@ashlr/stack 0.3.6 → 0.3.9

package/dist/index.js

@@ -1490,9 +1490,9 @@ var init_stack_manifest = __esm(() => {
     schema_version: 1,
     kind: "ashlr-stack-manifest",
     components: Object.freeze([
-      Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.6", distribution: "npm" }),
-      Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.6", distribution: "npm" }),
-      Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.6", distribution: "npm" }),
+      Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.9", distribution: "npm" }),
+      Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.9", distribution: "npm" }),
+      Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.9", distribution: "npm" }),
       Object.freeze({
         id: "plugin",
         name: "stack",
@@ -1974,28 +1974,28 @@ async function fetchWithRetry(input, init, opts = {}) {
   const baseDelayMs = opts.baseDelayMs ?? 400;
   const maxDelayMs = opts.maxDelayMs ?? 8000;
   const retryOn = opts.retryOn ?? defaultRetryOn;
-  const idempotent = opts.idempotent ?? isIdempotent(init?.method);
-  const signal = opts.signal;
+  const idempotent = opts.idempotent ?? isIdempotent(init?.method ?? (input instanceof Request ? input.method : undefined));
+  const requestSignal = init?.signal ?? (input instanceof Request ? input.signal : undefined);
+  const mergedInit = mergeSignal({ ...init, signal: requestSignal }, opts.signal);
+  const signal = mergedInit?.signal ?? undefined;
   let attempt = 0;
-  let lastResponse;
-  let lastError;
   while (true) {
     if (signal?.aborted)
       throw abortError(signal);
     try {
-      const res = await fetch(input, mergeSignal(init, signal));
+      const res = await fetch(input, mergedInit);
       if (res.ok || !idempotent || !retryOn(res))
         return res;
-      lastResponse = res;
       if (attempt >= retries)
         return res;
       const waitMs = computeDelay(res, attempt, baseDelayMs, maxDelayMs);
       await sleep(waitMs, signal);
       attempt++;
     } catch (err) {
+      if (signal?.aborted)
+        throw abortError(signal);
       if (isAbortError(err))
         throw err;
-      lastError = err;
       if (!idempotent || attempt >= retries)
         throw err;
       const waitMs = computeDelay(undefined, attempt, baseDelayMs, maxDelayMs);
@@ -7524,6 +7524,183 @@ args = [${GATEWAY_ARGS.map((a) => `"${a}"`).join(", ")}]
 `;
 });
 
+// ../core/src/fleet/capability-matrix.ts
+function parseStringList(value, valid) {
+  if (!Array.isArray(value) || value.some((v) => !valid(v)))
+    return null;
+  return [...new Set(value)];
+}
+function parseCapabilityDocument(text) {
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { status: "invalid", document: null, error: "not valid JSON" };
+  }
+  if (!isRecord(root))
+    return { status: "invalid", document: null, error: "not a JSON object" };
+  if (root.schema !== "fleet.capabilities.v1")
+    return { status: "invalid", document: null, error: 'expected schema "fleet.capabilities.v1"' };
+  if (root.resources !== undefined && !isRecord(root.resources))
+    return { status: "invalid", document: null, error: '"resources" must be an object' };
+  const resources = new Map;
+  let dropped = 0;
+  for (const [id, value] of Object.entries(isRecord(root.resources) ? root.resources : {})) {
+    if (!isResourceId(id) || !isRecord(value)) {
+      dropped++;
+      continue;
+    }
+    let roles = null;
+    if (value.roles !== undefined) {
+      const parsed = parseStringList(value.roles, isFleetRole);
+      if (parsed === null) {
+        dropped++;
+        continue;
+      }
+      roles = parsed;
+    }
+    let capabilities = [];
+    if (value.capabilities !== undefined) {
+      const parsed = parseStringList(value.capabilities, isTag);
+      if (parsed === null) {
+        dropped++;
+        continue;
+      }
+      capabilities = parsed;
+    }
+    let tiers = null;
+    if (value.tiers !== undefined) {
+      const parsed = parseStringList(value.tiers, isTier);
+      if (parsed === null) {
+        dropped++;
+        continue;
+      }
+      tiers = parsed;
+    }
+    resources.set(id, { roles, capabilities, tiers });
+  }
+  return {
+    status: "ok",
+    document: { schema: "fleet.capabilities.v1", resources, dropped },
+    error: null
+  };
+}
+function effectiveRoles(declaration) {
+  return declaration?.roles ?? DEFAULT_RESOURCE_ROLES;
+}
+function buildFleetResource(id, declaration, quota) {
+  return {
+    id,
+    declared: declaration !== undefined,
+    roles: effectiveRoles(declaration),
+    capabilities: declaration?.capabilities ?? [],
+    tiers: declaration?.tiers ?? null,
+    quota
+  };
+}
+function capacityBound(quota) {
+  const bounds = [quota.target, quota.ceiling, quota.hardCap].filter((v) => v !== null);
+  return bounds.length ? Math.min(...bounds) : null;
+}
+function resourceHeadroom(quota) {
+  if (quota === null || quota.running === null)
+    return null;
+  const bound = capacityBound(quota);
+  return bound === null ? null : Math.max(0, bound - quota.running);
+}
+function matchRequirement(requirement, resources, options = {}) {
+  const fleetFull = options.fleet?.hardCap != null && options.fleet.running != null && options.fleet.running >= options.fleet.hardCap;
+  const matches = resources.map((resource) => {
+    const reasons = [];
+    if (!resource.roles.includes(requirement.role))
+      reasons.push(`missing-role:${requirement.role}`);
+    for (const tag of requirement.capabilities)
+      if (!resource.capabilities.includes(tag))
+        reasons.push(`missing-capability:${tag}`);
+    if (requirement.tier !== null && resource.tiers !== null && !resource.tiers.includes(requirement.tier))
+      reasons.push(`tier-unsupported:${requirement.tier}`);
+    if (options.fleetHold === true)
+      reasons.push("fleet-hold");
+    if (fleetFull)
+      reasons.push("fleet-at-capacity");
+    if (resource.quota?.held === true)
+      reasons.push("held");
+    const headroom = resourceHeadroom(resource.quota);
+    if (headroom === 0)
+      reasons.push("at-capacity");
+    return { id: resource.id, eligible: reasons.length === 0, reasons, headroom };
+  });
+  matches.sort((a, b) => {
+    if (a.eligible !== b.eligible)
+      return a.eligible ? -1 : 1;
+    if (a.eligible) {
+      if (a.headroom !== b.headroom) {
+        if (a.headroom === null)
+          return 1;
+        if (b.headroom === null)
+          return -1;
+        return b.headroom - a.headroom;
+      }
+    }
+    return a.id.localeCompare(b.id);
+  });
+  const limited = options.limit === undefined ? matches : matches.slice(0, options.limit);
+  return {
+    requirement,
+    matches: limited,
+    eligible: limited.filter((m) => m.eligible).map((m) => m.id)
+  };
+}
+function parseModelMap(text) {
+  const map = new Map;
+  let dropped = 0;
+  let root;
+  try {
+    root = JSON.parse(text);
+  } catch {
+    return { map, dropped: 1, status: "invalid" };
+  }
+  if (!isRecord(root))
+    return { map, dropped: 1, status: "invalid" };
+  for (const [key, value] of Object.entries(root)) {
+    const dot = key.indexOf(".");
+    const lane = dot < 0 ? key : key.slice(0, dot);
+    const tier = dot < 0 ? null : key.slice(dot + 1);
+    if (!MODEL_KEY_RE.test(lane) || tier !== null && !isTier(tier) || typeof value !== "string" || !MODEL_RE.test(value.trim())) {
+      dropped++;
+      continue;
+    }
+    map.set(key, value.trim());
+  }
+  return { map, dropped, status: "ok" };
+}
+function resolveModel(map, resourceId, tier) {
+  const family = modelFamily(resourceId);
+  const keys = family === resourceId ? tier === null ? [resourceId] : [`${resourceId}.${tier}`, resourceId] : tier === null ? [resourceId, family] : [`${resourceId}.${tier}`, resourceId, `${family}.${tier}`, family];
+  for (const key of keys) {
+    const model = map.get(key);
+    if (model)
+      return { model, via: key };
+  }
+  return null;
+}
+var FLEET_ROLES, ROLE_SET, RESOURCE_ID_RE, TAG_RE, TIER_RE, isFleetRole = (value) => typeof value === "string" && ROLE_SET.has(value), isResourceId = (value) => typeof value === "string" && RESOURCE_ID_RE.test(value), isTag = (value) => typeof value === "string" && TAG_RE.test(value), isTier = (value) => typeof value === "string" && TIER_RE.test(value), isFleetCapability, isFleetTier, isRecord = (value) => value !== null && typeof value === "object" && !Array.isArray(value), DEFAULT_RESOURCE_ROLES, MODEL_KEY_RE, MODEL_RE, modelFamily = (resourceId) => resourceId.startsWith("codex") && resourceId !== "codex-local" ? "codex" : resourceId;
+var init_capability_matrix = __esm(() => {
+  FLEET_ROLES = ["planner", "implementer", "reviewer", "release-verifier"];
+  ROLE_SET = new Set(FLEET_ROLES);
+  RESOURCE_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  TAG_RE = /^[a-z0-9][a-z0-9-]{0,63}$/;
+  TIER_RE = /^[a-z0-9][a-z0-9_-]{0,31}$/;
+  isFleetCapability = isTag;
+  isFleetTier = isTier;
+  DEFAULT_RESOURCE_ROLES = ["implementer"];
+  MODEL_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:/+-]{0,127}$/;
+});
+
+// ../core/src/fleet/job-run.ts
+var init_job_run = () => {};
+
 // ../../node_modules/.bun/consola@3.4.2/node_modules/consola/dist/core.mjs
 function isPlainObject$1(value) {
   if (value === null || typeof value !== "object") {
@@ -9978,6 +10155,8 @@ var init_src = __esm(() => {
   init_detect_source();
   init_registry();
   init_agent_onboard();
+  init_capability_matrix();
+  init_job_run();
 });
 
 // ../../node_modules/.bun/sisteransi@1.0.5/node_modules/sisteransi/src/index.js
@@ -14555,6 +14734,8 @@ async function readFleetText(path, options = {}) {
             break;
           offset += bytesRead;
         }
+        if (options.requireInitialSize && offset < stat.size)
+          throw new Error("Incomplete source");
         text = buffer.subarray(0, offset).toString("utf8");
       }
       return { status: "ok", text };
@@ -15425,6 +15606,7 @@ async function collectFleetSilent(runs, now = Date.now()) {
   }
   const paths = [...authors, "dispatchd.log", "dispatch-events.log", "metrics/jobs.jsonl"];
   const inputs = await Promise.all(paths.map((path) => readFleetJsonl(join18(runs, path), {
+    requireInitialSize: true,
     parseLine: parse3,
     malformedLines: "flag",
     flagRow: wellFormed
@@ -16256,9 +16438,1130 @@ var init_fleet_graph = __esm(() => {
   });
 });
 
-// src/commands/fleet-bets.ts
+// src/lib/fleet-gc.ts
+import { execFile as execFile4 } from "node:child_process";
+import { createHash as createHash4 } from "node:crypto";
+import { lstat as lstat2, readFile as readFile12, readdir as readdir3, realpath } from "node:fs/promises";
+import { basename as basename3, dirname as dirname6, join as join22, resolve as resolve11 } from "node:path";
+import { promisify } from "node:util";
+function cleanEnv(extra = {}) {
+  const env = {};
+  for (const key of ENV_ALLOW) {
+    const value = process.env[key];
+    if (value !== undefined)
+      env[key] = value;
+  }
+  env.PATH ??= "/usr/bin:/bin:/usr/sbin:/sbin";
+  env.GIT_TERMINAL_PROMPT = "0";
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_CONFIG_NOSYSTEM = "1";
+  env.GIT_CONFIG_GLOBAL = "/dev/null";
+  return { ...env, ...extra };
+}
+async function runProc(bin, args, cwd, timeoutMs, maxBuffer) {
+  try {
+    const { stdout } = await execFileAsync(bin, args, {
+      cwd,
+      env: cleanEnv(),
+      timeout: timeoutMs,
+      maxBuffer
+    });
+    return { code: 0, stdout, timedOut: false };
+  } catch (error) {
+    const e = error;
+    return {
+      code: typeof e.code === "number" ? e.code : null,
+      stdout: typeof e.stdout === "string" ? e.stdout : "",
+      timedOut: e.killed === true
+    };
+  }
+}
+function parseWorktreePorcelain(text) {
+  const out = [];
+  let cur = null;
+  for (const rec of text.split("\x00")) {
+    if (rec.startsWith("worktree ")) {
+      if (cur)
+        out.push(cur);
+      cur = {
+        path: rec.slice("worktree ".length),
+        head: "",
+        branch: null,
+        detached: false,
+        locked: false,
+        prunable: false
+      };
+    } else if (cur) {
+      if (rec.startsWith("HEAD "))
+        cur.head = rec.slice(5);
+      else if (rec.startsWith("branch "))
+        cur.branch = rec.slice(7);
+      else if (rec === "detached")
+        cur.detached = true;
+      else if (rec === "locked" || rec.startsWith("locked "))
+        cur.locked = true;
+      else if (rec === "prunable" || rec.startsWith("prunable "))
+        cur.prunable = true;
+    }
+  }
+  if (cur)
+    out.push(cur);
+  return out;
+}
+function lastResultClass(text) {
+  const lines = text.split(`
+`).filter((l) => l.startsWith("RESULT"));
+  const line = lines.at(-1) ?? "";
+  if (!line)
+    return { cls: null, line: "" };
+  if (line.startsWith("RESULT PR ")) {
+    return RESULT_PR_RE.test(line) ? { cls: "pr", line } : { cls: "other", line };
+  }
+  if (line.startsWith("RESULT ARCHIVED "))
+    return { cls: "archived", line };
+  if (line === "RESULT EMPTY" || line.startsWith("RESULT EMPTY "))
+    return { cls: "empty", line };
+  if (line.includes("secret-shape"))
+    return { cls: "abort", line };
+  if (line.startsWith("RESULT DENIED"))
+    return { cls: "denied", line };
+  if (line.startsWith("RESULT ABORT "))
+    return { cls: "abort", line };
+  return { cls: "other", line };
+}
+async function readFleetBytes(path, maxBytes = 1024 * 1024) {
+  try {
+    const file = await openFleetFile(path);
+    try {
+      const stat = await file.stat();
+      if (stat.size > maxBytes)
+        return { status: "invalid", bytes: null };
+      const buf = Buffer.alloc(stat.size);
+      const { bytesRead } = await file.read(buf, 0, stat.size, 0);
+      return { status: "ok", bytes: buf.subarray(0, bytesRead) };
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    const code = error.code;
+    return {
+      status: code === "ENOENT" ? "missing" : "invalid",
+      bytes: null
+    };
+  }
+}
+async function loadHoldList(runs, sources) {
+  const rulesPath = join22(runs, "ENGINEER-RULES.md");
+  const shaPath = `${rulesPath}.sha256`;
+  const [rulesL, shaL] = await Promise.all([
+    lstat2(rulesPath).catch(() => null),
+    lstat2(shaPath).catch(() => null)
+  ]);
+  const bad = (key, status) => {
+    sources[key] = status;
+    return { entries: [], ok: false };
+  };
+  if (!rulesL || rulesL.isSymbolicLink() || !rulesL.isFile())
+    return bad("rules", rulesL ? "invalid" : "missing");
+  if (!shaL || shaL.isSymbolicLink() || !shaL.isFile())
+    return bad("rulesSha", shaL ? "invalid" : "missing");
+  const rulesBytes = await readFleetBytes(rulesPath);
+  const shaBytes = await readFleetBytes(shaPath, 4096);
+  sources.rules = rulesBytes.status;
+  sources.rulesSha = shaBytes.status;
+  if (rulesBytes.status !== "ok" || shaBytes.status !== "ok" || !rulesBytes.bytes || !shaBytes.bytes)
+    return { entries: [], ok: false };
+  const want = shaBytes.bytes.toString("utf8").trim().split(/\s+/)[0] ?? "";
+  if (!/^[0-9a-f]{64}$/.test(want) || sha256Hex(rulesBytes.bytes) !== want)
+    return { entries: [], ok: false };
+  const text = rulesBytes.bytes.toString("utf8");
+  const lines = text.split(`
+`).filter((l) => l.startsWith("7. Hold list"));
+  if (lines.length !== 1)
+    return { entries: [], ok: false };
+  const l7 = lines[0];
+  if (!/^7\. Hold list.*:/.test(l7))
+    return { entries: [], ok: false };
+  const body = l7.slice(l7.indexOf(":") + 1).replace(/\.$/, "");
+  const entries = [];
+  for (const seg of body.split(";")) {
+    const tokens = seg.trim().split(/\s+/).filter(Boolean);
+    if (tokens.length < 2)
+      return { entries: [], ok: false };
+    const repo = tokens[0];
+    if (!FLEET_REPOS.has(repo))
+      return { entries: [], ok: false };
+    const prs = new Set;
+    for (const t of tokens.slice(1)) {
+      const m = t.match(/^#(\d+)\.?$/);
+      if (!m)
+        return { entries: [], ok: false };
+      prs.add(m[1]);
+    }
+    entries.push({ repo, prs });
+  }
+  return { entries, ok: entries.length > 0 };
+}
+async function loadFleetState(runs, queue) {
+  const sources = {};
+  const readSet = async (path, key) => {
+    const src = await readFleetText(path);
+    sources[key] = src.status;
+    return src.text;
+  };
+  const [keepText, landonlyText, readyText, statusJson, skipsText, g1names] = await Promise.all([
+    readSet(join22(queue, "keep.txt"), "keep"),
+    readSet(join22(runs, "PUBLISH_LANDONLY"), "landonly"),
+    readSet(join22(queue, "ready.tsv"), "ready"),
+    readFleetJson(join22(queue, "status.json"), { object: true }),
+    readSet(join22(queue, "precheck-skips.tsv"), "precheckSkips"),
+    readdir3(join22(runs, "g1-pass")).then((names) => {
+      sources.g1pass = "ok";
+      return names;
+    }, (error) => {
+      sources.g1pass = error.code === "ENOENT" ? "missing" : "unavailable";
+      return [];
+    })
+  ]);
+  sources.status = statusJson.status;
+  const hold = await loadHoldList(runs, sources);
+  const queued = new Set;
+  for (const line of readyText.split(`
+`)) {
+    if (!line.trim() || line.startsWith("#"))
+      continue;
+    const id = line.split("\t")[0]?.trim();
+    if (id && JOB_ID.test(id))
+      queued.add(id);
+  }
+  const statusKept = new Set;
+  const statusReaping = new Set;
+  if (isFleetRow(statusJson.data)) {
+    for (const key of ["kept_worktrees", "reaping"]) {
+      const list = statusJson.data[key];
+      if (Array.isArray(list)) {
+        for (const id of list)
+          if (typeof id === "string")
+            (key === "kept_worktrees" ? statusKept : statusReaping).add(id);
+      }
+    }
+  }
+  const precheckDone = new Set;
+  for (const line of skipsText.split(`
+`)) {
+    const f = line.split("\t");
+    if (f.length === 4 && f[1] && /^[0-9]{1,2}$/.test(f[2] ?? "")) {
+      const code = Number(f[2]);
+      if (code >= 10 && code <= 13)
+        precheckDone.add(f[1]);
+    }
+  }
+  return {
+    keep: tokenSet(keepText),
+    landonly: tokenSet(landonlyText),
+    queued,
+    statusKept,
+    statusReaping,
+    g1pass: new Set(g1names.filter((n) => n.endsWith(".pass")).map((n) => n.slice(0, -5))),
+    precheckDone,
+    holdEntries: hold.entries,
+    holdListOk: hold.ok,
+    sources
+  };
+}
+async function newestTreeMtime(root, deadline) {
+  let newest = 0;
+  let visited = 0;
+  let complete = true;
+  const stack = [{ path: root, depth: 0 }];
+  const note = async (p) => {
+    const s = await lstat2(p).catch((e) => {
+      if (e.code !== "ENOENT")
+        complete = false;
+      return null;
+    });
+    if (s && s.mtimeMs > newest)
+      newest = s.mtimeMs;
+  };
+  while (stack.length) {
+    if (Date.now() > deadline || visited > WALK_MAX_ENTRIES) {
+      complete = false;
+      break;
+    }
+    const { path, depth } = stack.pop();
+    let dirents;
+    try {
+      dirents = await readdir3(path, { withFileTypes: true });
+    } catch (e) {
+      if (e.code !== "ENOENT")
+        complete = false;
+      continue;
+    }
+    for (const d of dirents) {
+      if (++visited > WALK_MAX_ENTRIES) {
+        complete = false;
+        break;
+      }
+      const p = join22(path, d.name);
+      if (d.isSymbolicLink()) {
+        await note(p);
+        continue;
+      }
+      if (d.isDirectory()) {
+        if (WALK_PRUNE_ANYWHERE.has(d.name))
+          continue;
+        if (depth === 0 && WALK_PRUNE_TOP.has(d.name))
+          continue;
+        stack.push({ path: p, depth: depth + 1 });
+        await note(p);
+        continue;
+      }
+      await note(p);
+    }
+  }
+  return { newest, complete };
+}
+async function worktreeMapFor(ctx, repoPath) {
+  let pending = ctx.worktreeMaps.get(repoPath);
+  if (!pending) {
+    pending = (async () => {
+      if (Date.now() > ctx.deadline) {
+        ctx.stats.budgetExceeded = true;
+        return null;
+      }
+      ctx.stats.gitChecks++;
+      const res = await runGit(["-C", repoPath, "worktree", "list", "--porcelain", "-z"], repoPath, 20000);
+      if (res.code !== 0)
+        return null;
+      const map = new Map;
+      for (const w of parseWorktreePorcelain(res.stdout))
+        map.set(resolve11(w.path), w);
+      return map;
+    })();
+    ctx.worktreeMaps.set(repoPath, pending);
+  }
+  return pending;
+}
+async function resolveRepo(entryPath) {
+  const gitPath = join22(entryPath, ".git");
+  const st = await lstat2(gitPath).catch(() => null);
+  if (!st)
+    return { error: "git-pointer-missing" };
+  if (st.isDirectory())
+    return { error: "not-a-linked-worktree" };
+  if (!st.isFile() || st.isSymbolicLink() || st.size > 8192)
+    return { error: "git-pointer-invalid" };
+  const text = await readFile12(gitPath, "utf8").catch(() => "");
+  const m = text.match(/^gitdir:\s*(.+)$/m);
+  if (!m)
+    return { error: "git-pointer-invalid" };
+  const gitdir = resolve11(entryPath, m[1].trim());
+  const gd = await lstat2(gitdir).catch(() => null);
+  if (!gd?.isDirectory() || gd.isSymbolicLink())
+    return { error: "gitdir-missing" };
+  let common = "../..";
+  const commondirPath = join22(gitdir, "commondir");
+  const cd = await lstat2(commondirPath).catch(() => null);
+  if (cd?.isFile() && !cd.isSymbolicLink() && cd.size <= 4096) {
+    const commondirText = await readFile12(commondirPath, "utf8").catch(() => "");
+    if (commondirText.trim())
+      common = commondirText.trim();
+  }
+  const commonGit = resolve11(gitdir, common);
+  if (basename3(commonGit) !== ".git")
+    return { error: "repo-unresolved" };
+  return { repo: dirname6(commonGit) };
+}
+function heldJob(state, job, lineText, repoName) {
+  if (!state.holdListOk)
+    return false;
+  const lineRepo = (lineText.split(`
+`)[0]?.split("\t")[1] ?? "").trim();
+  const repo = (lineRepo || repoName).replace(/^ashlrai\//, "");
+  if (!FLEET_REPOS.has(repo))
+    return true;
+  const entry = state.holdEntries.find((h) => h.repo === repo);
+  if (!entry)
+    return false;
+  const tokens = `${job} ${lineText}`.match(/\d+/g) ?? [];
+  for (const pr of entry.prs)
+    if (tokens.includes(pr))
+      return true;
+  return false;
+}
+function lsofHolds(lsofText, path) {
+  return lsofText.includes(`n${path}/`) || lsofText.includes(`n${path}
+`) || lsofText.endsWith(`n${path}`);
+}
+async function logFinished(runs, name, now, liveMs) {
+  const fail = (reason) => ({ ok: false, reason });
+  const lf = join22(runs, `${name}.log`);
+  const st = await lstat2(lf).catch(() => null);
+  if (!st || !st.isFile() || st.isSymbolicLink())
+    return fail("log-missing");
+  if (st.size <= 0)
+    return fail("log-empty");
+  if (now - st.mtimeMs < liveMs)
+    return fail("log-recent");
+  let tailText;
+  let lastByteNl = false;
+  try {
+    const file = await openFleetFile(lf);
+    try {
+      const size = st.size;
+      const len = Math.min(LOG_TAIL, size);
+      const buf = Buffer.alloc(len);
+      await file.read(buf, 0, len, size - len);
+      tailText = buf.toString("utf8").replace(/\r/g, "");
+      const last = Buffer.alloc(1);
+      await file.read(last, 0, 1, size - 1);
+      lastByteNl = last[0] === 10;
+    } finally {
+      await file.close();
+    }
+  } catch {
+    return fail("log-unreadable");
+  }
+  if (!lastByteNl)
+    return fail("log-truncated");
+  const lines = tailText.split(`
+`);
+  let endMarked = lines.some((l, i) => /^tokens used[ \t]*$/.test(l) && /^[ \t]*[0-9][0-9,]*[ \t]*$/.test(lines[i + 1] ?? ""));
+  if (!endMarked) {
+    const esc = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    if (new RegExp(`^API_SPEND ${esc} pool=(gift|monthly) `, "m").test(tailText))
+      endMarked = true;
+  }
+  if (!endMarked) {
+    const errRe = /^[ \t]*(?:ERROR|Error|API Error|stream error)[: ]/;
+    const termRe = /usage limit|you've hit your|weekly limit|credits? (are |have been )?(exhausted|depleted)|out of credits|insufficient credits|no credits remaining/i;
+    endMarked = lines.some((l) => errRe.test(l) && termRe.test(l));
+  }
+  if (!endMarked)
+    return fail("log-no-end-marker");
+  const st2 = await lstat2(lf).catch(() => null);
+  if (!st2 || st2.size !== st.size || st2.mtimeMs !== st.mtimeMs)
+    return fail("log-growing");
+  return { ok: true, reason: "" };
+}
+async function classifyEntry(ctx, name) {
+  const entry = { name, path: join22(ctx.root, name), class: "preserve", reasons: [] };
+  const reasons = entry.reasons;
+  const preserve = (reason) => {
+    reasons.push(reason);
+    return { entry };
+  };
+  if (!JOB_ID.test(name))
+    return preserve("bad-name");
+  if (DENIED_NAME.test(name) || DENIED_NAMES.has(name))
+    return preserve("denied-name");
+  const runs = ctx.runs;
+  const queue = ctx.queue;
+  const basePath = join22(runs, `${name}.base`);
+  const baseL = await lstat2(basePath).catch(() => null);
+  if (!baseL)
+    return preserve("no-job-record");
+  if (!baseL.isFile() || baseL.isSymbolicLink())
+    return preserve("base-invalid");
+  const baseText = await readFleetText(basePath);
+  if (baseText.status !== "ok")
+    return preserve("base-invalid");
+  const fields = baseText.text.split(/\s+/).filter(Boolean);
+  if (fields.length < 4)
+    return preserve("base-invalid");
+  const baseSha = fields[0];
+  const branch = fields[1];
+  const baseWt = fields[2];
+  if (!/^[0-9a-f]{40}$/.test(baseSha))
+    return preserve("base-invalid");
+  if (!/^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$/.test(branch))
+    return preserve("base-invalid");
+  const baseReal = await realpath(baseWt).catch(() => null);
+  if (baseReal !== entry.path)
+    return preserve("base-mismatch");
+  const runDir = join22(queue, "run");
+  const probe = (p) => lstat2(p).catch(() => null);
+  const [
+    wtStat,
+    dispatched,
+    reaping,
+    runLock,
+    rootLock,
+    logF,
+    launchF,
+    publishF,
+    pidRun,
+    pidRoot,
+    lineF
+  ] = await Promise.all([
+    probe(entry.path),
+    probe(join22(runDir, `${name}.dispatched`)),
+    probe(join22(runDir, `${name}.reaping`)),
+    probe(join22(runDir, `${name}.lock`)),
+    probe(join22(runs, `${name}.lock`)),
+    probe(join22(runs, `${name}.log`)),
+    probe(join22(runs, `${name}.launch`)),
+    probe(join22(runs, `${name}.publish`)),
+    probe(join22(runDir, `${name}.pid`)),
+    probe(join22(runs, `${name}.pid`)),
+    probe(join22(runDir, `${name}.line`))
+  ]);
+  if (!wtStat?.isDirectory() || wtStat.isSymbolicLink())
+    return preserve("not-a-directory");
+  if (dispatched)
+    reasons.push("dispatch-pending");
+  if (reaping)
+    reasons.push("reap-claimed");
+  if (runLock || rootLock)
+    reasons.push("lock-claimed");
+  const pidStat = pidRun ?? pidRoot;
+  if (pidStat) {
+    const pidPath = pidRun ? join22(runDir, `${name}.pid`) : join22(runs, `${name}.pid`);
+    const pidText = pidStat.isFile() && !pidStat.isSymbolicLink() ? (await readFleetText(pidPath)).text : "";
+    const pid = Number(pidText.trim());
+    if (!Number.isSafeInteger(pid) || pid <= 0)
+      reasons.push("pid-unknown");
+    else {
+      try {
+        process.kill(pid, 0);
+        reasons.push("process-live");
+      } catch (error) {
+        const code = error.code;
+        reasons.push(code === "EPERM" ? "process-live" : "pid-stale");
+      }
+    }
+  }
+  if (ctx.state.statusKept.has(name))
+    reasons.push("status-kept");
+  if (ctx.state.statusReaping.has(name))
+    reasons.push("status-reaping");
+  if (ctx.state.keep.has(name))
+    reasons.push("kept");
+  if (ctx.state.queued.has(name))
+    reasons.push("job-queued");
+  const now = ctx.now;
+  const recent = Math.max(baseL.mtimeMs, logF?.mtimeMs ?? 0, launchF?.mtimeMs ?? 0, publishF?.mtimeMs ?? 0, wtStat.mtimeMs);
+  if (now - recent < LIVE_WINDOW_MS)
+    reasons.push("recent-activity");
+  if (reasons.length)
+    return { entry };
+  let basis;
+  let resultCls = null;
+  let resultPr = null;
+  const lineText = lineF?.isFile() && !lineF.isSymbolicLink() ? (await readFleetText(join22(runDir, `${name}.line`))).text : "";
+  if (publishF) {
+    const pub = await readFleetText(join22(runs, `${name}.publish`));
+    if (pub.status !== "ok")
+      return preserve("publish-unreadable");
+    const { cls, line } = lastResultClass(pub.text);
+    if (!cls)
+      return preserve("publish-unresulted");
+    resultCls = cls;
+    entry.resultClass = cls;
+    if (cls !== "pr" && cls !== "empty") {
+      reasons.push(`kept-supervisor:${cls}`);
+      entry.jobState = "kept";
+      return { entry };
+    }
+    basis = cls === "pr" ? "result-pr" : "result-empty";
+    entry.jobState = "finished";
+    if (cls === "pr") {
+      const m = line.match(RESULT_PR_RE);
+      if (m)
+        resultPr = { repo: m[1], pr: m[2] };
+      entry.pr = resultPr ? `ashlrai/${resultPr.repo}#${resultPr.pr}` : undefined;
+    }
+  } else if (ctx.state.precheckDone.has(name)) {
+    basis = "done-noop";
+    entry.jobState = "done-noop";
+  } else {
+    const fin = await logFinished(runs, name, now, LIVE_WINDOW_MS);
+    if (!fin.ok)
+      return preserve(fin.reason);
+    basis = "empty-inferred";
+    entry.jobState = "finished-inferred";
+  }
+  const idleThresholdMs = basis === "result-pr" ? ctx.reapIdleMs : ctx.emptyIdleMs;
+  const newestRuns = Math.max(baseL.mtimeMs, logF?.mtimeMs ?? 0, launchF?.mtimeMs ?? 0, publishF?.mtimeMs ?? 0, wtStat.mtimeMs);
+  return {
+    entry,
+    deep: {
+      basis,
+      baseSha,
+      branch,
+      idleThresholdMs,
+      newestRuns,
+      publishMtimeMs: publishF?.mtimeMs ?? 0,
+      resultPr,
+      lineText
+    }
+  };
+}
+async function deepCheck(ctx, entry, d) {
+  const reasons = entry.reasons;
+  const bail = (reason) => {
+    reasons.push(reason);
+  };
+  if (Date.now() > ctx.deadline) {
+    ctx.stats.budgetExceeded = true;
+    bail("budget-exceeded");
+    return;
+  }
+  const resolved = await resolveRepo(entry.path);
+  if ("error" in resolved) {
+    bail(resolved.error);
+    return;
+  }
+  entry.repo = resolved.repo;
+  const repoName = basename3(resolved.repo);
+  const map = await worktreeMapFor(ctx, resolved.repo);
+  if (!map) {
+    bail("repo-scan-failed");
+    return;
+  }
+  const info = map.get(resolve11(entry.path));
+  if (!info) {
+    bail("unregistered");
+    return;
+  }
+  if (info.prunable) {
+    bail("prunable");
+    return;
+  }
+  if (info.locked) {
+    bail("locked");
+    return;
+  }
+  entry.head = info.head || undefined;
+  entry.branch = info.branch ? info.branch.replace(/^refs\/heads\//, "") : null;
+  entry.detached = info.detached || undefined;
+  if (!ctx.lsofOk) {
+    bail("lsof-unavailable");
+    return;
+  }
+  const realEntry = await realpath(entry.path).catch(() => entry.path);
+  if (lsofHolds(ctx.lsofText, entry.path) || realEntry !== entry.path && lsofHolds(ctx.lsofText, realEntry)) {
+    bail("live-process");
+    return;
+  }
+  if (d.basis === "result-pr") {
+    if (!d.resultPr || !FLEET_REPOS.has(d.resultPr.repo)) {
+      bail("repo-unlisted");
+      return;
+    }
+    const rp = d.resultPr;
+    const h = rp ? ctx.state.holdEntries.find((e) => e.repo === rp.repo) : undefined;
+    if (rp && h?.prs.has(rp.pr)) {
+      bail("hold-list");
+      return;
+    }
+    if (PROTECTED_PR.test(d.branch)) {
+      bail("protected-branch");
+      return;
+    }
+    if (CLAUDE_BRANCH.test(d.branch) && ctx.now - d.publishMtimeMs < CLAUDE_PUSH_MS) {
+      bail("claude-recent-push");
+      return;
+    }
+  } else {
+    if (ctx.state.landonly.has(entry.name) || ctx.state.g1pass.has(entry.name)) {
+      bail("publish-queued");
+      return;
+    }
+    if (PROTECTED_EMPTY.test(d.branch)) {
+      bail("protected-branch");
+      return;
+    }
+    if (heldJob(ctx.state, entry.name, d.lineText, repoName)) {
+      bail("held");
+      return;
+    }
+  }
+  if (Date.now() > ctx.deadline) {
+    ctx.stats.budgetExceeded = true;
+    bail("budget-exceeded");
+    return;
+  }
+  ctx.stats.gitChecks++;
+  const status = await runGit([
+    "--no-optional-locks",
+    "-C",
+    entry.path,
+    "-c",
+    "core.fsmonitor=false",
+    "-c",
+    "core.untrackedCache=false",
+    "status",
+    "--porcelain=v1",
+    "--untracked-files=all",
+    "--ignored=traditional",
+    "--ignore-submodules=all"
+  ], entry.path);
+  if (status.code !== 0) {
+    bail(status.timedOut ? "git-timeout" : "git-error");
+    return;
+  }
+  let dirty = false;
+  let badIgnored = false;
+  const checkIgnored = d.basis === "empty-inferred";
+  for (const line of status.stdout.split(`
+`)) {
+    if (!line)
+      continue;
+    if (line.startsWith("!!")) {
+      if (!checkIgnored)
+        continue;
+      const raw = line.slice(3);
+      if (raw.startsWith('"')) {
+        badIgnored = true;
+        continue;
+      }
+      const isDir = raw.endsWith("/");
+      const body = isDir ? raw.slice(0, -1) : raw;
+      const top = body.split("/")[0] ?? "";
+      if (!BUILD_ALLOW.has(top) || !isDir && !body.includes("/"))
+        badIgnored = true;
+      continue;
+    }
+    dirty = true;
+  }
+  if (dirty) {
+    bail("dirty");
+    return;
+  }
+  if (badIgnored) {
+    bail("ignored-files");
+    return;
+  }
+  if (d.basis === "result-pr") {
+    if (Date.now() > ctx.deadline) {
+      ctx.stats.budgetExceeded = true;
+      bail("budget-exceeded");
+      return;
+    }
+    ctx.stats.gitChecks++;
+    const unpushed = await runGit(["-C", entry.path, "rev-list", "--count", "HEAD", "--not", "--remotes"], entry.path);
+    if (unpushed.code !== 0) {
+      bail(unpushed.timedOut ? "git-timeout" : "git-error");
+      return;
+    }
+    if (unpushed.stdout.trim() !== "0") {
+      bail("unpushed-commits");
+      return;
+    }
+  } else {
+    if (Date.now() > ctx.deadline) {
+      ctx.stats.budgetExceeded = true;
+      bail("budget-exceeded");
+      return;
+    }
+    ctx.stats.gitChecks++;
+    const ahead = await runGit(["-C", entry.path, "rev-list", "--count", `${d.baseSha}..HEAD`], entry.path);
+    if (ahead.code !== 0) {
+      bail(ahead.timedOut ? "git-timeout" : "git-error");
+      return;
+    }
+    if (ahead.stdout.trim() !== "0") {
+      bail("unpublished-work");
+      return;
+    }
+    ctx.stats.gitChecks++;
+    const diff = await runGit([
+      "-C",
+      entry.path,
+      "diff",
+      "--quiet",
+      "--no-ext-diff",
+      "--no-textconv",
+      "--ignore-submodules=all",
+      d.baseSha,
+      "--"
+    ], entry.path);
+    if (diff.code === null || diff.code !== 0 && diff.code !== 1) {
+      bail(diff.timedOut ? "git-timeout" : "git-error");
+      return;
+    }
+    if (diff.code === 1) {
+      bail("unpublished-work");
+      return;
+    }
+  }
+  if (Date.now() > ctx.deadline) {
+    ctx.stats.budgetExceeded = true;
+    bail("budget-exceeded");
+    return;
+  }
+  ctx.stats.walks++;
+  const walk = await newestTreeMtime(entry.path, ctx.deadline);
+  if (!walk.complete) {
+    bail("walk-incomplete");
+    return;
+  }
+  const newest = Math.max(d.newestRuns, walk.newest, (await lstat2(entry.path).catch(() => null))?.mtimeMs ?? 0);
+  const idleHours = (ctx.now - newest) / 3600000;
+  entry.idleHours = Math.round(idleHours * 100) / 100;
+  if (idleHours * 3600000 < d.idleThresholdMs) {
+    bail("idle-below-threshold");
+    return;
+  }
+  if (d.basis === "result-pr") {
+    if (!d.resultPr) {
+      bail("pr-unparsed");
+      return;
+    }
+    if (ctx.ghCalls >= ctx.ghMax) {
+      bail("gh-budget");
+      return;
+    }
+    ctx.ghCalls++;
+    const gh = await runProc(ctx.ghBin, [
+      "pr",
+      "view",
+      d.resultPr.pr,
+      "--repo",
+      `ashlrai/${d.resultPr.repo}`,
+      "--json",
+      "state",
+      "-q",
+      ".state"
+    ], entry.path, 15000, 1024 * 1024);
+    if (gh.code === null) {
+      bail("gh-unavailable");
+      return;
+    }
+    if (gh.code === 0)
+      ctx.ghSawOk = true;
+    if (gh.code !== 0) {
+      bail(gh.timedOut ? "gh-timeout" : "pr-state-unknown");
+      return;
+    }
+    const state = gh.stdout.trim().toUpperCase();
+    if (state === "OPEN") {
+      bail("pr-open");
+      return;
+    }
+    if (state !== "MERGED" && state !== "CLOSED") {
+      bail("pr-state-unknown");
+      return;
+    }
+  }
+  entry.class = "collect-candidate";
+  entry.basis = d.basis;
+  entry.reasons = [];
+}
+async function firstExisting(paths) {
+  for (const p of paths) {
+    const st = await lstat2(p).catch(() => null);
+    if (st)
+      return p;
+  }
+  return null;
+}
+async function collectFleetGc(options) {
+  const started = Date.now();
+  const now = options.now ?? started;
+  const root = await realpath(resolve11(options.root)).catch(() => resolve11(options.root));
+  const runs = resolve11(options.runs);
+  const queue = resolve11(options.queue ?? join22(runs, "queue"));
+  const reapIdleHours = options.reapIdleHours ?? 2;
+  const emptyIdleHours = options.emptyIdleHours ?? 6;
+  const budgetSeconds = options.budgetSeconds ?? 120;
+  const ghMax = options.ghMax ?? GH_MAX_DEFAULT;
+  const sources = {};
+  const dirents = await readdir3(root, { withFileTypes: true }).then((d) => {
+    sources.root = "ok";
+    return d;
+  }, (error) => {
+    sources.root = error.code === "ENOENT" ? "missing" : "unavailable";
+    return [];
+  });
+  sources.runs = await lstat2(runs).then((s) => s.isDirectory() ? "ok" : "invalid").catch((e) => e.code === "ENOENT" ? "missing" : "unavailable");
+  const names = dirents.filter((d) => d.isDirectory() && !d.isSymbolicLink()).map((d) => d.name).sort();
+  const skippedNonDirs = dirents.length - names.length;
+  const state = await loadFleetState(runs, queue);
+  Object.assign(sources, state.sources);
+  const repoPaths = new Set;
+  const parent = dirname6(root);
+  const siblings = await readdir3(parent, { withFileTypes: true }).catch(() => []);
+  for (const d of siblings) {
+    if (!d.isDirectory() || d.isSymbolicLink())
+      continue;
+    const candidate = join22(parent, d.name);
+    const gitEntry = await lstat2(join22(candidate, ".git")).catch(() => null);
+    if (gitEntry && (gitEntry.isDirectory() || gitEntry.isFile()))
+      repoPaths.add(candidate);
+  }
+  const lsofBin = options.lsofBin ?? await firstExisting(["/usr/sbin/lsof", "/usr/bin/lsof", "/usr/local/bin/lsof"]);
+  let lsofOk = false;
+  let lsofText = "";
+  if (lsofBin) {
+    const lo = await runProc(lsofBin, ["-nP", "-w", "-Fn"], root, 30000, 64 * 1024 * 1024);
+    lsofOk = lo.code === 0 || lo.stdout.length > 0;
+    lsofText = lo.stdout;
+  }
+  sources.lsof = lsofOk ? "ok" : "unavailable";
+  const ghCandidates = ["/opt/homebrew/bin/gh", "/usr/local/bin/gh", "/usr/bin/gh"];
+  if (process.env.HOME)
+    ghCandidates.push(join22(process.env.HOME, ".local", "bin", "gh"));
+  const ghBin = options.ghBin ?? await firstExisting(ghCandidates) ?? "gh";
+  const deadline = started + budgetSeconds * 1000;
+  const ctx = {
+    root,
+    runs,
+    queue,
+    state,
+    now,
+    reapIdleMs: reapIdleHours * 3600000,
+    emptyIdleMs: emptyIdleHours * 3600000,
+    deadline,
+    lsofOk,
+    lsofText,
+    ghBin,
+    ghMax,
+    ghCalls: 0,
+    ghSawOk: false,
+    worktreeMaps: new Map,
+    stats: { gitChecks: 0, walks: 0, budgetExceeded: false }
+  };
+  const repoList = [...repoPaths];
+  let ri = 0;
+  await Promise.all(Array.from({ length: Math.min(8, repoList.length) }, async () => {
+    while (ri < repoList.length) {
+      const repo = repoList[ri++];
+      await worktreeMapFor(ctx, repo);
+    }
+  }));
+  const classified = [];
+  const CHUNK = 64;
+  for (let i = 0;i < names.length; i += CHUNK) {
+    const chunk = names.slice(i, i + CHUNK);
+    classified.push(...await Promise.all(chunk.map((n) => classifyEntry(ctx, n))));
+  }
+  const deepOnes = classified.filter((c) => c.deep);
+  let di = 0;
+  await Promise.all(Array.from({ length: Math.min(8, deepOnes.length) }, async () => {
+    while (di < deepOnes.length) {
+      const c = deepOnes[di++];
+      if (!state.holdListOk) {
+        c.entry.reasons.push("hold-list-unknown");
+        continue;
+      }
+      await deepCheck(ctx, c.entry, c.deep);
+    }
+  }));
+  const staleRegistrations = [];
+  const nameSet = new Set(names);
+  for (const pending of ctx.worktreeMaps.values()) {
+    const map = await pending;
+    if (!map)
+      continue;
+    for (const p of map.keys()) {
+      if (dirname6(p) !== root)
+        continue;
+      const rel = p.slice(root.length + 1);
+      if (!rel || rel.includes("/"))
+        continue;
+      if (nameSet.has(rel))
+        continue;
+      const exists = await lstat2(p).then(() => true, () => false);
+      if (!exists)
+        staleRegistrations.push(rel);
+    }
+  }
+  staleRegistrations.sort();
+  const entries = classified.map((c) => c.entry);
+  const byClass = { preserve: 0, "collect-candidate": 0 };
+  const byBasis = {};
+  const byReason = {};
+  const byResultClass = {};
+  for (const e of entries) {
+    byClass[e.class]++;
+    if (e.basis)
+      byBasis[e.basis] = (byBasis[e.basis] ?? 0) + 1;
+    if (e.resultClass)
+      byResultClass[e.resultClass] = (byResultClass[e.resultClass] ?? 0) + 1;
+    for (const r of e.reasons)
+      byReason[r] = (byReason[r] ?? 0) + 1;
+  }
+  return {
+    schemaVersion: 1,
+    mode: "dry-run",
+    generatedAt: new Date(now).toISOString(),
+    root,
+    runs,
+    queue,
+    thresholds: { reapIdleHours, emptyIdleHours, budgetSeconds },
+    sources,
+    tools: {
+      lsof: lsofOk ? "ok" : "unavailable",
+      gh: ctx.ghCalls === 0 ? "unused" : ctx.ghSawOk ? "ok" : "unavailable"
+    },
+    reposScanned: ctx.worktreeMaps.size,
+    scan: {
+      complete: !ctx.stats.budgetExceeded,
+      entries: entries.length,
+      skippedNonDirs,
+      gitChecks: ctx.stats.gitChecks,
+      walks: ctx.stats.walks,
+      ghCalls: ctx.ghCalls,
+      budgetExceeded: ctx.stats.budgetExceeded,
+      durationMs: Date.now() - started
+    },
+    summary: {
+      total: entries.length,
+      byClass,
+      byBasis,
+      byReason,
+      byResultClass
+    },
+    staleRegistrations: {
+      count: staleRegistrations.length,
+      sample: staleRegistrations.slice(0, 50)
+    },
+    entries
+  };
+}
+var execFileAsync, JOB_ID, LIVE_WINDOW_MS = 900000, CLAUDE_PUSH_MS = 1800000, LOG_TAIL = 8192, GH_MAX_DEFAULT = 40, FLEET_REPOS, BUILD_ALLOW, PROTECTED_EMPTY, PROTECTED_PR, CLAUDE_BRANCH, DENIED_NAME, DENIED_NAMES, WALK_PRUNE_ANYWHERE, WALK_PRUNE_TOP, WALK_MAX_ENTRIES = 60000, RESULT_PR_RE, ENV_ALLOW, runGit = (args, cwd, timeoutMs = 15000) => runProc("git", args, cwd, timeoutMs, 8 * 1024 * 1024), tokenSet = (text) => new Set(text.split(/\s+/).filter(Boolean)), sha256Hex = (buf) => createHash4("sha256").update(buf).digest("hex");
+var init_fleet_gc = __esm(() => {
+  init_fleet_jsonl();
+  execFileAsync = promisify(execFile4);
+  JOB_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+  FLEET_REPOS = new Set([
+    "phantom",
+    "phantom-secrets",
+    "ashlr-plugin",
+    "locus",
+    "lexicon",
+    "ashlr-md",
+    "ashlr-stack"
+  ]);
+  BUILD_ALLOW = new Set([
+    "node_modules",
+    "dist",
+    "build",
+    "target",
+    ".next",
+    ".turbo",
+    "coverage",
+    "__pycache__",
+    ".pytest_cache",
+    ".vite",
+    "out",
+    ".cache"
+  ]);
+  PROTECTED_EMPTY = /^(?:codex|claude)\//;
+  PROTECTED_PR = /^codex\//;
+  CLAUDE_BRANCH = /^claude\//;
+  DENIED_NAME = /vault|keychains/i;
+  DENIED_NAMES = new Set(["g1-pass", "quarantine", ".codex", ".codex-2", ".ashlr-runs"]);
+  WALK_PRUNE_ANYWHERE = new Set([".git", "node_modules"]);
+  WALK_PRUNE_TOP = new Set([...BUILD_ALLOW].filter((d) => d !== "node_modules"));
+  RESULT_PR_RE = /^RESULT PR https:\/\/github\.com\/ashlrai\/([A-Za-z0-9._-]+)\/pull\/([0-9]{1,7})(?: |$)/;
+  ENV_ALLOW = [
+    "HOME",
+    "PATH",
+    "LANG",
+    "LC_ALL",
+    "USER",
+    "LOGNAME",
+    "TMPDIR",
+    "GH_TOKEN",
+    "GITHUB_TOKEN",
+    "GH_CONFIG_DIR"
+  ];
+});
+
+// src/commands/fleet-gc.ts
 import { homedir as homedir12 } from "node:os";
-import { dirname as dirname6, join as join22 } from "node:path";
+import { join as join23 } from "node:path";
+var fleetGcCommand;
+var init_fleet_gc2 = __esm(() => {
+  init_dist3();
+  init_fleet_gc();
+  fleetGcCommand = defineCommand2({
+    meta: {
+      name: "fleet-gc",
+      description: "Dry-run report classifying fleet worktrees as preserved or collect-candidates (read-only)."
+    },
+    args: {
+      json: { type: "boolean", description: "Emit schemaVersion 1 JSON." },
+      root: {
+        type: "string",
+        description: "Worktree root (default: ~/Projects/ashlrai/wt)."
+      },
+      runs: {
+        type: "string",
+        description: "Fleet runs dir (default: ~/.ashlr-runs); queue defaults to <runs>/queue."
+      },
+      queue: { type: "string", description: "Queue dir override (default: <runs>/queue)." },
+      reapIdleHours: {
+        type: "string",
+        description: "Idle hours before RESULT PR worktrees are candidates (default 2)."
+      },
+      emptyIdleHours: {
+        type: "string",
+        description: "Idle hours before done/empty worktrees are candidates (default 6)."
+      },
+      budgetSeconds: {
+        type: "string",
+        description: "Seconds allowed for deep git/tree/gh inspection (default 120)."
+      },
+      ghBin: { type: "string", description: "gh binary override (default: PATH/install paths)." },
+      lsofBin: { type: "string", description: "lsof binary override (default: system lsof)." },
+      ghMax: {
+        type: "string",
+        description: "Cap on gh pr view calls (default 40)."
+      },
+      dryRun: {
+        type: "boolean",
+        description: "Accepted for explicitness; this command is always a dry run."
+      }
+    },
+    async run({ args }) {
+      const num = (v, fallback) => {
+        if (v === undefined)
+          return fallback;
+        const n = Number(v);
+        return Number.isFinite(n) && n >= 0 ? n : fallback;
+      };
+      const report = await collectFleetGc({
+        root: args.root ?? join23(homedir12(), "Projects", "ashlrai", "wt"),
+        runs: args.runs ?? join23(homedir12(), ".ashlr-runs"),
+        queue: args.queue,
+        reapIdleHours: num(args.reapIdleHours, 2),
+        emptyIdleHours: num(args.emptyIdleHours, 6),
+        budgetSeconds: num(args.budgetSeconds, 120),
+        ghBin: args.ghBin,
+        lsofBin: args.lsofBin,
+        ghMax: num(args.ghMax, 40)
+      });
+      if (args.json) {
+        console.log(JSON.stringify(report));
+        return;
+      }
+      const s = report.summary;
+      console.log(`fleet-gc dry-run: ${s.total} worktrees under ${report.root} — ${s.byClass["collect-candidate"]} collect-candidates, ${s.byClass.preserve} preserved (${report.scan.durationMs}ms)`);
+      for (const [basis, n] of Object.entries(s.byBasis).sort((a, b) => b[1] - a[1]))
+        console.log(`  basis ${basis}: ${n}`);
+      const topReasons = Object.entries(s.byReason).sort((a, b) => b[1] - a[1]).slice(0, 12);
+      for (const [reason, n] of topReasons)
+        console.log(`  preserve ${reason}: ${n}`);
+      if (report.staleRegistrations.count)
+        console.log(`  stale git registrations under root (missing dirs): ${report.staleRegistrations.count}`);
+      if (!report.scan.complete)
+        console.log("  WARNING: scan incomplete (deep-inspection budget exhausted); candidates are a lower bound.");
+      const candidates = report.entries.filter((e) => e.class === "collect-candidate");
+      for (const c of candidates.slice(0, 50))
+        console.log(`  candidate ${c.name} basis=${c.basis} idle=${c.idleHours ?? "?"}h result=${c.resultClass ?? "none"}`);
+      if (candidates.length > 50)
+        console.log(`  … and ${candidates.length - 50} more (--json for all)`);
+    }
+  });
+});
+
+// src/commands/fleet-bets.ts
+import { homedir as homedir13 } from "node:os";
+import { dirname as dirname7, join as join24 } from "node:path";
 function leaderBets(ledger, src) {
   const bets = new Map;
   for (const line of ledger.split(`
@@ -16294,11 +17597,11 @@ function classify(e, leader) {
   return "vanished";
 }
 async function collectFleetBets(queue, options = {}) {
-  const runs = dirname6(queue);
+  const runs = dirname7(queue);
   const [router, ready, metrics] = await Promise.all([
-    readFleetText(options.router ?? join22(queue, "router-queue.md"), { maxBytes: CAP }),
-    readFleetText(options.ready ?? join22(queue, "ready.tsv"), { maxBytes: CAP }),
-    readFleetJsonl(options.metrics ?? join22(runs, "metrics", "jobs.jsonl"), {
+    readFleetText(options.router ?? join24(queue, "router-queue.md"), { maxBytes: CAP }),
+    readFleetText(options.ready ?? join24(queue, "ready.tsv"), { maxBytes: CAP }),
+    readFleetJsonl(options.metrics ?? join24(runs, "metrics", "jobs.jsonl"), {
       maxBytes: CAP,
       tail: true,
       malformedLines: "ignore"
@@ -16432,7 +17735,7 @@ var init_fleet_bets = __esm(() => {
       src: { type: "string", description: "Source marker selecting bets (default: leader)." }
     },
     async run({ args }) {
-      const report = await collectFleetBets(args.queue ?? join22(homedir12(), ".ashlr-runs", "queue"), args);
+      const report = await collectFleetBets(args.queue ?? join24(homedir13(), ".ashlr-runs", "queue"), args);
       if (args.json)
         console.log(JSON.stringify(report));
       else {
@@ -16446,6 +17749,248 @@ var init_fleet_bets = __esm(() => {
   });
 });
 
+// src/commands/fleet-match.ts
+import { lstat as lstat3 } from "node:fs/promises";
+import { homedir as homedir14 } from "node:os";
+import { dirname as dirname8, join as join25 } from "node:path";
+function latestJobRows(rows) {
+  const latest = new Map;
+  for (const row of rows) {
+    const id = row.id ?? row.job_id;
+    if (typeof id === "string")
+      latest.set(id, { ...latest.get(id), ...row });
+  }
+  return latest;
+}
+function poolCounts(latest) {
+  const counts = new Map;
+  for (const row of latest.values()) {
+    const pool = row.pool;
+    const status = row.status;
+    if (typeof pool !== "string" || !isResourceId(pool))
+      continue;
+    if (status !== "running" && status !== "queued")
+      continue;
+    const entry = counts.get(pool) ?? { running: 0, queued: 0 };
+    entry[status]++;
+    counts.set(pool, entry);
+  }
+  return counts;
+}
+function readyRow(text, job) {
+  for (const line of text.split(/\r?\n/)) {
+    if (!line || line.startsWith("#"))
+      continue;
+    const f = line.split("\t");
+    if (f[0] !== job)
+      continue;
+    return {
+      lane: typeof f[2] === "string" && isResourceId(f[2]) ? f[2] : null,
+      tier: typeof f[3] === "string" && isFleetTier(f[3]) ? f[3] : null
+    };
+  }
+  return null;
+}
+function deriveFleetRequirement(flags, jobId, jobRow, ready) {
+  const found = jobRow !== undefined || ready !== null;
+  const job = jobId ? {
+    id: jobId,
+    found,
+    proposedResource: (typeof jobRow?.pool === "string" && isResourceId(jobRow.pool) ? jobRow.pool : null) ?? ready?.lane ?? null
+  } : null;
+  const flagGiven = flags.role !== undefined || flags.capabilities !== undefined || flags.tier !== undefined;
+  if (!flagGiven && (jobId === undefined || !found))
+    return { requirement: null, error: null, job };
+  const rowRole = jobRow?.role;
+  const rowCaps = Array.isArray(jobRow?.capabilities) ? jobRow.capabilities.filter((c) => typeof c === "string" && isFleetCapability(c)) : [];
+  const rowTier = typeof jobRow?.tier === "string" && isFleetTier(jobRow.tier) ? jobRow.tier : ready?.tier ?? null;
+  const role = flags.role ?? (typeof rowRole === "string" ? rowRole : "implementer");
+  if (!isFleetRole(role)) {
+    return {
+      requirement: null,
+      error: rowRole !== undefined && typeof rowRole === "string" ? `job ${jobId} declares role "${rowRole.slice(0, 64)}", which is not a fleet role (${FLEET_ROLES_HINT})` : `role "${String(role).slice(0, 64)}" is not a fleet role (${FLEET_ROLES_HINT})`,
+      job
+    };
+  }
+  return {
+    requirement: {
+      role,
+      capabilities: [...new Set(flags.capabilities ?? rowCaps)],
+      tier: flags.tier ?? rowTier
+    },
+    error: null,
+    job
+  };
+}
+async function collectFleetMatch(queue, options = {}) {
+  const runsDir = dirname8(queue);
+  const capabilitiesPath = options.capabilitiesPath ?? join25(runsDir, "capabilities.json");
+  const modelsPath = options.modelsPath ?? join25(runsDir, "models.json");
+  const [slots, queueJournal, jobsJournal, ready, hold, capsText, modelsText] = await Promise.all([
+    readFleetJson(join25(queue, "slots.json"), { object: true }),
+    readFleetJsonl(join25(queue, "queue.jsonl"), { allowArray: true }),
+    readFleetJsonl(join25(queue, "jobs.jsonl"), { allowArray: true }),
+    readFleetText(join25(queue, "ready.tsv"), { maxBytes: 4 * 1024 * 1024 }),
+    lstat3(join25(queue, "HOLD")).then(() => "present", (error) => isFleetRow(error) && error.code === "ENOENT" ? "absent" : "unavailable"),
+    readFleetText(capabilitiesPath),
+    readFleetText(modelsPath)
+  ]);
+  const journalsKnown = queueJournal.status === "ok" && jobsJournal.status === "ok";
+  const latest = latestJobRows([...queueJournal.rows, ...jobsJournal.rows]);
+  const counts = journalsKnown ? poolCounts(latest) : new Map;
+  const declarations = new Map;
+  let capsDropped = 0;
+  let capsStatus = capsText.status === "ok" ? "ok" : capsText.status;
+  if (capsText.status === "ok") {
+    const parsed = parseCapabilityDocument(capsText.text);
+    if (parsed.status === "ok") {
+      for (const [id, decl] of parsed.document.resources)
+        declarations.set(id, decl);
+      capsDropped = parsed.document.dropped;
+    } else {
+      capsStatus = "invalid";
+    }
+  }
+  const modelsParsed = modelsText.status === "ok" ? parseModelMap(modelsText.text) : { map: new Map, dropped: 0, status: "ok" };
+  const slotRows = isFleetRow(slots.data) ? slots.data : {};
+  const fleetHardCap = nonNegInt(slotRows.hard_cap);
+  const ids = new Set;
+  for (const [key, value] of Object.entries(slotRows))
+    if (isFleetRow(value) && isResourceId(key))
+      ids.add(key);
+  for (const id of declarations.keys())
+    ids.add(id);
+  if (journalsKnown)
+    for (const id of counts.keys())
+      ids.add(id);
+  const derived = deriveFleetRequirement({ role: options.role, capabilities: options.capabilities, tier: options.tier }, options.job, options.job ? latest.get(options.job) : undefined, options.job && ready.status === "ok" ? readyRow(ready.text, options.job) : null);
+  const tierForModel = derived.requirement?.tier ?? null;
+  const resources = [...ids].sort().map((id) => {
+    const slot = isFleetRow(slotRows[id]) ? slotRows[id] : null;
+    const quota = slots.status === "ok" && slot !== null ? {
+      target: nonNegInt(slot.target),
+      ceiling: nonNegInt(slot.ceiling),
+      hardCap: nonNegInt(slot.hard_cap),
+      held: slot.held === true,
+      running: journalsKnown ? counts.get(id)?.running ?? 0 : null,
+      queued: journalsKnown ? counts.get(id)?.queued ?? 0 : null,
+      quotaRemaining: numOrNull(slot.quota)
+    } : null;
+    const resolved = resolveModel(modelsParsed.map, id, tierForModel);
+    return {
+      ...buildFleetResource(id, declarations.get(id), quota),
+      model: resolved?.model ?? null,
+      modelVia: resolved?.via ?? null
+    };
+  });
+  const fleetRunning = journalsKnown ? [...counts.values()].reduce((sum, c) => sum + c.running, 0) : null;
+  const match = derived.requirement === null ? null : matchRequirement(derived.requirement, resources, {
+    fleetHold: hold === "present",
+    fleet: { running: fleetRunning, hardCap: fleetHardCap }
+  });
+  const matchById = new Map((match?.matches ?? []).map((m) => [m.id, m]));
+  return {
+    schemaVersion: 1,
+    generatedAt: (options.now ?? (() => new Date))().toISOString(),
+    sources: {
+      slots: slots.status,
+      queue: queueJournal.status,
+      jobs: jobsJournal.status,
+      capabilities: capsStatus,
+      capabilitiesDropped: capsDropped,
+      models: modelsText.status === "ok" && modelsParsed.status === "invalid" ? "invalid" : modelsText.status,
+      modelsDropped: modelsParsed.dropped,
+      ready: ready.status,
+      hold
+    },
+    fleet: { running: fleetRunning, hardCap: fleetHardCap, hold: hold === "present" },
+    requirement: derived.requirement,
+    requirementError: derived.error,
+    job: derived.job,
+    resources: resources.map((r) => {
+      const { model, modelVia, ...rest } = r;
+      const m = matchById.get(r.id);
+      return {
+        ...rest,
+        quota: r.quota === null ? null : { ...r.quota, headroom: resourceHeadroom(r.quota) },
+        model,
+        modelVia,
+        match: m ? { eligible: m.eligible, reasons: m.reasons, headroom: m.headroom } : null
+      };
+    }),
+    eligible: match?.eligible ?? null
+  };
+}
+var FLEET_ROLES_HINT = "planner, implementer, reviewer, release-verifier", nonNegInt = (v) => typeof v === "number" && Number.isSafeInteger(v) && v >= 0 ? v : null, numOrNull = (v) => typeof v === "number" && Number.isFinite(v) ? v : null, fleetMatchCommand;
+var init_fleet_match = __esm(() => {
+  init_src();
+  init_dist3();
+  init_fleet_jsonl();
+  fleetMatchCommand = defineCommand2({
+    meta: {
+      name: "fleet-match",
+      description: "Map a job requirement to eligible fleet resources by capability, quota and availability."
+    },
+    args: {
+      json: { type: "boolean", description: "Emit schemaVersion 1 JSON." },
+      queue: { type: "string", description: "Fleet queue directory (default: ~/.ashlr-runs/queue)." },
+      role: { type: "string", description: `Required role: ${FLEET_ROLES_HINT}.` },
+      capability: {
+        type: "string",
+        description: "Comma-separated capability tags the resource must declare."
+      },
+      tier: { type: "string", description: "Required tier (e.g. frontier, work, mid, fast)." },
+      job: {
+        type: "string",
+        description: "Derive the requirement from a queued job id (ready.tsv + journals)."
+      },
+      capabilitiesFile: {
+        type: "string",
+        description: "Capabilities file (default: capabilities.json beside the queue directory)."
+      },
+      modelsFile: {
+        type: "string",
+        description: "Models file (default: models.json beside the queue directory)."
+      }
+    },
+    async run({ args }) {
+      const capabilities = args.capability?.split(",").map((c) => c.trim()).filter(Boolean);
+      if (capabilities?.some((c) => !isFleetCapability(c)))
+        throw new Error("Invalid capability tag; expected lowercase tags like local-inference.");
+      if (args.role !== undefined && !isFleetRole(args.role))
+        throw new Error(`Invalid role; expected one of: ${FLEET_ROLES_HINT}.`);
+      if (args.tier !== undefined && !isFleetTier(args.tier))
+        throw new Error("Invalid tier; expected a lowercase tier name.");
+      if (args.job !== undefined && !isResourceId(args.job))
+        throw new Error("Invalid job id.");
+      const report = await collectFleetMatch(args.queue ?? join25(homedir14(), ".ashlr-runs", "queue"), {
+        role: args.role,
+        capabilities,
+        tier: args.tier,
+        job: args.job,
+        capabilitiesPath: typeof args.capabilitiesFile === "string" ? args.capabilitiesFile : undefined,
+        modelsPath: typeof args.modelsFile === "string" ? args.modelsFile : undefined
+      });
+      if (args.json) {
+        console.log(JSON.stringify(report));
+        return;
+      }
+      const req = report.requirement;
+      console.log(req ? `Requirement: role=${req.role} capabilities=[${req.capabilities.join(", ")}] tier=${req.tier ?? "any"}${report.job?.proposedResource ? ` (job ${report.job.id} proposed ${report.job.proposedResource})` : ""}` : report.requirementError ? `Requirement: invalid — ${report.requirementError}` : "Capability matrix (no requirement given; pass --role/--job to match)");
+      console.log(`Sources: slots=${report.sources.slots} queue=${report.sources.queue} jobs=${report.sources.jobs} capabilities=${report.sources.capabilities} models=${report.sources.models} hold=${report.sources.hold} ready=${report.sources.ready}`);
+      console.log(`Fleet: running=${report.fleet.running ?? "unknown"} hardCap=${report.fleet.hardCap ?? "unknown"} hold=${report.fleet.hold}`);
+      for (const r of report.resources) {
+        const q = r.quota;
+        const quotaText = q ? `target=${q.target ?? "?"} running=${q.running ?? "?"} headroom=${q.headroom ?? "?"}${q.held ? " held" : ""}` : "quota=unknown";
+        const matchText = r.match ? r.match.eligible ? "ELIGIBLE" : `ineligible: ${r.match.reasons.join(", ")}` : "";
+        console.log(`${r.id}: roles=[${r.roles.join(", ")}] caps=[${r.capabilities.join(", ")}]${r.tiers ? ` tiers=[${r.tiers.join(", ")}]` : ""} ${quotaText}${r.model ? ` model=${r.model}` : ""} ${matchText}`.trimEnd());
+      }
+      if (report.eligible)
+        console.log(`Eligible: ${report.eligible.join(", ") || "none"}`);
+    }
+  });
+});
+
 // src/commands/fleet-collisions.ts
 function collectFleetCollisions2(input) {
   if (!Array.isArray(input))
@@ -16635,8 +18180,8 @@ var init_fleet_slo2 = __esm(() => {
 });
 
 // src/commands/fleet-waste.ts
-import { homedir as homedir13 } from "node:os";
-import { join as join23 } from "node:path";
+import { homedir as homedir15 } from "node:os";
+import { join as join26 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 async function collectFleetWaste2(metrics, hours = 1, now = Date.now()) {
   const start = now - hours * 3600000;
@@ -16756,7 +18301,7 @@ var init_fleet_waste2 = __esm(() => {
       json: { type: "boolean", description: "Emit schemaVersion 1 JSON (also the default)." }
     },
     async run({ args }) {
-      console.log(JSON.stringify(await collectFleetWaste2(args.metrics ?? join23(homedir13(), ".ashlr-runs", "metrics", "jobs.jsonl"), Number(args.hours))));
+      console.log(JSON.stringify(await collectFleetWaste2(args.metrics ?? join26(homedir15(), ".ashlr-runs", "metrics", "jobs.jsonl"), Number(args.hours))));
     }
   });
   fleetWasteSubcommand2 = defineCommand2({
@@ -16766,9 +18311,9 @@ var init_fleet_waste2 = __esm(() => {
 });
 
 // src/commands/fleet.ts
-import { execFile as execFile4 } from "node:child_process";
-import { homedir as homedir14 } from "node:os";
-import { join as join24 } from "node:path";
+import { execFile as execFile5 } from "node:child_process";
+import { homedir as homedir16 } from "node:os";
+import { join as join27 } from "node:path";
 function fleetLanes(slotsText, log) {
   let slots = {};
   try {
@@ -16803,9 +18348,9 @@ function fleetLanes(slotsText, log) {
     })
   };
 }
-async function collectFleet(queue, runner = locusGh3, logPath = join24(queue, "dispatchd.log")) {
+async function collectFleet(queue, runner = locusGh3, logPath = join27(queue, "dispatchd.log")) {
   const [slots, log, health] = await Promise.all([
-    readFleetText(join24(queue, "slots.json")).then((source) => source.text),
+    readFleetText(join27(queue, "slots.json")).then((source) => source.text),
     readFleetText(logPath, { maxBytes: 65536, tail: true }).then((source) => source.text),
     checkRepos(runner)
   ]);
@@ -16821,7 +18366,7 @@ async function collectFleet(queue, runner = locusGh3, logPath = join24(queue, "d
   };
 }
 var unknown = "unknown", count3 = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : unknown, locusGh3 = (args, signal) => new Promise((resolve, reject) => {
-  execFile4("locus", ["exec", "--", "gh", ...args], { signal, timeout: 5000, maxBuffer: 1024 * 1024 }, (error, stdout) => error ? reject(error) : resolve(stdout));
+  execFile5("locus", ["exec", "--", "gh", ...args], { signal, timeout: 5000, maxBuffer: 1024 * 1024 }, (error, stdout) => error ? reject(error) : resolve(stdout));
 }), fleetCommand;
 var init_fleet = __esm(() => {
   init_dist3();
@@ -16854,7 +18399,7 @@ var init_fleet = __esm(() => {
     async run({ args, rawArgs }) {
       if (rawArgs.some((a) => !a.startsWith("-")))
         return;
-      const report = await collectFleet(args.queue ?? join24(homedir14(), ".ashlr-runs", "queue"), locusGh3, args.log ?? join24(homedir14(), ".ashlr-runs", "dispatchd.log"));
+      const report = await collectFleet(args.queue ?? join27(homedir16(), ".ashlr-runs", "queue"), locusGh3, args.log ?? join27(homedir16(), ".ashlr-runs", "dispatchd.log"));
       if (args.json)
         console.log(JSON.stringify(report));
       else {
@@ -18738,7 +20283,7 @@ var init_apply = __esm(() => {
 });
 
 // src/commands/projects.ts
-import { resolve as resolve11 } from "node:path";
+import { resolve as resolve12 } from "node:path";
 async function buildProjectsReport() {
   const projects = (await listProjects()).map((p) => ({
     name: p.name,
@@ -18822,7 +20367,7 @@ var init_projects = __esm(() => {
           intro("stack projects remove");
           const target = String(args.target);
           const byName = await findProjectByName(target);
-          const removed = await unregisterProject(byName?.path ?? resolve11(target));
+          const removed = await unregisterProject(byName?.path ?? resolve12(target));
           if (!removed) {
             outroError(`No registered project matches "${target}". Run \`stack projects list\` for names and paths.`);
             return;
@@ -18856,7 +20401,7 @@ var init_projects = __esm(() => {
 
 // src/commands/ci.ts
 import { existsSync as existsSync13 } from "node:fs";
-import { join as join25, resolve as resolve12 } from "node:path";
+import { join as join28, resolve as resolve13 } from "node:path";
 function refuse(message, json, title) {
   if (json) {
     process.stdout.write(`${JSON.stringify({ error: message })}
@@ -18895,7 +20440,7 @@ var init_ci = __esm(() => {
         refuse("No .stack.toml found. Run `stack init` first.", json, "stack ci init");
         return;
       }
-      const path = join25(resolve12(join25(process.cwd(), ".github", "workflows")), "stack-ci.yml");
+      const path = join28(resolve13(join28(process.cwd(), ".github", "workflows")), "stack-ci.yml");
       if (existsSync13(path) && !args.force) {
         refuse(`${path} already exists. It was not changed.`, json, "stack ci init");
         return;
@@ -19177,6 +20722,18 @@ var init_completion = __esm(() => {
     "fleet-bets": {
       flags: ["json", "queue", "router", "ready", "metrics", "src"].map((name) => ({ name }))
     },
+    "fleet-match": {
+      flags: [
+        "json",
+        "queue",
+        "role",
+        "capability",
+        "tier",
+        "job",
+        "capabilitiesFile",
+        "modelsFile"
+      ].map((name) => ({ name }))
+    },
     fleet: {
       subcommands: ["slo", "collisions", "waste"],
       flags: ["json", "queue", "log", "file", "metrics", "hours"].map((name) => ({ name }))
@@ -19262,6 +20819,7 @@ var init_completion = __esm(() => {
     "fleet-stream",
     "fleet-graph",
     "fleet-bets",
+    "fleet-match",
     "fleet",
     "exec",
     "sync",
@@ -19315,7 +20873,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@ashlr/stack",
-    version: "0.3.6",
+    version: "0.3.9",
     description: "Ashlr Stack CLI — the control plane for your entire dev stack. One command to provision, wire, and operate every third-party service in your project. 39 providers, MCP-native.",
     license: "MIT",
     author: {
@@ -19369,7 +20927,7 @@ var init_package = __esm(() => {
       typecheck: "bunx tsc --noEmit"
     },
     dependencies: {
-      "@ashlr/stack-core": "^0.3.6",
+      "@ashlr/stack-core": "^0.3.9",
       "@clack/prompts": "^0.8.2",
       citty: "^0.1.6",
       picocolors: "^1.1.1"
@@ -19382,19 +20940,19 @@ var init_package = __esm(() => {
 });
 
 // src/lib/upgrade-install.ts
-import { execFile as execFile5 } from "node:child_process";
-import { lstat as lstat2, mkdir as mkdir7, mkdtemp, readFile as readFile12, realpath, rename as rename2, rm as rm2 } from "node:fs/promises";
-import { dirname as dirname7, join as join26 } from "node:path";
-import { promisify } from "node:util";
+import { execFile as execFile6 } from "node:child_process";
+import { lstat as lstat4, mkdir as mkdir7, mkdtemp, readFile as readFile13, realpath as realpath2, rename as rename2, rm as rm2 } from "node:fs/promises";
+import { dirname as dirname9, join as join29 } from "node:path";
+import { promisify as promisify2 } from "node:util";
 function isReleaseVersion(version) {
   return typeof version === "string" && /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(version);
 }
 async function health(directory, version, runner) {
-  const manifest = JSON.parse(await readFile12(join26(directory, "package.json"), "utf8"));
+  const manifest = JSON.parse(await readFile13(join29(directory, "package.json"), "utf8"));
   if (manifest.name !== PACKAGE || manifest.version !== version) {
     throw new Error("Installed package identity does not match the requested release.");
   }
-  const entry = join26(directory, "dist/index.js");
+  const entry = join29(directory, "dist/index.js");
   const output = JSON.parse(await runner("node", [entry, "--version", "--json"]));
   if (output.version !== version)
     throw new Error("CLI version health check failed.");
@@ -19411,17 +20969,17 @@ async function installUpgrade(current, latest, runner = run) {
   const root = await runner("npm", ["root", "--global"]);
   if (!root.startsWith("/"))
     throw new Error("npm did not return an absolute global root.");
-  const target = join26(root, PACKAGE);
-  if (!(await lstat2(target)).isDirectory()) {
+  const target = join29(root, PACKAGE);
+  if (!(await lstat4(target)).isDirectory()) {
     throw new Error("Applying upgrades requires an npm global install, not a linked package.");
   }
   const prefix = await runner("npm", ["prefix", "--global"]);
   if (!prefix.startsWith("/"))
     throw new Error("npm did not return an absolute global prefix.");
-  if (await realpath(join26(prefix, "bin/stack")) !== join26(await realpath(target), "dist/index.js")) {
+  if (await realpath2(join29(prefix, "bin/stack")) !== join29(await realpath2(target), "dist/index.js")) {
     throw new Error("The npm stack launcher does not point to this installation.");
   }
-  const lock = join26(dirname7(target), ".stack-upgrade-lock");
+  const lock = join29(dirname9(target), ".stack-upgrade-lock");
   try {
     await mkdir7(lock);
   } catch {
@@ -19431,7 +20989,7 @@ async function installUpgrade(current, latest, runner = run) {
   let retainBackup = false;
   try {
     await health(target, current, runner);
-    workspace = await mkdtemp(join26(dirname7(target), ".stack-upgrade-"));
+    workspace = await mkdtemp(join29(dirname9(target), ".stack-upgrade-"));
     await runner("npm", [
       "install",
       "--global",
@@ -19442,9 +21000,9 @@ async function installUpgrade(current, latest, runner = run) {
       "--no-fund",
       `${PACKAGE}@${latest}`
     ]);
-    const candidate = join26(workspace, "lib/node_modules", PACKAGE);
+    const candidate = join29(workspace, "lib/node_modules", PACKAGE);
     await health(candidate, latest, runner);
-    const backup = join26(workspace, "previous");
+    const backup = join29(workspace, "previous");
     await rename2(target, backup);
     try {
       await rename2(candidate, target);
@@ -19480,7 +21038,7 @@ var exec2, PACKAGE = "@ashlr/stack", run = async (command, args) => {
   }
 };
 var init_upgrade_install = __esm(() => {
-  exec2 = promisify(execFile5);
+  exec2 = promisify2(execFile6);
 });
 
 // src/commands/upgrade.ts
@@ -19605,6 +21163,8 @@ init_detect();
 init_detect_source();
 init_registry();
 init_agent_onboard();
+init_capability_matrix();
+init_job_run();
 
 // ../../node_modules/.bun/citty@0.1.6/node_modules/citty/dist/index.mjs
 init_dist2();
@@ -19855,7 +21415,7 @@ async function checkForUpdate(currentVersion, _cacheFile) {
 }
 
 // src/index.ts
-var VERSION = "0.3.6";
+var VERSION = "0.3.9";
 var main = defineCommand({
   meta: {
     name: "stack",
@@ -19934,7 +21494,9 @@ var main = defineCommand({
     "fleet-act": () => Promise.resolve().then(() => (init_fleet_act(), {})).then((m) => fleetActCommand),
     "fleet-stream": () => Promise.resolve().then(() => (init_fleet_stream(), {})).then((m) => fleetStreamCommand),
     "fleet-graph": () => Promise.resolve().then(() => (init_fleet_graph(), {})).then((m) => fleetGraphCommand),
+    "fleet-gc": () => Promise.resolve().then(() => (init_fleet_gc2(), {})).then((m) => fleetGcCommand),
     "fleet-bets": () => Promise.resolve().then(() => (init_fleet_bets(), {})).then((m) => fleetBetsCommand),
+    "fleet-match": () => Promise.resolve().then(() => (init_fleet_match(), {})).then((m) => fleetMatchCommand),
     fleet: () => Promise.resolve().then(() => (init_fleet(), {})).then((m) => fleetCommand),
     exec: () => Promise.resolve().then(() => (init_exec(), {})).then((m) => execCommand),
     swap: () => Promise.resolve().then(() => (init_swap2(), {})).then((m) => swapCommand),