@plot-pm/board 0.11.0 → 0.13.0

package/plot-release-refs.sh

@@ -44,6 +44,35 @@
 #   4. a branch checked out in ANY worktree         (somebody is reading it)
 #   5. the default branch itself                    (never ours to delete)
 #
+# THE SCRIPT DOES NOT OWN THE FIVE. They are conditions in
+# `packages/domain/src/rules/reapable.ts`'s `finishedWith`, which states every
+# condition that can hold a desk and judges none of them. This script and
+# `plot-reap.sh` were asking about the same desk in two places, and they had
+# already drifted: this one never asked whether a worker was alive, and the
+# reaper never asked `pr_open`. Each was blind to a condition the other
+# measured, and neither omission was argued for anywhere.
+#
+# WHAT CHANGED IS WHERE THE CONDITIONS ARE STATED, NOT WHICH ONES THIS SCRIPT
+# ASKS. The rule also answers `liveWorker`, `uncommittedChanges` and
+# `blockedMarker` — the reaper's three — and this script reads none of them.
+# Folding them in *"would silently widen a licence that was written narrow on
+# purpose"*, which is what line 30 above has warned since this script existed.
+# The rule makes the difference VISIBLE; making it disappear is a different
+# change, and it is not this one.
+#
+# `unknown` PERMITS HERE, AND THAT IS THE CALLER'S HALF. Four of the rule's
+# conditions need a worktree and 69% of branches have none (22 of 32, measured
+# 2026-09-06), so the rule answers `unknown` rather than inventing `false`. The
+# reaper reads `unknown` as *nothing to reap*; this reads it as *no evidence
+# against deletion*, which is exactly what it did before the rule existed.
+# Refusing on silence is the estate's rule for an unreachable HOST — applied to
+# a missing tree it would keep every ref on two branches in three and make this
+# script useless where the scan cost is highest.
+#
+# The SCOPE is still this script's and is not shared. The rule answers about
+# one branch and enumerates nothing; which branches to ask about stays bounded
+# by the plan file, for the reason the paragraph above gives.
+#
 # THE RULE THIS MUST NOT BREAK. `/plot-implement` says plainly: *"leave the ref
 # in place — never delete a remote ref another session may be reading."* Read in
 # context that rule governs GIVING A BRANCH UP — work that turned out
@@ -65,7 +94,7 @@ while [ $# -gt 0 ]; do
     --yes) DRY=0 ;;
     --dry-run) DRY=1 ;;
     --max) MAX="${2:-0}"; shift ;;
-    -h|--help) sed -n '2,60p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
+    -h|--help) sed -n '2,86p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
     -*) echo "plot-release-refs: unknown argument: $1" >&2; exit 2 ;;
     *) slug="$1" ;;
   esac
@@ -115,7 +144,17 @@ prefix_re=$(bash "$script_dir/plot-config.sh" get "Branch prefixes" "idea/, feat
 meta=$(bash "$script_dir/plot-plan-meta.sh" --prefixes "$prefix_re" "$plan_file" 2>/dev/null) || meta=""
 [ -n "$meta" ] || die "cannot parse '$plan_file' — refusing rather than guessing"
 
-# The default branch, via the host adapter when it can answer. Guard 5 compares
+# The shared rule, resolved from THIS SCRIPT's location rather than the cwd, and
+# as a `file://` URL because `import()` needs one for an absolute path. Missing
+# or unreadable, the decision below reports "could not be asked" and keeps every
+# ref — the same fail-safe `plot-reap.sh` applies to the same module.
+#
+# THIS SCRIPT NOW NEEDS NODE. The alternative is a second implementation of the
+# guards living in shell where nothing can test it, which is what this branch
+# exists to end: the two copies had already drifted apart by three readings.
+RULE_PATH="file://$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." 2>/dev/null && pwd)/packages/domain/src/rules/reapable.ts"
+
+# The default branch, via the host adapter when it can answer. The rule compares
 # against it, and a wrong answer here can only ever protect MORE.
 HOST="$script_dir/plot-host.sh"
 DEFAULT=main
@@ -123,18 +162,31 @@ if [ -x "$HOST" ]; then
   d=$("$HOST" default-branch 2>/dev/null) && [ -n "$d" ] && DEFAULT="$d"
 fi
 
-# Every branch currently checked out ANYWHERE, for guard 4.
+# Every branch currently checked out ANYWHERE, WITH THE TREE THAT HOLDS IT.
 #
 # Collected once, before the loop, rather than asked per branch: `git worktree
 # list` walks the whole estate and this script runs on the delivery path where
 # that estate may hold dozens of trees. The answer cannot change underneath a
 # single run in a way that matters — a worktree created mid-run holds a branch
 # whose ref this run has not yet reached, and the next run sees it.
+#
+# THE TREE'S STATE IS COLLECTED TOO, and that is what the shared rule needed.
+# `finishedWith` answers four conditions from a worktree, and it answers them
+# `unknown` where there is none — so it has to be told whether one was found.
+# That is a reading, not a refusal: this script asks none of those four, and
+# passing the tree is what lets the rule say `unknown` instead of inventing
+# `false`. Git's own `prunable` distinguishes a listed tree whose directory is
+# gone from one that was never made; both are unaskable, and the rule keeps the
+# two words apart because an operator acts on them differently.
 checked_out=$(git worktree list --porcelain 2>/dev/null \
-                | sed -n 's|^branch refs/heads/||p')
+                | awk '/^worktree /{wt=substr($0,10); pr="no"}
+                       /^prunable/{pr="yes"}
+                       /^branch refs\/heads\//{print substr($0,19) "\t" wt "\t" pr}')
 
-is_checked_out() {
-  printf '%s\n' "$checked_out" | grep -qxF "$1"
+# The worktree holding a branch and whether git calls it prunable, or empty
+# when no tree holds it.
+worktree_of() {
+  printf '%s\n' "$checked_out" | awk -F'\t' -v b="$1" '$1 == b {print $2 "\t" $3; exit}'
 }
 
 released=0; kept=0; deleted=0
@@ -149,51 +201,141 @@ printf '%-8s %-52s %s\n' "verdict" "branch" "why"
 while IFS=$'\t' read -r br deferred; do
   [ -n "$br" ] || continue
 
-  # 5. The default branch is never ours to delete, whatever a plan says. A plan
-  #    that names it is malformed, and acting on that is unrecoverable.
-  if [ "$br" = "$DEFAULT" ]; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "the default branch — never deleted"
-    kept=$((kept+1)); continue
-  fi
+  # THE READINGS, each taken once and none judged here. The script holds no
+  # `if` about whether a ref may go — only about which conditions it asks and
+  # what to do with the answers.
+  #
+  # `pr_merged` reads `mergedAt` on ANY PR (never `state`, never ancestry) and
+  # answers false when the host cannot be asked, so silence keeps the ref.
+  # `pr_open` is asked separately rather than derived from it: a branch carries
+  # both, and `changeset-release/main` is the measured case.
+  merge=not-merged
+  pr_merged "$br" && merge=merged
 
-  # 1. Given up, not finished. A `deferred:`/`moved:` annotation is what
-  #    `/plot-reconcile` reads to tell deliberate abandonment from a dead
-  #    worker, and it needs the REF to be there to read it against. Checked
-  #    before the host is even asked: this is a decision a person already
-  #    recorded, and no merge state overturns it.
-  if [ "$deferred" = "true" ]; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "deferred — a given-up branch keeps its ref"
-    kept=$((kept+1)); continue
-  fi
+  open_pr=false
+  pr_open "$br" && open_pr=true
 
-  # 2. THE GATE. Unlanded work keeps its ref, always — `Done when` item 12, and
-  #    the assertion a naive implementation passes without, since a sweep that
-  #    deletes every ref of a delivered plan satisfies item 11 and destroys
-  #    work that exists nowhere else. `pr_merged` also returns false when the
-  #    host cannot be asked, so silence keeps the ref.
-  if ! pr_merged "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "unlanded work — no merged PR"
-    kept=$((kept+1)); continue
+  # WHETHER A TREE HOLDS THE BRANCH, AND IN WHAT STATE. Three words, because
+  # the rule answers its four tree-sourced conditions `unknown` without one and
+  # `unknown` is a reading rather than a failure. `vanished` is git's own
+  # `prunable`: it reads like `absent` to every condition — there is equally
+  # nothing to measure — and stays a separate word because `git worktree prune`
+  # is the repair for one and not the other.
+  #
+  # NOTHING INSIDE THE TREE IS READ. A live pid, an uncommitted file and a
+  # `PLOT-BLOCKED` marker are the reaper's three conditions and this script
+  # asks none of them; measuring them here would put a refusal within one edit's
+  # reach of a licence written narrow on purpose. A checked-out branch keeps its
+  # ref whatever is going on inside it, which is guard 4 and needs no reading
+  # from the tree at all.
+  wt_line=$(worktree_of "$br")
+  wt=${wt_line%%$'\t'*}
+  prunable=${wt_line#*$'\t'}
+  tree=absent
+  if [ -n "$wt" ]; then
+    if [ "$prunable" = "yes" ] || [ ! -d "$wt" ]; then tree=vanished; else tree=present; fi
   fi
 
-  # 3. An OPEN PR vetoes, even where an older PR merged. Measured by hand on
-  #    2026-08-28: `changeset-release/main` is merged repeatedly, and Changesets
-  #    RECREATES and reuses that same branch for the next release — so its ref
-  #    carries a live release PR while an older PR of its own has merged.
-  #    Deleting it disturbs the release in flight.
-  if pr_open "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "an open PR is using this branch"
-    kept=$((kept+1)); continue
-  fi
+  # THE DECISION. `packages/domain/src/rules/reapable.ts`, imported directly —
+  # the same shape and the same reason as `plot-reap.sh`: node 24 strips the
+  # types, so there is no build step between this script and the rule, and the
+  # JS arrives on STDIN from a QUOTED heredoc so the shell expands none of it.
+  #
+  # ONE RULE, TWO CALLERS, AND THE CALLERS STAY DIFFERENT. `finishedWith`
+  # STATES every condition that can hold a desk and JUDGES none of them; which
+  # conditions refuse a ref is this caller's half, and it names exactly the five
+  # this script has always asked. The reaper reads the same rule and names its
+  # own. Neither script gains the other's, which is what makes the difference
+  # visible instead of eliminating it.
+  #
+  # `unknown` PERMITS, AND THE ORDER OF THE TESTS IS THE ARGUMENT. Only the
+  # first two conditions are answerable without a tree, and 69% of branches have
+  # none. `=== "true"` is therefore the test at every guard: `unknown` falls
+  # through, exactly as this script behaved before the rule existed. That is
+  # deliberate and it is the caller's decision to make — the reaper reads the
+  # same `unknown` as *nothing to reap*.
+  #
+  # A rule that cannot be asked REFUSES: node missing, the import failing, the
+  # module throwing all leave `verdict` empty, and an empty verdict keeps the
+  # ref and says why. Silence is never permission on this path either — that is
+  # the module being absent, which is not the same reading as a condition
+  # answering `unknown`.
+  verdict=$(PLOT_BRANCH="$br" PLOT_DEFAULT="$DEFAULT" PLOT_MERGE="$merge" \
+            PLOT_GIVEN_UP="$deferred" PLOT_OPEN_PR="$open_pr" \
+            PLOT_TREE="$tree" \
+            PLOT_CHECKED_OUT="$([ -n "$wt" ] && echo true || echo false)" \
+            PLOT_RULE="$RULE_PATH" \
+            node --input-type=module - <<'NODE_EOF' 2>/dev/null
+// An ABSOLUTE path derived from this script, never from the cwd: this runs
+// wherever the operator invoked it, and the reconcile suite runs it against
+// sandbox repos in the temp directory.
+//
+// NO APOSTROPHE MAY APPEAR ANYWHERE IN THIS BLOCK. bash 3.2 is /bin/bash on
+// macOS, and it is what the reconcile suite runs this script under when it
+// strips PATH. It parses the body of a quoted heredoc nested inside `$(...)`,
+// so one contraction opens a string that never closes and the whole file fails
+// to parse. The error reads `unexpected EOF` and names a line 30 further down,
+// which points nowhere near the apostrophe.
+const { finishedWith } = await import(process.env.PLOT_RULE);
+
+const held = finishedWith({
+  branch: process.env.PLOT_BRANCH,
+  defaultBranch: process.env.PLOT_DEFAULT,
+  // This script never looks at the main checkout as a tree; the branch test
+  // the rule makes is what catches the default branch.
+  isMain: false,
+  // The three the reaper measures and this script does not. They are passed
+  // empty because the rule shape asks for them, and the tree reading below is
+  // what makes them honest: with no tree they answer `unknown`, and this
+  // caller reads none of the three either way.
+  workerPid: null,
+  dirtyPath: "",
+  blockedMarker: false,
+  merge: process.env.PLOT_MERGE,
+  givenUp: process.env.PLOT_GIVEN_UP === "true",
+  openPr: process.env.PLOT_OPEN_PR === "true",
+  checkedOut: process.env.PLOT_CHECKED_OUT === "true",
+  tree: process.env.PLOT_TREE,
+});
+
+// THE FIVE GUARDS, in the order they have always been tested, and each
+// satisfied only by a condition answering `true`. `unknown` permits: it means
+// no evidence against deletion, which on this estate is the majority reading
+// and the one the script already acted on. `liveWorker`, `uncommittedChanges`
+// and `blockedMarker` are in `held` and are deliberately not consulted.
+const guards = [
+  ["given-up", held.givenUp, ""],
+  ["no-merged-pr", held.noMergedPr, ""],
+  ["open-pr", held.openPr, ""],
+  ["checked-out", held.checkedOut, ""],
+  ["on-default-branch", held.onDefaultBranch, process.env.PLOT_DEFAULT],
+];
+
+const refusal = guards.find(([, reading]) => reading === "true");
+
+process.stdout.write(refusal === undefined ? "delete\t" : `${refusal[0]}\t${refusal[2]}`);
+NODE_EOF
+  )
+
+  refusal=${verdict%%$'\t'*}
+  detail=${verdict#*$'\t'}
 
-  # 4. A ref another checkout is sitting on is one somebody is reading, and
-  #    deleting it pulls the branch out from under them. Measured 2026-08-28:
-  #    `bug/a-head-counts-its-own-waves` was merged AND checked out. This runs
-  #    after the reap, so a worktree still here is one the reaper's own five
-  #    measurements declined to remove — its verdict is inherited, not
-  #    second-guessed.
-  if is_checked_out "$br"; then
-    printf '%-8s %-52s %s\n' "keep" "$br" "checked out in a worktree — somebody is reading it"
+  if [ "$refusal" != "delete" ]; then
+    # The rule named the refusal; this renders it. A verdict the rule could not
+    # produce is empty, and an empty refusal keeps the ref and says so.
+    case "$refusal" in
+      given-up)            why="deferred — a given-up branch keeps its ref" ;;
+      no-merged-pr)        why="unlanded work — no merged PR" ;;
+      open-pr)             why="an open PR is using this branch" ;;
+      checked-out)         why="checked out in a worktree — somebody is reading it" ;;
+      on-default-branch)   why="the default branch — never deleted" ;;
+      # No arm for `live-worker`, `uncommitted-changes` or `blocked-marker`.
+      # The rule answers all three and this script consults none, so none can
+      # reach here; an arm for one would be the first line of a licence this
+      # script does not hold.
+      *)                   why="the rule could not be asked — keeping the ref" ;;
+    esac
+    printf '%-8s %-52s %s\n' "keep" "$br" "$why"
     kept=$((kept+1)); continue
   fi
 

package/plot-resolve-artifact.sh

@@ -9,10 +9,11 @@
 # THE ONLY AUTOMATIC WRITE THIS SYSTEM GRANTS, and it is granted for three
 # verified reasons rather than for convenience:
 #
-#   1. `-merge` KEEPS THE FILE VALID. `.gitattributes` marks the artifact
+#   1. `-merge` KEEPS THE FILE VALID. `.gitattributes` marks every bundle
 #      `-merge`, so git keeps one side whole and writes NO conflict markers.
 #      The artifact stays buildable JavaScript *through* a conflict — which is
-#      why a script may touch it at all.
+#      why a script may touch it at all. `scripts/check-bundle-attributes.sh`
+#      is the gate that keeps that true of every bundle rather than of one.
 #   2. THE REBUILD IS DETERMINISTIC. Measured: `build.mjs` embeds no timestamp
 #      and no randomness, so the output does not depend on which side was kept.
 #   3. CI PROVES IT. The no-diff gate fails the build if the committed artifact
@@ -52,7 +53,7 @@
 # AN EMPTY CONFLICT SET IS NOT A REFUSAL ABOUT FILES. Three cases, named apart,
 # because two of them were once one:
 #
-#   exactly the artifact  → the licensed case                    → repair
+#   bundles only          → the licensed case                    → repair
 #   other files present   → needs judgement                      → not-artifact-only
 #   empty, no merge ran   → nothing was observed                 → not-observed
 #
@@ -70,10 +71,45 @@ set -uo pipefail
 
 script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 
-# The one file this script may resolve. Named here as well as in the board's
-# contract because the two run in different languages and neither can import
-# the other's constant; the pairing is asserted by a test rather than trusted.
-ARTIFACT_PATH="skills/plot/scripts/board/board-server.mjs"
+# THE FILES THIS SCRIPT MAY RESOLVE — a SET, and derived rather than listed.
+#
+# It was one hardcoded filename until 2026-09-06, and that cost a repair the
+# same day: PR #727 conflicted in `plot-registryd.mjs` — a `-merge` bundle with
+# a deterministic rebuild, exactly the licensed case — and this script refused
+# `not-artifact-only` against a list naming only `board-server.mjs`. The refusal
+# was correct behaviour against a stale list. Hours later the same branch
+# conflicted in `board-server.mjs` and was repaired automatically: same class of
+# conflict, opposite outcome, one filename apart.
+#
+# DERIVED FROM `build.mjs`'S OWN DECLARATIONS, by the same pipeline
+# `scripts/check-bundle-attributes.sh` uses, because a hand-written list here
+# would be a fourth place to drift — and drift is the defect this replaces. The
+# build declares each output as `const shippedX = path.join(here, '…')`, which
+# is what an author writes when adding a bundle; nothing else has to be
+# remembered. Nine bundles today; `plot-landed.mjs` arrived while the plan that
+# asked for this was still in draft, and the derivation found it.
+#
+# `plot-monitor.mjs` IS DELIBERATELY ABSENT. It is committed and documented, and
+# no `outfile` names it — nothing rebuilds it. Property 2 above is the whole
+# licence, so a file with no deterministic rebuild cannot be on this list. The
+# derivation reads the build, so it cannot ask for it.
+#
+# Still named in the board's contract as well, because the two run in different
+# languages and neither can import the other's constant. The pairing is asserted
+# by a test rather than trusted — and that test now asserts SET EQUALITY, since
+# a set that agrees on one member and differs on another is exactly the drift
+# this replaces.
+#
+# READ FROM THE REPOSITORY BEING REPAIRED, not from this script's own checkout.
+# The script is vendored into the published package, where `packages/` does not
+# exist — and it rebuilds with `pnpm build:board` inside the target repo, so the
+# build that defines the set is the one that will run. Resolved below, once
+# `repo_root` is known.
+bundle_set() { # $1=repo root → one path per line, sorted
+  grep -aoE "shipped[A-Za-z]* = path\.join\([^)]*'[^']*'\)" "$1/packages/board/build.mjs" 2>/dev/null \
+    | sed -E "s|.*'\.\./\.\./([^']*)'.*|\1|" \
+    | sort -u
+}
 
 dry_run=0
 branch=""
@@ -109,6 +145,19 @@ MAIN=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's#^o
 
 repo_root=$(git rev-parse --show-toplevel)
 
+# THE SET, resolved against the repository this run will rebuild.
+ARTIFACT_PATHS=$(bundle_set "$repo_root")
+
+# AN EMPTY DERIVATION REFUSES, and it must: the guard below asks whether every
+# unmerged path is in this set, and against an empty set that question has no
+# true answer to give — but a guard written the other way round would have said
+# yes to everything. The build changing shape, or a checkout with no
+# `packages/`, is a reason to stop rather than a reason to repair blind.
+if [ -z "$ARTIFACT_PATHS" ]; then
+  echo "step: no bundles derived from packages/board/build.mjs — refusing"
+  finish refused no-bundle-set
+fi
+
 # WHICH WORKTREE HOLDS THIS BRANCH — ASK GIT, do not reconstruct the path from
 # the branch name.
 #
@@ -151,7 +200,10 @@ fi
 
 if [ "$dry_run" = 1 ]; then
   echo "step: would use worktree $wt"
-  echo "step: would merge origin/$MAIN, take a side of $ARTIFACT_PATH, rebuild, test"
+  echo "step: would merge origin/$MAIN, take a side of each conflicted bundle, rebuild, test"
+  printf 'step: bundle set (%s): %s\n' \
+    "$(printf '%s\n' "$ARTIFACT_PATHS" | grep -c .)" \
+    "$(printf '%s' "$ARTIFACT_PATHS" | tr '\n' ' ')"
   echo "step: would push only if pnpm run test:board passes"
   finish refused dry-run
 fi
@@ -274,23 +326,53 @@ if [ "$n_unmerged" = "0" ]; then
   finish refused not-observed
 fi
 
-# EXACTLY the artifact: one path, that path, nothing else. Not "the artifact
-# among the conflicts" — an implementation asking that passes every
-# artifact-only case and silently repairs merges that need judgement as a whole.
-if [ "$n_unmerged" != "1" ] || [ "$unmerged" != "$ARTIFACT_PATH" ]; then
+# EVERY unmerged path is a bundle: the conflict set is a SUBSET of the bundle
+# set, and nothing else is in it. NOT "a bundle is among the conflicts" — an
+# implementation asking that passes every bundle-only case and silently repairs
+# merges that need judgement as a whole. The claim stayed exact when the list
+# grew from one file to nine; only the thing each path is checked against
+# changed. A merge conflicting in a bundle AND anything else still needs a
+# person, even though one of its files does not.
+#
+# WALKED PER PATH rather than compared as a whole, because the conflict set is
+# an arbitrary subset of nine and there is no single string to compare it to.
+# The direction is what keeps it exact: every element of the observed set must
+# appear in the licensed set, so an unlicensed path can only ever refuse.
+outside=""
+while IFS= read -r conflict; do
+  [ -n "$conflict" ] || continue
+  if ! printf '%s\n' "$ARTIFACT_PATHS" | grep -qxF -- "$conflict"; then
+    outside="${outside}${outside:+ }$conflict"
+  fi
+done <<EOF
+$unmerged
+EOF
+
+if [ -n "$outside" ]; then
   git -C "$wt" merge --abort >/dev/null 2>&1 || true
-  echo "step: conflict set is not exactly the artifact — refusing"
+  echo "step: conflict set is not bundles only — refusing"
   printf 'step: unmerged: %s\n' "$(printf '%s' "$unmerged" | tr '\n' ' ')"
+  printf 'step: outside the bundle set: %s\n' "$outside"
   finish refused not-artifact-only
 fi
 
-# 3. Take a side. WHICH SIDE CANNOT MATTER — the rebuild overwrites it — and the
-#    diff is never read. `--theirs` because the command needs a word.
-git -C "$wt" checkout --theirs -- "$ARTIFACT_PATH" 2>/dev/null \
-  || git -C "$wt" checkout --ours -- "$ARTIFACT_PATH" 2>/dev/null \
-  || true
-git -C "$wt" add -- "$ARTIFACT_PATH" 2>/dev/null || true
-echo "step: took a side of $ARTIFACT_PATH (either — the rebuild decides)"
+# 3. Take a side of EACH conflicted bundle. WHICH SIDE CANNOT MATTER — the
+#    rebuild overwrites it — and the diff is never read. `--theirs` because the
+#    command needs a word.
+#
+#    Only the paths that actually conflicted, never the whole set: a bundle git
+#    merged cleanly has no side to take, and `checkout --theirs` on an unmerged-
+#    stage-free path errors rather than doing nothing useful.
+while IFS= read -r conflict; do
+  [ -n "$conflict" ] || continue
+  git -C "$wt" checkout --theirs -- "$conflict" 2>/dev/null \
+    || git -C "$wt" checkout --ours -- "$conflict" 2>/dev/null \
+    || true
+  git -C "$wt" add -- "$conflict" 2>/dev/null || true
+  echo "step: took a side of $conflict (either — the rebuild decides)"
+done <<EOF
+$unmerged
+EOF
 
 # 4. Rebuild, in the branch's OWN worktree. This is what makes the kept side
 #    irrelevant, and it is the property CI's no-diff gate then re-checks.
@@ -299,8 +381,19 @@ if ! (cd "$wt" && pnpm build:board >/dev/null 2>&1); then
   echo "step: rebuild failed — pushing nothing"
   finish abandoned build-failed
 fi
-git -C "$wt" add -- "$ARTIFACT_PATH" 2>/dev/null || true
-echo "step: rebuilt $ARTIFACT_PATH"
+# EVERY bundle is staged after the rebuild, not just the ones that conflicted.
+# `pnpm build:board` regenerates all nine, and a rebuild triggered by one
+# conflict can legitimately move another — the merge brought in source changes
+# for the whole package. Staging only the conflicted paths would leave those
+# modifications unstaged, and CI's no-diff gate would then fail the push for a
+# file this run had already rebuilt correctly.
+while IFS= read -r bundle; do
+  [ -n "$bundle" ] || continue
+  git -C "$wt" add -- "$bundle" 2>/dev/null || true
+done <<EOF
+$ARTIFACT_PATHS
+EOF
+printf 'step: rebuilt and staged %s bundle(s)\n' "$(printf '%s\n' "$ARTIFACT_PATHS" | grep -c .)"
 
 # The merge commit exists only once the rebuild has produced the artifact it
 # will carry. Committing before the build would leave a commit holding a stale

package/plot-worker-state.sh

@@ -754,3 +754,97 @@ plot_worker_state() { # $1=worktree $2=pr-fact → "state\tpid\tcode"
   # mistake in the other direction.
   printf 'ended\t%s\t' "$pid"
 }
+
+# ---------------------------------------------------------------------------
+# THE SAME READINGS, HANDED OUT RATHER THAN DECIDED
+# ---------------------------------------------------------------------------
+#
+# `plot_worker_state` above gathers six facts and turns them into a word. So
+# does `rules/agent-state.ts`, and `docs/shell-and-domain.md` says why both
+# exist: this function is sourced inside per-branch loops and by the agent's own
+# loop, where a `node` hop is 39 ms every caller pays on every pass, while the
+# board and the supervisor are already in node and pay nothing.
+#
+# WHAT THE PAIR NEEDS IS THE READINGS, NOT THE WORD. A caller handed `finished`
+# can only compare two strings; a caller handed the six facts can ask the domain
+# rule and compare its answer to this file's. That is what the corpus test does,
+# and it is why this function exists at all.
+#
+# ONE GATHERING, TWO CONSUMERS. Every fact below is read the way
+# `plot_worker_state` reads it — the manifest first and the worktree file as the
+# fallback, `plot_pid_is_current` for staleness, the same `PLOT-BLOCKED*` glob
+# and the same dirty filter. A second gathering that drifted would make the
+# corpus test compare this file against itself and pass while production broke.
+#
+# Prints one TAB-separated line, six fields:
+#
+#   worktree_here  pid_recorded  liveness  exit  blocked  dirty  unpushed
+#
+# `liveness` is `live`, `stale` or `dead`; `exit` is the code as read, empty for
+# an unreadable record and the literal `-` for an absent one, because an empty
+# field cannot say which of the two it is and the rule answers them alike only
+# because it was told they differ. The PR fact is NOT here: it comes from the
+# caller, exactly as it does for `plot_worker_state`.
+plot_worker_readings() { # $1=worktree → "here\tpid\tliveness\texit\tblocked\tdirty\tunpushed"
+  local wt="$1" pid="" started_at="" manifest_data="" manifest=""
+  local here=1 pid_recorded=0 liveness=dead exit_field='-' blocked=0 dirty=0 ahead=""
+
+  # NO WORKTREE IS ANSWERED FIRST, and it is a question about the worktree LIST
+  # rather than about anything inside one — the same split `worker_of` makes in
+  # `plot-fleet-scan.sh`, where `elsewhere` is decided before this file is
+  # reached. A caller iterating worktrees it found never sees this arm.
+  if [ -z "$wt" ] || [ ! -d "$wt" ]; then
+    printf '0\t0\tdead\t-\t0\t0\t'
+    return
+  fi
+
+  # THE MANIFEST IS PRIMARY, as above: it carries `pid` and `startedAt`
+  # together, and `startedAt` is what tells a reused pid from the real worker.
+  if manifest=$(plot_manifest_for_worktree "$wt" 2>/dev/null) && [ -n "$manifest" ]; then
+    if manifest_data=$(plot_read_manifest_pid "$manifest") && [ -n "$manifest_data" ]; then
+      pid=$(printf '%s' "$manifest_data" | cut -f1)
+      started_at=$(printf '%s' "$manifest_data" | cut -f2)
+    fi
+  fi
+  if [ -z "$pid" ] && [ -f "$wt/.plot-worker.pid" ]; then
+    pid=$(cat "$wt/.plot-worker.pid" 2>/dev/null | tr -d ' \n')
+  fi
+
+  # A pid of 0 and any non-numeric junk are NOT pids. `kill -0 0` signals the
+  # whole process group and succeeds, so a zero read as live reports `running`
+  # forever — rejected here exactly as `plot_worker_state` rejects it.
+  case "$pid" in
+    ''|0|*[!0-9]*) pid_recorded=0 ;;
+    *)             pid_recorded=1 ;;
+  esac
+
+  if [ "$pid_recorded" = 1 ]; then
+    if kill -0 "$pid" 2>/dev/null; then
+      # A recorded start time closes the pid-reuse window. Without one the old
+      # behaviour applies and `kill -0` alone decides, which keeps an
+      # uncheckable pid honest rather than pessimistic.
+      if [ -n "$started_at" ] && ! plot_pid_is_current "$pid" "$started_at"; then
+        liveness=stale
+      else
+        liveness=live
+      fi
+    fi
+  fi
+
+  # THE EXIT RECORD, distinguishing absent from unreadable. `plot_worker_state`
+  # reaches `ended` for both, but by different routes, and a reading that
+  # collapsed them would hide which one a desk is in from anybody comparing.
+  if [ -f "$wt/.plot-worker.exit" ]; then
+    exit_field=$(cat "$wt/.plot-worker.exit" 2>/dev/null | tr -d ' \n')
+  fi
+
+  plot_worker_blocked "$wt" && blocked=1 || blocked=0
+  [ -n "$(plot_worker_dirty "$wt")" ] && dirty=1 || dirty=0
+  # UNPUSHED IS A REF QUESTION asked THROUGH the worktree, and an unreadable
+  # count stays EMPTY — `null` is not `false`, and a branch with no upstream
+  # cannot be asked at all.
+  ahead=$(git -C "$wt" rev-list --count '@{upstream}..HEAD' 2>/dev/null) || ahead=""
+
+  printf '%s\t%s\t%s\t%s\t%s\t%s\t%s' \
+    "$here" "$pid_recorded" "$liveness" "$exit_field" "$blocked" "$dirty" "$ahead"
+}