@north-light/crouter 0.3.254 → 0.3.256

package/dist/commands/api-client.js

@@ -19,6 +19,7 @@ import { join } from 'node:path';
 import { CrtrClient, ApiError } from '../api/index.js';
 import { apiErrorToCliError } from '../core/io.js';
 import { autostartDisabled, ensureDaemon } from '../daemon/manage.js';
+import { daemonStartupBlocked } from '../daemon/startup-block-marker.js';
 import { DAEMON_STARTUP_WINDOW_MS } from '../daemon/startup-policy.js';
 import { readState } from '../core/config.js';
 import { resolveRemoteCanvasTarget } from '../core/remote-canvas-target.js';
@@ -126,6 +127,9 @@ export function cliClient(opts) {
         // On a cold-start timeout, enrich the bare `daemon_unavailable` with the
         // tail of crtrd's event log instead of discarding it.
         coldStartDiagnostic: readColdStartDiagnostic,
+        // A blocked startup is standing: every poll left in the window would report
+        // the same thing this already knows, so fail now and carry the repair.
+        coldStartAbort: daemonStartupBlocked,
         coldStartPollWindowMs: DAEMON_STARTUP_WINDOW_MS,
     });
 }

package/dist/commands/sys/worktrees.d.ts

@@ -0,0 +1 @@
+export declare const sysWorktreesLeaf: import("../../core/command.js").LeafDef;

package/dist/commands/sys/worktrees.js

@@ -0,0 +1,53 @@
+import { defineLeaf } from '../../core/command.js';
+import { cliClient, rethrowAsCliError } from '../api-client.js';
+function formatSize(bytes) {
+    if (bytes === null || !Number.isFinite(bytes) || bytes < 0)
+        return 'unmeasurable';
+    const units = ['B', 'KiB', 'MiB', 'GiB', 'TiB'];
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit++;
+    }
+    return `${value >= 10 || unit === 0 ? value.toFixed(0) : value.toFixed(1)} ${units[unit]}`;
+}
+export const sysWorktreesLeaf = defineLeaf({
+    name: 'worktrees',
+    description: 'list managed worktrees quarantined by daemon cleanup',
+    whenToUse: 'daemon cleanup has stopped retrying managed worktrees it could not reconcile and you need the recorded refusal, remaining checkout, and disk cost for human intervention',
+    help: {
+        name: 'sys worktrees',
+        summary: 'list managed worktrees the daemon cleanup sweep quarantined',
+        params: [],
+        output: [
+            { name: 'worktrees', type: 'QuarantinedWorktreeDTO[]', required: true, constraint: 'Oldest refusal first. Each record: {node_id, path, branch, repo_root, reason, detail?, attempts, last_attempt, size_bytes}; size_bytes is null when the checkout path is gone or cannot be measured.' },
+        ],
+        outputKind: 'object',
+        effects: ['None. Read-only.'],
+    },
+    run: async () => {
+        try {
+            return { worktrees: await cliClient().listQuarantinedWorktrees() };
+        }
+        catch (err) {
+            rethrowAsCliError(err);
+        }
+    },
+    render: (result) => {
+        const worktrees = result['worktrees'];
+        if (worktrees.length === 0)
+            return '0 quarantined managed worktrees.';
+        return `${worktrees.length} quarantined managed worktree${worktrees.length === 1 ? '' : 's'}:\n\n${worktrees.map((worktree) => {
+            const details = [
+                `- \`${worktree.node_id}\` — ${worktree.reason} · ${formatSize(worktree.size_bytes)} · ${worktree.attempts} attempt${worktree.attempts === 1 ? '' : 's'} · ${worktree.last_attempt}`,
+                `  - path: \`${worktree.path}\``,
+                `  - branch: \`${worktree.branch}\``,
+                `  - repo root: \`${worktree.repo_root}\``,
+            ];
+            if (worktree.detail !== undefined)
+                details.push(`  - detail: ${worktree.detail}`);
+            return details.join('\n');
+        }).join('\n')}`;
+    },
+});

package/dist/commands/sys.js

@@ -5,6 +5,7 @@ import { daemonBranch } from './sys/daemon.js';
 import { sysDoctorLeaf } from './sys/doctor.js';
 import { sysFeedbackLeaf } from './sys/feedback.js';
 import { sysLogsLeaf } from './sys/logs.js';
+import { sysWorktreesLeaf } from './sys/worktrees.js';
 import { sysSettingsLeaf } from './sys/settings.js';
 import { sysSetupLeaf } from './sys/setup.js';
 import { supportBranch } from './sys/support.js';
@@ -25,6 +26,6 @@ export function registerSys() {
             summary: 'crtr system configuration, settings, diagnostics, and self-management',
             model: 'Configuration and settings own durable behavior; diagnostics and support observe it. Setup, migration, sync, and update change installed or generated state, while daemon control owns the supervisor lifecycle.',
         },
-        children: [sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, contextBranch, sysFeedbackLeaf, sysLogsLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysMigrateLeaf, sysSyncBranch, daemonBranch],
+        children: [sysSettingsLeaf, configBranch, sysSetupLeaf, sysDoctorLeaf, contextBranch, sysFeedbackLeaf, sysLogsLeaf, sysWorktreesLeaf, supportBranch, sysUpdateLeaf, sysVersionLeaf, sysMigrateLeaf, sysSyncBranch, daemonBranch],
     });
 }

package/dist/core/__tests__/integration/worktree-land.test.js

@@ -4,12 +4,13 @@
 // parallel files; they share the fixture shape, not state.
 import { test, before, after, beforeEach } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, mkdirSync, rmSync, existsSync, statSync, writeFileSync, chmodSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, existsSync, statSync, writeFileSync, readFileSync, chmodSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../../git.js';
 import { createManagedWorktree, closeManagedWorktree, managedWorktreePath, rollbackManagedWorktree } from '../../worktree.js';
+import { reconcileManagedWorktree } from '../../worktree-sweep.js';
 import { createNode, getNode } from '../../canvas/canvas.js';
 import { closeDb } from '../../canvas/db.js';
 let home;
@@ -35,6 +36,10 @@ function node(id, over = {}) {
     };
 }
 before(() => {
+    // NOT realpath'd on purpose: the macOS tmpdir is reached through the
+    // `/var` → `/private/var` symlink, so the recorded managed-worktree path and
+    // git's canonical `worktree list` output differ as strings while naming one
+    // directory. Every path-ownership check must judge identity, not spelling.
     home = mkdtempSync(join(tmpdir(), 'crtr-worktree-home-'));
     process.env['CRTR_HOME'] = home;
     // Bare "remote" wired up as origin so the test can prove landing NEVER pushes
@@ -89,6 +94,71 @@ test('closeManagedWorktree leaves the active caller checkout intact with named d
     assert.equal(meta?.cwd, wt.repo_root, 'a later revive uses the durable base checkout');
     assert.equal(meta?.pi_session_id, null, 'the live transcript remains sole-writer-owned, so close invalidates its stale resume identity');
     assert.equal(meta?.pi_session_file, null, 'a later revive launches fresh rather than loading the header that still names this checkout');
+    return reconcileManagedWorktree(nodeId, { stillEligible: () => true }).then((outcome) => {
+        assert.equal(outcome.status, 'complete', 'the daemon-owned sweep consumes pending cleanup after the caller exits');
+        assert.equal(existsSync(wt.path), false, 'the sweep removes the deferred caller checkout');
+        assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the sweep deletes the now-contained managed branch');
+        const swept = getNode(nodeId)?.managed_worktree;
+        assert.deepEqual({ state: swept?.state, cleanup: swept?.cleanup }, { state: 'closed', cleanup: 'complete' });
+    });
+});
+test('close lands underneath disjoint tracked changes in the base checkout', () => {
+    const nodeId = 'wt-close-disjoint-base-dirt';
+    writeFileSync(join(sourceDir, 'base-local.txt'), 'base version\n');
+    run(['add', 'base-local.txt'], sourceDir);
+    run(['commit', '-m', 'base local file'], sourceDir);
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'incoming-disjoint.txt'), 'child work\n');
+    run(['add', 'incoming-disjoint.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'disjoint child work'], wt.path);
+    writeFileSync(join(sourceDir, 'base-local.txt'), 'base local edit\n');
+    const result = closeManagedWorktree(nodeId);
+    assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), result.landed_sha, 'the child commit fast-forwards main despite disjoint local dirt');
+    assert.equal(readFileSync(join(sourceDir, 'base-local.txt'), 'utf8'), 'base local edit\n', 'the base checkout local edit survives untouched');
+    assert.match(gitSync(['status', '--porcelain'], sourceDir).stdout, /M base-local.txt/, 'the base local edit remains uncommitted');
+    assert.equal(gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], sourceDir).status, 1, 'disjoint changes require no stash');
+    run(['reset', '--hard'], sourceDir);
+});
+test('close stashes and restores overlapping tracked changes without leaving a stash', () => {
+    const nodeId = 'wt-close-overlap-base-dirt';
+    // The child commit and the base local edit touch the SAME file (so landing
+    // takes the stash path) but in far-apart regions, so the stash re-apply
+    // merges cleanly rather than conflicting.
+    const original = Array.from({ length: 20 }, (_, i) => `line ${i + 1}`).join('\n') + '\n';
+    writeFileSync(join(sourceDir, 'overlap.txt'), original);
+    run(['add', 'overlap.txt'], sourceDir);
+    run(['commit', '-m', 'overlap base file'], sourceDir);
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    const childEdit = original.replace('line 1\n', 'line 1 child-changed\n');
+    writeFileSync(join(wt.path, 'overlap.txt'), childEdit);
+    run(['add', 'overlap.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'overlap child work'], wt.path);
+    const baseEdit = original.replace('line 20\n', 'line 20 base-changed\n');
+    writeFileSync(join(sourceDir, 'overlap.txt'), baseEdit);
+    const result = closeManagedWorktree(nodeId);
+    assert.equal(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), result.landed_sha, 'the child commit fast-forwards main under the local edit');
+    const landed = childEdit.replace('line 20\n', 'line 20 base-changed\n');
+    assert.equal(readFileSync(join(sourceDir, 'overlap.txt'), 'utf8'), landed, 'the disjoint local edit is restored over the landed child change');
+    assert.equal(result.base_checkout_stash, undefined, 'a clean stash apply leaves no preserved-stash note');
+    assert.match(gitSync(['status', '--porcelain'], sourceDir).stdout, /M overlap.txt/, 'the restored base edit remains uncommitted');
+    assert.equal(gitSync(['rev-parse', '--verify', '--quiet', 'refs/stash'], sourceDir).status, 1, 'a clean stash apply drops the temporary stash');
+    run(['reset', '--hard'], sourceDir);
+});
+test('close refuses an incoming path that collides with an untracked base file', () => {
+    const nodeId = 'wt-close-untracked-collision';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'incoming-collision.txt'), 'child work\n');
+    run(['add', 'incoming-collision.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'incoming collision'], wt.path);
+    writeFileSync(join(sourceDir, 'incoming-collision.txt'), 'base untracked work\n');
+    assert.throws(() => closeManagedWorktree(nodeId), (error) => error instanceof Error && 'code' in error && error.code === 'land_base_failed', 'close must refuse rather than overwrite an untracked base file');
+    assert.equal(readFileSync(join(sourceDir, 'incoming-collision.txt'), 'utf8'), 'base untracked work\n', 'the base untracked file remains intact');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'a refused land remains unreconciled');
+    assert.ok(getNode(nodeId)?.managed_worktree?.land_intent, 'the blocked close records the intent the sweep may later finish');
+    rmSync(join(sourceDir, 'incoming-collision.txt'));
 });
 test('two concurrent creates from linked worktrees serialize on their shared repository', async () => {
     const worktreeModule = new URL('../../worktree.ts', import.meta.url).href;

package/dist/core/__tests__/integration/worktree-reap.test.js

@@ -9,6 +9,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { gitSync } from '../../git.js';
 import { createManagedWorktree, closeManagedWorktree } from '../../worktree.js';
+import { reconcileManagedWorktree } from '../../worktree-sweep.js';
 import { createApiServer } from '../../../daemon/api/server.js';
 import { apiSocketPath } from '../../canvas/paths.js';
 import { CrtrClient } from '../../../api/index.js';
@@ -37,6 +38,10 @@ function node(id, over = {}) {
     };
 }
 before(() => {
+    // NOT realpath'd on purpose: the macOS tmpdir is reached through the
+    // `/var` → `/private/var` symlink, so the recorded managed-worktree path and
+    // git's canonical `worktree list` output differ as strings while naming one
+    // directory. Every path-ownership check must judge identity, not spelling.
     home = mkdtempSync(join(tmpdir(), 'crtr-worktree-home-'));
     process.env['CRTR_HOME'] = home;
     // Bare "remote" wired up as origin so the test can prove landing NEVER pushes
@@ -85,6 +90,102 @@ test('autoDropCleanManagedWorktree drops a clean, zero-commit worktree', async (
     assert.equal(meta?.cwd, wt.repo_root, 'auto-dropped node cwd repoints to the durable base checkout');
     assert.equal(gitSync(['rev-parse', '--git-dir'], meta.cwd).status, 0, 'repointed cwd resolves to a real git checkout');
     assert.ok(existsSync(join(wt.path, '.git')), 'the intact caller worktree remains a git checkout');
+    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(outcome.status, 'complete', 'the daemon-owned sweep consumes pending cleanup after the caller exits');
+    assert.equal(existsSync(wt.path), false, 'the sweep removes the deferred caller checkout');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the sweep deletes the clean managed branch');
+    const swept = getNode(nodeId)?.managed_worktree;
+    assert.deepEqual({ state: swept?.state, cleanup: swept?.cleanup }, { state: 'closed', cleanup: 'complete' });
+});
+test('the sweep refuses a managed checkout with uncommitted changes', async () => {
+    const nodeId = 'wt-sweep-dirty';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'uncommitted.txt'), 'must survive\n');
+    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(outcome.status, 'refused');
+    assert.equal(outcome.status === 'refused' ? outcome.reason : undefined, 'dirty_worktree');
+    assert.ok(existsSync(join(wt.path, 'uncommitted.txt')), 'the uncommitted file remains in the checkout');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'the managed branch remains');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the record remains unreconciled');
+});
+// The lock the sweep holds serializes worktree operations, NOT node lifecycle:
+// a revive can land in any await between the containment proof and the removal.
+// So eligibility is re-asked immediately before every destructive step, and a
+// node that came back keeps the checkout it is now running in.
+test('the sweep stops before removing a checkout whose node revived mid-pass', async () => {
+    const nodeId = 'wt-sweep-revived-mid-pass';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    // True on the first ask (the pass starts), false afterwards (the revive won).
+    // Everything about this worktree is otherwise disposable: it is clean and its
+    // tip is its base, so ONLY the recheck can save it.
+    let asks = 0;
+    const outcome = await reconcileManagedWorktree(nodeId, {
+        stillEligible: () => {
+            asks += 1;
+            return asks === 1;
+        },
+    });
+    assert.ok(asks > 1, 'eligibility is re-asked before the destructive steps, not once per pass');
+    assert.equal(outcome.status, 'skipped');
+    assert.equal(outcome.status === 'skipped' ? outcome.reason : undefined, 'node_no_longer_terminal');
+    assert.ok(existsSync(join(wt.path, '.git')), 'the revived node keeps the checkout it is running in');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 0, 'its branch survives');
+    const record = getNode(nodeId)?.managed_worktree;
+    assert.equal(record?.state, 'open', 'the record is untouched, so a later pass can resume it');
+    assert.equal(record?.sweep, undefined, 'a revived node is not charged a refusal or a backoff');
+});
+test('the sweep refuses unlanded commits when close never recorded land intent', async () => {
+    const nodeId = 'wt-sweep-no-land-intent';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'unlanded.txt'), 'must survive\n');
+    run(['add', 'unlanded.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'unlanded work'], wt.path);
+    const branchSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
+    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(outcome.status, 'refused');
+    assert.equal(outcome.status === 'refused' ? outcome.reason : undefined, 'unlanded_work');
+    assert.ok(existsSync(wt.path), 'the checkout remains available for a human');
+    assert.equal(gitSync(['rev-parse', wt.branch], sourceDir).stdout.trim(), branchSha, 'the unlanded branch remains intact');
+    assert.equal(getNode(nodeId)?.managed_worktree?.state, 'open', 'the record remains unreconciled');
+});
+test('the sweep removes a rebased branch whose patches already landed', async () => {
+    const nodeId = 'wt-sweep-patch-identity';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'patch-identity.txt'), 'same content\n');
+    run(['add', 'patch-identity.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'child patch'], wt.path);
+    const childSha = gitSync(['rev-parse', 'HEAD'], wt.path).stdout.trim();
+    writeFileSync(join(sourceDir, 'patch-identity.txt'), 'same content\n');
+    run(['add', 'patch-identity.txt'], sourceDir);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'landed independently'], sourceDir);
+    assert.notEqual(gitSync(['rev-parse', 'main'], sourceDir).stdout.trim(), childSha, 'the independently landed patch has a different commit identity');
+    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(outcome.status, 'complete', 'patch identity proves the rebased branch content is already present');
+    assert.equal(existsSync(wt.path), false, 'the redundant checkout is removed');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the redundant branch is deleted');
+    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'complete');
+});
+test('the sweep removes a squash-merged branch whose merge is a content no-op', async () => {
+    const nodeId = 'wt-sweep-content-noop';
+    const wt = createManagedWorktree(sourceDir, nodeId);
+    createNode(node(nodeId, { cwd: wt.path, status: 'done', managed_worktree: wt }));
+    writeFileSync(join(wt.path, 'squash-one.txt'), 'one\n');
+    run(['add', 'squash-one.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'first child patch'], wt.path);
+    writeFileSync(join(wt.path, 'squash-two.txt'), 'two\n');
+    run(['add', 'squash-two.txt'], wt.path);
+    run(['-c', 'user.email=test@example.com', '-c', 'user.name=Test', 'commit', '-m', 'second child patch'], wt.path);
+    run(['merge', '--squash', wt.branch], sourceDir);
+    run(['commit', '-m', 'squash landed child work'], sourceDir);
+    const outcome = await reconcileManagedWorktree(nodeId, { stillEligible: () => true });
+    assert.equal(outcome.status, 'complete', 'a content-no-op merge proves squash-landed work is safe to remove');
+    assert.equal(existsSync(wt.path), false, 'the redundant checkout is removed');
+    assert.equal(gitSync(['show-ref', '--verify', '--quiet', `refs/heads/${wt.branch}`], sourceDir).status, 1, 'the squash-landed branch is deleted');
+    assert.equal(getNode(nodeId)?.managed_worktree?.cleanup, 'complete');
 });
 // The same real-commit case close already protects: a worktree with actual
 // unlanded work must NEVER be auto-dropped by push-final.

package/dist/core/__tests__/worktree-landing.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/worktree-landing.test.js

@@ -0,0 +1,11 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { parseStatusPorcelain, planLandIntoCheckout } from '../worktree-landing.js';
+test('parseStatusPorcelain separates tracked modifications, untracked files, and rename destinations', () => {
+    assert.deepEqual(parseStatusPorcelain(' M modified.txt\nM  staged.txt\nR  old-name.txt -> new-name.txt\n?? untracked.txt\n!! ignored.txt\n'), { tracked: ['modified.txt', 'staged.txt', 'new-name.txt'], untracked: ['untracked.txt'] });
+});
+test('planLandIntoCheckout selects direct landing, a tracked-change stash, or an untracked collision refusal', () => {
+    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['incoming.txt']), { kind: 'direct' });
+    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['local.txt']), { kind: 'stash', overlapping: ['local.txt'] });
+    assert.deepEqual(planLandIntoCheckout({ tracked: ['local.txt'], untracked: ['scratch.txt'] }, ['scratch.txt']), { kind: 'refuse', collisions: ['scratch.txt'] });
+});

package/dist/core/canvas/canvas.js

@@ -836,16 +836,32 @@ export function rebuildIndex() {
             recordSpawn(meta.node_id, prov);
     }
 }
-/** True when this node's identity is still required to own a managed checkout. */
-function hasOpenManagedWorktree(nodeId) {
-    return getNode(nodeId)?.managed_worktree?.state === 'open';
+/** True when this node's identity is still required to own a managed checkout.
+ *
+ *  Ownership outlives the OPEN state. A closed record whose cleanup is still
+ *  pending names a checkout and a branch that are physically still there, and
+ *  this node record is the only proof of who they belong to — deleting it turns
+ *  a retained residual into an ownerless orphan the daemon sweep can never
+ *  safely reclaim, because it must never guess at a worktree it cannot prove it
+ *  created. So prune may take this node only once cleanup is COMPLETE. A
+ *  historical closed record written before the cleanup field existed carries no
+ *  such proof and counts as incomplete.
+ *
+ *  An abandoned record is deliberately NOT protected: abandon already removed
+ *  the checkout and retains its branch for a person on purpose, so there is no
+ *  residual for the sweep to own. */
+function hasUnreconciledManagedWorktree(nodeId) {
+    const wt = getNode(nodeId)?.managed_worktree;
+    if (wt == null || wt.state === 'abandoned')
+        return false;
+    return wt.state === 'open' || wt.cleanup !== 'complete';
 }
 /** Whether a row may be removed by an automatic collection sweep. */
 export function isCollectible(row, opts = {}) {
     if (!['done', 'dead', 'canceled'].includes(row.status)
         || row.pi_pid !== null
         || row.frozen_at !== null
-        || hasOpenManagedWorktree(row.node_id)
+        || hasUnreconciledManagedWorktree(row.node_id)
         || row.node_id === envNodeId())
         return false;
     return opts.pastTtl === true || !['crashed', 'stranded', null].includes(row.terminal_reason ?? null);
@@ -860,7 +876,7 @@ export function isCollectible(row, opts = {}) {
  *  state are removed in one canvas write boundary. Best-effort dir removal
  *  follows the commit. */
 export function deleteNode(nodeId) {
-    if (hasOpenManagedWorktree(nodeId))
+    if (hasUnreconciledManagedWorktree(nodeId))
         return { deleted: false };
     const result = withCanvasWrite((db) => {
         db.prepare('DELETE FROM nodes WHERE node_id = ?').run(nodeId);
@@ -875,9 +891,9 @@ export function deleteNodes(nodeIds) {
     const ids = [...new Set(nodeIds)];
     if (ids.length === 0)
         return [];
-    const blocked = ids.filter(hasOpenManagedWorktree);
+    const blocked = ids.filter(hasUnreconciledManagedWorktree);
     if (blocked.length > 0) {
-        throw new Error(`refusing to delete nodes with open managed worktrees: ${blocked.join(', ')}`);
+        throw new Error(`refusing to delete nodes with unreconciled managed worktrees: ${blocked.join(', ')}`);
     }
     const placeholders = ids.map(() => '?').join(',');
     const deleted = withCanvasWrite((db) => {
@@ -941,7 +957,7 @@ export function pruneNodes(opts) {
         status: r['status'],
         created: r['created'],
     }))
-        .filter((node) => !hasOpenManagedWorktree(node.node_id));
+        .filter((node) => !hasUnreconciledManagedWorktree(node.node_id));
     const candidates = [...terminal, ...stale];
     if (dryRun || candidates.length === 0)
         return { pruned: candidates, dryRun };

package/dist/core/canvas/pid.d.ts

@@ -153,6 +153,12 @@ export interface PsLivenessSnapshot {
     childrenOf: ReadonlyMap<number, number[]>;
 }
 export declare function captureLivenessSnapshot(): PsLivenessSnapshot | null;
+/** The same sample without blocking the event loop, for callers running inside
+ *  crtrd's detached work: one `ps` read classifies every pid they care about,
+ *  where a per-pid `spawnSync` probe would stall broker supervision and the API
+ *  socket for the duration of each probe. `null` means the probe failed, which
+ *  every caller must preserve as unknown rather than absence. */
+export declare function captureLivenessSnapshotAsync(): Promise<PsLivenessSnapshot | null>;
 /** Every transitive descendant of `rootPid`, discovered by walking `ps`'s
  *  pid/ppid table (BFS) — NOT process-GROUP membership. The pi SDK's bash tool
  *  spawns its shell child with

package/dist/core/canvas/pid.js

@@ -6,7 +6,7 @@
 // above runtime/). It is a pure process-existence utility, NOT data-model access,
 // so it is exempt from the "only canvas.ts touches the db" rule. canvas.ts,
 // revive.ts, placement.ts, and crtrd.ts all probe liveness through it.
-import { spawnSync } from 'node:child_process';
+import { spawn, spawnSync } from 'node:child_process';
 import { readFileSync } from 'node:fs';
 import { readKernelBootId } from './boot-id.js';
 /** Classify the current `ps` row for a pid. BSD ps and procps-ng both report a
@@ -330,12 +330,16 @@ export function composeIdentity(pid, lstart, deps = {}) {
     const bootId = deps.bootId !== undefined ? deps.bootId : bootIdBase();
     return `${bootId ?? lstart}#${ticks}`;
 }
+/** The `ps` invocation both snapshot captures share, so the synchronous and
+ *  asynchronous forms can never sample different columns. */
+const PS_SNAPSHOT_ARGS = ['-Ao', 'pid=,ppid=,stat=,lstart=,command='];
+const PS_SNAPSHOT_TIMEOUT_MS = 2000;
 export function captureLivenessSnapshot() {
     let stdout;
     try {
-        const r = spawnSync('ps', ['-Ao', 'pid=,ppid=,stat=,lstart=,command='], {
+        const r = spawnSync('ps', [...PS_SNAPSHOT_ARGS], {
             encoding: 'utf8',
-            timeout: 2000,
+            timeout: PS_SNAPSHOT_TIMEOUT_MS,
             maxBuffer: 8 * 1024 * 1024,
         });
         if (r.status !== 0 || typeof r.stdout !== 'string')
@@ -345,6 +349,47 @@ export function captureLivenessSnapshot() {
     catch {
         return null;
     }
+    return parseLivenessTable(stdout);
+}
+/** The same sample without blocking the event loop, for callers running inside
+ *  crtrd's detached work: one `ps` read classifies every pid they care about,
+ *  where a per-pid `spawnSync` probe would stall broker supervision and the API
+ *  socket for the duration of each probe. `null` means the probe failed, which
+ *  every caller must preserve as unknown rather than absence. */
+export async function captureLivenessSnapshotAsync() {
+    const stdout = await new Promise((resolve) => {
+        let child;
+        try {
+            child = spawn('ps', [...PS_SNAPSHOT_ARGS]);
+        }
+        catch {
+            return resolve(null);
+        }
+        let out = '';
+        let settled = false;
+        const settle = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(value);
+        };
+        const timer = setTimeout(() => {
+            try {
+                child.kill('SIGKILL');
+            }
+            catch { /* already gone */ }
+            settle(null);
+        }, PS_SNAPSHOT_TIMEOUT_MS);
+        timer.unref?.();
+        child.stdout.on('data', (d) => (out += d.toString()));
+        child.stderr.on('data', () => { });
+        child.on('error', () => settle(null));
+        child.on('close', (status) => settle(status === 0 ? out : null));
+    });
+    return stdout === null ? null : parseLivenessTable(stdout);
+}
+function parseLivenessTable(stdout) {
     const processes = new Map();
     const childrenOf = new Map();
     for (const line of stdout.split('\n')) {

package/dist/core/canvas/types.d.ts

@@ -48,10 +48,41 @@ export interface LaunchSpec {
     /** Extra env injected into the pi process. */
     env: Record<string, string>;
 }
+/** The repository fingerprint a refusal was decided against. An examination
+ *  that reads the same three values can skip the whole proof cascade: nothing
+ *  about the refusal can have changed. */
+export interface ManagedWorktreeObservation {
+    /** Tip of `refs/heads/<base_ref>`, or null when it no longer resolves. */
+    base: string | null;
+    /** Tip of `refs/heads/<branch>`, or null when the branch is gone. */
+    branch: string | null;
+    /** `absent`, or a hash of the checkout's HEAD plus `git status --porcelain`. */
+    checkout: string | null;
+}
+/** Reconciliation bookkeeping owned SOLELY by the daemon's managed-worktree
+ *  sweep. Present only while a record is not yet reconciled; cleared when
+ *  cleanup completes. */
+export interface ManagedWorktreeSweep {
+    /** Structured code for why the last pass did not complete cleanup. */
+    reason: string;
+    detail?: string;
+    observed: ManagedWorktreeObservation;
+    /** Consecutive passes that examined this record without completing it. */
+    attempts: number;
+    last_attempt: string;
+    /** The sweep does not re-examine this record before this instant. */
+    next_attempt: string;
+    /** Set once `attempts` reaches the terminal backoff tier: this record needs a
+     *  human, and `crtr sys worktrees` lists it with its reason. It is still
+     *  fingerprint-checked at the capped interval, so work that lands later is
+     *  still cleaned up. */
+    quarantined?: true;
+}
 export interface ManagedWorktree {
     state: 'open' | 'closed' | 'abandoned';
     /** A closed worktree remains registered until its owner has exited, so Git
-     *  never deletes the caller's live checkout beneath it. */
+     *  never deletes the caller's live checkout beneath it. The daemon sweep is
+     *  the one authority that turns `pending` into `complete`. */
     cleanup?: 'pending' | 'complete';
     path: string;
     branch: string;
@@ -66,6 +97,15 @@ export interface ManagedWorktree {
         at: string;
         by: string;
     };
+    /** Recorded by `close` when the rebase succeeded but fast-forwarding the base
+     *  was blocked. The sweep lands a dead node's commits ONLY for a record
+     *  carrying this: the daemon finishes a job someone started, it never invents
+     *  the intent to land. */
+    land_intent?: {
+        at: string;
+        blocked: string;
+    };
+    sweep?: ManagedWorktreeSweep;
 }
 /** Immutable companion provenance. The origin session/leaf/model coordinates
  *  remain canonical in the review row rather than being duplicated into node

package/dist/core/exclusive-lock.d.ts

@@ -1,3 +1,9 @@
+/** The pid currently holding this lock, read straight off the marker name (the
+ *  token opens with the owner's pid). Null when the lock is free, unowned, or
+ *  names a token we cannot parse. Lets a caller tell "my child is doing the
+ *  work" apart from "my child is queued behind someone else's work" without
+ *  any new bookkeeping. */
+export declare function exclusiveLockOwnerPid(path: string): number | null;
 export interface ExclusiveLockOptions {
     /** Grace before a lock that names no owner at all is cleared. */
     staleMs?: number;

package/dist/core/exclusive-lock.js

@@ -91,6 +91,18 @@ function reclaimIfOwnerGone(path, staleMs) {
             throw error;
     }
 }
+/** The pid currently holding this lock, read straight off the marker name (the
+ *  token opens with the owner's pid). Null when the lock is free, unowned, or
+ *  names a token we cannot parse. Lets a caller tell "my child is doing the
+ *  work" apart from "my child is queued behind someone else's work" without
+ *  any new bookkeeping. */
+export function exclusiveLockOwnerPid(path) {
+    const token = observedMarkerToken(path);
+    if (token === null)
+        return null;
+    const pid = Number(token.split('.', 1)[0]);
+    return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
 function tryAcquire(path, staleMs) {
     const token = `${process.pid}.${randomUUID()}`;
     try {

package/dist/core/git.d.ts

@@ -11,7 +11,7 @@ export interface GitSyncOptions {
     timeoutMs?: number;
 }
 export declare function gitSync(args: string[], cwd?: string, input?: string, options?: GitSyncOptions): GitResult;
-export declare function gitAsync(args: string[], cwd?: string): Promise<GitResult>;
+export declare function gitAsync(args: string[], cwd?: string, input?: string): Promise<GitResult>;
 export declare function clone(url: string, dest: string, opts?: {
     ref?: string;
     depth?: number;

package/dist/core/git.js

@@ -10,9 +10,13 @@ export function gitSync(args, cwd, input, options = {}) {
     const timedOut = res.error?.code === 'ETIMEDOUT';
     return { status, stdout, stderr, ...(completed ? {} : { executionFailed: true }), ...(processError === undefined ? {} : { processError }), ...(timedOut ? { timedOut: true } : {}) };
 }
-export async function gitAsync(args, cwd) {
+export async function gitAsync(args, cwd, input) {
     return new Promise((resolve) => {
         const child = spawn('git', args, { cwd });
+        if (input === undefined)
+            child.stdin.end();
+        else
+            child.stdin.end(input);
         let stdout = '';
         let stderr = '';
         child.stdout.on('data', (d) => (stdout += d.toString()));

package/dist/core/runtime/fleet.d.ts

@@ -37,6 +37,12 @@ export interface FleetRegistry {
     register(nodeId: string, handle: HostHandle): void;
     /** The reviveNode double-launch guard: a fleet entry IS liveness. */
     has(nodeId: string): boolean;
+    /** True while ANY launch claim exists for this node — a registered broker OR
+     *  an in-flight reservation. `has` alone reads false during the window
+     *  between `reserveSlot` and registration, so a caller asking "could this
+     *  node come back to life right now?" (the managed-worktree sweep, before it
+     *  destroys a checkout) must ask this instead. */
+    isClaimed(nodeId: string): boolean;
     /** Live-fleet checks pass (yield-stall, wedge, fatal-fault). */
     get(nodeId: string): FleetEntry | undefined;
     /** The capacity count: registered brokers only, excluding reservations. */