@gajae-code/coding-agent 0.12.21 → 0.13.0

package/src/gjc-runtime/gc-runtime.ts

@@ -528,15 +528,16 @@ export function gcHelpText(): string {
 		"  --dry-run         Force report-only mode (overrides --prune/--force)",
 		"  -j, --json        Emit machine-readable JSON",
 		"  --repair-session-index  Explicitly quarantine a corrupt session-index suffix and retain its valid prefix",
-		"  --disk            Also report on-disk retention (sessions, blobs, natives, backups)",
+		"  --disk            Also report on-disk retention (sessions, blobs, artifacts, natives, backups)",
 		"",
 		"Liveness-only: a record is removed only when its owning process is dead",
 		"(ESRCH). Live / permission-denied / unknown processes are always kept.",
 		"",
 		"Disk retention (--disk) is a separate, opt-in axis. Without --prune it only",
 		"reports reclaimable bytes per surface. Live, referenced, permission-denied or",
-		"otherwise ambiguous state is always KEPT and the report says why. Managed",
-		"worktrees under ~/.gjc/wt are never touched.",
+		"otherwise ambiguous state is always KEPT and the report says why. Session tool",
+		"artifacts (`*.<tool>.log`, `.artifact-id-*`, evicted output) are reported per",
+		"family. Managed worktrees under ~/.gjc/wt are never touched.",
 		"",
 	].join("\n");
 }
@@ -580,15 +581,21 @@ export async function defaultGcAdapters(): Promise<GcStoreAdapter[]> {
 // needs evidence-based merge detection, which this axis does not have.
 
 /** On-disk surfaces the retention axis can reclaim. */
-export type GcDiskSurface = "sessions" | "blobs" | "natives" | "backups";
-
-export const GC_DISK_SURFACES: readonly GcDiskSurface[] = ["sessions", "blobs", "natives", "backups"] as const;
+export type GcDiskSurface = "sessions" | "blobs" | "artifacts" | "natives" | "backups";
+
+export const GC_DISK_SURFACES: readonly GcDiskSurface[] = [
+	"sessions",
+	"blobs",
+	"artifacts",
+	"natives",
+	"backups",
+] as const;
 
 export type GcDiskAction = "keep" | "would_reclaim" | "reclaimed" | "reclaim_failed";
 
 export interface GcDiskRecord {
 	surface: GcDiskSurface;
-	/** Session id, blob hash, natives version, or backup entry name. */
+	/** Session id, blob hash, `<session id>/<filename>` artifact, natives version, or backup entry name. */
 	id: string;
 	path: string;
 	bytes: number;
@@ -603,8 +610,21 @@ export interface GcDiskRecord {
 }
 
 /**
- * Why a surface refused to reclaim anything, and how much it withheld to stay
- * fail-closed. Present only when the surface declined.
+ * Per-family rollup of a surface whose growth is many small files.
+ *
+ * The artifacts surface writes one record per file, which answers "what may go"
+ * but not "what filled the scope". A family is derived from the filename shape
+ * (`*.bash.log`, `.artifact-id-*`, …) rather than a fixed list, so a tool that
+ * starts writing a new kind of log is counted the day it ships.
+ */
+export interface GcDiskFamilyUsage {
+	family: string;
+	count: number;
+	bytes: number;
+}
+
+/**
+ * Why a surface withheld reclaim candidates because its evidence was incomplete.
  */
 export interface GcDiskDeclined {
 	reason: string;
@@ -624,8 +644,10 @@ export interface GcDiskSurfaceReport {
 	kept: number;
 	kept_bytes: number;
 	failed: number;
-	/** Set when the surface declined to reclaim anything because its evidence was incomplete. */
+	/** Set when the surface withheld reclaim candidates because its evidence was incomplete. */
 	declined?: GcDiskDeclined;
+	/** Per-family counts and bytes. Only surfaces whose records are individual files set this. */
+	families?: GcDiskFamilyUsage[];
 	records: GcDiskRecord[];
 }
 
@@ -673,6 +695,17 @@ const GC_DISK_BLOB_GRACE_MS = GC_DISK_DAY_MS;
  * sweep on, so the sweep withholds instead.
  */
 const GC_DISK_MARK_REMARK_ROUNDS = 2;
+/**
+ * How long the store must be observed completely quiet before the sweep may
+ * remove anything. The mark rounds and their drift checks can each complete
+ * inside an inter-append gap of a live session, so a single clean observation
+ * is not evidence of quiescence: the sweep brackets its decision with a probe
+ * that spans this window, which is far larger than any realistic gap between
+ * two transcript appends. A store that still moves inside the window withholds
+ * the sweep with `sessions_changed_during_mark` instead of reclaiming on
+ * evidence it could not prove stable.
+ */
+const GC_DISK_MARK_QUIESCENCE_MS = 50;
 
 /** Bound every recursive size walk so a pathological tree cannot stall `gjc gc`. */
 const GC_DISK_MAX_WALK_ENTRIES = 200_000;
@@ -1165,8 +1198,12 @@ interface GcDiskMarkedTranscript {
 
 /**
  * Read one transcript's blob references and bind the result to the bytes that
- * produced it. An append landing after this lstat can introduce a reference the
- * pass never saw, which is precisely what the drift check below looks for.
+ * produced it. The read is fenced by a stat before it and a stat after it: an
+ * append landing between the two (or after the read but before the fence) can
+ * introduce a reference the pass never saw, so the mark is only recorded when
+ * both stats agree on the bytes the read had to see. Anything that moved while
+ * the read was in flight degrades `evidence` instead of silently shrinking the
+ * reference set.
  */
 async function markGcDiskTranscript(
 	transcriptPath: string,
@@ -1175,18 +1212,35 @@ async function markGcDiskTranscript(
 	evidence: GcDiskEvidence,
 	errors: GcDiskError[],
 ): Promise<void> {
+	let before: Stats;
+	try {
+		before = await fsp.lstat(transcriptPath);
+	} catch (error) {
+		markGcDiskEvidenceIncomplete(evidence, "transcript_unstattable_before_mark");
+		errors.push({ surface: "blobs", scope: transcriptPath, message: gcDiskErrorText(error) });
+		return;
+	}
 	if (!(await markGcDiskBlobReferences(transcriptPath, referenced))) {
 		markGcDiskEvidenceIncomplete(evidence, "transcript_unreadable_during_mark");
 		errors.push({ surface: "blobs", scope: transcriptPath, message: "transcript_unreadable_during_mark" });
 		return;
 	}
+	let after: Stats;
 	try {
-		const stat = await fsp.lstat(transcriptPath);
-		marked.set(transcriptPath, { size: stat.size, mtimeMs: stat.mtimeMs });
+		after = await fsp.lstat(transcriptPath);
 	} catch (error) {
 		markGcDiskEvidenceIncomplete(evidence, "transcript_unstattable_after_mark");
 		errors.push({ surface: "blobs", scope: transcriptPath, message: gcDiskErrorText(error) });
+		return;
+	}
+	if (before.size !== after.size || before.mtimeMs !== after.mtimeMs) {
+		// The transcript changed while its references were being read: the
+		// reference set is not bound to a stable snapshot, so it cannot vouch
+		// for any blob. Same posture as the drift rounds exhausting below.
+		markGcDiskEvidenceIncomplete(evidence, "sessions_changed_during_mark");
+		return;
 	}
+	marked.set(transcriptPath, { size: after.size, mtimeMs: after.mtimeMs });
 }
 
 /**
@@ -1223,6 +1277,53 @@ async function findGcDiskMarkDrift(input: {
 	});
 	return drifted;
 }
+/**
+ * The sweep's evidence fence: re-walk the store and confirm every transcript
+ * still matches the snapshot its references were read from. Returns false —
+ * after degrading `evidence` to `sessions_changed_during_mark` — when anything
+ * moved since the mark, so the sweep withholds rather than acting on stale
+ * evidence. Run once after the mark loop converges and again immediately
+ * before each removal, because the sweep itself is a window a live session can
+ * write into.
+ */
+async function verifyGcDiskMarkFence(input: {
+	sessionsRoot: string;
+	accounted: ReadonlySet<string>;
+	marked: Map<string, GcDiskMarkedTranscript>;
+	evidence: GcDiskEvidence;
+	errors: GcDiskError[];
+}): Promise<boolean> {
+	const drifted = await findGcDiskMarkDrift({
+		sessionsRoot: input.sessionsRoot,
+		accounted: input.accounted,
+		marked: input.marked,
+		evidence: input.evidence,
+		errors: input.errors,
+	});
+	if (drifted.length === 0) return true;
+	markGcDiskEvidenceIncomplete(input.evidence, "sessions_changed_during_mark");
+	return false;
+}
+/**
+ * Confirm the store is observably quiet before the sweep may remove anything.
+ * A single fence pass can still complete inside an inter-append gap of a live
+ * session, so this probes the store across {@link GC_DISK_MARK_QUIESCENCE_MS}
+ * and only reports quiet when every transcript stayed unchanged for the whole
+ * window. A store that keeps moving under the probe never satisfies it, which
+ * is exactly the `sessions_changed_during_mark` condition the sweep must
+ * withhold on instead of reclaiming on evidence it could not prove stable.
+ */
+async function confirmGcDiskStoreQuiet(input: {
+	sessionsRoot: string;
+	accounted: ReadonlySet<string>;
+	marked: Map<string, GcDiskMarkedTranscript>;
+	evidence: GcDiskEvidence;
+	errors: GcDiskError[];
+}): Promise<boolean> {
+	if (!(await verifyGcDiskMarkFence(input))) return false;
+	await Bun.sleep(GC_DISK_MARK_QUIESCENCE_MS);
+	return await verifyGcDiskMarkFence(input);
+}
 
 /**
  * Mark and sweep the content-addressed blob store.
@@ -1240,6 +1341,14 @@ async function findGcDiskMarkDrift(input: {
  * grew, and only sweeps once the store stops moving under it. Drift that
  * outlasts {@link GC_DISK_MARK_REMARK_ROUNDS} is incomplete evidence, not a
  * licence to delete.
+ *
+ * The drift rounds are themselves a window: they can converge on a transcript
+ * that is mid-append, and the sweep then takes time to run. So the mark is
+ * additionally fenced — each transcript's references are bound to a stable
+ * stat snapshot taken around its read, the store must be observed completely
+ * quiet across {@link GC_DISK_MARK_QUIESCENCE_MS} before the sweep acts, and
+ * the fence is re-verified immediately before every removal. Any transcript
+ * that moved at any of those points withholds the whole sweep.
  */
 async function runGcDiskBlobs(input: {
 	surface: GcDiskSurfaceReport;
@@ -1280,6 +1389,19 @@ async function runGcDiskBlobs(input: {
 		}
 	}
 
+	// Gate the sweep on observable quiescence. The rounds can converge inside
+	// an inter-append gap of a live session, and a single clean re-walk would
+	// miss that; a store that keeps moving under the probe never satisfies it.
+	// Only pay for the probe when a blob could actually be reclaimed.
+	if (evidence.complete) {
+		const couldReclaim = blobs.some(
+			blob => !referenced.has(blob.hash) && now - blob.mtimeMs >= GC_DISK_BLOB_GRACE_MS,
+		);
+		if (couldReclaim && !(await confirmGcDiskStoreQuiet({ sessionsRoot, accounted, marked, evidence, errors }))) {
+			markGcDiskEvidenceIncomplete(evidence, "sessions_changed_during_mark");
+		}
+	}
+
 	let withheld = 0;
 	let withheldBytes = 0;
 	for (const blob of blobs) {
@@ -1300,15 +1422,36 @@ async function runGcDiskBlobs(input: {
 			withheld++;
 			withheldBytes += blob.bytes;
 		} else {
-			record.action = "would_reclaim";
-			record.reason = "unreferenced_by_any_surviving_session";
+			// Fence again immediately before acting: the sweep itself is a
+			// window, and a transcript that moved since the last check
+			// invalidates the whole mark, not just this blob.
+			if (!(await verifyGcDiskMarkFence({ sessionsRoot, accounted, marked, evidence, errors }))) {
+				record.reason = `withheld_evidence_incomplete: ${evidence.notes.join(", ")}`;
+				record.withheld = true;
+				withheld++;
+				withheldBytes += blob.bytes;
+			} else {
+				record.action = "would_reclaim";
+				record.reason = "unreferenced_by_any_surviving_session";
+			}
 		}
 		surface.records.push(record);
 
 		if (!prune || record.action !== "would_reclaim") continue;
-		const removal = await removeCanonicalBlob(blob);
+		const removal = await removeCanonicalBlob(blob, {
+			// The blob identity check has its own asynchronous read window. Bind the
+			// transcript fence after that check and before unlink, so a reference
+			// appended while the blob is being revalidated withholds the sweep.
+			beforeUnlink: async () => await verifyGcDiskMarkFence({ sessionsRoot, accounted, marked, evidence, errors }),
+		});
 		if (removal.removed) {
 			record.action = "reclaimed";
+		} else if (!evidence.complete) {
+			record.action = "keep";
+			record.reason = `withheld_evidence_incomplete: ${evidence.notes.join(", ")}`;
+			record.withheld = true;
+			withheld++;
+			withheldBytes += blob.bytes;
 		} else if (removal.failed) {
 			record.action = "reclaim_failed";
 			record.reason = removal.reason;
@@ -1328,6 +1471,199 @@ async function runGcDiskBlobs(input: {
 	}
 }
 
+/**
+ * Which family of GJC-written file a name belongs to, derived from the name's
+ * shape rather than from a list of known tools.
+ *
+ * A published artifact is `<id>.<toolType>.log` and an ID claim is
+ * `.artifact-id-<n>`, so a tool that starts writing `*.newthing.log` tomorrow is
+ * counted the day it ships. Everything else falls back to its extension, so
+ * nothing lands in the scope uncounted.
+ */
+function gcDiskArtifactFamily(name: string): string {
+	const toolLog = /^\d+\.([A-Za-z0-9_-]+)\.log$/.exec(name);
+	if (toolLog) return `*.${toolLog[1]}.log`;
+	if (/^\.artifact-id-\d+$/.test(name)) return ".artifact-id-*";
+	const extension = path.extname(name);
+	return extension ? `*${extension}` : "(no extension)";
+}
+
+function countGcDiskArtifactFamily(families: Map<string, GcDiskFamilyUsage>, name: string, bytes: number): void {
+	const family = gcDiskArtifactFamily(name);
+	const usage = families.get(family);
+	if (!usage) {
+		families.set(family, { family, count: 1, bytes });
+		return;
+	}
+	usage.count++;
+	usage.bytes += bytes;
+}
+
+/**
+ * The per-session artifact directories GJC writes its own tool output into:
+ * `<id>.<tool>.log`, `.artifact-id-<n>` ID claims, evicted-output generations.
+ *
+ * The sessions surface already counts these bytes, but only as one number per
+ * session and only reclaimable by retiring the whole session — so a scope filled
+ * by a retained session's own tool logs was both unattributable and
+ * unreclaimable. They are reported per family always, and reclaimed only for a
+ * transcript that (a) no live surface references, (b) is not the newest
+ * resumable transcript left in its project directory, and (c) holds a file that
+ * has been still for the write-grace window.
+ *
+ * The walk never leaves `sessionsRoot`: directories come from the same
+ * transcript enumeration the sessions surface uses, and inside one only regular
+ * non-symlink files are candidates. A symlink, a subdirectory, or an unstattable
+ * entry is reported as unverified and left alone — never followed, never removed.
+ */
+async function runGcDiskArtifacts(input: {
+	surface: GcDiskSurfaceReport;
+	survivors: GcDiskTranscript[];
+	references: GcSessionReferences;
+	agentDir: string;
+	now: number;
+	prune: boolean;
+	errors: GcDiskError[];
+}): Promise<void> {
+	const { surface, survivors, references, agentDir, now, prune, errors } = input;
+	const sessionIndex = new SessionIndex(agentDir);
+	try {
+		await sessionIndex.withLocked(async () => {
+			// Recomputed over survivors: whichever transcript the sessions surface left
+			// newest in a project directory is the `--continue` target, and a resumed
+			// session still reads its own `artifact://` handles.
+			const newestPerDirectory = new Map<string, GcDiskTranscript>();
+			for (const transcript of survivors) {
+				const current = newestPerDirectory.get(transcript.directory);
+				if (!current || transcript.mtimeMs > current.mtimeMs)
+					newestPerDirectory.set(transcript.directory, transcript);
+			}
+
+			const families = new Map<string, GcDiskFamilyUsage>();
+			let withheld = 0;
+			let withheldBytes = 0;
+
+			for (const transcript of survivors) {
+				const directory = transcript.path.slice(0, -".jsonl".length);
+				let entries: Dirent[];
+				try {
+					entries = await fsp.readdir(directory, { withFileTypes: true });
+				} catch (error) {
+					// No artifact directory is complete evidence: this session wrote none.
+					if (!isEnoent(error)) {
+						errors.push({ surface: "artifacts", scope: directory, message: gcDiskErrorText(error) });
+					}
+					continue;
+				}
+
+				const retained = !references.complete
+					? `reference_scan_incomplete: ${references.notes.join(", ")}`
+					: references.ids.has(transcript.sessionId)
+						? "referenced_by_live_surface"
+						: newestPerDirectory.get(transcript.directory) === transcript
+							? "most_recent_resumable_session"
+							: undefined;
+
+				for (const entry of entries) {
+					if (surface.records.length >= GC_DISK_MAX_WALK_ENTRIES) {
+						errors.push({ surface: "artifacts", scope: directory, message: "artifact_walk_capped" });
+						break;
+					}
+					const target = path.join(directory, entry.name);
+					const record: GcDiskRecord = {
+						surface: "artifacts",
+						id: `${transcript.sessionId}/${entry.name}`,
+						path: target,
+						bytes: 0,
+						age_days: 0,
+						action: "keep",
+						reason: "",
+					};
+
+					// A symlink is never followed and never removed: following one is exactly
+					// how a scope cleanup reaches bytes that are not GJC's to reclaim.
+					// Anything that is not a regular file is unverified state, not an artifact.
+					if (entry.isSymbolicLink() || !entry.isFile()) {
+						record.reason = `unverified_entry: ${entry.isSymbolicLink() ? "symlink" : "not_a_regular_file"}`;
+						record.withheld = true;
+						surface.records.push(record);
+						countGcDiskArtifactFamily(families, entry.name, 0);
+						withheld++;
+						continue;
+					}
+
+					let stat: Stats;
+					try {
+						stat = await fsp.lstat(target);
+					} catch (error) {
+						// Vanished mid-walk is the opposite of withheld: it is already gone.
+						if (isEnoent(error)) continue;
+						const message = gcDiskErrorText(error);
+						errors.push({ surface: "artifacts", scope: target, message });
+						record.reason = `entry_unverifiable: ${message}`;
+						record.error = message;
+						record.withheld = true;
+						surface.records.push(record);
+						countGcDiskArtifactFamily(families, entry.name, 0);
+						withheld++;
+						continue;
+					}
+
+					record.bytes = stat.size;
+					record.age_days = gcDiskAgeDays(now, stat.mtimeMs);
+					surface.records.push(record);
+					countGcDiskArtifactFamily(families, entry.name, stat.size);
+
+					if (retained !== undefined) {
+						record.reason = retained;
+						if (!references.complete) {
+							record.withheld = true;
+							withheld++;
+							withheldBytes += record.bytes;
+						}
+						continue;
+					}
+					if (now - stat.mtimeMs < GC_DISK_BLOB_GRACE_MS) {
+						record.reason = "within_write_grace_window";
+						continue;
+					}
+					record.action = "would_reclaim";
+					record.reason = "unreferenced_by_any_live_session";
+
+					if (!prune) continue;
+					const removal = await removeGcDiskEntry(target, stat);
+					if (removal.removed) record.action = "reclaimed";
+					else if (removal.failed) {
+						record.action = "reclaim_failed";
+						record.reason = removal.reason;
+						record.error = removal.reason;
+					} else {
+						record.action = "keep";
+						record.reason = removal.reason;
+						if (removal.withheld) record.withheld = true;
+					}
+				}
+			}
+
+			surface.families = [...families.values()].sort(
+				(a, b) => b.bytes - a.bytes || a.family.localeCompare(b.family),
+			);
+			if (!references.complete) {
+				surface.declined = {
+					reason: `reference_scan_incomplete: ${references.notes.join(", ")}`,
+					withheld,
+					withheld_bytes: withheldBytes,
+				};
+			}
+		});
+	} catch (error) {
+		errors.push({
+			surface: "artifacts",
+			scope: surface.root,
+			message: `artifact_liveness_authority_unavailable: ${gcDiskErrorText(error)}`,
+		});
+	}
+}
 /** Numeric `major.minor.patch` prefix, or undefined when the name is not a version. */
 function parseGcDiskVersion(value: string): [number, number, number] | undefined {
 	const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(value);
@@ -1649,6 +1985,7 @@ export async function collectGcDiskReport(input: {
 	const surfaces: Record<GcDiskSurface, GcDiskSurfaceReport> = {
 		sessions: emptyGcDiskSurface("sessions", getSessionsDir(agentDir)),
 		blobs: emptyGcDiskSurface("blobs", getBlobsDir(agentDir)),
+		artifacts: emptyGcDiskSurface("artifacts", getSessionsDir(agentDir)),
 		natives: emptyGcDiskSurface("natives", path.join(gjcRoot, "natives")),
 		backups: emptyGcDiskSurface("backups", path.join(gjcRoot, "backups")),
 	};
@@ -1673,6 +2010,15 @@ export async function collectGcDiskReport(input: {
 		prune,
 		errors,
 	});
+	await runGcDiskArtifacts({
+		surface: surfaces.artifacts,
+		survivors,
+		references,
+		agentDir,
+		now,
+		prune,
+		errors,
+	});
 	await runGcDiskNatives({
 		surface: surfaces.natives,
 		policy,
@@ -1687,10 +2033,15 @@ export async function collectGcDiskReport(input: {
 	for (const name of GC_DISK_SURFACES) {
 		const surface = surfaces[name];
 		summarizeGcDiskSurface(surface);
-		totals.scanned_bytes += surface.scanned_bytes;
+		// The artifacts surface re-attributes bytes the sessions surface already
+		// counted inside surviving sessions, so only what it can act on is added:
+		// summing its scan too would report more bytes than exist on disk.
+		if (name !== "artifacts") {
+			totals.scanned_bytes += surface.scanned_bytes;
+			totals.kept_bytes += surface.kept_bytes;
+		}
 		totals.reclaimable_bytes += surface.reclaimable_bytes;
 		totals.reclaimed_bytes += surface.reclaimed_bytes;
-		totals.kept_bytes += surface.kept_bytes;
 		totals.failed += surface.failed;
 	}
 
@@ -1700,6 +2051,7 @@ export async function collectGcDiskReport(input: {
 const GC_DISK_SURFACE_HEADINGS: Record<GcDiskSurface, string> = {
 	sessions: "Session transcripts",
 	blobs: "Content-addressed blobs",
+	artifacts: "Session tool artifacts",
 	natives: "Cached native versions",
 	backups: "Update/restore backups",
 };
@@ -1755,11 +2107,18 @@ export function buildGcDiskReportText(disk: GcDiskReport): string {
 				`kept=${surface.kept} (${formatGcDiskBytes(surface.kept_bytes)})`,
 		);
 		if (surface.declined) {
+			const reclaimState =
+				surface.reclaimed === 0 ? "reclaimed nothing" : `reclaimed ${surface.reclaimed} before withholding`;
 			lines.push(
-				`  declined: reclaimed nothing — ${surface.declined.reason} ` +
+				`  declined: ${reclaimState} — ${surface.declined.reason} ` +
 					`(withheld=${surface.declined.withheld} (${formatGcDiskBytes(surface.declined.withheld_bytes)}))`,
 			);
 		}
+		// The per-file records below say what may go; the family rollup is what
+		// answers "what filled this scope?", so it is never truncated.
+		for (const family of surface.families ?? []) {
+			lines.push(`  family ${family.family} count=${family.count} (${formatGcDiskBytes(family.bytes)})`);
+		}
 		// Reclaim decisions first: they are what an operator has to audit.
 		const ranked = [...surface.records].sort(
 			(a, b) => Number(a.action === "keep") - Number(b.action === "keep") || b.bytes - a.bytes,

package/src/gjc-runtime/launch-worktree.ts

@@ -274,7 +274,7 @@ function isWorktreeDirty(worktreePath: string): boolean {
 function resolveOptionalWorktreeName(args: string[], index: number): { name: string | null; nextIndex: number } {
 	const next = args[index + 1];
 	if (!next) return { name: null, nextIndex: index };
-	if (next === "--") return { name: null, nextIndex: index + 1 };
+	if (next === "--") return { name: null, nextIndex: index };
 	if (next.startsWith("-")) return { name: null, nextIndex: index };
 	return { name: next.trim() || null, nextIndex: index + 1 };
 }
@@ -285,6 +285,10 @@ export function parseLaunchWorktreeMode(args: string[]): ParsedLaunchWorktreeMod
 
 	for (let index = 0; index < args.length; index += 1) {
 		const arg = args[index] ?? "";
+		if (arg === "--") {
+			remainingArgs.push(...args.slice(index));
+			break;
+		}
 		if (arg === "--worktree" || arg === "-w") {
 			const parsed = resolveOptionalWorktreeName(args, index);
 			mode = parsed.name

package/src/gjc-runtime/team-runtime.ts

@@ -2892,13 +2892,16 @@ type TeamTmuxMutation =
 	| { type: "profile-option"; target: string; name: string; value: string }
 	| { type: "profile-window-option"; target: string; name: string; value: string };
 
+const TMUX_ENCODED_LAYOUT_PATTERN = /^[0-9a-f]{4},/i;
+
 function readTeamTmuxValue(
 	config: GjcTeamConfig,
 	command: "show-options" | "show-window-options",
 	target: string,
 	name: string,
 ): string | undefined {
-	const result = Bun.spawnSync(teamTmuxArgs(config, command, ["-qv", "-t", target, name]), {
+	const flags = command === "show-options" ? "-qv" : "-v";
+	const result = Bun.spawnSync(teamTmuxArgs(config, command, [flags, "-t", target, name]), {
 		stdout: "pipe",
 		stderr: "pipe",
 	});
@@ -2944,6 +2947,55 @@ function assertTeamTmuxMutationPreproof(config: GjcTeamConfig, operation: TeamTm
 	// alone is never treated as delivery proof.
 }
 
+function hasMainVerticalPaneTopology(config: GjcTeamConfig, target: string): boolean {
+	const result = Bun.spawnSync(
+		teamTmuxArgs(config, "list-panes", ["-t", target, "-F", "#{pane_left} #{pane_top} #{pane_width} #{pane_height}"]),
+		{ stdout: "pipe", stderr: "pipe" },
+	);
+	if (result.exitCode !== 0) return false;
+	const lines = result.stdout.toString().trim().split("\n");
+	const tokens = lines.map(line => line.trim().split(/\s+/));
+	if (
+		tokens.length < 2 ||
+		tokens.some(values => values.length !== 4 || values.some(value => !/^(?:0|[1-9]\d*)$/.test(value)))
+	)
+		return false;
+	const geometry = tokens.map(values => values.map(value => Number.parseInt(value, 10))) as [
+		number,
+		number,
+		number,
+		number,
+	][];
+	if (geometry.some(values => values.some(value => !Number.isSafeInteger(value) || value < 0))) return false;
+	if (geometry.some(([, , width, height]) => width === 0 || height === 0)) return false;
+	const right = Math.max(...geometry.map(([left, , width]) => left + width));
+	const bottom = Math.max(...geometry.map(([, top, , height]) => top + height));
+	const main = geometry.filter(
+		([left, top, width, height]) => left === 0 && top === 0 && height === bottom && width < right,
+	);
+	if (main.length !== 1) return false;
+	const mainRight = main[0]![0] + main[0]![2];
+	const stack = geometry.filter(pane => pane !== main[0]);
+	const stackLeft = stack[0]![0];
+	if (
+		stack.some(([left, , width]) => left !== stackLeft || left + width !== right) ||
+		stackLeft - mainRight < 0 ||
+		stackLeft - mainRight > 1
+	)
+		return false;
+	const ordered = [...stack].sort((a, b) => a[1] - b[1]);
+	return (
+		ordered[0]![1] === 0 &&
+		ordered.every((pane, index) => {
+			if (index === 0) return true;
+			const previous = ordered[index - 1]!;
+			const rowGap = pane[1] - (previous[1] + previous[3]);
+			return rowGap >= 0 && rowGap <= 1;
+		}) &&
+		ordered.at(-1)![1] + ordered.at(-1)![3] === bottom
+	);
+}
+
 function executeTeamTmuxMutation(
 	config: GjcTeamConfig,
 	operation: TeamTmuxMutation,
@@ -2995,7 +3047,12 @@ function executeTeamTmuxMutation(
 			teamTmuxArgs(config, "display-message", ["-p", "-t", operation.target, "#{window_layout}"]),
 			{ stdout: "pipe", stderr: "pipe" },
 		);
-		if (layout.exitCode !== 0 || layout.stdout.toString().trim() !== operation.layout)
+		const observedLayout = layout.stdout.toString().trim();
+		if (
+			layout.exitCode !== 0 ||
+			!TMUX_ENCODED_LAYOUT_PATTERN.test(observedLayout) ||
+			!hasMainVerticalPaneTopology(config, operation.target)
+		)
 			throw new Error("tmux_layout_postproof_failed");
 	} else if (operation.type === "set-window-option" || operation.type === "profile-window-option") {
 		if (readTeamTmuxValue(config, "show-window-options", operation.target, operation.name) !== operation.value)

package/src/gjc-runtime/tmux-owner-isolation.ts

@@ -1496,8 +1496,27 @@ function normalizeTerminalObservation(request: ObserveTerminalRequest): ObserveT
 	};
 }
 
+/** One process must not race its own duplicate terminal observers through SQLite. */
+const liveOwnerTerminalObservations = new Map<string, Promise<OwnerVerdict>>();
+
 /** Publish exactly one terminal verdict. Existing valid verdicts always win. */
 export async function observeOwnerTerminal(request: ObserveTerminalRequest): Promise<OwnerVerdict> {
+	if (!isObserveTerminalRequest(request)) throw new Error("terminal_observation_invalid");
+	const paths = lifecyclePaths(request.state_dir, request.session_id, request.owner_generation);
+	const existing = liveOwnerTerminalObservations.get(paths.root);
+	if (existing) return existing;
+	const observation = observeOwnerTerminalExclusive(request);
+	liveOwnerTerminalObservations.set(paths.root, observation);
+	try {
+		return await observation;
+	} finally {
+		if (liveOwnerTerminalObservations.get(paths.root) === observation)
+			liveOwnerTerminalObservations.delete(paths.root);
+	}
+}
+
+/** Publish exactly one terminal verdict. Existing valid verdicts always win. */
+async function observeOwnerTerminalExclusive(request: ObserveTerminalRequest): Promise<OwnerVerdict> {
 	if (!isObserveTerminalRequest(request)) throw new Error("terminal_observation_invalid");
 	const paths = lifecyclePaths(request.state_dir, request.session_id, request.owner_generation);
 	let observation = normalizeTerminalObservation(request);