@codedology/code-forge 0.15.4 → 0.16.0

package/src/state/block-end.mjs

@@ -25,6 +25,7 @@ import path from 'node:path';
 import { runSpend } from '../ledger/spend.mjs';
 import { readAllRows } from '../ledger/write.mjs';
 import { exec } from '../util/exec.mjs';
+import { daemonRequest } from '../util/native.mjs';
 import { assertRunId, runsDir } from './paths.mjs';
 import { withRunLock, writeSigned } from './run.mjs';
 
@@ -113,7 +114,8 @@ export async function writeDoneFile({ record, id, status, event, reason = null,
     /** @type {Record<string, any>[] | null} */
     let rows = null;
     try {
-      rows = await readAllRows(record.project);
+      const reply = await daemonRequest(runId, { method: 'rows', block: id }, { config: record.config?.snapshots?.[record.config?.hash] });
+      rows = reply?.rows ?? await readAllRows(record.project);
     } catch {
       rows = null;
     }

package/src/state/block.mjs

@@ -613,8 +613,20 @@ async function rebaseWorktreeBlock({ runId, id, writeRow, acceptChanged, reason,
     const before = closed ? await committedBlobs(tree, reviewedHead, files) : null;
     const moved = { old_base: block.base_sha, new_base: newBase };
     try {
-      const rebased = await exec(['git', '-C', tree, 'rebase', newBase], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
-      if (rebased.result !== 'ok') throw new StateError('rebase-conflict', 'rebase-conflict');
+      try {
+        // Read every original identity once. Exclude commits already in the new base, including
+        // upstream commits retained by a pending rebase check. Global config and GIT_* stay scrubbed.
+        const commits = await git(['git', 'log', '--format=%H%x00%cn%x00%ce', '--reverse', `${block.base_sha}..${oldHead}`, '--not', newBase], tree);
+        await git(['git', 'reset', '--hard', newBase], tree);
+        for (const commit of commits.stdout.trimEnd().split('\n').filter(Boolean)) {
+          const [sha, committerName, committerEmail] = commit.split('\0');
+          // No -m: cherry-pick refuses merge commits. An original empty commit is still a commit.
+          const replayed = await exec(['git', '-C', tree, 'cherry-pick', '--allow-empty', sha], { cwd: record.workspace, env: { ...gitEnv(), GIT_COMMITTER_NAME: committerName, GIT_COMMITTER_EMAIL: committerEmail }, timeoutMs: 30000 });
+          if (replayed.result !== 'ok') throw new StateError('rebase-conflict', 'rebase-conflict');
+        }
+      } catch {
+        throw new StateError('rebase-conflict', 'rebase-conflict');
+      }
       const after = before === null ? null : await committedBlobs(tree, 'HEAD', files);
       const changed = after === null ? [] : files.filter((file) => before.get(file) !== after.get(file));
       const repoRoot = await repoRootOf(record.workspace);
@@ -652,9 +664,9 @@ async function rebaseWorktreeBlock({ runId, id, writeRow, acceptChanged, reason,
       await saveRun(record);
       return moved;
     } catch (err) {
-      // --abort restores a conflicted rebase; after a completed rebase there is nothing to
-      // abort, and reset restores the old branch head. The tree was clean before either.
-      await exec(['git', '-C', tree, 'rebase', '--abort'], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
+      // Abort a conflicted replay; after a completed replay there is nothing to abort.
+      // Reset restores the exact old branch head. The tree was clean before either.
+      await exec(['git', '-C', tree, 'cherry-pick', '--abort'], { cwd: record.workspace, env: gitEnv(), timeoutMs: 30000 });
       await git(['git', 'reset', '--hard', oldHead], tree);
       throw err;
     }

package/src/state/run.mjs

@@ -26,6 +26,11 @@ import { generateKey, loadKey, signRow } from './signer.mjs';
 const LOCK_TIMEOUT_MS = 5000;
 const LOCK_POLL_MS = 25;
 
+/** @param {string} text @returns {string | null} */
+export function normalizeStartTime(text) {
+  return text.trim().replace(/\s+/g, ' ') || null;
+}
+
 /**
  * The process start time of `pid` (`ps -o lstart=`), or null when no such process exists.
  * @type {StartTimeProbe}
@@ -37,8 +42,7 @@ export async function processStartTime(pid) {
     okExitCodes: [0, 1],
     timeoutMs: 10000,
   });
-  const text = res.stdout.trim();
-  return res.result === 'ok' && res.code === 0 && text.length > 0 ? text : null;
+  return res.result === 'ok' && res.code === 0 ? normalizeStartTime(res.stdout) : null;
 }
 
 /** @param {unknown} value @returns {string} */
@@ -348,7 +352,10 @@ export async function checkWorkerPin(record, { livePid, probe = processStartTime
       return { ok: false, event: 'worker.replaced', reason: 'the live worker does not match a pinned worker' };
     }
     if (livePid === undefined) {
-      const live = await Promise.all(pins.map(async (p) => (await probe(p.pid)) === p.started_at));
+      const live = await Promise.all(pins.map(async (p) => {
+        const startedAt = await probe(p.pid);
+        return startedAt !== null && startedAt === normalizeStartTime(p.started_at);
+      }));
       return live.some(Boolean) ? { ok: true } : { ok: false, event: 'worker.down', reason: 'no pinned worker is running' };
     }
     pin = pins.find((p) => p.pid === livePid);
@@ -360,7 +367,7 @@ export async function checkWorkerPin(record, { livePid, probe = processStartTime
   }
   const startedAt = await probe(pin.pid);
   if (startedAt === null) return { ok: false, event: 'worker.down', reason: `pinned worker pid ${pin.pid} is not running` };
-  if (startedAt !== pin.started_at) {
+  if (startedAt !== normalizeStartTime(pin.started_at)) {
     return { ok: false, event: 'worker.replaced', reason: `pid ${pin.pid} was restarted (start time differs from the pin)` };
   }
   return { ok: true };
@@ -378,7 +385,7 @@ export async function stopPinnedWorker(pin, { probe = processStartTime, kill = (
   if (!pin || !isSignalablePid(pin.pid)) return { stopped: false, reason: 'invalid pid' };
   const startedAt = await probe(pin.pid);
   if (startedAt === null) return { stopped: false, reason: 'not running' };
-  if (startedAt !== pin.started_at) return { stopped: false, reason: 'pid reused' };
+  if (startedAt !== normalizeStartTime(pin.started_at)) return { stopped: false, reason: 'pid reused' };
   try {
     kill(pin.pid, 'SIGTERM');
   } catch (err) {

package/src/util/native.mjs

@@ -83,6 +83,8 @@ export async function daemonRequest(run, request, { config, timeoutMs = request.
         socket.write(`${JSON.stringify(request)}\n`);
       } else {
         const { stats, ...result } = answer;
+        if (request.method === 'rows' && (!Array.isArray(result.rows)
+          || !result.rows.every((row) => row !== null && typeof row === 'object' && !Array.isArray(row)))) return finish(null);
         if (request.method === 'wait-block' && (result.block !== request.block || !Array.isArray(result.files) || typeof result.done !== 'boolean'
           || !result.files.every((/** @type {any} */ file) => file && typeof file.file === 'string' && typeof file.status === 'string'))) return finish(null);
         if (request.method === 'status' && (!Array.isArray(result.runs) || result.runs.length !== 1 || result.runs[0]?.run_id !== run || !Array.isArray(result.runs[0]?.blocks))) return finish(null);

package/src/worker/engine.mjs

@@ -108,7 +108,7 @@ import { ledgerSchemaHistory } from '../review/schema-fallback.mjs';
 import { verifyRow } from '../state/signer.mjs';
 import { redact } from '../util/redact.mjs';
 import { withLock } from '../util/file-locks.mjs';
-import { blockAnchors, blockRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
+import { fileRungUsed, loadState, RESTORED_EVENT, saveState } from './review-state.mjs';
 import { assertAnswers, enqueueHash, isDone, reviewExclusionFor, writeResult } from './queue.mjs';
 import { assertTicketId, contentHash, readRegularFileNoFollow, WorkerError } from './ticket.mjs';
 
@@ -527,7 +527,7 @@ export function blockPeerDiffs(repoRoot, { base, owned, ownedKinds, file }) {
 }
 
 /**
- * The key of a block's lock (B42): the block's budget row and its L3 rung are taken under it.
+ * The key of a block's lock (B42): the budget row and each file's L3 rung are taken under it.
  * It carries the run, so two runs in one process never share a lock.
  * @param {string} runId @param {string} block @returns {string}
  */
@@ -537,33 +537,18 @@ export const blockLockKey = (runId, block) => `block:${runId}\0${block}`;
 export const LOST_MESSAGE = 'the review state file is gone and the ledger cannot rebuild it (its anchor carries no state_body); the file is not reviewed again from round 1 — the owner can run `code-forge block reopen`';
 
 /**
- * Whether the block's one L3 rung is taken: a verified anchor says so (`blockRungUsed`), OR another
- * file of the block has a saved state whose round decided `next: patch` — that round took the rung,
- * but its anchor records `l3_rung_used` only once the patch_check ticket saves. A sibling state that
- * does not load is counted as taken (fail closed; its own ticket refuses it).
+ * Whether this file's L3 rung is taken, derived from its verified anchors (`fileRungUsed`).
+ * A pending `next: patch` on this file is handled by its patch_check ticket; sibling files
+ * have their own rungs.
  * @param {import('./review-state.mjs').Where} where
  * @returns {{status: 'ok' | 'tampered', used: boolean}}
  */
 export function rungTaken(where) {
-  const rung = blockRungUsed(where);
-  if (rung.status === 'tampered' || rung.used) return rung;
-  const anchors = blockAnchors(where) ?? [];
-  const siblings = new Set(anchors.map((a) => a.file).filter((f) => typeof f === 'string' && f !== where.file));
-  for (const file of siblings) {
-    let other;
-    try {
-      other = loadState({ ...where, file, migrate: false }); // B69: a sibling's old file is read, never moved here
-    } catch {
-      return { status: 'ok', used: true };
-    }
-    // a sibling that would be restored (B68) counts by its rebuilt state; lost or tampered fails closed
-    if ((other.status !== 'ok' && other.status !== 'restored') || other.state?.next?.action === 'patch') return { status: 'ok', used: true };
-  }
-  return rung;
+  return fileRungUsed(where);
 }
 
 /**
- * Whether this round could take the block's L3 rung (so it must run under the block lock): never
+ * Whether this round could take the file's L3 rung (so it must run under the block lock): never
  * when the rung is taken or the round is the patch_check (the rung is already this file's); never
  * for a file's first full round while the cap and the per-level ladder are both above 1 (round 1
  * cannot stall, reach the cap or exhaust the ladder); else conservatively yes.
@@ -586,9 +571,9 @@ export function mayTakeRung(state, kind, cfg, rungUsed) {
  * Concurrency (B42): the worker runs several tickets at once but never two for the same
  * (block, file) (its file lock, `loop.mjs`), so this file's state `seq` is read and saved by one
  * ticket at a time. What the files of a BLOCK share is taken under the block lock
- * (`blockLockKey`): the budget row's check-then-write (written once per block) and the L3 rung —
+ * (`blockLockKey`): the budget row's check-then-write (written once per block) and each file's L3 rung —
  * the rung read and, for a round that could take the rung (`mayTakeRung`), the whole round and its
- * state save, so two files of one block never both take it. A round that cannot take the rung (a
+ * state save, so workers cannot take the same file's rung twice. A round that cannot take the rung (a
  * first full round, or any round once the rung is gone) runs outside the block lock, in parallel
  * with the block's other files.
  * @param {import('./queue.mjs').Ticket} ticket @param {ReviewContext} ctx
@@ -636,7 +621,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
       if (row.event === 'review.state' && row.file === ticket.file) anchoredAt = i;
     });
     // A changed review input starts a full round, including previously stopped files. Keep
-    // the anchor sequence and the block's spent L3 rung; tampered state still refuses above.
+    // the anchor sequence and the file's spent L3 rung; tampered state still refuses above.
     const reopened = amendedAt > anchoredAt || reopenRowFor(rows, reopenAt) !== null;
     if (loaded.status === 'lost' && !reopened) return { outcome: /** @type {ReviewOutcome} */ ({ status: 'refused', reason: 'review-state-lost', message: LOST_MESSAGE, approved: false, engine: 'adaptive', sessions: [] }) };
     let seq = loaded.seq;
@@ -664,7 +649,7 @@ async function fixLoopRound(ticket, ctx, { base, level, owned, ownedKinds, block
     if (state.next?.action === 'retry') kind = state.pending_kind ?? kind;
     else if (state.next?.action === 'patch') {
       kind = 'patch_check';
-      state.l3_rung_used = true; // the orchestrator ran the block's one L3 patch before this ticket
+      state.l3_rung_used = true; // the orchestrator ran this file's one L3 patch before this ticket
     }
     const fixed = state;
     const round = () => playRound(ticket, ctx, { state: fixed, kind, where, seq, base, blockKindOf, workDir, factsExcerpt, rulesDigest, extraRounds, peerDiffs, fileContext });

package/src/worker/loop.mjs

@@ -44,7 +44,8 @@ import { expiryChecks } from '../autopilot/limits.mjs';
 import { loadProjectConfig } from '../config/load.mjs';
 import { reviewWorkers } from '../config/validate.mjs';
 import { cacheHoursFrom, createDefaultKeyStore, resolveKey } from '../keys/store.mjs';
-import { appendRow, readAllRows } from '../ledger/write.mjs';
+import { createTailReader } from '../ledger/tail.mjs';
+import { appendRow } from '../ledger/write.mjs';
 import { providerLimit, spawnSession } from '../session/spawn.mjs';
 import { snapshotFor } from '../state/config-snapshot.mjs';
 import { runRecordPath } from '../state/paths.mjs';
@@ -243,6 +244,7 @@ export function recordedVerdict(result) {
  * @property {{beforeLock?: () => void, afterCount?: (count: number) => Promise<unknown>}} [hooks] - deterministic boot races.
  * @property {typeof readTicket} [readTicket] - the ticket read (a test seam).
  * @property {typeof import('../util/exec.mjs').exec} [watchExec] - watch git exec seam.
+ * @property {() => number} [watchNow] - watch debounce clock (default: Date.now).
  * @property {Parameters<typeof watchTick>[0]['hooks']} [watchHooks] - deterministic watch races.
  * @property {import('../keys/store.mjs').KeyStore} [store] - default: B2's production store.
  * @property {any} [opRead]
@@ -250,7 +252,7 @@ export function recordedVerdict(result) {
  * @property {Partial<Record<'claude'|'codex'|'grok', string>>} [bins]
  * @property {(row: Record<string, any>) => Promise<unknown>} [writeRow] - default: B6 `appendRow`.
  * @property {() => Promise<Array<Record<string, any>>>} [readRows] - the ledger rows the fix-loop
- *   state is anchored in; default: B6 `readAllRows(slug)`.
+ *   state is anchored in; default: one project tail reader for the worker.
  * @property {{write: (s: string) => unknown}} [stderr]
  * @property {import('../review/triage.mjs').JevAsk} [jev] - S1 for triage and the recheck (tests
  *   inject a mock); default: `askJev` with the resolved Jev key, none without one.
@@ -272,7 +274,7 @@ export async function createWorker(opts, deps = {}) {
   const loadRun = deps.readRun ?? readRun;
   const loadTicket = deps.readTicket ?? readTicket;
   const writeRow = deps.writeRow ?? ((/** @type {Record<string, any>} */ row) => appendRow(row, { slug }));
-  const readRows = deps.readRows ?? (() => readAllRows(slug));
+  const readRows = deps.readRows ?? createTailReader(slug).read;
   // B48: the run's own writer (unsigned base; the checks sign their rows with the run key)
   const expiryCheck = deps.expiryCheck ?? (() => expiryChecks(runId, new Date(), { writeRow }));
   const warnStream = deps.stderr ?? process.stderr;
@@ -356,7 +358,7 @@ export async function createWorker(opts, deps = {}) {
   const ledger = (row) => writeRow(signRow({ run: runId, ...row }, key));
   // Shared across direct ticks and the scheduler, so running tickets are never superseded.
   const activeTickets = new Set();
-  const tickWatch = () => watchTick({ repoRoot, runId, cfg, readRun: loadRun, writeRow: ledger, running: activeTickets, exec: deps.watchExec, hooks: deps.watchHooks });
+  const tickWatch = () => watchTick({ repoRoot, runId, cfg, readRun: loadRun, writeRow: ledger, running: activeTickets, exec: deps.watchExec, hooks: deps.watchHooks, now: deps.watchNow });
 
   /**
    * The config ticket `id` is reviewed with (B35): its snapshot from the run record, re-read per

package/src/worker/queue.mjs

@@ -520,8 +520,9 @@ export function pendingTickets(repoRoot) {
     return [];
   }
   const claimed = new Set(names.map((n) => CLAIM.exec(n)?.[1]));
+  const present = new Set(names);
   const ids = names.filter((n) => /^[0-9a-f]{24}\.json$/.test(n)).map((n) => n.slice(0, 24));
-  const pending = ids.filter((id) => !names.includes(`${id}.done`) && !claimed.has(id));
+  const pending = ids.filter((id) => !present.has(`${id}.done`) && !claimed.has(id));
   const at = (/** @type {string} */ id) => {
     const t = readJSON(path.join(queueDir(repoRoot), `${id}.json`));
     return typeof t?.enqueued_at === 'string' ? t.enqueued_at : '';

package/src/worker/review-state.mjs

@@ -25,7 +25,7 @@
  * (the engine saves it as a new seq and writes `review.state_restored`); an anchor with no body
  * makes a missing file `lost` (refused, never a round 1). A
  * `review.state` row of the run whose MAC does not verify is `tampered` for every block and file
- * of it (`blockAnchors`). Whether the block's one L3 rung was used comes from the anchors, never
+ * of it (`blockAnchors`). Whether a file's one L3 rung was used comes from the anchors, never
  * from the state files.
  *
  * B78: the reviewed text itself is kept as a git blob in the content root's object store
@@ -427,8 +427,8 @@ export async function saveState({ runId, block, file, key, state, seq, writeRow,
 }
 
 /**
- * Whether the block's one L3 rung (§3.6 rules 5/6) was already used on ANY of its files — the
- * rung is once per block. Derived from the ledger anchors only; fails closed: a block anchor that
+ * Whether any file of the block has used its L3 rung (§3.6 rules 5/6).
+ * Derived from the ledger anchors only; fails closed: a block anchor that
  * does not verify is `tampered`.
  * @param {{runId: string, block: string, key: Buffer, rows: Array<Record<string, any>>}} opts
  * @returns {{status: 'ok' | 'tampered', used: boolean}}
@@ -438,3 +438,15 @@ export function blockRungUsed(opts) {
   if (anchors === null) return { status: 'tampered', used: true };
   return { status: 'ok', used: anchors.some((a) => a.l3_rung_used === true) };
 }
+
+/**
+ * Whether this file has used its L3 rung, once per file across all its anchors.
+ * Verify the run's anchors before filtering by file, preserving fail-closed tamper detection.
+ * @param {{runId: string, block: string, file: string, key: Buffer, rows: Array<Record<string, any>>}} opts
+ * @returns {{status: 'ok' | 'tampered', used: boolean}}
+ */
+export function fileRungUsed(opts) {
+  const anchors = blockAnchors(opts);
+  if (anchors === null) return { status: 'tampered', used: true };
+  return { status: 'ok', used: anchors.some((a) => a.file === opts.file && a.l3_rung_used === true) };
+}

package/src/worker/watch.mjs

@@ -7,6 +7,7 @@ import { snapshotFor } from '../state/config-snapshot.mjs';
 import { readRun } from '../state/run.mjs';
 import { ownsAt } from '../review/gate-check.mjs';
 import { exec } from '../util/exec.mjs';
+import { withLock } from '../util/file-locks.mjs';
 import { blockTickets, enqueueHash, isDone, queueDir, supersedeTicket } from './queue.mjs';
 import { assertRowPath, DELETED_HASH, gitChildEnv, hashBytes } from './ticket.mjs';
 
@@ -30,97 +31,99 @@ export async function watchTick({ repoRoot, runId, cfg, readRun: loadRun = readR
   const env = gitChildEnv();
   for (const [block, entry] of Object.entries(record.blocks ?? {})) {
     if (entry.status !== 'open' || !BLOCK.test(block)) continue;
-    const stateFile = path.join(queueDir(repoRoot), 'watch', `${block}.json`);
-    let tree = null;
-    let root = repoRoot;
-    let state = {};
-    try { state = JSON.parse(readFileSync(stateFile, 'utf8')) ?? {}; } catch { /* restart at base */ }
-    const base = entry.base_sha;
-    /** @param {Record<string, any>} next */
-    const save = (next) => {
-      mkdirSync(path.dirname(stateFile), { recursive: true });
-      const tmp = `${stateFile}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+    await withLock(`watch:${realpathSync(repoRoot)}\0${block}`, async () => {
+      const stateFile = path.join(queueDir(repoRoot), 'watch', `${block}.json`);
+      let tree = null;
+      let root = repoRoot;
+      let state = {};
+      try { state = JSON.parse(readFileSync(stateFile, 'utf8')) ?? {}; } catch { /* restart at base */ }
+      const base = entry.base_sha;
+      /** @param {Record<string, any>} next */
+      const save = (next) => {
+        mkdirSync(path.dirname(stateFile), { recursive: true });
+        const tmp = `${stateFile}.${process.pid}.${randomBytes(4).toString('hex')}.tmp`;
+        try {
+          writeFileSync(tmp, `${JSON.stringify(next)}\n`, { mode: 0o600 });
+          renameSync(tmp, stateFile);
+          state = next;
+        } finally { rmSync(tmp, { force: true }); }
+      };
+      /** @param {string} reason */
+      const skip = async (reason) => {
+        const skipped = Array.isArray(state.skipped) ? state.skipped : [];
+        if (!skipped.includes(reason)) {
+          await writeRow({ event: 'watch.skipped', block, reason });
+          save({ ...state, skipped: [...skipped, reason] });
+        }
+      };
       try {
-        writeFileSync(tmp, `${JSON.stringify(next)}\n`, { mode: 0o600 });
-        renameSync(tmp, stateFile);
-        state = next;
-      } finally { rmSync(tmp, { force: true }); }
-    };
-    /** @param {string} reason */
-    const skip = async (reason) => {
-      const skipped = Array.isArray(state.skipped) ? state.skipped : [];
-      if (!skipped.includes(reason)) {
-        await writeRow({ event: 'watch.skipped', block, reason });
-        save({ ...state, skipped: [...skipped, reason] });
-      }
-    };
-    try {
-      if (entry.worktree) {
-        root = realpathSync(entry.worktree.path);
-        tree = root;
-      }
-      if (state.run !== runId || state.base !== base || state.tree !== tree) state = { run: runId, base, tree, skipped: [] };
-      /** @param {string[]} argv */
-      const git = (argv) => execute(['git', ...argv], { cwd: root, env, timeoutMs: 10000 });
-      const headResult = await git(['rev-parse', '--verify', 'HEAD^{commit}']);
-      const head = headResult.stdout.trim();
-      if (headResult.result !== 'ok' || !SHA.test(head)) { await skip('unreadable_head'); continue; }
-      const earlier = blockTickets({ repoRoot, run: runId, block, tree });
-      await hooks.afterHead?.(head);
-      if (typeof base !== 'string' || !SHA.test(base) || (await git(['merge-base', '--is-ancestor', base, head])).result !== 'ok') {
-        await skip('not_descendant'); continue;
-      }
-      const last = typeof state.sha === 'string' && SHA.test(state.sha) ? state.sha : base;
-      const previous = typeof state.pending?.sha === 'string' && SHA.test(state.pending.sha) ? state.pending.sha : last;
-      if (previous !== base && (await git(['merge-base', '--is-ancestor', previous, head])).result !== 'ok') {
-        await skip('rewound');
-        const { sha: _sha, pending: _pending, burst_started_at: _burst, ...restart } = state;
-        save(restart);
-        continue;
-      }
-      // A healthy tick ends the skip streak: no new commit here, or a queued commit below. An
-      // unreadable commit keeps the streak, so it writes one watch.skipped row, not one per tick.
-      if (last === head) { if (state.skipped?.length) save({ ...state, skipped: [] }); continue; }
-      const time = now();
-      if (state.pending?.sha !== head) {
-        // A new HEAD restarts the quiet wait, but keeps the burst's original deadline.
-        save({ ...state, pending: { sha: head, seen_at: time }, burst_started_at: state.burst_started_at ?? time });
-      }
-      if (time - state.pending.seen_at < QUIET_MS && time - state.burst_started_at < MAX_BURST_MS) continue;
-      const diff = await git(['diff', '--name-only', '-z', '--no-renames', last, head, '--']);
-      if (diff.result !== 'ok') { await skip('unreadable_head'); continue; }
-      const owns = ownsAt(tree ? '' : path.relative(repoRoot, record.workspace).split(path.sep).join('/'));
-      const files = diff.stdout.split('\0').filter(Boolean);
-      const owned = files.filter((file) => owns(entry.owned_files, file, entry.owned_kinds));
-      if (owned.length !== files.length) await skip('unowned_path');
-      // Stage every hash before publishing anything: an unreadable object queues nothing.
-      const hashes = [];
-      let unreadable = false;
-      for (const raw of owned.filter((file) => reviewExcludeRule(snapshotFor(record, '')?.config ?? cfg, file) === null)) {
-        const file = assertRowPath(raw);
-        const listed = await git(['ls-tree', '-z', head, '--', file]);
-        if (listed.result !== 'ok') { unreadable = true; break; }
-        if (!listed.stdout) { hashes.push({ file, content_hash: DELETED_HASH }); continue; }
-        if (!/^100(?:644|755) blob /.test(listed.stdout)) { unreadable = true; break; }
-        const shown = await execute(['git', 'show', `${head}:${file}`], { cwd: root, env, timeoutMs: 10000, stdoutEncoding: 'base64' });
-        if (shown.result !== 'ok') { unreadable = true; break; }
-        hashes.push({ file, content_hash: hashBytes(Buffer.from(shown.stdout, 'base64')) });
-      }
-      if (unreadable) { await skip('unreadable_head'); continue; }
-      await hooks.beforeQueue?.();
-      for (const { file, content_hash } of hashes) {
-        const held = earlier.some((old) => old.file === file);
-        if (!held) enqueueHash({ repoRoot, run: runId, block, file, content_hash, tree });
-        for (const old of earlier) {
-          if (old.file === file && old.content_hash !== content_hash && !running.has(old.ticket) && !isDone(repoRoot, old.ticket)) supersedeTicket(repoRoot, old.ticket);
+        if (entry.worktree) {
+          root = realpathSync(entry.worktree.path);
+          tree = root;
+        }
+        if (state.run !== runId || state.base !== base || state.tree !== tree) state = { run: runId, base, tree, skipped: [] };
+        /** @param {string[]} argv */
+        const git = (argv) => execute(['git', ...argv], { cwd: root, env, timeoutMs: 10000 });
+        const headResult = await git(['rev-parse', '--verify', 'HEAD^{commit}']);
+        const head = headResult.stdout.trim();
+        if (headResult.result !== 'ok' || !SHA.test(head)) { await skip('unreadable_head'); return; }
+        const earlier = blockTickets({ repoRoot, run: runId, block, tree });
+        await hooks.afterHead?.(head);
+        if (typeof base !== 'string' || !SHA.test(base) || (await git(['merge-base', '--is-ancestor', base, head])).result !== 'ok') {
+          await skip('not_descendant'); return;
+        }
+        const last = typeof state.sha === 'string' && SHA.test(state.sha) ? state.sha : base;
+        const previous = typeof state.pending?.sha === 'string' && SHA.test(state.pending.sha) ? state.pending.sha : last;
+        if (previous !== base && (await git(['merge-base', '--is-ancestor', previous, head])).result !== 'ok') {
+          await skip('rewound');
+          const { sha: _sha, pending: _pending, burst_started_at: _burst, ...restart } = state;
+          save(restart);
+          return;
+        }
+        // A healthy tick ends the skip streak: no new commit here, or a queued commit below. An
+        // unreadable commit keeps the streak, so it writes one watch.skipped row, not one per tick.
+        if (last === head) { if (state.skipped?.length) save({ ...state, skipped: [] }); return; }
+        const time = now();
+        if (state.pending?.sha !== head) {
+          // A new HEAD restarts the quiet wait, but keeps the burst's original deadline.
+          save({ ...state, pending: { sha: head, seen_at: time }, burst_started_at: state.burst_started_at ?? time });
+        }
+        if (time - state.pending.seen_at < QUIET_MS && time - state.burst_started_at < MAX_BURST_MS) return;
+        const diff = await git(['diff', '--name-only', '-z', '--no-renames', last, head, '--']);
+        if (diff.result !== 'ok') { await skip('unreadable_head'); return; }
+        const owns = ownsAt(tree ? '' : path.relative(repoRoot, record.workspace).split(path.sep).join('/'));
+        const files = diff.stdout.split('\0').filter(Boolean);
+        const owned = files.filter((file) => owns(entry.owned_files, file, entry.owned_kinds));
+        if (owned.length !== files.length) await skip('unowned_path');
+        // Stage every hash before publishing anything: an unreadable object queues nothing.
+        const hashes = [];
+        let unreadable = false;
+        for (const raw of owned.filter((file) => reviewExcludeRule(snapshotFor(record, '')?.config ?? cfg, file) === null)) {
+          const file = assertRowPath(raw);
+          const listed = await git(['ls-tree', '-z', head, '--', file]);
+          if (listed.result !== 'ok') { unreadable = true; break; }
+          if (!listed.stdout) { hashes.push({ file, content_hash: DELETED_HASH }); continue; }
+          if (!/^100(?:644|755) blob /.test(listed.stdout)) { unreadable = true; break; }
+          const shown = await execute(['git', 'show', `${head}:${file}`], { cwd: root, env, timeoutMs: 10000, stdoutEncoding: 'base64' });
+          if (shown.result !== 'ok') { unreadable = true; break; }
+          hashes.push({ file, content_hash: hashBytes(Buffer.from(shown.stdout, 'base64')) });
+        }
+        if (unreadable) { await skip('unreadable_head'); return; }
+        await hooks.beforeQueue?.();
+        for (const { file, content_hash } of hashes) {
+          const held = earlier.some((old) => old.file === file);
+          if (!held) enqueueHash({ repoRoot, run: runId, block, file, content_hash, tree });
+          for (const old of earlier) {
+            if (old.file === file && old.content_hash !== content_hash && !running.has(old.ticket) && !isDone(repoRoot, old.ticket)) supersedeTicket(repoRoot, old.ticket);
+          }
+          if (held) await writeRow({ event: 'watch.held', block, file, content_hash });
         }
-        if (held) await writeRow({ event: 'watch.held', block, file, content_hash });
+        const { pending: _pending, burst_started_at: _burst, ...queued } = state;
+        save({ ...queued, run: runId, base, tree, sha: head, skipped: [] });
+      } catch {
+        // A bad path, missing tree or failed git read is a skip, never a block failure.
+        await skip('unreadable_head');
       }
-      const { pending: _pending, burst_started_at: _burst, ...queued } = state;
-      save({ ...queued, run: runId, base, tree, sha: head, skipped: [] });
-    } catch {
-      // A bad path, missing tree or failed git read is a skip, never a block failure.
-      await skip('unreadable_head');
-    }
+    });
   }
 }

package/src/worker/worker-warning.mjs

@@ -0,0 +1,35 @@
+import { workerRegistry } from './queue.mjs';
+import { repoRootOf } from './ticket.mjs';
+import { checkWorkerPin, normalizeStartTime, processStartTime } from '../state/run.mjs';
+
+/** @typedef {{pid: number, start_time: string, run: string}} WarningWorker */
+/** @typedef {{live: boolean, worker: WarningWorker | null}} RegistryEntry */
+
+/**
+ * Read-only advice about live workers serving a run without a matching process identity pin.
+ * Failure to discover the repository, read its registry or probe a pin never breaks status.
+ * @param {Record<string, any>} record
+ * @param {{repoRoot?: string, registry?: (root: string) => RegistryEntry[] | Promise<RegistryEntry[]>, probe?: import('../state/run.mjs').StartTimeProbe}} [opts]
+ * @returns {Promise<string[]>}
+ */
+export async function unpinnedWorkerWarnings(record, { repoRoot, registry = workerRegistry, probe = processStartTime } = {}) {
+  try {
+    if (record.status === 'ended') return [];
+    const root = repoRoot ?? await repoRootOf(record.workspace);
+    const pins = record.workers ?? (record.worker ? [record.worker] : []);
+    const unpinned = (await registry(root)).filter(({ live, worker }) => live && worker?.run === record.run_id
+      && !pins.some((pin) => pin.pid === worker.pid
+        && normalizeStartTime(pin.started_at) === normalizeStartTime(worker.start_time)));
+    if (unpinned.length === 0) return [];
+
+    let suffix = '';
+    if (unpinned.length === 1 && pins.length > 0) {
+      const check = await checkWorkerPin(record, { probe });
+      if (!check.ok) suffix = ` (pinned pid ${pins[0].pid} is ${check.event === 'worker.replaced' ? 'replaced' : 'down'})`;
+    }
+    return unpinned.map(({ worker }) => `warning: live worker ${worker.pid} is not pinned: run start --reattach --run ${record.run_id}`
+      + (unpinned.length > 1 ? ` --worker-pid ${worker.pid}` : suffix));
+  } catch {
+    return [];
+  }
+}