@groundnuty/macf-core 0.2.57 → 0.2.59

package/dist/fleet-driver.d.ts

@@ -107,12 +107,18 @@ export interface FleetDriver {
      * `.claude/.macf/env.*` + `host-prelude.sh`, `CLAUDE.md`, `env.local.*` —
      * see `ROLL_TOUCHED_CONFIG_PATTERNS` in `fleet-upgrade.ts`, narrowed off a
      * `.claude/**` wildcard by DR-040 Decision 6 / macf#698). VM: `git status`
-     * in the agent's workspace, filtered to that path set. A DEAD/absent agent
-     * reads `false` (nothing to check; reconcile will launch it). Kept as a
-     * boolean convenience alongside `listDirtyConfig` below — `rollFleet`'s
-     * pre-flight gate itself calls `listDirtyConfig` (it needs the file list to
-     * OBJECT with, macf#725), so this predicate form is for OTHER callers that
-     * only need the yes/no answer.
+     * in the agent's workspace, filtered to that path set. Kept as a boolean
+     * convenience alongside `listDirtyConfig` below — `rollFleet`'s pre-flight
+     * gate itself calls `classifyDirtyConfig` (it needs the tiered file list
+     * to OBJECT with, macf#725/macf#1101), so this predicate form is for OTHER
+     * callers that only need the yes/no answer.
+     *
+     * `true` when the workspace itself couldn't be resolved OR inspected at
+     * all (macf#1101) — DISTINCT from `isBusy`'s "DEAD/absent agent is not
+     * busy": that predicate concerns SESSION liveness on an agent whose
+     * workspace resolved fine; this one concerns whether the workspace could
+     * be found/read in the first place. "Couldn't verify" must never read as
+     * "verified clean" — the false-pass hazard this issue codifies.
      */
     readonly isConfigDirty: (agent: string) => Promise<boolean>;
     /**
@@ -122,7 +128,9 @@ export interface FleetDriver {
      * uncommitted paths rather than a boolean. Empty array == clean
      * (equivalent to `isConfigDirty` reading `false`). VM: `git status
      * --porcelain` in the agent's workspace, filtered to that path set, one
-     * path per line.
+     * path per line. An unresolvable/unreadable workspace (macf#1101) returns
+     * a single diagnostic SENTINEL entry (never a real path), not an empty
+     * array — see `isConfigDirty`'s doc for why.
      *
      * **Superseded as `rollFleet`'s pre-flight call site by `classifyDirtyConfig`
      * below (DR-040 Decision 3 / macf#698 R1)** — the roll no longer treats
@@ -152,7 +160,12 @@ export interface FleetDriver {
      * Both arrays are empty when the agent has no dirty config surface at all
      * (mirrors `listDirtyConfig`'s empty-array-== -clean contract). VM: reuses
      * `listDirtyConfig` for the raw list, then classifies each path via
-     * `classifyDirtyFile`.
+     * `classifyDirtyFile`. An unresolvable agent (macf#1101 — no workspace
+     * matches this routing label under the driver's bound project) yields a
+     * NON-EMPTY `genuineDelta` (a diagnostic sentinel) — this is the gate
+     * `rollFleet` actually calls, so its fail-safe direction is load-bearing:
+     * an unresolvable agent must OBJECT, never silently read as "nothing
+     * dirty."
      */
     readonly classifyDirtyConfig: (agent: string) => Promise<{
         readonly alreadyCanonical: readonly string[];
@@ -190,6 +203,24 @@ export interface FleetDriver {
      * throws.
      */
     readonly canonicalBranch: (agent: string) => Promise<string>;
+    /**
+     * Diagnostic-only: a driver-specific description of WHERE `agent` was
+     * inspected — VM: the resolved absolute workspace directory; a future K8s
+     * driver: pod/namespace. `null` when `agent` could not be resolved at all
+     * (unknown agent, or — VM specifically — no workspace matches BOTH the
+     * agent's routing label AND this driver's own bound project; see
+     * `vm-driver.ts`'s `resolveTarget`). NEVER used for decision-branching
+     * (that stays on `currentBranch`/`classifyDirtyConfig`/etc. — the DR-037
+     * hard rule that nothing runtime-specific leaks above the driver line is
+     * about DECISIONS, not diagnostics) — its ONLY consumer is `rollFleet`'s
+     * pre-flight OBJECT messages (macf#1101), so an operator reading a
+     * branch/config-dirty objection can see EXACTLY which on-disk location
+     * produced it and catch a misattribution instead of trusting the agent
+     * name alone. Optional: a driver that has no meaningful "where" (or
+     * predates this field) simply omits it — callers treat the omission the
+     * same as `null`.
+     */
+    readonly resolveWorkspace?: (agent: string) => Promise<string | null>;
     /**
      * Read the agent's current pane content for stall-signature matching
      * (`macf fleet resume`, DR-037 / macf#686). VM: a single `tmux capture-pane`

package/dist/fleet-driver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-driver.d.ts","sourceRoot":"","sources":["../src/fleet-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,SAAS,eAAe,EAAE,CAAC;IAE9D;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAExE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QACvD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnE,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzG;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE1E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"fleet-driver.d.ts","sourceRoot":"","sources":["../src/fleet-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAC;CACxC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;CAC7C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC;IAE1C;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,SAAS,eAAe,EAAE,CAAC;IAE9D;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAE5D;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAExE;;;;;;;;;;;;;;;;;;;;;;;;;;OA0BG;IACH,QAAQ,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QACvD,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;QAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1F;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElE;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAE7D;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEtE;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEhE;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAEnE,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzG;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE,wEAAwE;IACxE,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAElD;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;IAE1E;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9E;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,IAAI,CAAC;CACxD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,SAAS;gBACjC,OAAO,EAAE,MAAM;CAI5B"}

package/dist/fleet-driver.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-driver.js","sourceRoot":"","sources":["../src/fleet-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAuSxC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"fleet-driver.js","sourceRoot":"","sources":["../src/fleet-driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAuUxC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,SAAS;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF"}

package/dist/fleet-upgrade.d.ts

@@ -23,6 +23,16 @@ export interface AgentUpgradePlan {
     readonly fleet: string;
     /** The agent's live self-reported `/health.version`, or `null` when offline/version-less. */
     readonly runningVersion: string | null;
+    /**
+     * The agent's live self-reported `/health.instance_id` (DR-030 phase-1 mesh
+     * self-report; DR-037 Decision 5 mints a NEW one on every relaunch), or
+     * `null` when offline or reporting a body that predates the field. Captured
+     * at PLAN time so `classifyHalt` can later tell "the SAME process is still
+     * answering /health after the restart" (an honest not-yet-serving unknown)
+     * apart from "a genuinely NEW process is serving the wrong version" (a
+     * confirmed bad release) — see `classifyHalt`'s doc.
+     */
+    readonly runningInstanceId: string | null;
     /** The workspace's on-disk version pin (legible even when the agent is dead). */
     readonly pinnedVersion: string | null;
     /** The version-only disposition (see `UpgradeDisposition`). */
@@ -56,6 +66,18 @@ export interface AgentUpgradePlan {
  *                             ran) but its stale-old-pin state endangers no
  *                             OTHER agent, so `rollFleet` skips it and moves
  *                             on to the next agent in the SAME fleet.
+ * - `not-yet-serving-skipped` — (NEW, follow-up to macf#899) verify-green
+ *                             confirmed the agent REACHABLE at its OLD
+ *                             version, but the responder is PROVEN to be the
+ *                             SAME pre-restart process instance (not a fresh
+ *                             one) — `reason: 'not-yet-serving'` (see
+ *                             `HaltReason`). The agent's own relaunch simply
+ *                             hasn't taken over serving yet (a common cause
+ *                             is an unanswered interactive launch prompt);
+ *                             this is an honest UNKNOWN, not a confirmed bad
+ *                             release, and — like `stale-pin-skipped` —
+ *                             endangers no OTHER agent, so `rollFleet` skips
+ *                             it and continues.
  * - `halted`                — verify-green did NOT confirm the target version,
  *                             and the cause is either a confirmed/unverifiable
  *                             bad release or a genuinely unconfirmed relaunch;
@@ -64,21 +86,25 @@ export interface AgentUpgradePlan {
  *
  * The three pre-flight skip outcomes (`busy-skipped` / `config-dirty-skipped`
  * / `branch-skipped`) are safe to continue past because the agent was NEVER
- * mutated. `stale-pin-skipped` (macf#899) IS safe to continue past DESPITE the
- * agent having been mutated, because the specific cause (a stale LAUNCH pin)
- * is a property of this one workspace's launch config, not of the release —
- * see `HaltReason`'s `stale-pin` doc for the full reasoning. `halted` is
- * always terminal because the agent WAS rolled and its post-restart state is
- * either confirmed-bad, unverifiable, or unconfirmed — none of those three are
- * safe to leave behind while moving on to the next agent (macf#722 Fix A,
- * extended by macf#899).
+ * mutated. `stale-pin-skipped` (macf#899) and `not-yet-serving-skipped` ARE
+ * safe to continue past DESPITE the agent having been mutated, because each
+ * specific cause (a stale LAUNCH pin; a not-yet-superseded pre-restart
+ * process) is a property of THIS one workspace, not of the release — see
+ * `HaltReason`'s `stale-pin` / `not-yet-serving` docs for the full reasoning.
+ * `halted` is always terminal because the agent WAS rolled and its
+ * post-restart state is either confirmed-bad, unverifiable, or unconfirmed —
+ * none of those three are safe to leave behind while moving on to the next
+ * agent (macf#722 Fix A, extended by macf#899).
  */
-export type RollOutcome = 'upgraded' | 'busy-skipped' | 'config-dirty-skipped' | 'branch-skipped' | 'stale-pin-skipped' | 'halted';
+export type RollOutcome = 'upgraded' | 'busy-skipped' | 'config-dirty-skipped' | 'branch-skipped' | 'stale-pin-skipped' | 'not-yet-serving-skipped' | 'halted';
 /**
  * WHY a roll's verify-green did not confirm the target version:
  * - `bad-release`           — verify-green confirmed the agent came back up
- *                             REACHABLE at its OLD (pre-upgrade) version, AND
- *                             (macf#899) its own launch pin either already
+ *                             REACHABLE at its OLD (pre-upgrade) version, the
+ *                             responder is NOT provably the lingering
+ *                             pre-restart process (see `not-yet-serving`
+ *                             below — ruled out FIRST, `classifyHalt`'s doc),
+ *                             AND (macf#899) its own launch pin either already
  *                             matches the target (a genuine crash-loop /
  *                             stuck-old-process release) or could not be
  *                             read at all (honest-unknown, treated
@@ -108,15 +134,44 @@ export type RollOutcome = 'upgraded' | 'busy-skipped' | 'config-dirty-skipped' |
  *                             because a stale launch pin on one workspace says
  *                             nothing about the release quality and endangers
  *                             no other agent.
+ * - `not-yet-serving`       — (NEW, follow-up to macf#899) verify-green
+ *                             confirmed the agent REACHABLE at its OLD
+ *                             version, AND the exact same `instance_id` is
+ *                             still answering `/health` as answered BEFORE
+ *                             this roll's own `restart()` call (DR-037
+ *                             Decision 5 mints a fresh `instance_id` per
+ *                             relaunch, so an unchanged one PROVES the
+ *                             pre-restart process was never superseded) — the
+ *                             agent's relaunch simply hasn't taken over
+ *                             serving yet. A common cause is an unanswered
+ *                             interactive launch prompt (Claude Code's trust
+ *                             dialog or the dev-channels confirmation), but
+ *                             this decision layer never touches tmux/
+ *                             capture-pane (DR-037), so it reports the STATE
+ *                             observed (same instance still live), not a
+ *                             confirmed CAUSE. Honest UNKNOWN, never
+ *                             `CONFIRMED` bad-release wording — same floor as
+ *                             `bad-release`'s pin-unreadable case. NOT
+ *                             terminal; `outcome: 'not-yet-serving-skipped'`
+ *                             — `rollFleet` skips this ONE agent and
+ *                             CONTINUES: a slow-to-take-over relaunch on one
+ *                             workspace endangers no other agent, and later
+ *                             fleets are never halted for it. Only reachable
+ *                             when BOTH the pre-restart and post-restart
+ *                             `/health` bodies carry an `instance_id` — an
+ *                             older/mixed-version fleet without that field
+ *                             falls straight through to the `bad-release` /
+ *                             `stale-pin` pin-check below, UNCHANGED.
  */
-export type HaltReason = 'bad-release' | 'relaunch-unconfirmed' | 'stale-pin';
+export type HaltReason = 'bad-release' | 'relaunch-unconfirmed' | 'stale-pin' | 'not-yet-serving';
 /** The per-agent EXECUTE result. `detail` carries a human-readable summary. */
 export interface AgentRollResult {
     readonly agent: string;
     readonly outcome: RollOutcome;
     /**
      * Set when `outcome === 'halted'` OR `outcome === 'stale-pin-skipped'`
-     * (macf#899 added the latter) — see `HaltReason`.
+     * (macf#899 added the latter) OR `outcome === 'not-yet-serving-skipped'`
+     * (NEW, follow-up to macf#899) — see `HaltReason`.
      */
     readonly reason?: HaltReason;
     readonly detail?: string;
@@ -267,6 +322,15 @@ export interface FleetRollResult {
      * skip counters above, but still safe to continue past — see `HaltReason`.
      */
     readonly stalePinSkipped: number;
+    /**
+     * Count of agents skipped because verify-green confirmed them REACHABLE
+     * at their OLD version but the responder was PROVEN to be the SAME
+     * pre-restart process instance (`reason: 'not-yet-serving'`, NEW —
+     * follow-up to macf#899) — POST-flight, like `stalePinSkipped`, but the
+     * agent's relaunch simply hasn't taken over serving yet rather than
+     * anything about its launch pin.
+     */
+    readonly notYetServingSkipped: number;
 }
 /** Progress events for CLI rendering (the RESULT objects are what tests assert on). */
 export type UpgradeEvent = {
@@ -289,13 +353,18 @@ export type UpgradeEvent = {
  * BEFORE the config-dirty tiering / auto-resolve / busy-gate even run for
  * this agent. `current` is the agent's actual branch (`null` on detached
  * HEAD / an unresolvable branch); `canonical` is the resolved expected
- * branch. Fired INSTEAD of any mutation — nothing was touched.
+ * branch. `workspace` (macf#1101) is the on-disk location the branch check
+ * actually inspected (`driver.resolveWorkspace(agent)`, `null` when the
+ * driver can't report one or the agent is unresolvable) — surfaced so a
+ * misattributed resolution is VISIBLE in the objection rather than silent.
+ * Fired INSTEAD of any mutation — nothing was touched.
  */
  | {
     readonly kind: 'branch-skip';
     readonly agent: string;
     readonly current: string | null;
     readonly canonical: string;
+    readonly workspace: string | null;
 }
 /**
  * The pre-flight AUTO-RESOLVE (DR-040 Decision 3 / macf#698 R1) — `files`
@@ -317,15 +386,20 @@ export type UpgradeEvent = {
  * auto-resolved above and are never part of this list). `files` is the
  * exact genuine-delta uncommitted-path list; `message` is the
  * ready-to-forward, agent-directed text (inspect + commit / delete /
- * gitignore, then re-run). Fired INSTEAD of any mutation — nothing on this
- * agent's genuine-delta files was touched (though the already-canonical
- * subset, if any, WAS committed by the preceding `config-auto-resolved`).
+ * gitignore, then re-run) and, per macf#1101, NAMES the workspace the
+ * check actually inspected so a misattributed resolution is visible
+ * rather than silent. `workspace` carries the same location as a
+ * separate structured field for programmatic consumers. Fired INSTEAD of
+ * any mutation — nothing on this agent's genuine-delta files was touched
+ * (though the already-canonical subset, if any, WAS committed by the
+ * preceding `config-auto-resolved`).
  */
  | {
     readonly kind: 'config-dirty-skip';
     readonly agent: string;
     readonly files: readonly string[];
     readonly message: string;
+    readonly workspace: string | null;
 } | {
     readonly kind: 'busy-skip';
     readonly agent: string;
@@ -365,6 +439,20 @@ export type UpgradeEvent = {
     readonly pin: string;
     readonly target: string;
 }
+/**
+ * The POST-restart NOT-YET-SERVING skip (NEW, follow-up to macf#899) —
+ * verify-green confirmed the agent reachable at its OLD version, but the
+ * SAME `instanceId` answered before AND after this roll's own `restart()`
+ * call — the relaunch hasn't taken over serving yet, so `rollFleet` skips
+ * this agent (NOT a halt) and continues to the next one. Distinct from
+ * `stale-pin-skip`: the cause here is a not-yet-superseded process, never
+ * the launch pin (which is never even consulted on this path).
+ */
+ | {
+    readonly kind: 'not-yet-serving-skip';
+    readonly agent: string;
+    readonly instanceId: string;
+}
 /**
  * DR-043 §D6 write-back (macf#907) — `deps.recordDeployedVersion` (the
  * confirmed-green `fleet.lock` write) rejected. NON-FATAL: `outcome` for
@@ -448,11 +536,25 @@ export interface RollFleetDeps {
 export declare const DEFAULT_WAIT_TIMEOUT_MS = 300000;
 /** Default `--wait` re-poll interval (ms). */
 export declare const DEFAULT_WAIT_POLL_MS = 5000;
+/**
+ * Render the inspected-workspace clause shared by both pre-flight OBJECT
+ * messages (macf#1101) — `null` reads as an explicit UNRESOLVED diagnostic,
+ * never a blank/omitted clause, so a caller can't mistake "the driver didn't
+ * report a workspace" for "this gate has nothing to say about location."
+ * Pure — exported for CLI-rendering reuse / tests.
+ */
+export declare function describeInspectedWorkspace(workspace: string | null): string;
 /**
  * Build the agent-directed OBJECT message for a config-dirty pre-flight skip
- * (macf#725). Pure — exported for CLI-rendering reuse / tests.
+ * (macf#725). `workspace` (macf#1101) names the on-disk location the check
+ * actually inspected — the fix for the class of bug where a routing-label
+ * collision (or a caller-cwd-dependent resolution) silently attributed a
+ * DIFFERENT agent's — or the orchestrator's OWN — dirty files to `agent`;
+ * naming the inspected path makes that misattribution visible in the
+ * objection itself rather than requiring separate investigation. Pure —
+ * exported for CLI-rendering reuse / tests.
  */
-export declare function buildConfigDirtyMessage(agent: string, files: readonly string[]): string;
+export declare function buildConfigDirtyMessage(agent: string, files: readonly string[], workspace?: string | null): string;
 /**
  * Build the agent-directed post-upgrade modified-files message (macf#725).
  * Pure — exported for CLI-rendering reuse / tests.
@@ -467,9 +569,13 @@ export declare function buildConfigDirtyMessage(agent: string, files: readonly s
 export declare function buildModifiedFilesMessage(agent: string, files: readonly string[]): string;
 /**
  * Build the agent-directed OBJECT message for the branch-gate pre-flight skip
- * (macf#755). Pure — exported for CLI-rendering reuse / tests.
+ * (macf#755). `workspace` (macf#1101) names the on-disk location the branch
+ * check actually inspected — see `buildConfigDirtyMessage`'s doc for why this
+ * matters (the same routing-label-collision / caller-cwd-dependent
+ * misattribution class applies to the branch check too). Pure — exported for
+ * CLI-rendering reuse / tests.
  */
-export declare function buildBranchSkipMessage(agent: string, current: string | null, canonical: string): string;
+export declare function buildBranchSkipMessage(agent: string, current: string | null, canonical: string, workspace?: string | null): string;
 /**
  * Roll ONE fleet: for every `behind` plan (in order) run the PRE-FLIGHT gates
  * (branch-gate FIRST, then config-dirty tier-first, then busy) → upgrade →

package/dist/fleet-upgrade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-upgrade.d.ts","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAuFA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,cAAc,GACd,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,QAAQ,CAAC;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,sBAAsB,GAAG,WAAW,CAAC;AAE9E,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AACH,eAAO,MAAM,4BAA4B,sTA6B/B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AAC5G;;;;;;GAMG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AACvH;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AACtG;;;;;;;;;GASG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3H;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE;AAClF;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpJ;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AACrH;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC5G;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,GACpB,SAAS,gBAAgB,EAAE,CAqB7B;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAED,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAoI1C;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMzF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,SAAS,EAAE,MAAM,GAChB,MAAM,CAUR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAClC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CAkN1B;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,iJAAiJ;IACjJ,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAuC7B"}
+{"version":3,"file":"fleet-upgrade.d.ts","sourceRoot":"","sources":["../src/fleet-upgrade.ts"],"names":[],"mappings":"AAuFA,OAAO,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAEpE,oFAAoF;AACpF,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6FAA6F;IAC7F,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,iFAAiF;IACjF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;CAC1C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,MAAM,MAAM,WAAW,GACnB,UAAU,GACV,cAAc,GACd,sBAAsB,GACtB,gBAAgB,GAChB,mBAAmB,GACnB,yBAAyB,GACzB,QAAQ,CAAC;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,sBAAsB,GAAG,WAAW,GAAG,iBAAiB,CAAC;AAElG,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAChD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AACH,eAAO,MAAM,4BAA4B,sTA6B/B,CAAC;AAEX,0DAA0D;AAC1D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,eAAe,EAAE,CAAC;IAC7C,yEAAyE;IACzE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;CACvC;AAED,uFAAuF;AACvF,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACzG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnF;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE;AAC5G;;;;;;;;;;GAUG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC;AACH;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE;AACtG;;;;;;;;;;;;;GAaG;GACD;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CACnC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CAAE;AAClF;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACpJ;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AACrH;;;;;;;GAOG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC5G;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE;AAChG;;;;;;;;GAQG;GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErH;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,SAAS,eAAe,EAAE,EACnC,KAAK,EAAE,UAAU,EACjB,aAAa,EAAE,MAAM,GACpB,SAAS,gBAAgB,EAAE,CA4B7B;AAED,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,oDAAoD;IACpD,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,oDAAoD;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,uEAAuE;AACvE,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,yFAAyF;IACzF,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6EAA6E;IAC7E,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAED,sEAAsE;AACtE,eAAO,MAAM,uBAAuB,SAAU,CAAC;AAC/C,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,OAAQ,CAAC;AAuL1C;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAE3E;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,MAAM,CAOR;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAMzF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAM,GAAG,IAAW,GAC9B,MAAM,CAWR;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,SAAS,gBAAgB,EAAE,EAClC,IAAI,EAAE,gBAAgB,EACtB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,eAAe,CAAC,CA6P1B;AAED,gDAAgD;AAChD,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,mFAAmF;IACnF,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,uDAAuD;AACvD,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC/E,QAAQ,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,iJAAiJ;IACjJ,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnG;AAED,2CAA2C;AAC3C,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,oCAAoC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,iFAAiF;IACjF,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,SAAS,MAAM,EAAE,EACzB,IAAI,EAAE,oBAAoB,EAC1B,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAuC7B"}

package/dist/fleet-upgrade.js

@@ -221,6 +221,12 @@ export function planFleetUpgrade(members, state, targetVersion) {
     return members.map((m) => {
         const live = byName.get(m.agent);
         const runningVersion = live?.online ? (live.version ?? null) : null;
+        // NEW (follow-up to macf#899) — captured alongside `runningVersion` so
+        // `classifyHalt` can later tell "the SAME process is still answering
+        // /health post-restart" (not-yet-serving) apart from "a genuinely NEW
+        // process is serving the wrong version" (bad-release). `null` when
+        // offline or the `/health` body predates the field.
+        const runningInstanceId = live?.online ? (live.health?.instance_id ?? null) : null;
         let disposition;
         if (runningVersion === null) {
             disposition = 'offline';
@@ -235,6 +241,7 @@ export function planFleetUpgrade(members, state, targetVersion) {
             agent: m.agent,
             fleet: m.project,
             runningVersion,
+            runningInstanceId,
             pinnedVersion: m.versionPin,
             disposition,
         };
@@ -309,8 +316,34 @@ async function waitForIdle(agent, opts, deps) {
  *   be read, so the reason string alone is never mistaken for a positively
  *   confirmed diagnosis, and the operator's remedy is "check the launch
  *   pin/mount," not "assume the release is broken."
+ *
+ * ## The not-yet-serving discriminator (NEW, follow-up to macf#899)
+ *
+ * The 0.2.58 roll incident this follow-up is grounded in showed the
+ * `pin === targetVersion` branch ABOVE still overstates: it fires unconditional
+ * `CONFIRMED` wording even when the agent simply hasn't finished relaunching
+ * (e.g. sitting at an unanswered interactive launch prompt) — the SAME
+ * pre-restart process was still the one answering `/health` for the whole
+ * verify-green budget, which looks IDENTICAL to a genuine crash-loop from the
+ * version comparison alone. `restart-self` mints a NEW `instance_id` on every
+ * relaunch (DR-037 Decision 5) precisely so this is checkable: if the
+ * `instance_id` verify-green saw on its MOST RECENT probe — `lastInstanceId`
+ * is cleared on any unreachable probe, never latched like `lastVersion`, see
+ * `verify-green.ts` — is the EXACT SAME one recorded before this roll's own
+ * `restart()` call, the responder is PROVEN to be STILL CONTINUOUSLY the
+ * lingering pre-restart process — not a fresh one running broken code. That
+ * is `not-yet-serving`: an honest UNKNOWN (this decision layer never touches
+ * tmux/capture-pane, so it cannot confirm WHY the relaunch stalled, only
+ * THAT it has), reported and skipped, never a `CONFIRMED` bad-release. Ruled
+ * out FIRST, before the pin-check, because a not-yet-superseded process makes
+ * the pin question moot — the pin can only describe what the process WILL
+ * request once it actually restarts. Only fires when a same-non-null
+ * `instance_id` is available on BOTH sides; an older/mixed-version fleet
+ * without the field falls straight through to the pin-check UNCHANGED — this
+ * is strictly additive, never a behavior change for a fleet that lacks the
+ * data.
  */
-async function classifyHalt(green, oldVersion, targetVersion, agent, driver) {
+async function classifyHalt(green, oldVersion, oldInstanceId, targetVersion, agent, driver) {
     const base = `verify-green ${green.reason} (last=${green.lastVersion ?? 'down'})`;
     const confirmedOldVersion = green.reason === 'wrong-version' &&
         green.lastVersion !== null &&
@@ -319,8 +352,29 @@ async function classifyHalt(green, oldVersion, targetVersion, agent, driver) {
     if (!confirmedOldVersion) {
         return { reason: 'relaunch-unconfirmed', detail: `relaunch-unconfirmed: ${base}` };
     }
-    // macf#899 — POSITIVELY confirmed reachable-at-OLD-version. Read the
-    // agent's own launch pin before naming this a bad release.
+    // NEW (follow-up to macf#899) — before implicating the release at all,
+    // rule out the simplest honest explanation: the SAME pre-restart process
+    // instance is still the one answering /health, i.e. this agent's relaunch
+    // has not taken over serving yet. Only possible when BOTH sides carry an
+    // `instance_id` — see this function's doc.
+    const lastInstanceId = green.lastInstanceId ?? null;
+    if (oldInstanceId !== null && lastInstanceId !== null && lastInstanceId === oldInstanceId) {
+        return {
+            reason: 'not-yet-serving',
+            detail: `not-yet-serving: ${base} — the SAME pre-restart instance (${oldInstanceId}) is still ` +
+                `the one answering ${agent}'s /health; its relaunch has not taken over serving yet. ` +
+                `This is an honest UNKNOWN, not a confirmed bad release — a common cause is an ` +
+                `unanswered interactive launch prompt (Claude Code's trust dialog or the dev-channels ` +
+                `confirmation); attach to ${agent}'s session, clear any pending prompt, then re-run the ` +
+                `upgrade to pick it up. NOT halting the roll — a slow-to-take-over relaunch on one ` +
+                `workspace endangers no other agent.`,
+            instanceId: oldInstanceId,
+        };
+    }
+    // macf#899 — POSITIVELY confirmed reachable-at-OLD-version (and, whenever
+    // instance-id data was available above, confirmed NOT to be the lingering
+    // pre-restart process). Read the agent's own launch pin before naming this
+    // a bad release.
     const pin = await driver.readVersionPin(agent);
     if (pin === null) {
         return {
@@ -352,13 +406,30 @@ async function classifyHalt(green, oldVersion, targetVersion, agent, driver) {
         pin,
     };
 }
+/**
+ * Render the inspected-workspace clause shared by both pre-flight OBJECT
+ * messages (macf#1101) — `null` reads as an explicit UNRESOLVED diagnostic,
+ * never a blank/omitted clause, so a caller can't mistake "the driver didn't
+ * report a workspace" for "this gate has nothing to say about location."
+ * Pure — exported for CLI-rendering reuse / tests.
+ */
+export function describeInspectedWorkspace(workspace) {
+    return workspace ?? 'UNRESOLVED — no workspace could be matched to this agent for this fleet';
+}
 /**
  * Build the agent-directed OBJECT message for a config-dirty pre-flight skip
- * (macf#725). Pure — exported for CLI-rendering reuse / tests.
+ * (macf#725). `workspace` (macf#1101) names the on-disk location the check
+ * actually inspected — the fix for the class of bug where a routing-label
+ * collision (or a caller-cwd-dependent resolution) silently attributed a
+ * DIFFERENT agent's — or the orchestrator's OWN — dirty files to `agent`;
+ * naming the inspected path makes that misattribution visible in the
+ * objection itself rather than requiring separate investigation. Pure —
+ * exported for CLI-rendering reuse / tests.
  */
-export function buildConfigDirtyMessage(agent, files) {
+export function buildConfigDirtyMessage(agent, files, workspace = null) {
     return (`Fleet upgrade skipped ${agent} — these files have uncommitted changes ` +
-        `\`macf update\` would overwrite: ${files.join(', ')}. Inspect each and ` +
+        `\`macf update\` would overwrite: ${files.join(', ')} ` +
+        `(inspected workspace: ${describeInspectedWorkspace(workspace)}). Inspect each and ` +
         `commit, delete, or .gitignore it, then re-run the upgrade.`);
 }
 /**
@@ -379,11 +450,16 @@ export function buildModifiedFilesMessage(agent, files) {
 }
 /**
  * Build the agent-directed OBJECT message for the branch-gate pre-flight skip
- * (macf#755). Pure — exported for CLI-rendering reuse / tests.
+ * (macf#755). `workspace` (macf#1101) names the on-disk location the branch
+ * check actually inspected — see `buildConfigDirtyMessage`'s doc for why this
+ * matters (the same routing-label-collision / caller-cwd-dependent
+ * misattribution class applies to the branch check too). Pure — exported for
+ * CLI-rendering reuse / tests.
  */
-export function buildBranchSkipMessage(agent, current, canonical) {
+export function buildBranchSkipMessage(agent, current, canonical, workspace = null) {
     const branchDesc = current === null ? 'a detached HEAD (or an unresolvable branch)' : `branch \`${current}\``;
-    return (`Fleet upgrade skipped ${agent} — on ${branchDesc}, expected \`${canonical}\`. ` +
+    return (`Fleet upgrade skipped ${agent} — on ${branchDesc}, expected \`${canonical}\` ` +
+        `(inspected workspace: ${describeInspectedWorkspace(workspace)}). ` +
         `A mutation (macf update / an auto-resolve commit) or a relaunch would land on the ` +
         `wrong branch. Switch the workspace to \`${canonical}\` (or set canonicalBranch / ` +
         `MACF_CANONICAL_BRANCH if this is a legitimate fork), then re-run the upgrade, or ` +
@@ -451,10 +527,20 @@ export async function rollFleet(plans, opts, deps) {
     let configAutoResolved = 0;
     let branchSkipped = 0;
     let stalePinSkipped = 0;
+    let notYetServingSkipped = 0;
     for (const plan of plans) {
         if (plan.disposition !== 'behind')
             continue;
         const agent = plan.agent;
+        // macf#1101 — resolve the on-disk location the pre-flight gates below
+        // are ABOUT to inspect, ONCE per agent, so both OBJECT messages can name
+        // it (a misattribution — e.g. a routing-label collision resolving to a
+        // DIFFERENT project's, or the orchestrator's OWN, workspace — becomes
+        // visible in the objection instead of silent). `null` when the driver
+        // doesn't implement `resolveWorkspace` (optional) or can't resolve
+        // `agent` at all. Skipped entirely under `--force`, which bypasses both
+        // gates below and never inspects anything.
+        const workspace = opts.force ? null : ((await deps.driver.resolveWorkspace?.(agent)) ?? null);
         // PRE-FLIGHT branch-gate (macf#755) — the FIRST gate, before config-dirty
         // or busy. Detached HEAD / unresolvable (`current === null`) is ALWAYS
         // non-canonical.
@@ -463,9 +549,9 @@ export async function rollFleet(plans, opts, deps) {
             const current = await deps.driver.currentBranch(agent);
             if (current === null || current !== canonical) {
                 branchSkipped += 1;
-                const message = buildBranchSkipMessage(agent, current, canonical);
+                const message = buildBranchSkipMessage(agent, current, canonical, workspace);
                 results.push({ agent, outcome: 'branch-skipped', detail: message });
-                deps.onEvent?.({ kind: 'branch-skip', agent, current, canonical });
+                deps.onEvent?.({ kind: 'branch-skip', agent, current, canonical, workspace });
                 continue;
             }
         }
@@ -489,14 +575,14 @@ export async function rollFleet(plans, opts, deps) {
             }
             if (genuineDelta.length > 0) {
                 configDirtySkipped += 1;
-                const message = buildConfigDirtyMessage(agent, genuineDelta);
+                const message = buildConfigDirtyMessage(agent, genuineDelta, workspace);
                 results.push({
                     agent,
                     outcome: 'config-dirty-skipped',
                     detail: message,
                     ...(autoResolvedFiles ? { autoResolvedFiles } : {}),
                 });
-                deps.onEvent?.({ kind: 'config-dirty-skip', agent, files: genuineDelta, message });
+                deps.onEvent?.({ kind: 'config-dirty-skip', agent, files: genuineDelta, message, workspace });
                 continue;
             }
             // genuineDelta is empty (nothing dirty at all, or everything dirty WAS
@@ -580,8 +666,30 @@ export async function rollFleet(plans, opts, deps) {
             }
             continue;
         }
-        const classification = await classifyHalt(green, plan.runningVersion, opts.targetVersion, agent, deps.driver);
+        const classification = await classifyHalt(green, plan.runningVersion, plan.runningInstanceId, opts.targetVersion, agent, deps.driver);
         const { reason, detail } = classification;
+        if (reason === 'not-yet-serving') {
+            // NEW (follow-up to macf#899) — SAFE TO CONTINUE despite the agent
+            // having been mutated: the post-restart old-version state is explained
+            // by the SAME pre-restart process instance still answering /health
+            // (its relaunch hasn't taken over yet), not a bad release, and a
+            // slow-to-take-over relaunch on ONE workspace endangers no OTHER
+            // agent. Leave the maintenance lock in place (DR-040 Decision 3 —
+            // "release ONLY on confirmed clean success"; this agent is NOT
+            // confirmed clean): same posture as `stale-pin`. Only the heartbeat
+            // stops here; the lock self-clears via MAINT_LOCK_TTL.
+            notYetServingSkipped += 1;
+            results.push({
+                agent,
+                outcome: 'not-yet-serving-skipped',
+                reason,
+                detail,
+                ...(autoResolvedFiles ? { autoResolvedFiles } : {}),
+            });
+            deps.onEvent?.({ kind: 'not-yet-serving-skip', agent, instanceId: classification.instanceId });
+            stopHeartbeat();
+            continue;
+        }
         if (reason === 'stale-pin') {
             // macf#899 — SAFE TO CONTINUE despite the agent having been mutated
             // (upgrade + restart already ran): the post-restart old-version state
@@ -631,6 +739,7 @@ export async function rollFleet(plans, opts, deps) {
             configAutoResolved,
             branchSkipped,
             stalePinSkipped,
+            notYetServingSkipped,
         };
     }
     return {
@@ -642,6 +751,7 @@ export async function rollFleet(plans, opts, deps) {
         configAutoResolved,
         branchSkipped,
         stalePinSkipped,
+        notYetServingSkipped,
     };
 }
 /**