@detergent-software/conductor 3.0.0-dev.9 → 3.1.0-dev.1

package/build/manager.js

@@ -7,14 +7,16 @@ import { formatCondition, parseCondition, prRef, uncheckable } from "./condition
 import { ConductorError } from "./errors.js";
 import { UNWATCHED_HANDOFFS } from "./inbox.js";
 import { processAlive as defaultProcessAlive } from "./lock.js";
+import { projectPaths } from "./paths.js";
 import { missingPluginSkills, projectSkills } from "./plugin.js";
 import { WAKE_PREFIX } from "./protocol.js";
+import { registeredByCheckout } from "./registry.js";
 import { resolveOpenWait } from "./resolve.js";
 import { findTranscript, formatTokens, lastTurnAt, localDay, projectSlug, readUsage, transcriptFiles, } from "./spend.js";
 import { ACTIVE_STATUSES, openStore, waitSchema, workerSchema, } from "./store.js";
 import { linkedPr } from "./tracker-writes.js";
 import { pendingCall } from "./transcript.js";
-import { BRANCH_PREFIX, worktreePath } from "./worktrees.js";
+import { BRANCH_PREFIX } from "./worktrees.js";
 // A worker as GET /fleet shows it.
 export const fleetWorkerSchema = workerSchema.extend({
     // launching, starting, working, idle, waiting on <x>, parked, stopped, no session
@@ -86,7 +88,7 @@ export function workerLine(w) {
 }
 export const PROBE_PREFIX = 'probe-';
 export const PROBE_PROMPT = 'This is a conductor probe session started by a test run. It works no issue: reply "probe ready" and wait.';
-// conduct-atk starts workers this way; a resume keeps both (ATK-309's open check).
+// Workers start in auto mode; a resume keeps it (ATK-309's open check).
 export const PERMISSION_MODE = 'auto';
 // How long a started or woken worker's session has to report its plugin. A start runs the create
 // hook first only for a launch, which is before the clock starts.
@@ -96,7 +98,15 @@ const ITEM = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const STOP_WAIT_MS = 30_000;
 // A park that failed (the process outlived `claude stop`) is tried again this much later.
 const PARK_RETRY_MS = 5 * 60_000;
+// How long a new session id has to stay listed before the worker follows it. A resuming session is
+// listed for under a second under the id its process started with, before it loads its own (ATK-574).
+const SESSION_ID_SETTLE_MS = 5_000;
 const TRANSCRIPT_SCAN_MS = 60_000;
+// The process scan for `claude attach` clients runs at most this often, and only while a worker is
+// attached: on Windows it takes about a second (ATK-520).
+const CLIENT_SCAN_MS = 30_000;
+// This many scans in a row without the client, once one had found it, mean the tab closed.
+const CLIENT_MISSES = 2;
 // A compaction with no boundary in the transcript this long after it started, its turn over, failed.
 const COMPACT_MINUTES = 10;
 // What a parked worker is resumed with when its context has grown past the rules' threshold
@@ -118,7 +128,7 @@ export function eventText(waits) {
     return `${WAKE_PREFIX}${[...facts].map(([fact, at]) => `${fact} ${clock(new Date(at))}`).join('; ')}`;
 }
 export function sessionManager(deps) {
-    const { broker, claude, config, log, openTab, pluginDir, prs, store, worktrees } = deps;
+    const { broker, claude, config, log, pluginDir, prs, store, tabs, worktrees } = deps;
     const now = deps.now ?? (() => new Date());
     const alive = deps.processAlive ?? defaultProcessAlive;
     const sleep = deps.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
@@ -128,7 +138,12 @@ export function sessionManager(deps) {
     const stalls = new Map();
     const transcripts = new Map();
     const transcriptScans = new Map();
+    // worker id → a session id the listing shows for it that it hasn't followed yet, since when
+    const newSessionIds = new Map();
     let sessions = [];
+    // The last scan for `claude attach` clients: when, its number, and the sessions it found them for
+    // (null: the processes couldn't be read).
+    let clientScan = null;
     // Until the first sweep, nothing is known about any session.
     let listed = false;
     let sweeping = null;
@@ -138,6 +153,8 @@ export function sessionManager(deps) {
     const held = new Set();
     // Workers whose compaction failed: not tried again while the daemon runs (their inbox item says so).
     const uncompactable = new Set();
+    // worker id → the attach (its attachedAt) a retire was last refused for, so each is logged once.
+    const attachRefusals = new Map();
     // Every session the conductor starts loads its plugin, and a resume whose saved --plugin-dir went
     // missing runs on without it, silently (ATK-522). The mod reports each session start (pluginSeen),
     // so a worker started or woken that doesn't report within PLUGIN_REPORT_MS is a
@@ -228,10 +245,15 @@ export function sessionManager(deps) {
             throw new ConductorError(`project "${found.name}" has a problem: ${found.problem ?? 'no profile'}`);
         if (!found.enabled)
             throw new ConductorError(`project "${found.name}" is disabled`);
+        if (registeredByCheckout(deps.paths, found)) {
+            throw new ConductorError(`project "${found.name}" is registered by the checkout ${found.clone}`, [
+                `the conductor works only in a clone of its own: run \`conduct project add "${found.clone}"\` first`,
+            ]);
+        }
         return { ...found, profile: found.profile };
     };
-    // Where a worker's commands run: its project's main checkout, where conduct-atk starts them too.
-    const rootOf = (worker) => store.listProjects().find((p) => p.name === worker.project)?.root ?? worker.worktree ?? process.cwd();
+    // Where a worker's commands run when it has no worktree: its project's clone.
+    const cloneOf = (worker) => projectPaths(deps.paths, worker.project).clone;
     const sessionOf = (worker) => sessions.find((s) => (worker.sessionId !== null && s.sessionId === worker.sessionId) ||
         (worker.handle !== null && s.id === worker.handle));
     const minutesSince = (iso) => (now().getTime() - Date.parse(iso)) / 60_000;
@@ -269,13 +291,14 @@ export function sessionManager(deps) {
     };
     // ---------- launch ----------
     // The worktree first (design note v2, section 2): its ports from the broker, then `git worktree add`
-    // from origin/<base>, the local files and the profile's setup. The session starts in it.
-    const launchWorker = async (worker, root, profile, prompt) => {
+    // in the project's clone from origin/<base>, the local files and the profile's setup. The session
+    // starts in it.
+    const launchWorker = async (worker, profile, prompt) => {
         let current = worker;
         let stage = 'assign ports';
-        const path = worktreePath(root, worker.name);
-        // A worktree there already (a kept one, or one a person made with `claude --worktree`) isn't
-        // this launch's to remove when it fails.
+        const { clone, worktrees: dir } = projectPaths(deps.paths, worker.project);
+        const path = join(dir, worker.name);
+        // A worktree there already (a kept one) isn't this launch's to remove when it fails.
         const reused = existsSync(join(path, '.git'));
         try {
             // Recorded before it exists: the broker keeps an in-flight worker's ports while its directory
@@ -286,10 +309,11 @@ export function sessionManager(deps) {
             const env = portEnv(ports);
             const worktree = await worktrees.create({
                 base: profile.baseBranch,
+                clone,
                 env: { ...env, CONDUCTOR_ITEM: worker.item, CONDUCTOR_PROJECT: worker.project, CONDUCTOR_WORKTREE: path },
                 ...(profile.localFilesFrom === undefined ? {} : { localFilesFrom: profile.localFilesFrom }),
                 name: worker.name,
-                root,
+                path,
                 sessionEnv: env,
                 setup: profile.setup,
             });
@@ -314,8 +338,8 @@ export function sessionManager(deps) {
                 // Claude Code's own message names the worktree, which this failed launch removes.
                 if (!(error instanceof WorkspaceUntrusted))
                     throw error;
-                throw new ConductorError(`Claude Code doesn't trust ${root}`, [
-                    `${trustStep(root)}, then \`conduct project check ${worker.project}\``,
+                throw new ConductorError(`Claude Code doesn't trust ${clone}`, [
+                    `${trustStep(clone)}, then \`conduct project check ${worker.project}\``,
                     ...error.details,
                 ]);
             });
@@ -330,8 +354,8 @@ export function sessionManager(deps) {
             current = update(current, { handle, sessionId: session?.sessionId ?? null, status: 'running' });
             event(current, 'worker.launched', { handle, pluginDir, sessionId: current.sessionId, worktree });
             expectPlugin(current, started);
-            if (profile.workers.tab) {
-                const tab = await openTab({
+            if (tabs.onLaunch) {
+                const tab = await tabs.open({
                     cwd: worktree,
                     handle,
                     title: worker.name,
@@ -346,7 +370,7 @@ export function sessionManager(deps) {
             const cleanup = reused
                 ? { kept: path, keptBecause: 'it was there before the launch' }
                 : current.worktree && existsSync(current.worktree)
-                    ? await removeIfClean(root, current.worktree)
+                    ? await removeIfClean(clone, current.worktree)
                     : {};
             freePorts(store, path, 'launch failed');
             current = update(current, { status: 'failed' });
@@ -356,13 +380,13 @@ export function sessionManager(deps) {
     };
     // A failed launch's worktree, unless it holds work. Its branch goes with it while it still has the
     // name the launch gave it; a renamed one was the worker's.
-    const removeIfClean = async (root, worktree) => {
+    const removeIfClean = async (clone, worktree) => {
         try {
             const work = await worktrees.unfinishedWork(worktree);
             if (work)
                 return { kept: worktree, ...work };
             const branch = await worktrees.branchOf(worktree);
-            await worktrees.remove(root, worktree, { deleteBranch: branch?.startsWith(BRANCH_PREFIX) === true });
+            await worktrees.remove(worktree, { deleteBranch: branch?.startsWith(BRANCH_PREFIX) === true, repo: clone });
             return { removed: worktree };
         }
         catch (error) {
@@ -452,7 +476,7 @@ export function sessionManager(deps) {
         const text = eventText(resolved);
         const started = now().getTime();
         const { copy } = await claude.resume({
-            cwd: session?.cwd ?? worker.worktree ?? rootOf(worker),
+            cwd: session?.cwd ?? worker.worktree ?? cloneOf(worker),
             sessionId: worker.sessionId,
             text,
         });
@@ -501,7 +525,7 @@ export function sessionManager(deps) {
         let copy;
         try {
             ({ copy } = await claude.resume({
-                cwd: session?.cwd ?? worker.worktree ?? rootOf(worker),
+                cwd: session?.cwd ?? worker.worktree ?? cloneOf(worker),
                 sessionId: worker.sessionId,
                 text: COMPACT_TEXT,
             }));
@@ -578,7 +602,7 @@ export function sessionManager(deps) {
                 });
             }
         }
-        // An attached worker is Jason's while he has it open. One whose Handoff is open waits on him,
+        // An attached worker is the operator's while they have it open. One whose Handoff is open waits on them,
         // though no wait says so: its note raised the inbox item already (ATK-416).
         if (!turnEnded(session) || waiting || worker.attachedAt !== null || handedOff(worker)) {
             cleared('idle', state.idle?.reported);
@@ -594,25 +618,78 @@ export function sessionManager(deps) {
         }
         stalls.set(worker.id, state);
     };
-    // The daemon can't see the tab, so attached means "Jason may be in it" only while the session is
+    // Once the process scan has seen the worker's `claude attach` client and then missed it
+    // CLIENT_MISSES times in a row, and its turn is over, the tab closed: the worker is the daemon's
+    // again (ATK-520). A client seen still doesn't hold it past the releases below: a tab left open
+    // with nobody in it would hold its waits as before ATK-516, and a park closes the tab.
+    // Attached means "the operator may be in it" only while the session is
     // in use. Once its turn has been over `idleMinutes`, the worker is the daemon's again, and its
     // waits park and resume it as usual. A resolved wait takes it back at once when the transcript
     // shows no turn since the attach: nobody is in it, and the park and resume deliver the wait
     // (ATK-516). A turn, or no transcript to tell, holds it, and the hold is logged once.
     // Only a wait that resolved after the attach releases it: one resolved before was there when
-    // Jason chose to attach, so taking the session back would undo the attach.
+    // The operator chose to attach, so taking the session back would undo the attach.
     // A new attach, or the end of one, starts its spell afresh.
     const forgetAttach = (workerId) => {
         const state = stalls.get(workerId);
         if (!state)
             return;
+        state.attachedClient = undefined;
         state.attachedHeld = undefined;
         state.attachedIdleSince = undefined;
         state.attachedUsed = undefined;
     };
+    // Where the daemon can read the processes, it sees the tab after all (ATK-520): a `claude attach`
+    // client on the session is the tab, or one opened by hand in another terminal. Never rejects.
+    const scanClients = async () => {
+        if (!tabs.clients)
+            return null;
+        // As of its start: an attach's scan and a sweep's can overlap, and the older mustn't win.
+        const at = now().getTime();
+        let targets = null;
+        try {
+            targets = await tabs.clients();
+        }
+        catch (error) {
+            log.log('warn', 'attach client scan failed', { error: messageOf(error) });
+        }
+        if (clientScan === null || at >= clientScan.at)
+            clientScan = { at, scan: (clientScan?.scan ?? 0) + 1, targets };
+        return targets;
+    };
+    // What a client of the worker's session attaches by: its short id, session id or name.
+    const clientNames = (worker) => [worker.handle, worker.sessionId, worker.name].filter((name) => name !== null);
+    // Each scan since the attach counts once. One that finds the client marks it seen and starts the
+    // misses over; one that doesn't, after it was seen, is a miss. So a tab that never opened (its
+    // terminal failed, and the operator runs `claude attach` by hand) or hasn't started its client yet
+    // is no closed tab. The names include every one the worker had since the attach: a client keeps
+    // the id it attached by when the worker follows a new one. A scan that couldn't read the
+    // processes tells nothing.
+    const watchClient = (worker, state) => {
+        if (worker.attachedAt === null)
+            return;
+        const watch = (state.attachedClient ??= { misses: 0, names: [], scan: 0, seen: false });
+        for (const name of clientNames(worker))
+            if (!watch.names.includes(name))
+                watch.names.push(name);
+        const scan = clientScan;
+        if (scan === null || scan.targets === null || scan.scan === watch.scan)
+            return;
+        if (scan.at < Date.parse(worker.attachedAt))
+            return;
+        const { targets } = scan;
+        watch.scan = scan.scan;
+        if (watch.names.some((name) => targets.has(name))) {
+            watch.seen = true;
+            watch.misses = 0;
+        }
+        else if (watch.seen)
+            watch.misses += 1;
+    };
     const releaseAttached = (worker, session, resolved) => {
         const state = stalls.get(worker.id) ?? {};
         stalls.set(worker.id, state);
+        watchClient(worker, state);
         if (!turnEnded(session)) {
             state.attachedIdleSince = undefined;
             return worker;
@@ -623,6 +700,9 @@ export function sessionManager(deps) {
             event(released, 'worker.detached', data);
             return released;
         };
+        // Nobody has it open: its waits park and resume it as usual, with no idle spell first.
+        if ((state.attachedClient?.misses ?? 0) >= CLIENT_MISSES)
+            return detach({ reason: 'tab closed' });
         const attachedAt = worker.attachedAt;
         if (resolved.length > 0 && attachedAt !== null) {
             const since = Date.parse(attachedAt);
@@ -647,14 +727,29 @@ export function sessionManager(deps) {
         let current = worker;
         const session = sessionOf(current);
         // The listing is the truth for ids: fill them in after a launch, and follow a changed short id.
-        if (session && (current.sessionId !== session.sessionId || current.handle !== session.id)) {
-            // A new session id (a /clear) writes a new transcript.
-            if (current.sessionId !== session.sessionId) {
+        // A changed session id is followed once it has stayed listed SESSION_ID_SETTLE_MS.
+        if (session) {
+            let sessionId = current.sessionId;
+            const pending = newSessionIds.get(current.id);
+            if (sessionId === null || session.sessionId === sessionId)
+                newSessionIds.delete(current.id);
+            else if (pending?.sessionId !== session.sessionId) {
+                newSessionIds.set(current.id, { sessionId: session.sessionId, since: now().getTime() });
+            }
+            else if (now().getTime() - pending.since >= SESSION_ID_SETTLE_MS) {
+                newSessionIds.delete(current.id);
+                // A new session id (a /clear) writes a new transcript.
                 transcripts.delete(current.id);
                 transcriptScans.delete(current.id);
+                sessionId = session.sessionId;
+            }
+            sessionId ??= session.sessionId;
+            if (sessionId !== current.sessionId || session.id !== current.handle) {
+                current = update(current, { handle: session.id, sessionId });
             }
-            current = update(current, { handle: session.id, sessionId: session.sessionId });
         }
+        else
+            newSessionIds.delete(current.id);
         const waits = store.waitsOf(current.id);
         const resolved = waits.filter((w) => w.resolvedAt !== null);
         // A listed pid can outlive its process for a moment after a stop.
@@ -702,6 +797,10 @@ export function sessionManager(deps) {
         }
         if (current.status !== 'parked')
             return;
+        // A park needs a wait, so a parked worker with none was stopped by a retire that didn't finish
+        // (ATK-519): the retire, tried again, takes it on.
+        if (waits.length === 0)
+            return;
         if (resolved.length > 0)
             await resume(current, resolved, session);
         else
@@ -798,6 +897,9 @@ export function sessionManager(deps) {
             return;
         }
         try {
+            const attached = store.listWorkers(['running']).some((w) => w.attachedAt !== null);
+            if (attached && (clientScan === null || now().getTime() - clientScan.at >= CLIENT_SCAN_MS))
+                await scanClients();
             resolveTimeWaits();
             for (const { id } of store.listWorkers(SWEPT)) {
                 if (busy.has(id))
@@ -842,8 +944,8 @@ export function sessionManager(deps) {
                     });
                     continue;
                 }
-                const root = rootOf(worker);
-                const worktree = worker.worktree ?? worktreePath(root, worker.name);
+                const root = cloneOf(worker);
+                const worktree = worker.worktree ?? join(projectPaths(deps.paths, worker.project).worktrees, worker.name);
                 const reused = store
                     .workerEvents(worker.id, 1000)
                     .some((e) => e.kind === 'worker.launching' && e.data.reused === true);
@@ -882,7 +984,7 @@ export function sessionManager(deps) {
             const problem = uncheckable(parsed, project?.profile ?? null);
             if (problem) {
                 throw new ConductorError(problem, [
-                    `the conductor takes ${worker.project}'s profile from ${project?.profilePath ?? 'its .claude/conductor.json'} when it starts or the file is saved; \`conduct rules\` lists one it refused`,
+                    `the conductor takes ${worker.project}'s profile again when it starts, when ${project?.profilePath ?? 'its machine profile'} is saved, and after each fetch of its clone; \`conduct profile ${worker.project}\` shows it, and \`conduct rules\` lists one it refused`,
                 ]);
             }
             // Stored in its normal full form, so the watchers and `conduct status` read one spelling. A
@@ -914,6 +1016,19 @@ export function sessionManager(deps) {
             try {
                 let current = worker;
                 const resumed = current.status !== 'running';
+                const window = `${current.probe ? 'probe' : 'Conductor'} · ${current.project}`;
+                // A running session can have a client already: an attach's tab, a launch's, or one by hand.
+                // A second tab would be a second client; the operator has the first (ATK-520). The hint
+                // still says how to reach a tab off the desktop.
+                const targets = resumed ? null : await scanClients();
+                if (targets !== null && clientNames(current).some((name) => targets.has(name))) {
+                    if (current.attachedAt === null) {
+                        current = update(current, { attachedAt: now().toISOString() });
+                        forgetAttach(current.id);
+                    }
+                    event(current, 'worker.attached', { resumed, tabOpen: true });
+                    return { already: true, hint: tabs.hint(window), resumed, tab: null, worker: current };
+                }
                 let started = null;
                 if (resumed) {
                     const settle = current.stoppedAt === null
@@ -924,7 +1039,7 @@ export function sessionManager(deps) {
                     // No event text: the session wakes idle and keeps running when the tab closes.
                     started = now().getTime();
                     const { copy } = await claude.resume({
-                        cwd: sessionOf(current)?.cwd ?? current.worktree ?? rootOf(current),
+                        cwd: sessionOf(current)?.cwd ?? current.worktree ?? cloneOf(current),
                         sessionId,
                         text: null,
                     });
@@ -936,16 +1051,11 @@ export function sessionManager(deps) {
                 }
                 current = update(current, { attachedAt: now().toISOString(), status: 'running', stoppedAt: null });
                 forgetAttach(current.id);
-                const tab = await openTab({
-                    cwd: current.worktree ?? rootOf(current),
-                    handle,
-                    title: current.name,
-                    window: `${current.probe ? 'probe' : 'Conductor'} · ${current.project}`,
-                });
+                const tab = await tabs.open({ cwd: current.worktree ?? cloneOf(current), handle, title: current.name, window });
                 event(current, 'worker.attached', { resumed, ...(tab ? { tabError: tab } : {}) });
                 if (started !== null)
                     expectPlugin(current, started);
-                return { resumed, tab, worker: current };
+                return { already: false, hint: tab === null ? tabs.hint(window) : null, resumed, tab, worker: current };
             }
             finally {
                 busy.delete(worker.id);
@@ -974,19 +1084,22 @@ export function sessionManager(deps) {
                 project: target.name,
             });
             // A worktree there already isn't the launch's to remove if it fails, after a restart too.
-            const reused = existsSync(join(worktreePath(target.root, name), '.git'));
+            const reused = existsSync(join(projectPaths(deps.paths, target.name).worktrees, name, '.git'));
             event(worker, 'worker.launching', {
                 probe: worker.probe,
                 ...(reused ? { reused } : {}),
                 ...(request.cause === undefined ? {} : { cause: request.cause }),
             });
             busy.add(worker.id);
-            void track(launchWorker(worker, target.root, target.profile, prompt).finally(() => busy.delete(worker.id)));
+            void track(launchWorker(worker, target.profile, prompt).finally(() => busy.delete(worker.id)));
             return worker;
         },
         pluginSeen: (sessionId) => {
             pluginReports.set(sessionId, now().getTime());
-            return store.listWorkers(ACTIVE_STATUSES).find((w) => w.sessionId === sessionId) ?? null;
+            // A /clear's session reports before the worker follows its new id.
+            return (store
+                .listWorkers(ACTIVE_STATUSES)
+                .find((w) => w.sessionId === sessionId || newSessionIds.get(w.id)?.sessionId === sessionId) ?? null);
         },
         retire: async (workerId, { cause, force = false } = {}) => {
             const worker = activeWorker(workerId);
@@ -1000,8 +1113,6 @@ export function sessionManager(deps) {
             }
             busy.add(worker.id);
             try {
-                // Fresh: the last sweep's listing can be ten seconds old.
-                const session = (await claude.agents().catch(() => sessions)).find((s) => s.sessionId === worker.sessionId || s.id === worker.handle);
                 const refuse = (reason, transient, work) => {
                     event(worker, 'worker.retire-refused', {
                         reason,
@@ -1011,6 +1122,27 @@ export function sessionManager(deps) {
                     });
                     return { outcome: 'refused', reason, transient, ...(work ? { work } : {}), worker };
                 };
+                // The operator has its session open in a tab (ATK-519). The scheduler tries again every tick,
+                // so it is logged once per attach. Only a running worker is attached: one whose session
+                // stopped unexpectedly keeps the attach it had.
+                const attachedAt = worker.status === 'running' ? worker.attachedAt : null;
+                if (attachedAt !== null && !force) {
+                    const reason = 'attached: retire once its tab is released, or retire --force';
+                    if (attachRefusals.get(worker.id) !== attachedAt) {
+                        attachRefusals.set(worker.id, attachedAt);
+                        event(worker, 'worker.retire-refused', {
+                            attached: true,
+                            reason,
+                            transient: true,
+                            ...(cause === undefined ? {} : { cause }),
+                        });
+                    }
+                    return { attached: true, outcome: 'refused', reason, transient: true, worker };
+                }
+                attachRefusals.delete(worker.id);
+                // Fresh: the last sweep's listing can be ten seconds old. Null when it couldn't be read.
+                const listing = await claude.agents().catch(() => null);
+                const session = (listing ?? sessions).find((s) => s.sessionId === worker.sessionId || s.id === worker.handle);
                 // Removing the worktree while `claude --bg` still sets the session up there strands it.
                 if (session && isStarting(session))
                     return refuse('its session is still starting: try again shortly', true);
@@ -1027,7 +1159,6 @@ export function sessionManager(deps) {
                 const work = fate.remove && worker.worktree ? await worktrees.unfinishedWork(worker.worktree) : null;
                 if (work && !force)
                     return refuse('unfinished work: commit and push it, or retire --force to throw it away', false, work);
-                const root = store.listProjects().find((p) => p.name === worker.project)?.root;
                 const steps = [];
                 const handle = worker.handle;
                 if (handle !== null && session?.pid !== undefined) {
@@ -1049,14 +1180,17 @@ export function sessionManager(deps) {
                 if (worker.worktree !== null) {
                     const worktree = worker.worktree;
                     if (fate.remove) {
-                        await step(steps, 'remove worktree', async () => {
-                            if (!root)
-                                throw new Error(`project ${worker.project} is not registered`);
-                            await worktrees.remove(root, worktree, { deleteBranch: true });
-                        });
+                        // The repository is the worktree's own: one launched before clones is in a person's
+                        // checkout, and retires from there.
+                        await step(steps, 'remove worktree', () => worktrees.remove(worktree, { deleteBranch: true, repo: cloneOf(worker) }));
                     }
                     else if (existsSync(worktree)) {
-                        kept = { branch: await worktrees.branchOf(worktree), reason: fate.reason, worktree };
+                        kept = {
+                            branch: await worktrees.branchOf(worktree),
+                            reason: fate.reason,
+                            repo: await worktrees.repoOf(worktree),
+                            worktree,
+                        };
                     }
                     // No session serves on them any more, kept worktree or not.
                     freePorts(store, worktree, 'worker retired');
@@ -1070,11 +1204,21 @@ export function sessionManager(deps) {
                 if (handle !== null)
                     await step(steps, 'rm', () => claude.rm(handle));
                 const ok = steps.every((s) => s.ok);
-                const current = ok ? update(worker, { status: 'exited', stoppedAt: now().toISOString() }) : worker;
-                if (ok)
+                // Its session no longer runs once the stop succeeded, or when a fresh listing showed it wasn't
+                // live, even when a later step failed. A retire that didn't finish then parks the worker with no
+                // wait, so no sweep reads it as stopped unexpectedly or wakes it, and the retire is tried again
+                // (ATK-519). With no fresh listing to say, the worker stays as it was.
+                const down = steps.some((s) => s.step === 'stop' && s.ok) || (listing !== null && !(session && isLive(session)));
+                const stoppedAt = now().toISOString();
+                const parked = !ok && down;
+                const current = ok
+                    ? update(worker, { status: 'exited', stoppedAt })
+                    : parked
+                        ? update(worker, { attachedAt: null, status: 'parked', stoppedAt })
+                        : worker;
+                if (ok || parked)
                     store.closeWaits(worker.id, 'worker retired');
-                // Its session is stopped by now, even when a later step failed. A probe shares its item with
-                // the live worker, whose locks those are.
+                // A probe shares its item with the live worker, whose locks those are.
                 if (!worker.probe)
                     releaseLocks(store, worker.item, 'worker retired');
                 stalls.delete(worker.id);
@@ -1082,6 +1226,7 @@ export function sessionManager(deps) {
                     forced: force && work !== null,
                     steps,
                     ...(kept === null ? {} : { kept }),
+                    ...(parked ? { parked } : {}),
                     ...(cause === undefined ? {} : { cause }),
                 });
                 return { outcome: ok ? 'retired' : 'partial', steps, worker: current };
@@ -1102,7 +1247,7 @@ export function sessionManager(deps) {
             try {
                 const started = now().getTime();
                 const { copy } = await claude.resume({
-                    cwd: worker.worktree ?? rootOf(worker),
+                    cwd: worker.worktree ?? cloneOf(worker),
                     sessionId: worker.sessionId,
                     text,
                 });