@plot-pm/board 0.16.1 → 0.16.2

package/plot-reap.sh

@@ -399,79 +399,35 @@ if [ -r "$CONFIG" ]; then
 fi
 case "$MANIFEST_DIR" in /*) ;; *) MANIFEST_DIR="$ROOT/$MANIFEST_DIR" ;; esac
 
-# Where the agent logs live, resolved through `plot-config.sh` from the SAME
-# `Worktree root` key `resolve_wt_root()` and `agentLogDir` read. Three readers
-# of one key, and none of them may invent a second: a reaper sweeping a
-# directory the board never writes to reports success over a file that is still
-# there, which is the failure this slice exists to stop.
+# Where the DESKS and the agent logs live: the desk root, `deskRoot`'s answer
+# asked through `plot-desk-root.sh` — the rule `plot-dispatch.sh` creates desks
+# under and `agentLogDir` writes logs into. One rule, so a reaper cannot sweep a
+# directory the board never writes to and report success over a file that is
+# still there.
 #
-# THE FALLBACK IS THE PARENT DIRECTORY, NOT AN ERROR — `agentLogDir`'s rule,
-# stated the same way here. A repository with no key has no `.worktrees/`, and
-# the logs it wrote are beside it; a reaper that refused to look there would
-# clean nothing on exactly the repositories that never migrated.
+# Two questions read the one answer. `LOG_DIR` is where a finished branch's log
+# files are swept from; `WT_ROOT` is the directory a tree must sit under to be a
+# candidate desk at all. The sweep's filename filter (`branch_log_files`) is
+# unchanged, so what it may delete is still only `plot-<kind>-*` names. The
+# default root is `<repo>/.worktrees`, which Plot owns, so a sibling checkout in
+# the parent is never under it and stays silent.
 #
-# The case split is `resolve_wt_root()`'s: absolute taken as given, relative
-# joined onto the repo root, trailing slash trimmed as pure string work because
-# the directory need not exist. A second convention for resolving a configured
-# directory is a second way to be wrong.
-LOG_DIR="$(cd "$ROOT/.." && pwd)"
-if [ -r "$CONFIG" ]; then
-  d=$(bash "$CONFIG" get "Worktree root" "" 2>/dev/null) || d=""
-  if [ -n "$d" ]; then
-    case "$d" in
-      /*) LOG_DIR="$d" ;;
-      *)  LOG_DIR="$ROOT/$d" ;;
-    esac
-    LOG_DIR="${LOG_DIR%/}"
-  fi
-fi
-
-# Where the DESKS live, which is the same key resolved for a different question.
-#
-# `LOG_DIR` and this answer two things: `LOG_DIR` is where a finished branch's
-# log files are swept from, and this is the directory a tree must sit under to
-# be a candidate desk at all. A repository with NO configured root has no
-# `.worktrees/` and its desks are named `plot-wt-*` beside the repo — so this
-# stays EMPTY there rather than defaulting to the parent, because the parent
-# holds every sibling checkout a person ever made and calling those candidate
-# desks is the over-broad reading this slice must not introduce.
-#
-# IT IS RESOLVED AGAINST THE MAIN CHECKOUT, NOT `$ROOT`, and that is the one
-# place in this script where the two differ on purpose. `git rev-parse
+# IT IS RESOLVED AGAINST THE MAIN CHECKOUT, NOT `$ROOT`. `git rev-parse
 # --show-toplevel` answers *this* worktree, so a reaper run from inside a desk
-# resolves `.worktrees` to a directory beneath that desk — which does not
+# would resolve `.worktrees` to a directory beneath that desk — which does not
 # exist, so every tree reads as unplaceable-but-elsewhere and the reading is
-# silently empty. Measured 2026-09-10 from this worktree: `$ROOT/.worktrees`
+# silently empty. Measured 2026-09-10 from inside a desk: `$ROOT/.worktrees`
 # named `.../plot-wt-feature-a-finished-desk-is-a-finding/.worktrees` while
 # every desk sits under `.../plot/.worktrees`. A dispatched agent runs the
 # reaper from exactly there, so the wrong answer would be the usual one.
 #
-# `--git-common-dir` is shared by every worktree of one repository, and its
-# parent is the primary checkout — which is what `plot-dispatch.sh` composes
-# desk paths from when it creates them. Same directory, same key, so a
-# creation and this reading cannot disagree.
-#
-# `LOG_DIR` above keeps `$ROOT` untouched: it is this script's established
-# behaviour with its own callers, and changing where a sweep DELETES from is a
-# blast radius rather than a reading. Named here rather than fixed silently.
-WT_ROOT=""
-if [ -r "$CONFIG" ]; then
-  d=$(bash "$CONFIG" get "Worktree root" "" 2>/dev/null) || d=""
-  if [ -n "$d" ]; then
-    case "$d" in
-      /*) WT_ROOT="$d" ;;
-      *)
-        # Falls back to `$ROOT` where git cannot answer, which is the same
-        # directory on a single-checkout repository and the only one available.
-        main_checkout=$(dirname "$(git rev-parse --path-format=absolute --git-common-dir 2>/dev/null)") \
-          || main_checkout="$ROOT"
-        [ -d "$main_checkout" ] || main_checkout="$ROOT"
-        WT_ROOT="$main_checkout/$d"
-        ;;
-    esac
-    WT_ROOT="${WT_ROOT%/}"
-  fi
-fi
+# There is NO FALLBACK: a reaper that cannot ask the rule stops rather than
+# compute a second default and delete from it.
+# shellcheck source=plot-desk-root.sh
+. "$(dirname "${BASH_SOURCE[0]}")/plot-desk-root.sh"
+WT_ROOT=$(plot_desk_root "$(plot_repo_root)") || {
+  echo "plot-reap: cannot resolve the desk root — nothing was reaped." >&2; exit 2; }
+LOG_DIR="$WT_ROOT"
 
 # The files ONE branch's agent run leaves beside its worktree, removed with it.
 #

package/plot-resolve-artifact.sh

@@ -165,11 +165,10 @@ fi
 # MEASURED, and recorded at length in plot-dispatch.sh's held_worktree: a
 # hand-made worktree is named for the branch with its TYPE dropped, so a gate
 # that guessed `plot-wt-<flattened>` missed a worktree with six modified files
-# in it. This site had the same shape — it composed `plot-wt-<flattened>` under
-# `repo_root/..` — and this change would make the guess worse, not better: the
-# new `Worktree root:` key introduces a SECOND naming convention, giving a
-# path guess a second way to be wrong. So the read asks git, and only the
-# CREATE-a-fresh-one fallback below composes a name (via dispatch's rule, so the
+# in it. Desks carry two naming conventions — `plot-wt-*` beside the repo from
+# older dispatches, and unprefixed names under the desk root — so a path guess
+# has two ways to be wrong. So the read asks git, and only the
+# CREATE-a-fresh-one fallback below composes a name (under the desk root, so the
 # fresh worktree lands where dispatch would have put it).
 #
 # `git worktree list --porcelain` emits `worktree <path>` then `branch
@@ -182,21 +181,15 @@ wt=$(git worktree list --porcelain </dev/null 2>/dev/null | awk -v want="refs/he
   /^worktree /  { path = substr($0, 10) }
   /^branch /    { if (substr($0, 8) == want) { print path; exit } }')
 
-# No existing worktree holds it — compose the path a fresh one will take, by the
-# same root+prefix rule plot-dispatch.sh uses. Under a `Worktree root:` key the
-# root moves and the `plot-wt-` prefix drops; absent it, today's behaviour.
+# No existing worktree holds it — compose the path a fresh one will take, under
+# the desk root `plot-dispatch.sh` also asks for, so the fresh worktree lands
+# where dispatch would have put it. The root is the MAIN checkout's, and there
+# is no fallback: an unaskable rule refuses the repair.
+# shellcheck source=plot-desk-root.sh
+. "$script_dir/plot-desk-root.sh"
 if [ -z "$wt" ]; then
-  wt_root=$("$script_dir/plot-config.sh" get "Worktree root" "")
-  if [ -z "$wt_root" ]; then
-    wt_root=$(cd "$repo_root/.." && pwd)
-    wt="$wt_root/plot-wt-$(printf '%s' "$branch" | tr '/' '-')"
-  else
-    case "$wt_root" in
-      /*) : ;;
-      *)  wt_root="$repo_root/$wt_root" ;;
-    esac
-    wt="${wt_root%/}/$(printf '%s' "$branch" | tr '/' '-')"
-  fi
+  wt_root=$(plot_desk_root "$(plot_repo_root)") || finish refused no-desk-root
+  wt="$wt_root/$(printf '%s' "$branch" | tr '/' '-')"
 fi
 
 if [ "$dry_run" = 1 ]; then
@@ -263,6 +256,7 @@ if [ -d "$wt" ] && git worktree list --porcelain | grep -qx "worktree $wt"; then
     finish refused worktree-busy
   fi
 else
+  plot_exclude_desk_root "$(plot_repo_root)"
   if ! git worktree add -q "$wt" "$branch" 2>/dev/null; then
     if ! git worktree add -q -b "$branch" "$wt" "origin/$branch" 2>/dev/null; then
       echo "plot-resolve-artifact: cannot create a worktree for $branch at $wt" >&2

package/plot-tmp.sh

@@ -1,5 +1,5 @@
 # plot-tmp.sh — every temp path a Plot script creates, and the process's only
-# EXIT/INT/TERM traps. SOURCED, not run.
+# EXIT/INT/TERM/PIPE traps. SOURCED, not run.
 #
 #   . "$SCRIPT_DIR/plot-tmp.sh"
 #   plot_tmpdir  work  fleet-ref     # $work  = $TMPDIR/plot-fleet-ref.XXXXXX (a directory)
@@ -27,8 +27,11 @@
 # first call would be installed inside that call's substitution and remove the
 # path when the substitution closed. `PLOT_TMP_LOADED` makes a second source in
 # the same process a no-op, because a re-run setup would truncate the live
-# registry. INT and TERM run the cleanup, clear their own trap and re-raise, so
-# the script stops with 130 or 143 rather than running on to exit 0.
+# registry. INT, TERM and PIPE run the cleanup, clear their own trap and
+# re-raise, so the script stops with 130, 143 or 141 rather than running on to
+# exit 0. PIPE is among them because a board server stopped with SIGTERM leaves
+# its running scripts writing to closed pipes, and SIGPIPE's default action
+# skips the EXIT trap.
 #
 # A script that sources this must not install its own EXIT, INT or TERM trap:
 # the last `trap` wins, and that replacement is the defect this file fixes
@@ -42,29 +45,51 @@ PLOT_TMP_LOADED=$$
 # Fixed at first source: a later `TMPDIR` change in the script does not move it.
 # A file already at this path belongs to a dead process that had the same pid,
 # and its `c:` commands are not this process's, so it is replaced, never read.
+# The file itself is created at the end of this file, after the traps.
 PLOT_TMP_REGISTRY="${TMPDIR:-/tmp}/plot-reg.$$"
-rm -f -- "$PLOT_TMP_REGISTRY" 2>/dev/null
-: > "$PLOT_TMP_REGISTRY" 2>/dev/null || true
 
 # One line per entry, in registration order: `p:<path>` or `c:<command>`.
 _plot_tmp_register() {
   printf '%s:%s\n' "$1" "$2" >> "$PLOT_TMP_REGISTRY" 2>/dev/null || true
 }
 
+# A SIGNAL INSIDE A CREATION WAITS FOR THE REGISTRATION. bash runs a pending
+# trap as soon as `$(mktemp …)` returns, before the next line registers the
+# path, so a cleanup run there would remove the registry and leave the new path
+# unlisted. While `__plot_tmp_busy` is set, the signal handler records the
+# signal in `__plot_tmp_pending` and returns; `_plot_tmp_create` handles it once
+# the path is registered.
+__plot_tmp_busy=''
+__plot_tmp_pending=''
+
+# _plot_tmp_create VAR prefix [-d] — create, register, assign to VAR.
+_plot_tmp_create() {
+  local __plot_tmp_new __plot_tmp_rc
+  __plot_tmp_busy=1
+  if [ "${3:-}" = -d ]; then
+    __plot_tmp_new=$(mktemp -d "${TMPDIR:-/tmp}/plot-$2.XXXXXX")
+  else
+    __plot_tmp_new=$(mktemp "${TMPDIR:-/tmp}/plot-$2.XXXXXX")
+  fi
+  __plot_tmp_rc=$?
+  [ "$__plot_tmp_rc" -eq 0 ] && _plot_tmp_register p "$__plot_tmp_new"
+  __plot_tmp_busy=''
+  if [ -n "$__plot_tmp_pending" ]; then
+    # shellcheck disable=SC2086 # "<name> <number>", split on purpose
+    _plot_tmp_on_signal $__plot_tmp_pending
+  fi
+  [ "$__plot_tmp_rc" -eq 0 ] || return 1
+  printf -v "$1" '%s' "$__plot_tmp_new"
+}
+
 # plot_tmpdir VAR prefix — create a directory, register it, assign it to VAR.
 plot_tmpdir() {
-  local __plot_tmp_new
-  __plot_tmp_new=$(mktemp -d "${TMPDIR:-/tmp}/plot-$2.XXXXXX") || return 1
-  _plot_tmp_register p "$__plot_tmp_new"
-  printf -v "$1" '%s' "$__plot_tmp_new"
+  _plot_tmp_create "$1" "$2" -d
 }
 
 # plot_tmpfile VAR prefix — create a file, register it, assign it to VAR.
 plot_tmpfile() {
-  local __plot_tmp_new
-  __plot_tmp_new=$(mktemp "${TMPDIR:-/tmp}/plot-$2.XXXXXX") || return 1
-  _plot_tmp_register p "$__plot_tmp_new"
-  printf -v "$1" '%s' "$__plot_tmp_new"
+  _plot_tmp_create "$1" "$2"
 }
 
 # plot_on_exit command — run `command` (one line) when the process ends.
@@ -75,9 +100,13 @@ plot_on_exit() {
 # Runs every registered command and removes every registered path, in
 # registration order, then removes the registry. Runs once: the registry is
 # gone afterwards, so a second call finds nothing.
+#
+# PIPE is ignored for the cleanup: the process is ending, and a registered
+# command that writes to a closed stdout or stderr must not stop the removals.
 _plot_tmp_cleanup() {
   local __plot_tmp_line
-  [ -f "$PLOT_TMP_REGISTRY" ] || return 0
+  [ -n "${__plot_tmp_owned:-}" ] && [ -f "$PLOT_TMP_REGISTRY" ] || return 0
+  trap '' PIPE
   while IFS= read -r __plot_tmp_line; do
     case $__plot_tmp_line in
       c:*) eval "${__plot_tmp_line#c:}" ;;
@@ -97,6 +126,10 @@ _plot_tmp_on_exit() {
 # $1 is the signal name, $2 its number. `kill` re-raises it with the default
 # disposition; the `exit` is reached only if the shell defers the delivery.
 _plot_tmp_on_signal() {
+  if [ -n "$__plot_tmp_busy" ]; then
+    __plot_tmp_pending="$1 $2"
+    return 0
+  fi
   trap - EXIT "$1"
   _plot_tmp_cleanup
   kill -"$1" "$$"
@@ -106,3 +139,18 @@ _plot_tmp_on_signal() {
 trap _plot_tmp_on_exit EXIT
 trap '_plot_tmp_on_signal INT 2' INT
 trap '_plot_tmp_on_signal TERM 15' TERM
+trap '_plot_tmp_on_signal PIPE 13' PIPE
+
+# THE REGISTRY IS CREATED AFTER THE TRAPS, so no signal lands between the file
+# and the handler that removes it. It is replaced under the creation deferral:
+# until `__plot_tmp_owned` is set, a file at this path is a dead process's and
+# the cleanup leaves it unread.
+__plot_tmp_busy=1
+rm -f -- "$PLOT_TMP_REGISTRY" 2>/dev/null
+: > "$PLOT_TMP_REGISTRY" 2>/dev/null || true
+__plot_tmp_owned=1
+__plot_tmp_busy=''
+if [ -n "$__plot_tmp_pending" ]; then
+  # shellcheck disable=SC2086 # "<name> <number>", split on purpose
+  _plot_tmp_on_signal $__plot_tmp_pending
+fi

package/plot-worker-state.sh

@@ -392,6 +392,28 @@ plot_worker_dirty() { # $1=worktree → the dirty files, one per line, leftovers
   plot_worker_dirty_filter "$(git -C "$wt" status --porcelain 2>/dev/null)"
 }
 
+# Keep a file the estate writes into every desk out of `git status`.
+#
+# THROUGH THE CLONE'S `info/exclude`, never `.gitignore`: a `.gitignore` rule
+# lives in the branch's own content, so a desk cut from an older branch would
+# not see it, and `info/exclude` is per-repository and shared by every worktree.
+# The directory and the file are CREATED when absent. Measured 2026-10-01
+# (#1130): a clone with no `.git/info/exclude` kept `?? .metadata_never_index`
+# in every free desk, and the AgentMonitor reported each waiting agent as
+# `holds unlanded work`, because the writer skipped a file that did not exist.
+#
+# Best-effort: a desk that cannot take the line still works. Always returns 0.
+plot_desk_exclude() { # $1=worktree $2=the exact line to exclude
+  local common excl
+  common=$(git -C "$1" rev-parse --git-common-dir 2>/dev/null) || return 0
+  [ -n "$common" ] || return 0
+  case "$common" in /*) ;; *) common="$1/$common" ;; esac
+  excl="$common/info/exclude"
+  mkdir -p "$common/info" 2>/dev/null || return 0
+  grep -qxF "$2" "$excl" 2>/dev/null || printf '%s\n' "$2" >> "$excl" 2>/dev/null || true
+  return 0
+}
+
 # The same filter, over status output the CALLER already has.
 #
 # SPLIT OUT BECAUSE THE STATUS CALL IS THE EXPENSIVE HALF and one caller had