@plot-pm/board 0.14.4 → 0.15.0

package/plot-host.sh

@@ -19,7 +19,18 @@
 #                                 than a transient to retry. Adding a host is
 #                                 an edit to `HOST_DRIVES` and the arms below,
 #                                 and to nothing in `packages/domain`.
-#   default-branch                print the repo's default branch name
+#   default-branch                print the repo's default branch name. THE HOST
+#                                 IS ASKED, on both backends, and the local
+#                                 `origin/HEAD` is the fallback where it cannot
+#                                 answer — that ref is a clone-time cache and a
+#                                 default branch moved since then never updates
+#                                 it. Prints "" where neither can answer.
+#   account                       print the signed-in host user, read from the
+#                                 CLI's config file (no API request).
+#                                 `PLOT_BUDGET_ACCOUNT` overrides it. Exit 3
+#                                 where GitHub's `hosts.yml` names no user;
+#                                 exit 4 on Bitbucket, which stores no username
+#                                 for free. Never prints `unknown`.
 #   pr-state <number|branch> [--repo <owner/repo>]   one JSON object:
 #                                   {"number":N,"state":"OPEN|MERGED|CLOSED|NONE",
 #                                    "draft":true|false,"url":"..."}
@@ -2996,14 +3007,77 @@ case "$op" in
     ;;
 
   default-branch)
+    # THE HOST IS ASKED FIRST, ON BOTH BACKENDS, and `origin/HEAD` is the
+    # fallback rather than the answer. `origin/HEAD` is a LOCAL CACHE WRITTEN AT
+    # CLONE TIME: a default branch changed afterwards never updates it and
+    # nothing in git notices. Reported 2026-09-24 — a clone whose GitHub default
+    # had moved to `develop` kept `origin/HEAD → main`, the board read plans from
+    # `origin/main`, and two of three plans went missing.
+    #
+    # THE BITBUCKET ARM ASKED THE CACHE FIRST UNTIL 2026-09-25, so on Bitbucket
+    # this op answered from the very cache it exists to bypass, the two readings
+    # could never disagree, and the defect was invisible there. Every caller —
+    # `plot-open-pr.sh:73`, `plot-approve.sh:205`, `plot-deliver.sh:218`,
+    # `plot-reap.sh:176`, `plot-release-refs.sh:162`, `/plot-idea:252` — wants
+    # the branch the host calls default, which is what this now answers.
+    #
+    # AND THE FALLBACK WAS DEAD CODE. `git symbolic-ref … | sed … || bb …` takes
+    # the PIPELINE's exit status, which is `sed`'s, and `sed` exits 0 on empty
+    # input — measured 2026-09-25 against a ref that does not exist. So `bb repo
+    # view` had never once been reached, and a Bitbucket clone with no
+    # `origin/HEAD` printed an empty line and exited 0. Each reading is now
+    # tested for a NON-EMPTY value of its own, never for a pipeline's status.
+    _db=""
     if [ "$be" = "github" ]; then
-      gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name'
+      _db=$(gh repo view --json defaultBranchRef --jq '.defaultBranchRef.name' 2>/dev/null || true)
     else
-      # Symbolic ref of origin/HEAD is host-neutral and offline; fall back to
-      # the bb API only when the local clone has no origin/HEAD.
-      git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||' \
-        || bb repo view --json 2>/dev/null | jq -r '.mainbranch.name'
+      # `--json` IS A CAPABILITY, NOT A GIVEN. Two products share the name `bb`
+      # and craftamap's rejects the flag (see `bb_require_json`) — against it
+      # this call emits `unknown flag: --json`, `jq` reads non-JSON, and the arm
+      # would answer nothing while exiting 0. This call was unguarded while it
+      # was unreachable; asking the host makes it live.
+      bb_require_json
+      _db=$(bb repo view --json 2>/dev/null | jq -r '.mainbranch.name // empty' 2>/dev/null || true)
     fi
+    # `null` is what `jq` prints for an absent field and it is not a branch name.
+    [ "$_db" = "null" ] && _db=""
+    # THE CACHE IS THE FALLBACK: a host that cannot be asked is not a reason to
+    # answer nothing, since every caller above needs a usable branch name and
+    # worked from this reading alone before today.
+    [ -n "$_db" ] || _db=$(git symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null | sed 's|^origin/||')
+    printf '%s\n' "$_db"
+    ;;
+
+  account)
+    # WHO IS READING, from the same free reading `budget_account` makes. It
+    # costs a file read and no request, which matters because the board asks on
+    # its timer. `PLOT_BUDGET_ACCOUNT` overrides it on every backend.
+    #
+    # THE BITBUCKET ARM IS NOT EXPOSED. `budget_account bitbucket` answers the
+    # remote's owner segment, which is the WORKSPACE: on a team workspace every
+    # contributor gets the same word, and it matches no PR author. Measured
+    # 2026-09-25, neither `bb` stores a username for free. Quatico's keeps only
+    # the Atlassian email, in the Keychain. craftamap's keeps an email in
+    # `configuration.toml`. A Bitbucket PR author carries a nickname, an
+    # account id and a uuid, and never an email. So this backend has no answer,
+    # and exit 4 says so.
+    #
+    # `unknown` IS NEVER PRINTED. It groups budget lines correctly and names
+    # nobody, so an unreadable `hosts.yml` exits 3 with the reason on stderr.
+    _acct=''
+    if [ -n "${PLOT_BUDGET_ACCOUNT:-}" ]; then
+      _acct="$PLOT_BUDGET_ACCOUNT"
+    elif [ "$be" = "github" ]; then
+      _acct="$(budget_account github)"
+    else
+      echo "plot-host.sh: account: $be names no signed-in user without an API request" >&2
+      exit 4
+    fi
+    if [ -z "$_acct" ] || [ "$_acct" = "unknown" ]; then
+      echo "plot-host.sh: account: no user in ${GH_CONFIG_DIR:-$HOME/.config/gh}/hosts.yml" >&2
+      exit 3
+    fi
+    printf '%s\n' "$_acct"
     ;;
 
   pr-state)
@@ -3550,7 +3624,7 @@ case "$op" in
           #   $jentry == null   → the branch has no Jenkins job; `none`.
           #   otherwise         → the joined colour's `checks`, job named on fail.
           _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
-            --json number,title,state,headRefName,isDraft,mergeable,mergeStateStatus,reviewDecision,url,updatedAt)" || exit $?
+            --json number,title,state,headRefName,isDraft,mergeable,mergeStateStatus,reviewDecision,url,updatedAt,author)" || exit $?
           pr_list_report_truncation github "$limit" "$state" \
             "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
           printf '%s' "$_gh_raw" \
@@ -3571,6 +3645,7 @@ case "$op" in
                 review:(.reviewDecision // ""),
                 url:.url,
                 updatedAt:(.updatedAt // ""),
+                author:(.author.login // ""),
                 failing_checks:(
                   if $jentry != null and $jentry.checks == "failing"
                   then [$jentry.job]
@@ -3580,7 +3655,7 @@ case "$op" in
         else
           # GitHub without Jenkins (or Jenkins not configured): use GitHub rollup
           _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
-            --json number,title,state,headRefName,isDraft,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision,url,updatedAt)" || exit $?
+            --json number,title,state,headRefName,isDraft,statusCheckRollup,mergeable,mergeStateStatus,reviewDecision,url,updatedAt,author)" || exit $?
           pr_list_report_truncation github "$limit" "$state" \
             "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
           printf '%s' "$_gh_raw" \
@@ -3603,6 +3678,7 @@ case "$op" in
                 review:(.reviewDecision // ""),
                 url:.url,
                 updatedAt:(.updatedAt // ""),
+                author:(.author.login // ""),
                 failing_checks:[
                   .statusCheckRollup[]? | select((if (.conclusion // "") != "" then .conclusion else (.status // .state) end) as $c
                     | $c=="FAILURE" or $c=="ERROR" or $c=="CANCELLED"
@@ -3612,13 +3688,19 @@ case "$op" in
         fi
       else
         _gh_raw="$(pr_list_call gh ${repo_args[@]+"${repo_args[@]}"} pr list --state "$state" ${limit_args[@]+"${limit_args[@]}"} ${search_args[@]+"${search_args[@]}"} \
-          --json number,title,state,headRefName)" || exit $?
+          --json number,title,state,headRefName,author)" || exit $?
         pr_list_report_truncation github "$limit" "$state" \
           "$(jq 'length' <<<"$_gh_raw" 2>/dev/null || echo 0)"
         printf '%s' "$_gh_raw" \
-          | jq -c '.[] | {number:.number,title:.title,state:.state,head:.headRefName}'
+          | jq -c '.[] | {number:.number,title:.title,state:.state,head:.headRefName,author:(.author.login // "")}'
       fi
     else
+      # `author` IS THE `nickname`, the one handle field a Bitbucket user
+      # object carries. Measured 2026-09-25 against bb 1.9.0: `author` holds
+      # `display_name`, `nickname`, `account_id` and `uuid` and no username,
+      # and on a Quatico workspace `nickname` equals the display name. GitHub's
+      # arm reads `.author.login`. Both answer `""` where the host omits it.
+      #
       # Bitbucket carries no check rollup through `bb pr list`, and no
       # mergeability verdict either. Rather than guess, --rich reports
       # checks:"unknown" and mergeable:"unknown" — a consumer must render those
@@ -3705,6 +3787,7 @@ case "$op" in
                   review:"",
                   url:(.links.html.href // ""),
                   updatedAt:(.updated_on // ""),
+                  author:(.author.nickname // ""),
                   failing_checks:(
                     if $jentry != null and $jentry.checks == "failing"
                     then [$jentry.job]
@@ -3715,13 +3798,13 @@ case "$op" in
           # Bitbucket without Jenkins: checks remain unknown
           PR_LIST_JQ_ARGS=()
           pr_list_states bitbucket "$limit" "$bb_states" \
-            '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,draft:(.draft // false),checks:"unknown",mergeable:"unknown",review:"",url:(.links.html.href // ""),updatedAt:(.updated_on // ""),failing_checks:[]}' \
+            '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,draft:(.draft // false),checks:"unknown",mergeable:"unknown",review:"",url:(.links.html.href // ""),updatedAt:(.updated_on // ""),author:(.author.nickname // ""),failing_checks:[]}' \
             "${bb_cmd[@]}" || exit $?
         fi
       else
         PR_LIST_JQ_ARGS=()
         pr_list_states bitbucket "$limit" "$bb_states" \
-          '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name}' \
+          '.[] | {number:.id,title:.title,state:(if .state=="DECLINED" then "CLOSED" else .state end),head:.source.branch.name,author:(.author.nickname // "")}' \
           "${bb_cmd[@]}" || exit $?
       fi
     fi

package/plot-plan-meta.sh

@@ -107,8 +107,9 @@
 #                  placeholder
 #   story          story slug the plan belongs to (`## Status` `Story:` or
 #                  front matter `story:`); "" if absent or a placeholder
-#   assignee       github handle from the `## Approval` `Assignee:` line or
-#                  front matter `assignee:`; "" if absent
+#   assignee       github handle from front matter `assignee:`, else the
+#                  `## Approval` `Assignee:` line, else the `## Status`
+#                  `Assignee:` line; "" if absent or a placeholder
 #   branches       branch names, sorted and unique, read from EITHER spelling:
 #                  the old `## Branches` section (a LIST ITEM whose first token
 #                  is the backtick-quoted name, matching the known prefixes) OR
@@ -415,7 +416,7 @@ function reset_state() {
   fm_delivered = ""; fm_design = ""
   fm_rounds = ""
   canon_state = ""; canon_phase = ""; canon_type = ""
-  canon_sprint = ""; canon_story = ""; canon_assignee = ""
+  canon_sprint = ""; canon_story = ""; canon_assignee = ""; status_assignee = ""
   canon_review = ""; canon_impl = ""; canon_approved = ""; canon_released = ""
   canon_delivered = ""; canon_design = ""
   canon_rounds = ""
@@ -478,6 +479,9 @@ function emit_record(   fmt, praw, palt_raw, traw, title, sprint, story, assigne
   sprint   = strip_placeholder((fm_sprint   != "") ? fm_sprint   : canon_sprint)
   story    = strip_placeholder((fm_story    != "") ? fm_story    : canon_story)
   assignee = strip_placeholder((fm_assignee != "") ? fm_assignee : canon_assignee)
+  # `## Status` is the section both templates offer; `## Approval` is older and
+  # outranks it, so a plan writing both keeps the answer it parsed to before.
+  if (fm_assignee == "" && assignee == "") assignee = status_assignee
   review   = strip_placeholder((fm_review   != "") ? fm_review   : canon_review)
   impl     = strip_placeholder((fm_impl     != "") ? fm_impl     : canon_impl)
   design   = strip_placeholder((fm_design   != "") ? fm_design   : canon_design)
@@ -823,6 +827,9 @@ section == "status" {
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**issue[:*]/ && canon_issue == "") canon_issue = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**review[:*]/ && canon_review == "") canon_review = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**impl[:*]/ && canon_impl == "") canon_impl = val_after_colon($0)
+  # Its own slot, not `canon_assignee`: the `## Approval` line outranks this one
+  # in `emit_record`, whichever section comes first.
+  else if (lower ~ /^[ \t]*[-*]?[ \t]*\**assignee[:*]/ && status_assignee == "") status_assignee = strip_placeholder(val_after_colon($0))
   # EACH TAKES THE FIRST LINE THAT CARRIES A VALUE, NOT THE FIRST LINE.
   #
   # A plan may hold both a record and an unfilled placeholder for the same

package/plot-pr-merged.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Plot helper: the ONE answer to "did the host merge ANY PR for this branch?"
 #
-# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged` and
-# `pr_open`; the file does nothing else on load. That is what makes sourcing it
+# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged`,
+# `pr_open` and `pr_merged_heads`; the file does nothing else on load. That is what makes sourcing it
 # safe, and it is the same shape — and the same reason — as
 # `plot-worker-state.sh`: the logic could not simply stay in `plot-reap.sh`,
 # because that file parses `$@` and `exit 2`s on an unknown argument at load
@@ -178,3 +178,30 @@ pr_open() {
   answer=$(_plot_landed none "$(_plot_open_lookup "$1")") || return 1
   case "$answer" in *"	open-pr") return 0 ;; *) return 1 ;; esac
 }
+
+# Which commits did the host merge for this branch? One `headRefOid` per merged
+# PR, one per line.
+#
+# A THIRD QUESTION, asked by `plot-reap.sh` only. After a squash merge the
+# host deletes the branch (`delete_branch_on_merge`), `git fetch --prune`
+# drops the remote-tracking ref, and the branch's own commits are then on no
+# remote ref at all. So "which commits did no remote ever hold?" needs the
+# head the host merged: a commit reachable from it was pushed; a commit beyond
+# it exists only on the desk.
+#
+# Returns 1 when the host cannot be asked. The caller reads that as
+# `unknown`, which keeps the desk: here a failure to observe is the case that
+# loses work. It prints nothing and returns 0 when the host answered and no PR
+# merged.
+pr_merged_heads() {
+  local br="$1" out
+  command -v gh >/dev/null 2>&1 || return 1
+  out=$(gh pr list --head "$br" --state all --limit 100 --json mergedAt,headRefOid 2>/dev/null) \
+    || return 1
+  printf '%s' "$out" | node -e '
+let s = "";
+process.stdin.on("data", (d) => { s += d; }).on("end", () => {
+  const rows = JSON.parse(s);
+  for (const r of rows) if (r.mergedAt && r.headRefOid) console.log(r.headRefOid);
+});' 2>/dev/null || return 1
+}

package/plot-reap.sh

@@ -187,6 +187,96 @@ git fetch origin "$DEFAULT" --quiet 2>/dev/null || true
 # newest — and defines `pr_merged` and nothing else on load.
 . "$(dirname "${BASH_SOURCE[0]}")/plot-pr-merged.sh"
 
+# Which uncommitted paths count as unlanded work. SOURCED, because the reap
+# reading, the dirty sweep below and `plot-reconcile-scan.sh` section 21 must
+# read one tree the same way; the helper names each excused path.
+. "$(dirname "${BASH_SOURCE[0]}")/plot-desk-dirt.sh"
+
+# Is an AGENT still working at a desk? SOURCED from `plot-worker-state.sh`,
+# the ONE classifier `plot-dispatch.sh --stop` also asks. Reading only whether
+# the recorded pid answers `ps` asked about the wrapper shell, which outlives
+# its agent: a desk whose agent had exited read `worker alive` here while
+# `--stop` answered `finished` for the same tree, so it could be neither
+# stopped nor reaped.
+# shellcheck source=plot-worker-state.sh
+. "$(dirname "${BASH_SOURCE[0]}")/plot-worker-state.sh"
+
+# The live worker's pid at a desk, or empty. The FIVE process states map to
+# one reading: `running` is live, and `finished`, `failed`, `ended` and `none`
+# are not.
+#
+# `waiting` and `stalled` are DISCARDED BY NAME. They are desk facts — a marker
+# for a person, work on the floor — which `plot_worker_state` reaches only once
+# no agent runs, and they answer what the agent still OWES. That question is
+# the blocked-marker, uncommitted and unpushed readings' below; only the
+# process fact under the two words (no agent is running) crosses into the
+# liveness reading.
+#
+# A word this mapping does not know keeps the desk: it reports the recorded
+# pid, or `unknown`, rather than guessing the process is gone.
+desk_worker_pid() { # $1=worktree → the live worker's pid, or empty
+  local row state spid
+  row=$(plot_worker_state "$1" "")
+  state=$(printf '%s' "$row" | cut -f1)
+  spid=$(printf '%s' "$row" | cut -f2)
+  case "$state" in
+    running)                   printf '%s' "${spid:-unknown}" ;;
+    finished|failed|ended|none) ;;
+    waiting|stalled)           ;;
+    *)                         printf '%s' "${spid:-unknown}" ;;
+  esac
+}
+
+# The commits on a desk's HEAD that no remote holds, as short shas, one per
+# line. Returns 1 when they cannot be counted, which the rule reads as
+# `unknown` and refuses on.
+#
+# NOT `@{upstream}..HEAD`. The host deletes a branch when its PR merges, and
+# the reaper only removes desks whose PR merged, so after `git fetch --prune`
+# every desk it serves has lost its upstream — and an absent upstream counts as
+# nothing. The reading is `HEAD --not --remotes` instead: what no remote-tracking
+# ref holds. After a squash merge and a pruned ref, the branch's own commits
+# are on no remote ref either, so the head the host MERGED is excluded too
+# (`pr_merged_heads`): a commit beyond it was never pushed.
+desk_unpushed() { # $1=worktree $2=branch $3=merge reading → short shas
+  local wt="$1" br="$2" merge="$3" list heads h
+  local -a excl=()
+  list=$(git -C "$wt" rev-list --abbrev-commit HEAD --not --remotes 2>/dev/null) || return 1
+  [ -n "$list" ] || return 0
+  if [ -n "$br" ] && [ "$merge" = merged ]; then
+    heads=$(pr_merged_heads "$br") || return 1
+    for h in $heads; do
+      git -C "$wt" cat-file -e "$h^{commit}" 2>/dev/null && excl+=("$h")
+    done
+    if [ "${#excl[@]}" -gt 0 ]; then
+      list=$(git -C "$wt" rev-list --abbrev-commit HEAD --not --remotes "${excl[@]}" 2>/dev/null) \
+        || return 1
+    else
+      # NO MERGED HEAD THIS DESK CONTAINS, and the host still said merged. The
+      # subtraction above cannot run, and without it `--not --remotes` reports
+      # EVERY commit the branch ever had — so the desk would be held forever
+      # for having done the work that merged.
+      #
+      # Two ways to reach here, both normal. A SQUASH merge rewrites the
+      # commits, so the head the host names exists nowhere in this history —
+      # the same property that makes `plot-pr-merged.sh` read `mergedAt` and
+      # never ancestry, measured here as ancestry clearing 1 of 29 finished
+      # trees against the host's 28. And a host answer that carries no head at
+      # all leaves nothing to subtract.
+      #
+      # The host's answer decides: it said this branch's work landed, and no
+      # reading taken from refs may overrule it. Answer empty.
+      #
+      # THE GUARD KEEPS ITS WHOLE POPULATION. It protects a desk whose agent
+      # finished and whose work has NOT merged, which is where work is lost.
+      # The merged desk that holds a commit the PR did not carry is still held,
+      # by the subtraction above, whenever the merged head is one this desk has.
+      list=""
+    fi
+  fi
+  printf '%s\n' "$list"
+}
+
 # Where the registry lives, resolved through `plot-config.sh` — the SAME key and
 # default the board's reader uses (`resolveManifestDir` in `registry.ts` shells
 # out to exactly this). Two implementations of "where is the registry" is how
@@ -501,25 +591,21 @@ while IFS=$'\037' read -r wt br prunable; do
 
   # The process table: the live worker's pid, or empty. Read but not judged —
   # an empty pid file is not a live process, and which of those two it is is
-  # the rule's to say.
-  pid=""
-  if [ -f "$wt/.plot-worker.pid" ]; then
-    p=$(cat "$wt/.plot-worker.pid" 2>/dev/null)
-    if [ -n "$p" ] && ps -p "$p" >/dev/null 2>&1; then pid="$p"; fi
-  fi
+  # the rule's to say. "Live" means an agent runs under the recorded pid, the
+  # answer `--stop` reads; a wrapper whose agent exited is not live.
+  pid=$(desk_worker_pid "$wt")
 
   # The tree: a PLOT-BLOCKED marker, and the first uncommitted path.
   #
-  # The tiny-garden pulse is excused because every board suite rewrites it — a
-  # worker that did nothing but run the tests would otherwise never be
-  # reapable. Any OTHER dirty path is still reported, which keeps this an
-  # exception rather than a hole. It is filtered HERE, in the reading, because
-  # it is a fact about this repository's fixtures and not about whether a
-  # worktree may go.
+  # `desk_dirt` excuses the paths the estate writes itself — the tiny-garden
+  # pulse and a root `PLOT-CORRECTION.md` — and reports every OTHER dirty path,
+  # which keeps this an exception rather than a hole. It is filtered HERE, in
+  # the reading, because those are facts about files this estate writes and
+  # not about whether a worktree may go. The filter runs before `head`, so a
+  # correction beside a real file names the real file.
   marker=false
   ls "$wt"/PLOT-BLOCKED* >/dev/null 2>&1 && marker=true
-  dirty=$(git -C "$wt" status --porcelain 2>/dev/null \
-            | grep -v 'tiny-garden/\.plot/state' | head -1)
+  dirty=$(desk_dirt "$wt" | head -1)
 
   # The host: whether ANY PR for this branch merged.
   #
@@ -560,6 +646,12 @@ while IFS=$'\037' read -r wt br prunable; do
     merge=merged; why="detached, nothing to land"
   fi
 
+  # The desk again: commits only this checkout holds. Taken AFTER the merge
+  # reading, because the head the host merged is what separates a pushed
+  # commit from an unpushed one once the remote ref is gone. Lines, or the
+  # word `unknown` when they could not be counted.
+  if unpushed=$(desk_unpushed "$wt" "$short" "$merge"); then :; else unpushed=unknown; fi
+
   # THE DECISION. One call, and the script holds no `if` about whether a
   # worktree may go — only about what to do with the answer.
   #
@@ -581,7 +673,7 @@ while IFS=$'\037' read -r wt br prunable; do
   # the tree and says why. Silence is never permission, on this path either.
   verdict=$(PLOT_BRANCH="$short" PLOT_DEFAULT="$DEFAULT" PLOT_PID="$pid" \
             PLOT_DIRTY="$dirty" PLOT_MARKER="$marker" PLOT_MERGE="$merge" \
-            PLOT_RULE="$RULE" \
+            PLOT_UNPUSHED="$unpushed" PLOT_RULE="$RULE" \
             node --input-type=module - <<'NODE_EOF' 2>/dev/null
 // Imported from an ABSOLUTE path derived from this script, never from the
 // cwd. The reaper runs with its cwd wherever the operator invoked it and the
@@ -603,6 +695,9 @@ const problem = firstReapRefusal({
   dirtyPath: process.env.PLOT_DIRTY,
   blockedMarker: process.env.PLOT_MARKER === "true",
   merge: process.env.PLOT_MERGE,
+  unpushed: process.env.PLOT_UNPUSHED === "unknown"
+    ? "unknown"
+    : process.env.PLOT_UNPUSHED.split("\n").filter((l) => l !== ""),
 });
 
 // `reap` when nothing refused; otherwise the refusal and its reading, which
@@ -622,6 +717,7 @@ NODE_EOF
       live-worker)         reason="worker alive (pid $detail)" ;;
       blocked-marker)      reason="PLOT-BLOCKED marker — needs a person" ;;
       uncommitted-changes) reason="uncommitted: ${detail:0:40}" ;;
+      unpushed-commits)    reason="unpushed commits: ${detail:0:40}" ;;
       on-default-branch)   reason="on $DEFAULT — dispatched branch not checked out" ;;
       no-merged-pr)        reason="unlanded work — no merged PR" ;;
       *)                   reason="rule could not be asked — keeping" ;;
@@ -1032,15 +1128,12 @@ while IFS=$'\t' read -r wt br; do
   [ -n "$MAIN_CHECKOUT" ] && [ "$(canonical "$wt")" = "$(canonical "$MAIN_CHECKOUT")" ] && continue
   dshort=${br#refs/heads/}
 
-  dcount=$(git -C "$wt" status --porcelain 2>/dev/null \
-             | grep -v 'tiny-garden/\.plot/state' | wc -l | tr -d ' ')
+  dcount=$(desk_dirt "$wt" | wc -l | tr -d ' ')
   [ "${dcount:-0}" -gt 0 ] || continue
 
-  dpid=""
-  if [ -f "$wt/.plot-worker.pid" ]; then
-    p=$(cat "$wt/.plot-worker.pid" 2>/dev/null)
-    if [ -n "$p" ] && ps -p "$p" >/dev/null 2>&1; then dpid="$p"; fi
-  fi
+  # The same liveness reading the reap loop takes, so a desk the reaper keeps
+  # for a live worker and one the sweep names as owned are the same desks.
+  dpid=$(desk_worker_pid "$wt")
 
   dmanifest=""
   if m=$(manifest_for "$(canonical "$wt")"); then dmanifest=$(basename "$m"); fi