@plot-pm/board 0.14.4 → 0.16.0

package/plot-plan-meta.sh

@@ -107,8 +107,9 @@
 #                  placeholder
 #   story          story slug the plan belongs to (`## Status` `Story:` or
 #                  front matter `story:`); "" if absent or a placeholder
-#   assignee       github handle from the `## Approval` `Assignee:` line or
-#                  front matter `assignee:`; "" if absent
+#   assignee       github handle from front matter `assignee:`, else the
+#                  `## Approval` `Assignee:` line, else the `## Status`
+#                  `Assignee:` line; "" if absent or a placeholder
 #   branches       branch names, sorted and unique, read from EITHER spelling:
 #                  the old `## Branches` section (a LIST ITEM whose first token
 #                  is the backtick-quoted name, matching the known prefixes) OR
@@ -199,6 +200,14 @@
 #                  every wave name is a label; ALWAYS present, so a consumer
 #                  never reads undefined. The plan still parses in full: waves[]
 #                  is unchanged and no name is shortened or dropped.
+#   unread_branch_headings
+#                  slice headings that carry `Branch:` and whose wave holds no
+#                  branch, verbatim, in document order — a report, not a
+#                  refusal. The wave stays in waves[] with branches []; this
+#                  separates a slice the parser could not read from a narrative
+#                  heading, which carries no `Branch:`. Covers both slice
+#                  consumers, so a heading lost to the first-heading latch
+#                  (#1042) is named too. ALWAYS present; [] when none.
 #   issues         tracker issue numbers this plan answers, from the `## Status`
 #                  `Issue:` line or front matter `issue:` (sorted, unique).
 #                  A DEDICATED field, never a scan of the body for `#NNN`: a
@@ -285,7 +294,7 @@ if [ ${#files[@]} -eq 0 ] && [ ${#missing[@]} -eq 0 ]; then
 fi
 
 for f in ${missing[@]+"${missing[@]}"}; do
-  printf '{"file":"%s","format":"none","error":"file not found","phase_raw":"","phase":"NONE","phase_alt_raw":"","phase_alt":"NONE","type":"","title":"","sprint":"","story":"","assignee":"","branches":[],"prs":[],"issues":[],"malformed_prs":[],"changelog":[],"long_wave_names":[],"review_raw":"","review":"NONE","impl_raw":"","impl":"NONE","design_raw":"","approved_raw":"","released_raw":"","delivered_raw":"","started_raw":[]}\n' \
+  printf '{"file":"%s","format":"none","error":"file not found","phase_raw":"","phase":"NONE","phase_alt_raw":"","phase_alt":"NONE","type":"","title":"","sprint":"","story":"","assignee":"","branches":[],"prs":[],"issues":[],"malformed_prs":[],"changelog":[],"long_wave_names":[],"unread_branch_headings":[],"review_raw":"","review":"NONE","impl_raw":"","impl":"NONE","design_raw":"","approved_raw":"","released_raw":"","delivered_raw":"","started_raw":[]}\n' \
     "$(printf '%s' "$f" | sed 's/\\/\\\\/g; s/"/\\"/g')"
 done
 
@@ -415,7 +424,7 @@ function reset_state() {
   fm_delivered = ""; fm_design = ""
   fm_rounds = ""
   canon_state = ""; canon_phase = ""; canon_type = ""
-  canon_sprint = ""; canon_story = ""; canon_assignee = ""
+  canon_sprint = ""; canon_story = ""; canon_assignee = ""; status_assignee = ""
   canon_review = ""; canon_impl = ""; canon_approved = ""; canon_released = ""
   canon_delivered = ""; canon_design = ""
   canon_rounds = ""
@@ -432,6 +441,7 @@ function reset_state() {
   delete issues; n_issues = 0
   delete wave_names; delete wave_of; delete wave_seq; delete wave_count
   delete deferred_of; delete deferred_why; delete claimed_of; delete ordered_b; n_waves = 0
+  delete branch_heading
   delete waits_of; delete waits_set
   delete builds_of; delete builds_set
   delete agent_of; delete agent_set
@@ -478,6 +488,9 @@ function emit_record(   fmt, praw, palt_raw, traw, title, sprint, story, assigne
   sprint   = strip_placeholder((fm_sprint   != "") ? fm_sprint   : canon_sprint)
   story    = strip_placeholder((fm_story    != "") ? fm_story    : canon_story)
   assignee = strip_placeholder((fm_assignee != "") ? fm_assignee : canon_assignee)
+  # `## Status` is the section both templates offer; `## Approval` is older and
+  # outranks it, so a plan writing both keeps the answer it parsed to before.
+  if (fm_assignee == "" && assignee == "") assignee = status_assignee
   review   = strip_placeholder((fm_review   != "") ? fm_review   : canon_review)
   impl     = strip_placeholder((fm_impl     != "") ? fm_impl     : canon_impl)
   design   = strip_placeholder((fm_design   != "") ? fm_design   : canon_design)
@@ -645,6 +658,20 @@ function emit_record(   fmt, praw, palt_raw, traw, title, sprint, story, assigne
     }
   }
   out = out "]"
+  # unread_branch_headings[]: a slice heading that carries `Branch:` and whose
+  # wave holds no branch, heading text verbatim, in document order. The wave
+  # itself stays in waves[] with branches []; this names WHY it is empty, since
+  # an empty wave with no `Branch:` is narrative and one with it is a slice the
+  # parser could not read. ALWAYS present, [] when every such heading was read.
+  out = out ",\"unread_branch_headings\":["
+  ubh = 0
+  for (w = 1; w <= n_waves; w++) {
+    if ((w in branch_heading) && wave_count[w] == 0) {
+      out = out (ubh > 0 ? "," : "") "\"" jesc(branch_heading[w]) "\""
+      ubh++
+    }
+  }
+  out = out "]"
   out = out ",\"review_raw\":\"" jesc(review) "\",\"review\":\"" norm_review(review) "\""
   out = out ",\"impl_raw\":\"" jesc(impl) "\",\"impl\":\"" norm_impl(impl) "\""
   out = out ",\"design_raw\":\"" jesc(design) "\""
@@ -666,6 +693,16 @@ function emit_record(   fmt, praw, palt_raw, traw, title, sprint, story, assigne
   out = out "}"
   print out
 }
+# Records the current `### ` heading when it carries `Branch:`. Called by BOTH
+# slice consumers, because the list consumer also opens a wave per heading: a
+# section whose FIRST heading is narrative routes every later heading there, and
+# a `(Branch: …)` heading below it then yields nothing (#1042).
+function note_branch_heading(   h) {
+  if (index($0, "Branch:") == 0) return
+  h = trim(substr($0, 4))
+  sub(/[ \t]*<!--.*$/, "", h)
+  branch_heading[n_waves] = h
+}
 # The longest wave name that still reads as a label, not prose. A JUDGEMENT, not
 # a measurement: the longest legitimate name in the estate is `Offered first`
 # (13), and the offender this exists to catch is a 53-character sentence, so the
@@ -823,6 +860,9 @@ section == "status" {
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**issue[:*]/ && canon_issue == "") canon_issue = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**review[:*]/ && canon_review == "") canon_review = val_after_colon($0)
   else if (lower ~ /^[ \t]*[-*]?[ \t]*\**impl[:*]/ && canon_impl == "") canon_impl = val_after_colon($0)
+  # Its own slot, not `canon_assignee`: the `## Approval` line outranks this one
+  # in `emit_record`, whichever section comes first.
+  else if (lower ~ /^[ \t]*[-*]?[ \t]*\**assignee[:*]/ && status_assignee == "") status_assignee = strip_placeholder(val_after_colon($0))
   # EACH TAKES THE FIRST LINE THAT CARRIES A VALUE, NOT THE FIRST LINE.
   #
   # A plan may hold both a record and an unfilled placeholder for the same
@@ -904,20 +944,26 @@ section == "changelog" {
   cl_open = 0
   next
 }
-# WHICH SHAPE THIS SECTION HOLDS, decided once from its first `### ` heading and
-# then fixed for the rest of the section.
+# WHICH SHAPE THIS SECTION HOLDS, decided by ANY heading in it that names a
+# branch — not by the first heading alone.
 #
 # `(Branch:` IS THE MARKER, and it is the only reliable one. A heading carrying
 # it is the new shape by construction — that parenthetical is where the new
-# layout puts the branch. A heading without it is the old shape, whose headings
+# layout puts the branch. Headings without it are the old shape, whose headings
 # are bare names (`### Tracer`) and whose branches ride list items below.
 #
-# A SECTION WITH NO `### ` AT ALL is the old shape, and must be: a plan written
-# before subheadings existed is one unnamed wave of list items, which is exactly
-# what the old consumer produces. `slice_shape` therefore stays `""` until a
-# heading is seen, and `""` routes to the old consumer.
+# THE FIRST HEADING IS NOT THE DECIDER, and a latch on it loses work. Measured
+# 2026-09-28 over 357 plans: 56 sections open with a narrative heading, and in 2
+# of them a branched heading sits below it, so the section routed to the list
+# consumer and 5 declared slices were read as none. `slice_shape` therefore
+# stays `""` until a BRANCHED heading appears, wherever it sits.
+#
+# A SECTION WITH NO BRANCHED `### ` AT ALL is the old shape, and must be: a plan
+# written before subheadings existed is one unnamed wave of list items, which is
+# exactly what the old consumer produces — 54 of those 56 plans. `""` routes
+# there, so the absent latch and the old answer are one behaviour.
 section == "slices" && $0 ~ /^###[ \t]/ && slice_shape == "" {
-  slice_shape = (index($0, "(Branch:") > 0) ? "heading" : "list"
+  if (index($0, "(Branch:") > 0) slice_shape = "heading"
 }
 
 section == "slices" && slice_shape != "heading" {
@@ -925,6 +971,7 @@ section == "slices" && slice_shape != "heading" {
   # unnamed wave, so a pre-wave plan parses as exactly one wave.
   if ($0 ~ /^###[ \t]/) {
     wave_names[++n_waves] = trim(substr($0, 4))
+    note_branch_heading()
     next
   }
   # Claim reflection, written by the worker after its ref push succeeds. This is
@@ -1180,6 +1227,7 @@ section == "slices" && slice_shape == "heading" {
   sub(/[ \t]*\(Branch:.*$/, "", wname)
   wname = trim(wname)
   wave_names[++n_waves] = wname
+  note_branch_heading()
 
   # Claim/deferral annotations bind to the line carrying the branch name, which
   # is the heading. Read before any match() below, which clobbers RSTART/RLENGTH.
@@ -1284,10 +1332,17 @@ section == "slices" && slice_shape == "heading" {
   # heading with no readable branch still opened a wave above — so a `## Waves`
   # section is never silently empty, which is the failure this plan refuses: a
   # consumer sees a wave it could not extract a branch from, not an absence.
+  #
+  # THE VALUE MAY BE BACKTICKED. `(Branch: \`bug/foo\`)` is unambiguous, and a
+  # backtick between `Branch:` and the prefix made the anchored match fail, so
+  # the heading opened a wave and yielded nothing. The backticks are optional on
+  # both sides and stripped from the name. Measured 2026-09-28 over 357 plans:
+  # 2 records change, 355 byte-identical.
   hmeta = $0
-  if (match(hmeta, "Branch:[ \t]*(" PREFIXES ")/[^ \t,)]+")) {
+  if (match(hmeta, "Branch:[ \t]*`?(" PREFIXES ")/[^ \t,)`]+`?")) {
     b = substr(hmeta, RSTART, RLENGTH)
     sub(/^Branch:[ \t]*/, "", b)
+    gsub(/`/, "", b)
     branches[++n_branches] = b
     wave_of[n_branches] = n_waves
     wave_seq[n_branches] = ++wave_count[n_waves]

package/plot-pr-merged.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # Plot helper: the ONE answer to "did the host merge ANY PR for this branch?"
 #
-# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged` and
-# `pr_open`; the file does nothing else on load. That is what makes sourcing it
+# SOURCED, NOT RUN. `. "$script_dir/plot-pr-merged.sh"` defines `pr_merged`,
+# `pr_open` and `pr_merged_heads`; the file does nothing else on load. That is what makes sourcing it
 # safe, and it is the same shape — and the same reason — as
 # `plot-worker-state.sh`: the logic could not simply stay in `plot-reap.sh`,
 # because that file parses `$@` and `exit 2`s on an unknown argument at load
@@ -178,3 +178,30 @@ pr_open() {
   answer=$(_plot_landed none "$(_plot_open_lookup "$1")") || return 1
   case "$answer" in *"	open-pr") return 0 ;; *) return 1 ;; esac
 }
+
+# Which commits did the host merge for this branch? One `headRefOid` per merged
+# PR, one per line.
+#
+# A THIRD QUESTION, asked by `plot-reap.sh` only. After a squash merge the
+# host deletes the branch (`delete_branch_on_merge`), `git fetch --prune`
+# drops the remote-tracking ref, and the branch's own commits are then on no
+# remote ref at all. So "which commits did no remote ever hold?" needs the
+# head the host merged: a commit reachable from it was pushed; a commit beyond
+# it exists only on the desk.
+#
+# Returns 1 when the host cannot be asked. The caller reads that as
+# `unknown`, which keeps the desk: here a failure to observe is the case that
+# loses work. It prints nothing and returns 0 when the host answered and no PR
+# merged.
+pr_merged_heads() {
+  local br="$1" out
+  command -v gh >/dev/null 2>&1 || return 1
+  out=$(gh pr list --head "$br" --state all --limit 100 --json mergedAt,headRefOid 2>/dev/null) \
+    || return 1
+  printf '%s' "$out" | node -e '
+let s = "";
+process.stdin.on("data", (d) => { s += d; }).on("end", () => {
+  const rows = JSON.parse(s);
+  for (const r of rows) if (r.mergedAt && r.headRefOid) console.log(r.headRefOid);
+});' 2>/dev/null || return 1
+}

package/plot-reap.sh

@@ -146,12 +146,36 @@
 # words and lives INSIDE the tree, so it goes when the tree does and is not
 # swept here. This is the dispatcher's record of what it started. Two files,
 # two lifetimes, and CLAUDE.md already distinguishes them.
+#
+# `--sweep-temp` IS A SEPARATE MODE, and it runs INSTEAD of the four kinds. A
+# trap does not run on SIGKILL — the board ends a scan at its timeout,
+# `bounded.sh` escalates to SIGKILL, a person kills a hung script — so some temp
+# paths outlive every trap. It removes two populations, each owned by this user
+# and older than `Temp sweep after` hours (default 24), by the entry's own
+# modification time:
+#
+#   - `$TMPDIR/plot-?*` entries directly under `$TMPDIR` — `plot-` and at least
+#     one more character, any separator: `mkdtempSync` appends six characters
+#     with no dot, so `plot-host-pTFuyG` is the common shape. Never `plot`,
+#     `plotter-old` or any `tmp.*`: that is every template-less `mktemp` on the
+#     machine, and neither owner nor age separates Plot's from another
+#     program's. A `plot-reg.<pid>` exit registry is kept while its pid lives,
+#     because a worker loop registers its exit command and runs for days.
+#   - `$PLOT_BUDGET_HOME/memo/<pid>` directories (default `~/.plot/state/memo`)
+#     whose pid is not alive.
+#
+# It lists each candidate with `find` and removes it by the full path it
+# listed; it never passes a glob to `rm`, and it never reads `/tmp` or
+# `/var/folders` when `$TMPDIR` points elsewhere. The age bound is safe because
+# every Plot temp path belongs to one script call, one scan or one board
+# request, and 24 h is about 1,000 times the scan's 90 s timeout.
 set -u
 
-DRY=1; MAX=0
+DRY=1; MAX=0; SWEEP_TEMP=0
 while [ $# -gt 0 ]; do
   case "$1" in
     --yes) DRY=0 ;;
+    --sweep-temp) SWEEP_TEMP=1 ;;
     --dry-run) DRY=1 ;;
     --max) MAX="${2:-0}"; shift ;;
     # The header, however long it has become. A hardcoded last line silently
@@ -163,6 +187,65 @@ while [ $# -gt 0 ]; do
   shift
 done
 
+# Is a pid alive? `ps -p` answers for another user's process too, where
+# `kill -0` reports EPERM, so a reused pid always keeps its entry.
+pid_alive() { ps -p "$1" >/dev/null 2>&1; }
+
+# One entry: report it, and remove it by the exact path unless this is a dry run.
+sweep_one() { # $1=path $2=why
+  temp_swept=$((temp_swept + 1))
+  if [ "$DRY" = 1 ]; then
+    echo "temp: would remove $1 ($2)"
+  elif rm -rf -- "$1" 2>/dev/null; then
+    echo "temp: removed $1 ($2)"
+    temp_removed=$((temp_removed + 1))
+  else
+    echo "temp: could not remove $1 ($2)"
+  fi
+}
+
+sweep_temp() {
+  local hours root me memo entry name
+  hours=$("$(dirname "${BASH_SOURCE[0]}")/plot-config.sh" get "Temp sweep after" 24 2>/dev/null) || hours=24
+  case "$hours" in
+    ''|*[!0-9]*) echo "plot-reap: 'Temp sweep after' must be a whole number of hours, not '$hours'" >&2; return 2 ;;
+  esac
+  root="${TMPDIR:-/tmp}"; root="${root%/}"
+  me=$(id -un)
+  temp_swept=0; temp_removed=0; temp_live=0
+  while IFS= read -r entry; do
+    [ -n "$entry" ] || continue
+    [ "$MAX" -gt 0 ] && [ "$temp_swept" -ge "$MAX" ] && break
+    name=${entry##*/}
+    case "$name" in
+      plot-reg.*)
+        if pid_alive "${name#plot-reg.}"; then temp_live=$((temp_live + 1)); continue; fi ;;
+    esac
+    sweep_one "$entry" "older than ${hours}h"
+  done <<LIST
+$(find "$root" -mindepth 1 -maxdepth 1 -user "$me" -name 'plot-?*' -mmin +$((hours * 60)) -print 2>/dev/null)
+LIST
+  memo="${PLOT_BUDGET_HOME:-${HOME:-}/.plot/state}/memo"
+  if [ -d "$memo" ]; then
+    while IFS= read -r entry; do
+      [ -n "$entry" ] || continue
+      [ "$MAX" -gt 0 ] && [ "$temp_swept" -ge "$MAX" ] && break
+      name=${entry##*/}
+      case "$name" in ''|*[!0-9]*) continue ;; esac
+      if pid_alive "$name"; then temp_live=$((temp_live + 1)); continue; fi
+      sweep_one "$entry" "memo of dead pid $name, older than ${hours}h"
+    done <<LIST
+$(find "$memo" -mindepth 1 -maxdepth 1 -type d -user "$me" -mmin +$((hours * 60)) -print 2>/dev/null)
+LIST
+  fi
+  echo "temp-summary: swept=$temp_swept removed=$temp_removed kept_live=$temp_live bound_hours=$hours root=$root dry_run=$DRY"
+}
+
+if [ "$SWEEP_TEMP" = 1 ]; then
+  sweep_temp
+  exit $?
+fi
+
 command -v git >/dev/null 2>&1 || { echo "plot-reap: git not found" >&2; exit 2; }
 ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || {
   echo "plot-reap: not a git repository" >&2; exit 2; }
@@ -187,6 +270,109 @@ git fetch origin "$DEFAULT" --quiet 2>/dev/null || true
 # newest — and defines `pr_merged` and nothing else on load.
 . "$(dirname "${BASH_SOURCE[0]}")/plot-pr-merged.sh"
 
+# Which uncommitted paths count as unlanded work. SOURCED, because the reap
+# reading, the dirty sweep below and `plot-reconcile-scan.sh` section 21 must
+# read one tree the same way; the helper names each excused path.
+. "$(dirname "${BASH_SOURCE[0]}")/plot-desk-dirt.sh"
+
+# Is an AGENT still working at a desk? SOURCED from `plot-worker-state.sh`,
+# the ONE classifier `plot-dispatch.sh --stop` also asks. Reading only whether
+# the recorded pid answers `ps` asked about the wrapper shell, which outlives
+# its agent: a desk whose agent had exited read `worker alive` here while
+# `--stop` answered `finished` for the same tree, so it could be neither
+# stopped nor reaped.
+# shellcheck source=plot-worker-state.sh
+. "$(dirname "${BASH_SOURCE[0]}")/plot-worker-state.sh"
+
+# The live worker's pid at a desk, or empty. The FIVE process states map to
+# one reading: `running` is live, and `finished`, `failed`, `ended` and `none`
+# are not.
+#
+# `waiting` and `stalled` are DISCARDED BY NAME. They are desk facts — a marker
+# for a person, work on the floor — which `plot_worker_state` reaches only once
+# no agent runs, and they answer what the agent still OWES. That question is
+# the blocked-marker, uncommitted and unpushed readings' below; only the
+# process fact under the two words (no agent is running) crosses into the
+# liveness reading.
+#
+# A word this mapping does not know keeps the desk: it reports the recorded
+# pid, or `unknown`, rather than guessing the process is gone.
+desk_worker_pid() { # $1=worktree → the live worker's pid, or empty
+  local row state spid
+  row=$(plot_worker_state "$1" "")
+  state=$(printf '%s' "$row" | cut -f1)
+  spid=$(printf '%s' "$row" | cut -f2)
+  case "$state" in
+    running)                   printf '%s' "${spid:-unknown}" ;;
+    finished|failed|ended|none) ;;
+    waiting|stalled)           ;;
+    *)                         printf '%s' "${spid:-unknown}" ;;
+  esac
+}
+
+# The commits on a desk's HEAD that no remote holds, as short shas, one per
+# line. Returns 1 when they cannot be counted, which the rule reads as
+# `unknown` and refuses on.
+#
+# NOT `@{upstream}..HEAD`. The host deletes a branch when its PR merges, and
+# the reaper only removes desks whose PR merged, so after `git fetch --prune`
+# every desk it serves has lost its upstream — and an absent upstream counts as
+# nothing. The reading is `HEAD --not --remotes` instead: what no remote-tracking
+# ref holds. After a squash merge and a pruned ref, the branch's own commits
+# are on no remote ref either, so the head the host MERGED is excluded too
+# (`pr_merged_heads`): a commit beyond it was never pushed.
+desk_unpushed() { # $1=worktree $2=branch $3=merge reading → short shas
+  local wt="$1" br="$2" merge="$3" list heads h
+  local -a excl=()
+  list=$(git -C "$wt" rev-list --abbrev-commit HEAD --not --remotes 2>/dev/null) || return 1
+  [ -n "$list" ] || return 0
+  if [ -n "$br" ] && [ "$merge" = merged ]; then
+    heads=$(pr_merged_heads "$br") || return 1
+    for h in $heads; do
+      git -C "$wt" cat-file -e "$h^{commit}" 2>/dev/null && excl+=("$h")
+    done
+    if [ "${#excl[@]}" -gt 0 ]; then
+      list=$(git -C "$wt" rev-list --abbrev-commit HEAD --not --remotes "${excl[@]}" 2>/dev/null) \
+        || return 1
+    else
+      # NO MERGED HEAD THIS DESK CONTAINS, and the host still said merged. The
+      # subtraction above cannot run, and without it `--not --remotes` reports
+      # EVERY commit the branch ever had — so the desk would be held forever
+      # for having done the work that merged (#1033).
+      #
+      # Two ways to reach here, both normal. A SQUASH merge rewrites the
+      # commits, so the head the host names exists nowhere in this history —
+      # the same property that makes `plot-pr-merged.sh` read `mergedAt` and
+      # never ancestry, measured here as ancestry clearing 1 of 29 finished
+      # trees against the host's 28. And a host answer that carries no head at
+      # all leaves nothing to subtract.
+      #
+      # THE READING IS PATCH-ID: `git cherry` marks a commit `-` when its
+      # change is already upstream and `+` when it is not. A `+` commit that no
+      # remote holds is work the merge did not take — a commit made after the
+      # merge — and it holds the desk. No clock is consulted: a committer date
+      # holds a rebased merged desk forever, and an author date reaps an old
+      # patch committed today (#1038). The rule stays in shell because the
+      # logic is the prefix test and nothing else; a second conditional here is
+      # the signal to move it into the domain with a corpus entry.
+      #
+      # It fails toward keeping: an unreadable base or a failing `git cherry`
+      # returns 1, which the rule reads as `unknown` and refuses on.
+      local full cherry
+      full=$(git -C "$wt" rev-list HEAD --not --remotes 2>/dev/null) || return 1
+      cherry=$(git -C "$wt" cherry "origin/$DEFAULT" HEAD 2>/dev/null) || return 1
+      list=""
+      for h in $(printf '%s\n' "$cherry" | sed -n 's/^+ //p'); do
+        case $'\n'"$full"$'\n' in
+          *$'\n'"$h"$'\n'*) list+="$(git -C "$wt" rev-parse --short "$h")"$'\n' ;;
+        esac
+      done
+      list=${list%$'\n'}
+    fi
+  fi
+  printf '%s\n' "$list"
+}
+
 # Where the registry lives, resolved through `plot-config.sh` — the SAME key and
 # default the board's reader uses (`resolveManifestDir` in `registry.ts` shells
 # out to exactly this). Two implementations of "where is the registry" is how
@@ -501,25 +687,21 @@ while IFS=$'\037' read -r wt br prunable; do
 
   # The process table: the live worker's pid, or empty. Read but not judged —
   # an empty pid file is not a live process, and which of those two it is is
-  # the rule's to say.
-  pid=""
-  if [ -f "$wt/.plot-worker.pid" ]; then
-    p=$(cat "$wt/.plot-worker.pid" 2>/dev/null)
-    if [ -n "$p" ] && ps -p "$p" >/dev/null 2>&1; then pid="$p"; fi
-  fi
+  # the rule's to say. "Live" means an agent runs under the recorded pid, the
+  # answer `--stop` reads; a wrapper whose agent exited is not live.
+  pid=$(desk_worker_pid "$wt")
 
   # The tree: a PLOT-BLOCKED marker, and the first uncommitted path.
   #
-  # The tiny-garden pulse is excused because every board suite rewrites it — a
-  # worker that did nothing but run the tests would otherwise never be
-  # reapable. Any OTHER dirty path is still reported, which keeps this an
-  # exception rather than a hole. It is filtered HERE, in the reading, because
-  # it is a fact about this repository's fixtures and not about whether a
-  # worktree may go.
+  # `desk_dirt` excuses the paths the estate writes itself — the tiny-garden
+  # pulse and a root `PLOT-CORRECTION.md` — and reports every OTHER dirty path,
+  # which keeps this an exception rather than a hole. It is filtered HERE, in
+  # the reading, because those are facts about files this estate writes and
+  # not about whether a worktree may go. The filter runs before `head`, so a
+  # correction beside a real file names the real file.
   marker=false
   ls "$wt"/PLOT-BLOCKED* >/dev/null 2>&1 && marker=true
-  dirty=$(git -C "$wt" status --porcelain 2>/dev/null \
-            | grep -v 'tiny-garden/\.plot/state' | head -1)
+  dirty=$(desk_dirt "$wt" | head -1)
 
   # The host: whether ANY PR for this branch merged.
   #
@@ -560,6 +742,12 @@ while IFS=$'\037' read -r wt br prunable; do
     merge=merged; why="detached, nothing to land"
   fi
 
+  # The desk again: commits only this checkout holds. Taken AFTER the merge
+  # reading, because the head the host merged is what separates a pushed
+  # commit from an unpushed one once the remote ref is gone. Lines, or the
+  # word `unknown` when they could not be counted.
+  if unpushed=$(desk_unpushed "$wt" "$short" "$merge"); then :; else unpushed=unknown; fi
+
   # THE DECISION. One call, and the script holds no `if` about whether a
   # worktree may go — only about what to do with the answer.
   #
@@ -581,7 +769,7 @@ while IFS=$'\037' read -r wt br prunable; do
   # the tree and says why. Silence is never permission, on this path either.
   verdict=$(PLOT_BRANCH="$short" PLOT_DEFAULT="$DEFAULT" PLOT_PID="$pid" \
             PLOT_DIRTY="$dirty" PLOT_MARKER="$marker" PLOT_MERGE="$merge" \
-            PLOT_RULE="$RULE" \
+            PLOT_UNPUSHED="$unpushed" PLOT_RULE="$RULE" \
             node --input-type=module - <<'NODE_EOF' 2>/dev/null
 // Imported from an ABSOLUTE path derived from this script, never from the
 // cwd. The reaper runs with its cwd wherever the operator invoked it and the
@@ -603,6 +791,9 @@ const problem = firstReapRefusal({
   dirtyPath: process.env.PLOT_DIRTY,
   blockedMarker: process.env.PLOT_MARKER === "true",
   merge: process.env.PLOT_MERGE,
+  unpushed: process.env.PLOT_UNPUSHED === "unknown"
+    ? "unknown"
+    : process.env.PLOT_UNPUSHED.split("\n").filter((l) => l !== ""),
 });
 
 // `reap` when nothing refused; otherwise the refusal and its reading, which
@@ -622,6 +813,7 @@ NODE_EOF
       live-worker)         reason="worker alive (pid $detail)" ;;
       blocked-marker)      reason="PLOT-BLOCKED marker — needs a person" ;;
       uncommitted-changes) reason="uncommitted: ${detail:0:40}" ;;
+      unpushed-commits)    reason="unpushed commits: ${detail:0:40}" ;;
       on-default-branch)   reason="on $DEFAULT — dispatched branch not checked out" ;;
       no-merged-pr)        reason="unlanded work — no merged PR" ;;
       *)                   reason="rule could not be asked — keeping" ;;
@@ -1032,15 +1224,12 @@ while IFS=$'\t' read -r wt br; do
   [ -n "$MAIN_CHECKOUT" ] && [ "$(canonical "$wt")" = "$(canonical "$MAIN_CHECKOUT")" ] && continue
   dshort=${br#refs/heads/}
 
-  dcount=$(git -C "$wt" status --porcelain 2>/dev/null \
-             | grep -v 'tiny-garden/\.plot/state' | wc -l | tr -d ' ')
+  dcount=$(desk_dirt "$wt" | wc -l | tr -d ' ')
   [ "${dcount:-0}" -gt 0 ] || continue
 
-  dpid=""
-  if [ -f "$wt/.plot-worker.pid" ]; then
-    p=$(cat "$wt/.plot-worker.pid" 2>/dev/null)
-    if [ -n "$p" ] && ps -p "$p" >/dev/null 2>&1; then dpid="$p"; fi
-  fi
+  # The same liveness reading the reap loop takes, so a desk the reaper keeps
+  # for a live worker and one the sweep names as owned are the same desks.
+  dpid=$(desk_worker_pid "$wt")
 
   dmanifest=""
   if m=$(manifest_for "$(canonical "$wt")"); then dmanifest=$(basename "$m"); fi

package/plot-resolve-artifact.sh

@@ -70,6 +70,7 @@
 set -uo pipefail
 
 script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+. "$script_dir/plot-tmp.sh"
 
 # THE FILES THIS SCRIPT MAY RESOLVE — a SET, and derived rather than listed.
 #
@@ -231,8 +232,9 @@ if ! mkdir "$lock" 2>/dev/null; then
 fi
 # Released on every exit, including a kill. A lock that outlives its process
 # would make one interrupted repair block the branch forever — and the repair is
-# idempotent, so there is nothing to protect after the process is gone.
-trap 'rmdir "$lock" 2>/dev/null || true' EXIT INT TERM
+# idempotent, so there is nothing to protect after the process is gone. A TERM
+# or INT stops the repair (143 or 130) after the lock is released.
+plot_on_exit 'rmdir "$lock" 2>/dev/null || true'
 
 if [ -d "$wt" ] && git worktree list --porcelain | grep -qx "worktree $wt"; then
   # A REUSED WORKTREE MAY BELONG TO SOMEONE ELSE, and on 2026-08-17 one did: the