@plot-pm/board 0.16.0 → 0.16.2

package/plot-fleet-scan.sh

@@ -2844,6 +2844,7 @@ is_plan_phase() { # $1=normalized phase → 0 when this file is a plan
 # gave when it failed.
 plan_meta_files=()
 plan_meta_phases=()
+plan_meta_types=()
 plan_meta_waves=()
 
 # Parses every plan file given, filling the four arrays above. Called ONCE.
@@ -2871,7 +2872,7 @@ for line in sys.stdin:
     f = d.get("file")
     if not f:
         continue
-    print("\t".join(["P", clean(f), clean(d.get("phase", ""))]))
+    print("\t".join(["P", clean(f), clean(d.get("phase", "")), clean(d.get("type", ""))]))
     for i, w in enumerate(d.get("waves", []) or []):
         name = w.get("name")
         for b in w.get("branches", []) or []:
@@ -2906,8 +2907,12 @@ for line in sys.stdin:
     case "$kind" in
       P)
         plan_meta_files+=("$file")
-        # `rest` is "<phase>", a single token with no tabs.
-        plan_meta_phases+=("$rest")
+        # `rest` is "<phase>\t<type>", two tokens with no tabs inside either.
+        plan_meta_phases+=("${rest%%$'\t'*}")
+        case "$rest" in
+          *$'\t'*) plan_meta_types+=("${rest#*$'\t'}") ;;
+          *) plan_meta_types+=("") ;;
+        esac
         plan_meta_waves+=("")
         ;;
       W)
@@ -3659,6 +3664,11 @@ for plan in "${plans[@]}"; do
   if is_terminal_phase "$plan_phase" && [ "$plan_phase" != "delivered" ]; then
     continue
   fi
+  # A docs or infra plan is live when it merges: /plot-release never records
+  # `Released` for one, so `delivered` is its last phase and it leaves here.
+  if [ "$plan_phase" = "delivered" ]; then
+    case "${plan_meta_types[$meta_i]}" in docs|infra) continue ;; esac
+  fi
 
   n_plans=$((n_plans + 1))
   plan_target=$(readlink "$plan" 2>/dev/null && echo "" || true)

package/plot-host.sh

@@ -247,7 +247,9 @@
 #                                 list` (no --json), pinned to bb 0.6.0. EXIT 4
 #                                 narrows rather than disappears: it is the
 #                                 tracker-DISABLED case (bb answers 404/410),
-#                                 which stays *this host cannot answer* where an
+#                                 and a bb whose `--help` lists no `issue`
+#                                 command (Quatico bb), both of
+#                                 which stay *this host cannot answer* where an
 #                                 empty list would say *there are none*. A call
 #                                 that failed on an enabled tracker, or any error
 #                                 wording this adapter does not recognise, exits
@@ -281,7 +283,8 @@
 #                                 Same three outcomes as issue-list, same codes:
 #                                 BITBUCKET NOW ANSWERS via `bb issue view`
 #                                 (pinned to 0.6.0); `url` comes from the view's
-#                                 footer. EXIT 4 is the tracker-DISABLED case,
+#                                 footer. EXIT 4 is the tracker-DISABLED case
+#                                 or a bb with no `issue` command,
 #                                 EXIT 3 a lookup that failed or an unrecognised
 #                                 error. An issue that does not exist is a
 #                                 FAILURE here, not an empty body: the caller
@@ -1016,7 +1019,7 @@ bb_state_listing() { # global bb args… --state <s> --json → one JSON array
     esac
   done
   [ -n "$_st" ] || die "bb_state_listing: no --state"
-  _out="$(bb ${_args[@]+"${_args[@]}"} api "/repositories/{ws}/{repo}/pullrequests?state=$(bb_query_state "$_st")&pagelen=50")" || return $?
+  _out="$(bb ${_args[@]+"${_args[@]}"} api "/repositories/{ws}/{repo}/pullrequests?state=$(bb_query_state "$_st")&pagelen=$BB_LIST_PAGELEN")" || return $?
   printf '%s' "$_out" | jq -c '.values // []'
 }
 
@@ -2033,17 +2036,41 @@ bb_issue_exit_code() {
 # fails LOUDLY rather than silently mis-reading a column that may have moved.
 # `PLOT_BB_SKIP_VERSION_CHECK` exists for the test harness, whose stub bb has no
 # meaningful version — the parse is exercised against captured fixture text.
+#
+# A VERSION MISMATCH IS NOT ALWAYS A MOVED FORMAT. Two products share the name
+# `bb` (see the capability check below), and Quatico `bb` — 1.9.0 measured
+# 2026-10-01 — has no `issue` command at all: `bb --help` lists `pr …`,
+# `source …` and `api`. Telling it to update would suggest a fix that does not
+# exist, so a mismatch first asks `bb --help` what the CLI offers. A help text
+# that lists a `pr` command and no `issue` command is a bb that cannot be asked
+# about issues, which is exit 4 — the same answer as a disabled tracker. Any
+# other help text keeps the refusal below, exit 3. Exits 4 or 3; 0 passes.
 bb_assert_issue_version() {
   [ -n "${PLOT_BB_SKIP_VERSION_CHECK:-}" ] && return 0
   local v
   v="$(bb --version 2>/dev/null | bb_strip_ansi | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1)"
   if [ "$v" != "$BB_ISSUE_VERSION" ]; then
+    if bb_lacks_issue_command; then
+      echo "plot-host: bb ${v:-unknown} lists no issue command — Quatico bb has none, unlike craftamap/bb — so this repository's issues cannot be read through it; declare the issue tracker with the \`Tracker\` config key" >&2
+      return 4
+    fi
     echo "plot-host: bb issue parse targets $BB_ISSUE_VERSION but found '${v:-unknown}' — refusing to mis-read a format that may have moved" >&2
     return 3
   fi
   return 0
 }
 
+# Whether `bb --help` lists commands and `issue` is not one of them. A help
+# that lists no `pr` command either is not a command listing this can read, so
+# it answers *not proven* (1) and the caller keeps its exit-3 refusal: guessing
+# 4 from unreadable help would turn a broken bb into *no issue tracker*.
+bb_lacks_issue_command() {
+  local help
+  help="$(bb --help 2>&1 | bb_strip_ansi)" || return 1
+  grep -qE '^[[:space:]]+pr([[:space:]]|$)' <<<"$help" || return 1
+  ! grep -qE '^[[:space:]]+issues?([[:space:]]|$)' <<<"$help"
+}
+
 # --- bb capability check (--json support) ------------------------------------
 #
 # TWO TOOLS SHARE THE NAME `bb`. craftamap/bb is a Go binary that does NOT
@@ -2516,27 +2543,36 @@ jira_check() {
 # `bb` returned 50 merged PRs (ids 836→787) against a repo numbering to 836, so
 # ~780 older merged PRs were invisible to the join.
 #
-# THE DETECTOR IS AGAINST THE REQUESTED LIMIT, NEVER THE CONSTANT 50. A future
-# `bb` page size of 100 must not make a truncated 100-row list report complete —
-# this plan's own defect restored. So the rule names no page size:
+# THE RULE IS `rules/listing-page.ts`'s `pagePossiblyTruncated`, and this is
+# its shell copy. `pr-list` runs on every board refresh, so the shell keeps the
+# rule rather than asking a bundle (docs/shell-and-domain.md), and
+# `packages/domain/corpus/listing-page.corpus.test.ts` holds the pair:
 #
 #   github (HONOURS --limit)  : a state is possibly truncated when it returned
-#                               AT LEAST the requested limit — the host may have
-#                               had more that the limit hid. Fewer rows than the
-#                               limit PROVES completeness.
-#   bitbucket (IGNORES --limit): `bb pr list` has no --limit and reports neither
-#                               a total nor a cursor, so it can NEVER prove
-#                               completeness for a --limit call. Any non-empty
-#                               page is therefore possibly truncated. An empty
-#                               page had nothing to truncate.
-#
-# THE PREMISE ABOVE IS ABOUT `bb pr list`, AND IT WAS ONCE WRITTEN ABOUT
-# BITBUCKET. It said the host "cannot report a total or a cursor" — true of the
-# CLI's listing and false of the REST endpoint behind it, which carries both a
-# `size` and a `next`. That mattered the moment a path existed that could ask:
-# the per-branch sweep (#333) proves completeness exactly, per branch, and this
-# detector is deliberately not asked about it (`pr_list_states`). The rule below
-# is unchanged and still governs every listing call.
+#                               AT LEAST the requested limit. Fewer rows than
+#                               the limit PROVES completeness.
+#   bitbucket (ONE FIXED PAGE): the listing ignores --limit and returns one page
+#                               per state. A page SHORTER than the page length
+#                               is the last page, so it is complete. A page AT
+#                               the length stays possibly truncated.
+#
+# THE PAGE LENGTH IS A READING, NEVER A CONSTANT THE RULE NAMES. The listing
+# asks `pagelen=$BB_LIST_PAGELEN` through `bb api`, and the length holds only
+# where that `bb` passes the query through unchanged, so it is read per version
+# from `BB_LIST_PAGE_VERSIONS` — pinned like `BB_ISSUE_VERSION`. A version
+# nobody measured has no length, and every non-empty page under it stays
+# possibly truncated: the rule never calls a page complete it cannot prove. A
+# future length of 100 is a new table entry, never a page of 50 read as short.
+#
+# Measured on `quatico/quaweb-website`: bb 1.9.0 returned 50 merged rows in one
+# request on 2026-09-30, and on 2026-10-01 answered `pagelen: 50` with 50 rows,
+# a `next` and `size: 895`. Before
+# 2026-10-01 every non-empty Bitbucket page was reported, so 20 open PRs read as
+# truncated on every refresh (#1137).
+#
+# THE PER-BRANCH SWEEP AND THE WINDOWED LISTING MAKE NO PAGE CLAIM. The sweep
+# proves completeness per branch and the window refuses a short read, so this
+# detector is not asked about either (`pr_list_states`).
 #
 # No --limit was requested → the caller accepted the host's default page and is
 # owed no report, so no existing no-limit caller's behaviour changes.
@@ -2555,18 +2591,40 @@ jira_check() {
 # future diff that teaches the scan to fall back, without moving the failure
 # into a minutes-long pulse. See the plan's Done-when item 3.
 #
+# The page length Bitbucket's plain listing asks for. `bb_state_listing` sends
+# it, and `pr_list_report_truncation` reads it as the page length only for a
+# `bb` in BB_LIST_PAGE_VERSIONS.
+BB_LIST_PAGELEN=50
+
+# The `bb` versions measured to pass `pagelen` through `bb api` unchanged,
+# space-separated. `adapters/host/listing-paging.ts` holds the same table.
+BB_LIST_PAGE_VERSIONS="1.9.0"
+
+# The page length the answering `bb` lists by, or nothing where its version is
+# not in BB_LIST_PAGE_VERSIONS. Reads the version `bb_require_json` recorded,
+# so it costs no `bb` call; a skipped capability check records no version.
+bb_list_page_length() {
+  local v="${BB_CAP_IDENTITY#*/}"
+  case " $BB_LIST_PAGE_VERSIONS " in
+    *" $v "*) printf '%s\n' "$BB_LIST_PAGELEN" ;;
+  esac
+}
+
 # $1 backend  $2 requested limit (may be "")  $3 state word  $4 row count
 pr_list_report_truncation() {
-  local be="$1" limit="$2" state="$3" count="$4"
+  local be="$1" limit="$2" state="$3" count="$4" len=""
   [ -n "$limit" ] || return 0            # no --limit → no completeness claim owed
   [ "$count" -gt 0 ] 2>/dev/null || return 0   # an empty page had nothing to hide
   if [ "$be" = "github" ]; then
     # github honours the limit: complete unless the page came back AT the limit.
     [ "$count" -ge "$limit" ] 2>/dev/null || return 0
+  else
+    # A fixed page: complete below a measured page length, unprovable otherwise.
+    [ "$be" = "bitbucket" ] && len="$(bb_list_page_length)"
+    if [ -n "$len" ] && [ "$count" -lt "$len" ] 2>/dev/null; then return 0; fi
   fi
-  # bitbucket: any non-empty page for a --limit call is unprovable, so it falls
-  # through to the report. Named per state so a future caller can resolve exactly
-  # the states that were capped, not a whole-call flag that over-reports.
+  # Named per state so a caller can resolve exactly the states that were
+  # capped, not a whole-call flag that over-reports.
   echo "plot-host: $be pr-list state=$state possibly truncated ($count rows, requested limit $limit unprovable) — a join against this page may read older branches as 'no PR' (#333)" >&2
 }
 

package/plot-reap.sh

@@ -399,79 +399,35 @@ if [ -r "$CONFIG" ]; then
 fi
 case "$MANIFEST_DIR" in /*) ;; *) MANIFEST_DIR="$ROOT/$MANIFEST_DIR" ;; esac
 
-# Where the agent logs live, resolved through `plot-config.sh` from the SAME
-# `Worktree root` key `resolve_wt_root()` and `agentLogDir` read. Three readers
-# of one key, and none of them may invent a second: a reaper sweeping a
-# directory the board never writes to reports success over a file that is still
-# there, which is the failure this slice exists to stop.
+# Where the DESKS and the agent logs live: the desk root, `deskRoot`'s answer
+# asked through `plot-desk-root.sh` — the rule `plot-dispatch.sh` creates desks
+# under and `agentLogDir` writes logs into. One rule, so a reaper cannot sweep a
+# directory the board never writes to and report success over a file that is
+# still there.
 #
-# THE FALLBACK IS THE PARENT DIRECTORY, NOT AN ERROR — `agentLogDir`'s rule,
-# stated the same way here. A repository with no key has no `.worktrees/`, and
-# the logs it wrote are beside it; a reaper that refused to look there would
-# clean nothing on exactly the repositories that never migrated.
+# Two questions read the one answer. `LOG_DIR` is where a finished branch's log
+# files are swept from; `WT_ROOT` is the directory a tree must sit under to be a
+# candidate desk at all. The sweep's filename filter (`branch_log_files`) is
+# unchanged, so what it may delete is still only `plot-<kind>-*` names. The
+# default root is `<repo>/.worktrees`, which Plot owns, so a sibling checkout in
+# the parent is never under it and stays silent.
 #
-# The case split is `resolve_wt_root()`'s: absolute taken as given, relative
-# joined onto the repo root, trailing slash trimmed as pure string work because
-# the directory need not exist. A second convention for resolving a configured
-# directory is a second way to be wrong.
-LOG_DIR="$(cd "$ROOT/.." && pwd)"
-if [ -r "$CONFIG" ]; then
-  d=$(bash "$CONFIG" get "Worktree root" "" 2>/dev/null) || d=""
-  if [ -n "$d" ]; then
-    case "$d" in
-      /*) LOG_DIR="$d" ;;
-      *)  LOG_DIR="$ROOT/$d" ;;
-    esac
-    LOG_DIR="${LOG_DIR%/}"
-  fi
-fi
-
-# Where the DESKS live, which is the same key resolved for a different question.
-#
-# `LOG_DIR` and this answer two things: `LOG_DIR` is where a finished branch's
-# log files are swept from, and this is the directory a tree must sit under to
-# be a candidate desk at all. A repository with NO configured root has no
-# `.worktrees/` and its desks are named `plot-wt-*` beside the repo — so this
-# stays EMPTY there rather than defaulting to the parent, because the parent
-# holds every sibling checkout a person ever made and calling those candidate
-# desks is the over-broad reading this slice must not introduce.
-#
-# IT IS RESOLVED AGAINST THE MAIN CHECKOUT, NOT `$ROOT`, and that is the one
-# place in this script where the two differ on purpose. `git rev-parse
+# IT IS RESOLVED AGAINST THE MAIN CHECKOUT, NOT `$ROOT`. `git rev-parse
 # --show-toplevel` answers *this* worktree, so a reaper run from inside a desk
-# resolves `.worktrees` to a directory beneath that desk — which does not
+# would resolve `.worktrees` to a directory beneath that desk — which does not
 # exist, so every tree reads as unplaceable-but-elsewhere and the reading is
-# silently empty. Measured 2026-09-10 from this worktree: `$ROOT/.worktrees`
+# silently empty. Measured 2026-09-10 from inside a desk: `$ROOT/.worktrees`
 # named `.../plot-wt-feature-a-finished-desk-is-a-finding/.worktrees` while
 # every desk sits under `.../plot/.worktrees`. A dispatched agent runs the
 # reaper from exactly there, so the wrong answer would be the usual one.
 #
-# `--git-common-dir` is shared by every worktree of one repository, and its
-# parent is the primary checkout — which is what `plot-dispatch.sh` composes
-# desk paths from when it creates them. Same directory, same key, so a
-# creation and this reading cannot disagree.
-#
-# `LOG_DIR` above keeps `$ROOT` untouched: it is this script's established
-# behaviour with its own callers, and changing where a sweep DELETES from is a
-# blast radius rather than a reading. Named here rather than fixed silently.
-WT_ROOT=""
-if [ -r "$CONFIG" ]; then
-  d=$(bash "$CONFIG" get "Worktree root" "" 2>/dev/null) || d=""
-  if [ -n "$d" ]; then
-    case "$d" in
-      /*) WT_ROOT="$d" ;;
-      *)
-        # Falls back to `$ROOT` where git cannot answer, which is the same
-        # directory on a single-checkout repository and the only one available.
-        main_checkout=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)") \
-          || main_checkout="$ROOT"
-        [ -d "$main_checkout" ] || main_checkout="$ROOT"
-        WT_ROOT="$main_checkout/$d"
-        ;;
-    esac
-    WT_ROOT="${WT_ROOT%/}"
-  fi
-fi
+# There is NO FALLBACK: a reaper that cannot ask the rule stops rather than
+# compute a second default and delete from it.
+# shellcheck source=plot-desk-root.sh
+. "$(dirname "${BASH_SOURCE[0]}")/plot-desk-root.sh"
+WT_ROOT=$(plot_desk_root "$(plot_repo_root)") || {
+  echo "plot-reap: cannot resolve the desk root — nothing was reaped." >&2; exit 2; }
+LOG_DIR="$WT_ROOT"
 
 # The files ONE branch's agent run leaves beside its worktree, removed with it.
 #

package/plot-resolve-artifact.sh

@@ -165,11 +165,10 @@ fi
 # MEASURED, and recorded at length in plot-dispatch.sh's held_worktree: a
 # hand-made worktree is named for the branch with its TYPE dropped, so a gate
 # that guessed `plot-wt-<flattened>` missed a worktree with six modified files
-# in it. This site had the same shape — it composed `plot-wt-<flattened>` under
-# `repo_root/..` — and this change would make the guess worse, not better: the
-# new `Worktree root:` key introduces a SECOND naming convention, giving a
-# path guess a second way to be wrong. So the read asks git, and only the
-# CREATE-a-fresh-one fallback below composes a name (via dispatch's rule, so the
+# in it. Desks carry two naming conventions — `plot-wt-*` beside the repo from
+# older dispatches, and unprefixed names under the desk root — so a path guess
+# has two ways to be wrong. So the read asks git, and only the
+# CREATE-a-fresh-one fallback below composes a name (under the desk root, so the
 # fresh worktree lands where dispatch would have put it).
 #
 # `git worktree list --porcelain` emits `worktree <path>` then `branch
@@ -182,21 +181,15 @@ wt=$(git worktree list --porcelain </dev/null 2>/dev/null | awk -v want="refs/he
   /^worktree /  { path = substr($0, 10) }
   /^branch /    { if (substr($0, 8) == want) { print path; exit } }')
 
-# No existing worktree holds it — compose the path a fresh one will take, by the
-# same root+prefix rule plot-dispatch.sh uses. Under a `Worktree root:` key the
-# root moves and the `plot-wt-` prefix drops; absent it, today's behaviour.
+# No existing worktree holds it — compose the path a fresh one will take, under
+# the desk root `plot-dispatch.sh` also asks for, so the fresh worktree lands
+# where dispatch would have put it. The root is the MAIN checkout's, and there
+# is no fallback: an unaskable rule refuses the repair.
+# shellcheck source=plot-desk-root.sh
+. "$script_dir/plot-desk-root.sh"
 if [ -z "$wt" ]; then
-  wt_root=$("$script_dir/plot-config.sh" get "Worktree root" "")
-  if [ -z "$wt_root" ]; then
-    wt_root=$(cd "$repo_root/.." && pwd)
-    wt="$wt_root/plot-wt-$(printf '%s' "$branch" | tr '/' '-')"
-  else
-    case "$wt_root" in
-      /*) : ;;
-      *)  wt_root="$repo_root/$wt_root" ;;
-    esac
-    wt="${wt_root%/}/$(printf '%s' "$branch" | tr '/' '-')"
-  fi
+  wt_root=$(plot_desk_root "$(plot_repo_root)") || finish refused no-desk-root
+  wt="$wt_root/$(printf '%s' "$branch" | tr '/' '-')"
 fi
 
 if [ "$dry_run" = 1 ]; then
@@ -263,6 +256,7 @@ if [ -d "$wt" ] && git worktree list --porcelain | grep -qx "worktree $wt"; then
     finish refused worktree-busy
   fi
 else
+  plot_exclude_desk_root "$(plot_repo_root)"
   if ! git worktree add -q "$wt" "$branch" 2>/dev/null; then
     if ! git worktree add -q -b "$branch" "$wt" "origin/$branch" 2>/dev/null; then
       echo "plot-resolve-artifact: cannot create a worktree for $branch at $wt" >&2

package/plot-tmp.sh

@@ -1,5 +1,5 @@
 # plot-tmp.sh — every temp path a Plot script creates, and the process's only
-# EXIT/INT/TERM traps. SOURCED, not run.
+# EXIT/INT/TERM/PIPE traps. SOURCED, not run.
 #
 #   . "$SCRIPT_DIR/plot-tmp.sh"
 #   plot_tmpdir  work  fleet-ref     # $work  = $TMPDIR/plot-fleet-ref.XXXXXX (a directory)
@@ -27,8 +27,11 @@
 # first call would be installed inside that call's substitution and remove the
 # path when the substitution closed. `PLOT_TMP_LOADED` makes a second source in
 # the same process a no-op, because a re-run setup would truncate the live
-# registry. INT and TERM run the cleanup, clear their own trap and re-raise, so
-# the script stops with 130 or 143 rather than running on to exit 0.
+# registry. INT, TERM and PIPE run the cleanup, clear their own trap and
+# re-raise, so the script stops with 130, 143 or 141 rather than running on to
+# exit 0. PIPE is among them because a board server stopped with SIGTERM leaves
+# its running scripts writing to closed pipes, and SIGPIPE's default action
+# skips the EXIT trap.
 #
 # A script that sources this must not install its own EXIT, INT or TERM trap:
 # the last `trap` wins, and that replacement is the defect this file fixes
@@ -42,29 +45,51 @@ PLOT_TMP_LOADED=$$
 # Fixed at first source: a later `TMPDIR` change in the script does not move it.
 # A file already at this path belongs to a dead process that had the same pid,
 # and its `c:` commands are not this process's, so it is replaced, never read.
+# The file itself is created at the end of this file, after the traps.
 PLOT_TMP_REGISTRY="${TMPDIR:-/tmp}/plot-reg.$$"
-rm -f -- "$PLOT_TMP_REGISTRY" 2>/dev/null
-: > "$PLOT_TMP_REGISTRY" 2>/dev/null || true
 
 # One line per entry, in registration order: `p:<path>` or `c:<command>`.
 _plot_tmp_register() {
   printf '%s:%s\n' "$1" "$2" >> "$PLOT_TMP_REGISTRY" 2>/dev/null || true
 }
 
+# A SIGNAL INSIDE A CREATION WAITS FOR THE REGISTRATION. bash runs a pending
+# trap as soon as `$(mktemp …)` returns, before the next line registers the
+# path, so a cleanup run there would remove the registry and leave the new path
+# unlisted. While `__plot_tmp_busy` is set, the signal handler records the
+# signal in `__plot_tmp_pending` and returns; `_plot_tmp_create` handles it once
+# the path is registered.
+__plot_tmp_busy=''
+__plot_tmp_pending=''
+
+# _plot_tmp_create VAR prefix [-d] — create, register, assign to VAR.
+_plot_tmp_create() {
+  local __plot_tmp_new __plot_tmp_rc
+  __plot_tmp_busy=1
+  if [ "${3:-}" = -d ]; then
+    __plot_tmp_new=$(mktemp -d "${TMPDIR:-/tmp}/plot-$2.XXXXXX")
+  else
+    __plot_tmp_new=$(mktemp "${TMPDIR:-/tmp}/plot-$2.XXXXXX")
+  fi
+  __plot_tmp_rc=$?
+  [ "$__plot_tmp_rc" -eq 0 ] && _plot_tmp_register p "$__plot_tmp_new"
+  __plot_tmp_busy=''
+  if [ -n "$__plot_tmp_pending" ]; then
+    # shellcheck disable=SC2086 # "<name> <number>", split on purpose
+    _plot_tmp_on_signal $__plot_tmp_pending
+  fi
+  [ "$__plot_tmp_rc" -eq 0 ] || return 1
+  printf -v "$1" '%s' "$__plot_tmp_new"
+}
+
 # plot_tmpdir VAR prefix — create a directory, register it, assign it to VAR.
 plot_tmpdir() {
-  local __plot_tmp_new
-  __plot_tmp_new=$(mktemp -d "${TMPDIR:-/tmp}/plot-$2.XXXXXX") || return 1
-  _plot_tmp_register p "$__plot_tmp_new"
-  printf -v "$1" '%s' "$__plot_tmp_new"
+  _plot_tmp_create "$1" "$2" -d
 }
 
 # plot_tmpfile VAR prefix — create a file, register it, assign it to VAR.
 plot_tmpfile() {
-  local __plot_tmp_new
-  __plot_tmp_new=$(mktemp "${TMPDIR:-/tmp}/plot-$2.XXXXXX") || return 1
-  _plot_tmp_register p "$__plot_tmp_new"
-  printf -v "$1" '%s' "$__plot_tmp_new"
+  _plot_tmp_create "$1" "$2"
 }
 
 # plot_on_exit command — run `command` (one line) when the process ends.
@@ -75,9 +100,13 @@ plot_on_exit() {
 # Runs every registered command and removes every registered path, in
 # registration order, then removes the registry. Runs once: the registry is
 # gone afterwards, so a second call finds nothing.
+#
+# PIPE is ignored for the cleanup: the process is ending, and a registered
+# command that writes to a closed stdout or stderr must not stop the removals.
 _plot_tmp_cleanup() {
   local __plot_tmp_line
-  [ -f "$PLOT_TMP_REGISTRY" ] || return 0
+  [ -n "${__plot_tmp_owned:-}" ] && [ -f "$PLOT_TMP_REGISTRY" ] || return 0
+  trap '' PIPE
   while IFS= read -r __plot_tmp_line; do
     case $__plot_tmp_line in
       c:*) eval "${__plot_tmp_line#c:}" ;;
@@ -97,6 +126,10 @@ _plot_tmp_on_exit() {
 # $1 is the signal name, $2 its number. `kill` re-raises it with the default
 # disposition; the `exit` is reached only if the shell defers the delivery.
 _plot_tmp_on_signal() {
+  if [ -n "$__plot_tmp_busy" ]; then
+    __plot_tmp_pending="$1 $2"
+    return 0
+  fi
   trap - EXIT "$1"
   _plot_tmp_cleanup
   kill -"$1" "$$"
@@ -106,3 +139,18 @@ _plot_tmp_on_signal() {
 trap _plot_tmp_on_exit EXIT
 trap '_plot_tmp_on_signal INT 2' INT
 trap '_plot_tmp_on_signal TERM 15' TERM
+trap '_plot_tmp_on_signal PIPE 13' PIPE
+
+# THE REGISTRY IS CREATED AFTER THE TRAPS, so no signal lands between the file
+# and the handler that removes it. It is replaced under the creation deferral:
+# until `__plot_tmp_owned` is set, a file at this path is a dead process's and
+# the cleanup leaves it unread.
+__plot_tmp_busy=1
+rm -f -- "$PLOT_TMP_REGISTRY" 2>/dev/null
+: > "$PLOT_TMP_REGISTRY" 2>/dev/null || true
+__plot_tmp_owned=1
+__plot_tmp_busy=''
+if [ -n "$__plot_tmp_pending" ]; then
+  # shellcheck disable=SC2086 # "<name> <number>", split on purpose
+  _plot_tmp_on_signal $__plot_tmp_pending
+fi

package/plot-worker-state.sh

@@ -392,6 +392,28 @@ plot_worker_dirty() { # $1=worktree → the dirty files, one per line, leftovers
   plot_worker_dirty_filter "$(git -C "$wt" status --porcelain 2>/dev/null)"
 }
 
+# Keep a file the estate writes into every desk out of `git status`.
+#
+# THROUGH THE CLONE'S `info/exclude`, never `.gitignore`: a `.gitignore` rule
+# lives in the branch's own content, so a desk cut from an older branch would
+# not see it, and `info/exclude` is per-repository and shared by every worktree.
+# The directory and the file are CREATED when absent. Measured 2026-10-01
+# (#1130): a clone with no `.git/info/exclude` kept `?? .metadata_never_index`
+# in every free desk, and the AgentMonitor reported each waiting agent as
+# `holds unlanded work`, because the writer skipped a file that did not exist.
+#
+# Best-effort: a desk that cannot take the line still works. Always returns 0.
+plot_desk_exclude() { # $1=worktree $2=the exact line to exclude
+  local common excl
+  common=$(git -C "$1" rev-parse --git-common-dir 2>/dev/null) || return 0
+  [ -n "$common" ] || return 0
+  case "$common" in /*) ;; *) common="$1/$common" ;; esac
+  excl="$common/info/exclude"
+  mkdir -p "$common/info" 2>/dev/null || return 0
+  grep -qxF "$2" "$excl" 2>/dev/null || printf '%s\n' "$2" >> "$excl" 2>/dev/null || true
+  return 0
+}
+
 # The same filter, over status output the CALLER already has.
 #
 # SPLIT OUT BECAUSE THE STATUS CALL IS THE EXPENSIVE HALF and one caller had