
+ *   }
+ *
+ * This module is pure read/write — classification logic lives in
+ * stop-matrix.mjs, the orchestrator lives in commands/ci-watch.mjs.
+ *
+ * Crash-safety: `writeState` goes through `atomicWriteJson` (tmp + fsync +
+ * rename). `readState` returns `null` for a missing file and never throws on
+ * a missing path — callers can distinguish "no watch yet" from "watch is
+ * corrupted".
+ *
+ * The corrupted-JSON branch returns a recoverable error envelope rather than
+ * throwing so the orchestrator can surface it without crashing the cron
+ * payload mid-tick.
+ */
+
+import { existsSync, readdirSync, readFileSync, unlinkSync } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { atomicWriteJson } from '../util/io.mjs'
+
+function watchesDir(root) {
+	return join(resolve(root), '.aperant', 'ci-watches')
+}
+
+function stateFile(root, pr) {
+	return join(watchesDir(root), `${pr}.json`)
+}
+
+/**
+ * Read the per-PR state file. Returns `null` when the file does not exist.
+ * Returns `{ error: 'corrupted', message }` when the file exists but is not
+ * parseable JSON — callers route that to the infra-backoff branch.
+ *
+ * @param {string} root
+ * @param {number|string} pr
+ */
+export function readState(root, pr) {
+	const path = stateFile(root, pr)
+	if (!existsSync(path)) return null
+	try {
+		return JSON.parse(readFileSync(path, 'utf-8'))
+	} catch (err) {
+		return { error: 'corrupted', message: err.message }
+	}
+}
+
+/**
+ * Atomically write the per-PR state file. Caller passes the full state object
+ * — this function does not merge, it overwrites. Use `readState` first if a
+ * merge is needed.
+ *
+ * @param {string} root
+ * @param {number|string} pr
+ * @param {object} state
+ */
+export function writeState(root, pr, state) {
+	atomicWriteJson(stateFile(root, pr), state)
+}
+
+/**
+ * Delete the per-PR state file. No-op when the file does not exist.
+ *
+ * @param {string} root
+ * @param {number|string} pr
+ */
+export function deleteState(root, pr) {
+	const path = stateFile(root, pr)
+	if (existsSync(path)) unlinkSync(path)
+}
+
+/**
+ * Enumerate every per-PR state file under `.aperant/ci-watches/`. Returns an
+ * array of parsed state objects in lexicographic filename order. Skips files
+ * whose name does not match `<pr>.json` and skips corrupted files (their
+ * presence does not block the rest of the listing).
+ *
+ * @param {string} root
+ */
+export function listWatches(root) {
+	const dir = watchesDir(root)
+	if (!existsSync(dir)) return []
+	const watches = []
+	for (const f of readdirSync(dir).sort()) {
+		if (!/^\d+\.json$/.test(f)) continue
+		try {
+			watches.push(JSON.parse(readFileSync(join(dir, f), 'utf-8')))
+		} catch {
+			// Skip corrupted state files — listWatches is a read-only enumerator
+			// and must not throw on partial corruption.
+		}
+	}
+	return watches
+}