@plot-pm/board 0.10.0 → 0.12.0

package/plot-release-refs.sh

@@ -44,6 +44,35 @@
 #   4. a branch checked out in ANY worktree         (somebody is reading it)
 #   5. the default branch itself                    (never ours to delete)
 #
+# THE SCRIPT DOES NOT OWN THE FIVE. They are conditions in
+# `packages/domain/src/rules/reapable.ts`'s `finishedWith`, which states every
+# condition that can hold a desk and judges none of them. This script and
+# `plot-reap.sh` were asking about the same desk in two places, and they had
+# already drifted: this one never asked whether a worker was alive, and the
+# reaper never asked `pr_open`. Each was blind to a condition the other
+# measured, and neither omission was argued for anywhere.
+#
+# WHAT CHANGED IS WHERE THE CONDITIONS ARE STATED, NOT WHICH ONES THIS SCRIPT
+# ASKS. The rule also answers `liveWorker`, `uncommittedChanges` and
+# `blockedMarker` — the reaper's three — and this script reads none of them.
+# Folding them in *"would silently widen a licence that was written narrow on
+# purpose"*, which is what line 30 above has warned since this script existed.
+# The rule makes the difference VISIBLE; making it disappear is a different
+# change, and it is not this one.
+#
+# `unknown` PERMITS HERE, AND THAT IS THE CALLER'S HALF. Four of the rule's
+# conditions need a worktree and 69% of branches have none (22 of 32, measured
+# 2026-09-06), so the rule answers `unknown` rather than inventing `false`. The
+# reaper reads `unknown` as *nothing to reap*; this reads it as *no evidence
+# against deletion*, which is exactly what it did before the rule existed.
+# Refusing on silence is the estate's rule for an unreachable HOST — applied to
+# a missing tree it would keep every ref on two branches in three and make this
+# script useless where the scan cost is highest.
+#
+# The SCOPE is still this script's and is not shared. The rule answers about
+# one branch and enumerates nothing; which branches to ask about stays bounded
+# by the plan file, for the reason the paragraph above gives.
+#
 # THE RULE THIS MUST NOT BREAK. `/plot-implement` says plainly: *"leave the ref
 # in place — never delete a remote ref another session may be reading."* Read in
 # context that rule governs GIVING A BRANCH UP — work that turned out
@@ -65,7 +94,7 @@ while [ $# -gt 0 ]; do
     --yes) DRY=0 ;;
     --dry-run) DRY=1 ;;
     --max) MAX="${2:-0}"; shift ;;
-    -h|--help) sed -n '2,60p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    -h|--help) sed -n '2,86p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
     -*) echo "plot-release-refs: unknown argument: $1" >&2; exit 2 ;;
     *) slug="$1" ;;
   esac
@@ -115,7 +144,17 @@ prefix_re=$(bash "$script_dir/plot-config.sh" get "Branch prefixes" "idea/, feat
 meta=$(bash "$script_dir/plot-plan-meta.sh" --prefixes "$prefix_re" "$plan_file" 2>/dev/null) || meta=""
 [ -n "$meta" ] || die "cannot parse '$plan_file' — refusing rather than guessing"
 
-# The default branch, via the host adapter when it can answer. Guard 5 compares
+# The shared rule, resolved from THIS SCRIPT's location rather than the cwd, and
+# as a `file://` URL because `import()` needs one for an absolute path. Missing
+# or unreadable, the decision below reports "could not be asked" and keeps every
+# ref — the same fail-safe `plot-reap.sh` applies to the same module.
+#
+# THIS SCRIPT NOW NEEDS NODE. The alternative is a second implementation of the
+# guards living in shell where nothing can test it, which is what this branch
+# exists to end: the two copies had already drifted apart by three readings.
+RULE_PATH="file://$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." 2>/dev/null && pwd)/packages/domain/src/rules/reapable.ts"
+
+# The default branch, via the host adapter when it can answer. The rule compares
 # against it, and a wrong answer here can only ever protect MORE.
 HOST="$script_dir/plot-host.sh"
 DEFAULT=main
@@ -123,18 +162,31 @@ if [ -x "$HOST" ]; then
   d=$("$HOST" default-branch 2>/dev/null) && [ -n "$d" ] && DEFAULT="$d"
 fi
 
-# Every branch currently checked out ANYWHERE, for guard 4.
+# Every branch currently checked out ANYWHERE, WITH THE TREE THAT HOLDS IT.
 #
 # Collected once, before the loop, rather than asked per branch: `git worktree
 # list` walks the whole estate and this script runs on the delivery path where
 # that estate may hold dozens of trees. The answer cannot change underneath a
 # single run in a way that matters — a worktree created mid-run holds a branch
 # whose ref this run has not yet reached, and the next run sees it.
+#
+# THE TREE'S STATE IS COLLECTED TOO, and that is what the shared rule needed.
+# `finishedWith` answers four conditions from a worktree, and it answers them
+# `unknown` where there is none — so it has to be told whether one was found.
+# That is a reading, not a refusal: this script asks none of those four, and
+# passing the tree is what lets the rule say `unknown` instead of inventing
+# `false`. Git's own `prunable` distinguishes a listed tree whose directory is
+# gone from one that was never made; both are unaskable, and the rule keeps the
+# two words apart because an operator acts on them differently.
 checked_out=$(git worktree list --porcelain 2>/dev/null \
-                | sed -n 's|^branch refs/heads/||p')
+                | awk '/^worktree /{wt=substr($0,10); pr="no"}
+                       /^prunable/{pr="yes"}
+                       /^branch refs\/heads\//{print substr($0,19) "\t" wt "\t" pr}')
 
-is_checked_out() {
-  printf '%s\n' "$checked_out" | grep -qxF "$1"
+# The worktree holding a branch and whether git calls it prunable, or empty
+# when no tree holds it.
+worktree_of() {
+  printf '%s\n' "$checked_out" | awk -F'\t' -v b="$1" '$1 == b {print $2 "\t" $3; exit}'
 }
 
 released=0; kept=0; deleted=0
@@ -149,51 +201,141 @@ printf '%-8s %-52s %s\n' "verdict" "branch" "why"
 while IFS=$'\t' read -r br deferred; do
   [ -n "$br" ] || continue
 
-  # 5. The default branch is never ours to delete, whatever a plan says. A plan
-  #    that names it is malformed, and acting on that is unrecoverable.
-  if [ "$br" = "$DEFAULT" ]; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "the default branch — never deleted"
-    kept=$((kept+1)); continue
-  fi
+  # THE READINGS, each taken once and none judged here. The script holds no
+  # `if` about whether a ref may go — only about which conditions it asks and
+  # what to do with the answers.
+  #
+  # `pr_merged` reads `mergedAt` on ANY PR (never `state`, never ancestry) and
+  # answers false when the host cannot be asked, so silence keeps the ref.
+  # `pr_open` is asked separately rather than derived from it: a branch carries
+  # both, and `changeset-release/main` is the measured case.
+  merge=not-merged
+  pr_merged "$br" && merge=merged
 
-  # 1. Given up, not finished. A `deferred:`/`moved:` annotation is what
-  #    `/plot-reconcile` reads to tell deliberate abandonment from a dead
-  #    worker, and it needs the REF to be there to read it against. Checked
-  #    before the host is even asked: this is a decision a person already
-  #    recorded, and no merge state overturns it.
-  if [ "$deferred" = "true" ]; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "deferred — a given-up branch keeps its ref"
-    kept=$((kept+1)); continue
-  fi
+  open_pr=false
+  pr_open "$br" && open_pr=true
 
-  # 2. THE GATE. Unlanded work keeps its ref, always — `Done when` item 12, and
-  #    the assertion a naive implementation passes without, since a sweep that
-  #    deletes every ref of a delivered plan satisfies item 11 and destroys
-  #    work that exists nowhere else. `pr_merged` also returns false when the
-  #    host cannot be asked, so silence keeps the ref.
-  if ! pr_merged "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "unlanded work — no merged PR"
-    kept=$((kept+1)); continue
+  # WHETHER A TREE HOLDS THE BRANCH, AND IN WHAT STATE. Three words, because
+  # the rule answers its four tree-sourced conditions `unknown` without one and
+  # `unknown` is a reading rather than a failure. `vanished` is git's own
+  # `prunable`: it reads like `absent` to every condition — there is equally
+  # nothing to measure — and stays a separate word because `git worktree prune`
+  # is the repair for one and not the other.
+  #
+  # NOTHING INSIDE THE TREE IS READ. A live pid, an uncommitted file and a
+  # `PLOT-BLOCKED` marker are the reaper's three conditions and this script
+  # asks none of them; measuring them here would put a refusal within one edit's
+  # reach of a licence written narrow on purpose. A checked-out branch keeps its
+  # ref whatever is going on inside it, which is guard 4 and needs no reading
+  # from the tree at all.
+  wt_line=$(worktree_of "$br")
+  wt=${wt_line%%$'\t'*}
+  prunable=${wt_line#*$'\t'}
+  tree=absent
+  if [ -n "$wt" ]; then
+    if [ "$prunable" = "yes" ] || [ ! -d "$wt" ]; then tree=vanished; else tree=present; fi
   fi
 
-  # 3. An OPEN PR vetoes, even where an older PR merged. Measured by hand on
-  #    2026-08-28: `changeset-release/main` is merged repeatedly, and Changesets
-  #    RECREATES and reuses that same branch for the next release — so its ref
-  #    carries a live release PR while an older PR of its own has merged.
-  #    Deleting it disturbs the release in flight.
-  if pr_open "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "an open PR is using this branch"
-    kept=$((kept+1)); continue
-  fi
+  # THE DECISION. `packages/domain/src/rules/reapable.ts`, imported directly —
+  # the same shape and the same reason as `plot-reap.sh`: node 24 strips the
+  # types, so there is no build step between this script and the rule, and the
+  # JS arrives on STDIN from a QUOTED heredoc so the shell expands none of it.
+  #
+  # ONE RULE, TWO CALLERS, AND THE CALLERS STAY DIFFERENT. `finishedWith`
+  # STATES every condition that can hold a desk and JUDGES none of them; which
+  # conditions refuse a ref is this caller's half, and it names exactly the five
+  # this script has always asked. The reaper reads the same rule and names its
+  # own. Neither script gains the other's, which is what makes the difference
+  # visible instead of eliminating it.
+  #
+  # `unknown` PERMITS, AND THE ORDER OF THE TESTS IS THE ARGUMENT. Only the
+  # first two conditions are answerable without a tree, and 69% of branches have
+  # none. `=== "true"` is therefore the test at every guard: `unknown` falls
+  # through, exactly as this script behaved before the rule existed. That is
+  # deliberate and it is the caller's decision to make — the reaper reads the
+  # same `unknown` as *nothing to reap*.
+  #
+  # A rule that cannot be asked REFUSES: node missing, the import failing, the
+  # module throwing all leave `verdict` empty, and an empty verdict keeps the
+  # ref and says why. Silence is never permission on this path either — that is
+  # the module being absent, which is not the same reading as a condition
+  # answering `unknown`.
+  verdict=$(PLOT_BRANCH="$br" PLOT_DEFAULT="$DEFAULT" PLOT_MERGE="$merge" \
+            PLOT_GIVEN_UP="$deferred" PLOT_OPEN_PR="$open_pr" \
+            PLOT_TREE="$tree" \
+            PLOT_CHECKED_OUT="$([ -n "$wt" ] && echo true || echo false)" \
+            PLOT_RULE="$RULE_PATH" \
+            node --input-type=module - <<'NODE_EOF' 2>/dev/null
+// An ABSOLUTE path derived from this script, never from the cwd: this runs
+// wherever the operator invoked it, and the reconcile suite runs it against
+// sandbox repos in the temp directory.
+//
+// NO APOSTROPHE MAY APPEAR ANYWHERE IN THIS BLOCK. bash 3.2 is /bin/bash on
+// macOS, and it is what the reconcile suite runs this script under when it
+// strips PATH. It parses the body of a quoted heredoc nested inside `$(...)`,
+// so one contraction opens a string that never closes and the whole file fails
+// to parse. The error reads `unexpected EOF` and names a line 30 further down,
+// which points nowhere near the apostrophe.
+const { finishedWith } = await import(process.env.PLOT_RULE);
+
+const held = finishedWith({
+  branch: process.env.PLOT_BRANCH,
+  defaultBranch: process.env.PLOT_DEFAULT,
+  // This script never looks at the main checkout as a tree; the branch test
+  // the rule makes is what catches the default branch.
+  isMain: false,
+  // The three the reaper measures and this script does not. They are passed
+  // empty because the rule shape asks for them, and the tree reading below is
+  // what makes them honest: with no tree they answer `unknown`, and this
+  // caller reads none of the three either way.
+  workerPid: null,
+  dirtyPath: "",
+  blockedMarker: false,
+  merge: process.env.PLOT_MERGE,
+  givenUp: process.env.PLOT_GIVEN_UP === "true",
+  openPr: process.env.PLOT_OPEN_PR === "true",
+  checkedOut: process.env.PLOT_CHECKED_OUT === "true",
+  tree: process.env.PLOT_TREE,
+});
+
+// THE FIVE GUARDS, in the order they have always been tested, and each
+// satisfied only by a condition answering `true`. `unknown` permits: it means
+// no evidence against deletion, which on this estate is the majority reading
+// and the one the script already acted on. `liveWorker`, `uncommittedChanges`
+// and `blockedMarker` are in `held` and are deliberately not consulted.
+const guards = [
+  ["given-up", held.givenUp, ""],
+  ["no-merged-pr", held.noMergedPr, ""],
+  ["open-pr", held.openPr, ""],
+  ["checked-out", held.checkedOut, ""],
+  ["on-default-branch", held.onDefaultBranch, process.env.PLOT_DEFAULT],
+];
+
+const refusal = guards.find(([, reading]) => reading === "true");
+
+process.stdout.write(refusal === undefined ? "delete\t" : `${refusal[0]}\t${refusal[2]}`);
+NODE_EOF
+  )
+
+  refusal=${verdict%%$'\t'*}
+  detail=${verdict#*$'\t'}
 
-  # 4. A ref another checkout is sitting on is one somebody is reading, and
-  #    deleting it pulls the branch out from under them. Measured 2026-08-28:
-  #    `bug/a-head-counts-its-own-waves` was merged AND checked out. This runs
-  #    after the reap, so a worktree still here is one the reaper's own five
-  #    measurements declined to remove — its verdict is inherited, not
-  #    second-guessed.
-  if is_checked_out "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "checked out in a worktree — somebody is reading it"
+  if [ "$refusal" != "delete" ]; then
+    # The rule named the refusal; this renders it. A verdict the rule could not
+    # produce is empty, and an empty refusal keeps the ref and says so.
+    case "$refusal" in
+      given-up)            why="deferred — a given-up branch keeps its ref" ;;
+      no-merged-pr)        why="unlanded work — no merged PR" ;;
+      open-pr)             why="an open PR is using this branch" ;;
+      checked-out)         why="checked out in a worktree — somebody is reading it" ;;
+      on-default-branch)   why="the default branch — never deleted" ;;
+      # No arm for `live-worker`, `uncommitted-changes` or `blocked-marker`.
+      # The rule answers all three and this script consults none, so none can
+      # reach here; an arm for one would be the first line of a licence this
+      # script does not hold.
+      *)                   why="the rule could not be asked — keeping the ref" ;;
+    esac
+    printf '%-8s %-52s %s\n' "keep" "$br" "$why"
     kept=$((kept+1)); continue
   fi
 

package/plot-resolve-artifact.sh

@@ -9,10 +9,11 @@
 # THE ONLY AUTOMATIC WRITE THIS SYSTEM GRANTS, and it is granted for three
 # verified reasons rather than for convenience:
 #
-#   1. `-merge` KEEPS THE FILE VALID. `.gitattributes` marks the artifact
+#   1. `-merge` KEEPS THE FILE VALID. `.gitattributes` marks every bundle
 #      `-merge`, so git keeps one side whole and writes NO conflict markers.
 #      The artifact stays buildable JavaScript *through* a conflict — which is
-#      why a script may touch it at all.
+#      why a script may touch it at all. `scripts/check-bundle-attributes.sh`
+#      is the gate that keeps that true of every bundle rather than of one.
 #   2. THE REBUILD IS DETERMINISTIC. Measured: `build.mjs` embeds no timestamp
 #      and no randomness, so the output does not depend on which side was kept.
 #   3. CI PROVES IT. The no-diff gate fails the build if the committed artifact
@@ -52,7 +53,7 @@
 # AN EMPTY CONFLICT SET IS NOT A REFUSAL ABOUT FILES. Three cases, named apart,
 # because two of them were once one:
 #
-#   exactly the artifact  → the licensed case                    → repair
+#   bundles only          → the licensed case                    → repair
 #   other files present   → needs judgement                      → not-artifact-only
 #   empty, no merge ran   → nothing was observed                 → not-observed
 #
@@ -70,10 +71,45 @@ set -uo pipefail
 
 script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
-# The one file this script may resolve. Named here as well as in the board's
-# contract because the two run in different languages and neither can import
-# the other's constant; the pairing is asserted by a test rather than trusted.
-ARTIFACT_PATH="skills/plot/scripts/board/board-server.mjs"
+# THE FILES THIS SCRIPT MAY RESOLVE — a SET, and derived rather than listed.
+#
+# It was one hardcoded filename until 2026-09-06, and that cost a repair the
+# same day: PR #727 conflicted in `plot-registryd.mjs` — a `-merge` bundle with
+# a deterministic rebuild, exactly the licensed case — and this script refused
+# `not-artifact-only` against a list naming only `board-server.mjs`. The refusal
+# was correct behaviour against a stale list. Hours later the same branch
+# conflicted in `board-server.mjs` and was repaired automatically: same class of
+# conflict, opposite outcome, one filename apart.
+#
+# DERIVED FROM `build.mjs`'S OWN DECLARATIONS, by the same pipeline
+# `scripts/check-bundle-attributes.sh` uses, because a hand-written list here
+# would be a fourth place to drift — and drift is the defect this replaces. The
+# build declares each output as `const shippedX = path.join(here, '…')`, which
+# is what an author writes when adding a bundle; nothing else has to be
+# remembered. Nine bundles today; `plot-landed.mjs` arrived while the plan that
+# asked for this was still in draft, and the derivation found it.
+#
+# `plot-monitor.mjs` IS DELIBERATELY ABSENT. It is committed and documented, and
+# no `outfile` names it — nothing rebuilds it. Property 2 above is the whole
+# licence, so a file with no deterministic rebuild cannot be on this list. The
+# derivation reads the build, so it cannot ask for it.
+#
+# Still named in the board's contract as well, because the two run in different
+# languages and neither can import the other's constant. The pairing is asserted
+# by a test rather than trusted — and that test now asserts SET EQUALITY, since
+# a set that agrees on one member and differs on another is exactly the drift
+# this replaces.
+#
+# READ FROM THE REPOSITORY BEING REPAIRED, not from this script's own checkout.
+# The script is vendored into the published package, where `packages/` does not
+# exist — and it rebuilds with `pnpm build:board` inside the target repo, so the
+# build that defines the set is the one that will run. Resolved below, once
+# `repo_root` is known.
+bundle_set() { # $1=repo root → one path per line, sorted
+  grep -aoE "shipped[A-Za-z]* = path\.join\([^)]*'[^']*'\)" "$1/packages/board/build.mjs" 2>/dev/null \
+    | sed -E "s|.*'\.\./\.\./([^']*)'.*|\1|" \
+    | sort -u
+}
 
 dry_run=0
 branch=""
@@ -109,6 +145,19 @@ MAIN=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^o
 
 repo_root=$(git rev-parse --show-toplevel)
 
+# THE SET, resolved against the repository this run will rebuild.
+ARTIFACT_PATHS=$(bundle_set "$repo_root")
+
+# AN EMPTY DERIVATION REFUSES, and it must: the guard below asks whether every
+# unmerged path is in this set, and against an empty set that question has no
+# true answer to give — but a guard written the other way round would have said
+# yes to everything. The build changing shape, or a checkout with no
+# `packages/`, is a reason to stop rather than a reason to repair blind.
+if [ -z "$ARTIFACT_PATHS" ]; then
+  echo "step: no bundles derived from packages/board/build.mjs — refusing"
+  finish refused no-bundle-set
+fi
+
 # WHICH WORKTREE HOLDS THIS BRANCH — ASK GIT, do not reconstruct the path from
 # the branch name.
 #
@@ -151,7 +200,10 @@ fi
 
 if [ "$dry_run" = 1 ]; then
   echo "step: would use worktree $wt"
-  echo "step: would merge origin/$MAIN, take a side of $ARTIFACT_PATH, rebuild, test"
+  echo "step: would merge origin/$MAIN, take a side of each conflicted bundle, rebuild, test"
+  printf 'step: bundle set (%s): %s\n' \
+    "$(printf '%s\n' "$ARTIFACT_PATHS" | grep -c .)" \
+    "$(printf '%s' "$ARTIFACT_PATHS" | tr '\n' ' ')"
   echo "step: would push only if pnpm run test:board passes"
   finish refused dry-run
 fi
@@ -274,23 +326,53 @@ if [ "$n_unmerged" = "0" ]; then
   finish refused not-observed
 fi
 
-# EXACTLY the artifact: one path, that path, nothing else. Not "the artifact
-# among the conflicts" — an implementation asking that passes every
-# artifact-only case and silently repairs merges that need judgement as a whole.
-if [ "$n_unmerged" != "1" ] || [ "$unmerged" != "$ARTIFACT_PATH" ]; then
+# EVERY unmerged path is a bundle: the conflict set is a SUBSET of the bundle
+# set, and nothing else is in it. NOT "a bundle is among the conflicts" — an
+# implementation asking that passes every bundle-only case and silently repairs
+# merges that need judgement as a whole. The claim stayed exact when the list
+# grew from one file to nine; only the thing each path is checked against
+# changed. A merge conflicting in a bundle AND anything else still needs a
+# person, even though one of its files does not.
+#
+# WALKED PER PATH rather than compared as a whole, because the conflict set is
+# an arbitrary subset of nine and there is no single string to compare it to.
+# The direction is what keeps it exact: every element of the observed set must
+# appear in the licensed set, so an unlicensed path can only ever refuse.
+outside=""
+while IFS= read -r conflict; do
+  [ -n "$conflict" ] || continue
+  if ! printf '%s\n' "$ARTIFACT_PATHS" | grep -qxF -- "$conflict"; then
+    outside="${outside}${outside:+ }$conflict"
+  fi
+done <<EOF
+$unmerged
+EOF
+
+if [ -n "$outside" ]; then
   git -C "$wt" merge --abort >/dev/null 2>&1 || true
-  echo "step: conflict set is not exactly the artifact — refusing"
+  echo "step: conflict set is not bundles only — refusing"
   printf 'step: unmerged: %s\n' "$(printf '%s' "$unmerged" | tr '\n' ' ')"
+  printf 'step: outside the bundle set: %s\n' "$outside"
   finish refused not-artifact-only
 fi
 
-# 3. Take a side. WHICH SIDE CANNOT MATTER — the rebuild overwrites it — and the
-#    diff is never read. `--theirs` because the command needs a word.
-git -C "$wt" checkout --theirs -- "$ARTIFACT_PATH" 2>/dev/null \
-  || git -C "$wt" checkout --ours -- "$ARTIFACT_PATH" 2>/dev/null \
-  || true
-git -C "$wt" add -- "$ARTIFACT_PATH" 2>/dev/null || true
-echo "step: took a side of $ARTIFACT_PATH (either — the rebuild decides)"
+# 3. Take a side of EACH conflicted bundle. WHICH SIDE CANNOT MATTER — the
+#    rebuild overwrites it — and the diff is never read. `--theirs` because the
+#    command needs a word.
+#
+#    Only the paths that actually conflicted, never the whole set: a bundle git
+#    merged cleanly has no side to take, and `checkout --theirs` on an unmerged-
+#    stage-free path errors rather than doing nothing useful.
+while IFS= read -r conflict; do
+  [ -n "$conflict" ] || continue
+  git -C "$wt" checkout --theirs -- "$conflict" 2>/dev/null \
+    || git -C "$wt" checkout --ours -- "$conflict" 2>/dev/null \
+    || true
+  git -C "$wt" add -- "$conflict" 2>/dev/null || true
+  echo "step: took a side of $conflict (either — the rebuild decides)"
+done <<EOF
+$unmerged
+EOF
 
 # 4. Rebuild, in the branch's OWN worktree. This is what makes the kept side
 #    irrelevant, and it is the property CI's no-diff gate then re-checks.
@@ -299,8 +381,19 @@ if ! (cd "$wt" && pnpm build:board >/dev/null 2>&1); then
   echo "step: rebuild failed — pushing nothing"
   finish abandoned build-failed
 fi
-git -C "$wt" add -- "$ARTIFACT_PATH" 2>/dev/null || true
-echo "step: rebuilt $ARTIFACT_PATH"
+# EVERY bundle is staged after the rebuild, not just the ones that conflicted.
+# `pnpm build:board` regenerates all nine, and a rebuild triggered by one
+# conflict can legitimately move another — the merge brought in source changes
+# for the whole package. Staging only the conflicted paths would leave those
+# modifications unstaged, and CI's no-diff gate would then fail the push for a
+# file this run had already rebuilt correctly.
+while IFS= read -r bundle; do
+  [ -n "$bundle" ] || continue
+  git -C "$wt" add -- "$bundle" 2>/dev/null || true
+done <<EOF
+$ARTIFACT_PATHS
+EOF
+printf 'step: rebuilt and staged %s bundle(s)\n' "$(printf '%s\n' "$ARTIFACT_PATHS" | grep -c .)"
 
 # The merge commit exists only once the rebuild has produced the artifact it
 # will carry. Committing before the build would leave a commit holding a stale

package/plot-transcript-quiet.sh

@@ -0,0 +1,142 @@
+#!/usr/bin/env bash
+# The ONE answer to "how long has this worktree's agent been quiet?" — sourced,
+# not run, by `plot-worker-monitor.sh`.
+#
+# It reads the AGENT rather than the machine. A `claude -p` session appends a
+# timestamped line to its transcript for every model turn, tool call and tool
+# result; the seconds since the newest of those lines is how long the agent has
+# produced nothing. A CPU sample answers *is this process on a core right now?*,
+# which is a different question and is zero for most of a working agent's life.
+#
+# ═══════════════════════════════════════════════════════════════════════════
+# THREE ANSWERS, AND THE THIRD IS NOT A FAILURE
+# ═══════════════════════════════════════════════════════════════════════════
+#
+#   <seconds>     the newest transcript line is that many seconds old
+#   unavailable   no transcript can be read for this worktree, INCLUDING the
+#                 case where the arguments name no worktree at all
+#
+# `unavailable` is a first-class answer, settled by
+# `the-registry-supervises-its-agents`: a capability the adopting project does
+# not provide is UNAVAILABLE, never failed and never zero. A caller that read
+# it as "quiet for 0 seconds" would report every unreadable agent healthy; one
+# that read it as an error would refuse to run where Plot's own contract says
+# it should degrade. So it is a word, and callers match on it.
+#
+# ═══════════════════════════════════════════════════════════════════════════
+# THE TRANSCRIPT IS FOUND BY PATH, NOT BY SESSION ID — AND THAT IS A CHOICE
+# ═══════════════════════════════════════════════════════════════════════════
+#
+# `.plot/worker-prompt.sh:29` DOES pass `--session-id` now (2026-09-04), so an
+# exact join is available here and this deliberately does not take it. The
+# reason is the question, not the capability: this asks *is anything happening
+# at this desk*, and an operator's own session at the same worktree is a true
+# answer to it. Joining on the worker's id alone would report a desk quiet
+# while somebody is visibly working at it.
+#
+# THE OPPOSITE JOIN IS RIGHT FOR THE OPPOSITE QUESTION. *What has THIS agent
+# spent* is per session and never per worktree — one project directory measured
+# 2026-09-03 held 45 session files, 30 of them subagents, and a sum across them
+# belongs to no one. `rules/spend.ts` states that side; the two read the same
+# files and must not be made to share a join.
+#
+# So the join here is the one `plot-quiet-stretch.mjs` already made and proved
+# on 23 real sessions: the runtime stores a session under
+# `$HOME/.claude/projects/<slug>` where the slug is the WORKTREE PATH with `/`
+# and `.` replaced by `-`. A dispatched worker has its own worktree, so the
+# path identifies the DESK without any id being passed anywhere.
+#
+# `agent-` PREFIXED FILES ARE SKIPPED, for wave 1's reason: a subagent's
+# transcript is a true statement about the wrong process. A worker whose
+# subagent is chatting while the worker itself has stopped must read as quiet.
+#
+# ═══════════════════════════════════════════════════════════════════════════
+# THE NEWEST LINE ACROSS ALL OF A WORKTREE'S SESSIONS
+# ═══════════════════════════════════════════════════════════════════════════
+#
+# A worktree can hold several sessions: a worker that hopped waves, or an
+# operator who opened a session at the same desk. Any of them producing output
+# means SOMEBODY is working there, and the monitor's question is about the desk.
+# Taking the maximum timestamp is the answer that never ends a live session
+# because a stale sibling exists beside it.
+
+# The runtime's project-slug derivation. Duplicated from `plot-quiet-stretch.mjs`
+# — which duplicates it from the board's `projectSlug` — because a monitor on a
+# 30s loop must not depend on a build step. One line, pinned by a test on each
+# side.
+plot_transcript_slug() { # $1=worktree path → slug
+  printf '%s' "$1" | tr '/.' '--'
+}
+
+# Where the runtime keeps this worktree's transcripts, or "" if nowhere.
+plot_transcript_dir() { # $1=worktree → directory path (may not exist)
+  local wt="$1" home="${PLOT_TRANSCRIPT_HOME:-${HOME:-}}"
+  [ -n "$wt" ] && [ -n "$home" ] || return 0
+  printf '%s/.claude/projects/%s' "$home" "$(plot_transcript_slug "$wt")"
+}
+
+# Seconds since this worktree's agent last wrote anything.
+#
+# THE MTIME IS THE READING, not the file's contents. The runtime appends as it
+# works, so the file's modification time IS the timestamp of its newest line —
+# and reading it costs one `stat` rather than parsing a transcript that reaches
+# tens of megabytes on a long session. Wave 1 parsed timestamps because it was
+# measuring a DISTRIBUTION of past gaps; this needs only the newest, on a 30s
+# loop, for as many workers as the machine holds.
+#
+# A CLOCK IS THE RIGHT INSTRUMENT HERE, and that is worth stating because Plot
+# usually refuses one. `plot-estate-changed.sh` hashes content rather than
+# reading mtime, because its question is *did this change?* and a checkout moves
+# mtime without changing anything. This question is *how long since output?* —
+# which is a question about elapsed time, and mtime is the measurement of it.
+plot_transcript_quiet_seconds() { # $1=worktree → seconds | unavailable
+  local wt="$1" dir newest now mtime
+  dir=$(plot_transcript_dir "$wt")
+  [ -n "$dir" ] && [ -d "$dir" ] || { printf 'unavailable'; return 0; }
+
+  # The newest mtime across every non-`agent-` session file in the directory.
+  # `find -print0` and a while-read keep paths with spaces intact; `stat` is
+  # asked once per file, and a worktree holds one to eight.
+  newest=''
+  while IFS= read -r -d '' f; do
+    case "$(basename "$f")" in agent-*) continue ;; esac
+    mtime=$(plot_transcript_mtime "$f") || continue
+    [ -n "$mtime" ] || continue
+    if [ -z "$newest" ] || [ "$mtime" -gt "$newest" ] 2>/dev/null; then newest="$mtime"; fi
+  done < <(find "$dir" -maxdepth 1 -type f -name '*.jsonl' -print0 2>/dev/null)
+
+  # A directory that exists but holds no session file is still UNAVAILABLE. The
+  # runtime creates the directory when the project is first opened, so an empty
+  # one means no session has written here — which is exactly "no transcript can
+  # be read", not "quiet for a very long time".
+  [ -n "$newest" ] || { printf 'unavailable'; return 0; }
+
+  now=$(date +%s)
+  local quiet=$(( now - newest ))
+  # A transcript written in the future — a clock skew across a mounted volume —
+  # reads as zero rather than negative. An end condition comparing a negative
+  # against a threshold would behave correctly by accident here and not
+  # elsewhere; clamping says what is meant.
+  [ "$quiet" -lt 0 ] && quiet=0
+  printf '%s' "$quiet"
+}
+
+# A file's modification time as a unix epoch. BSD and GNU `stat` disagree on the
+# flag, and a monitor that works on the author's laptop and not in CI is a
+# monitor nobody trusts.
+#
+# THE `||` IS NOT ENOUGH, AND CI MEASURED WHY. On Linux `stat -f` is not an
+# unknown flag — it means FILESYSTEM info, and it SUCCEEDS. So the BSD form
+# never falls through: it printed `Namelen: 255  Type: ext2/ext3` and the
+# caller subtracted that from a clock. Two of this branch's own tests failed on
+# it, 2026-09-02, having passed on macOS.
+#
+# So the answer is validated rather than trusted. Each form must yield digits;
+# anything else is treated as that form not being available here.
+plot_transcript_mtime() { # $1=file → epoch seconds
+  local m
+  m=$(stat -c '%Y' "$1" 2>/dev/null)
+  case "$m" in ''|*[!0-9]*) m=$(stat -f '%m' "$1" 2>/dev/null) ;; esac
+  case "$m" in ''|*[!0-9]*) return 1 ;; esac
+  printf '%s' "$m"
+}