cargo-hauler 0.6.17 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 0.7.0
+
+### Minor Changes
+
+- 80939ab: A `hauler exec` whose daemon connection drops after the ticket was accepted now
+  reattaches instead of giving up. The client prints `connection to daemon lost;
+  reattaching to ticket cc-N…`, reconnects (starting the daemon again if it is
+  gone, a few attempts one second apart), and sends the new `reattach` message;
+  the daemon rebinds the ticket, replays the output the client had not yet
+  received, and streams the rest, so the caller's exit code is cargo's as if the
+  connection had held. Output the replay buffer no longer holds is announced as
+  `N bytes of output missed while reconnecting; full log: <path>`, never
+  invented. A ticket that finished in the meantime yields its exit code and log
+  path.
+  
+  The daemon no longer kills a queued ticket the moment its submitter
+  disconnects: it keeps its queue position (and may start) for
+  `CARGO_HAULER_REATTACH_GRACE_MS` (default 30000; `0` restores the immediate
+  kill) and is killed as `killed while queued: submitter disconnected and did
+  not reattach within 30s` only if nobody reattaches. A running ticket continues
+  as before, marked orphaned; a reattach clears the flag.
+  
+  When the ticket cannot be reattached — it never ran cargo and was killed at
+  the daemon's shutdown or `orphaned by daemon restart`, the daemon does not
+  know it, the daemon predates this release and answers the message with
+  `bad-message`, or no daemon answered within the budget — the client fails
+  closed with `brokered run aborted: daemon connection lost; ticket cc-N
+  <reason>` and the new exit code `69` (`EX_UNAVAILABLE`), distinct from cargo's
+  `1` and from `2`/`75`/`130`/`143`. It no longer prints `ticket cc-N continues
+  — hauler result cc-N` and exits `1` while the daemon records `killed while
+  queued`. `--bg` and auto-backgrounded tickets are detached, not owned, and
+  are unchanged. (#187)
+- 3758d82: Refuse a target directory shared across workspace roots (#185). When a request's target dir lies outside its own workspace and another lane with a different workspace root already uses that dir, the daemon refuses it as a bad intent (client exit 2) with a message naming both roots, the dir, and the mechanism: cargo's `-C metadata` hash is relative to the workspace root, so same-layout worktrees write identical artifact filenames into a shared target dir and whichever compiled last runs as "fresh" in the others — a stale-binary collision, not a kache miss. `hauler exec --allow-shared-target` or `CARGO_HAULER_ALLOW_SHARED_TARGET=1` (per request, or in the daemon's environment for all requests) admits the request with one warning line on stderr that cargo's `--quiet` cannot hide. `hauler status` and the dashboard flag every lane on a shared dir with `sharedTargetWith` (optional; older daemons omit it). Refused intents — this one and the existing bad-intent rejections — are now ledgered as `denied` rows instead of `failed` runs under lane `invalid`, so `hauler log` no longer shows a command that never ran as a failed run.
+
+### Patch Changes
+
+- f84e901: `hauler exec --allow-shared-target` (and `CARGO_HAULER_ALLOW_SHARED_TARGET=1`
+  in the caller's environment) now reaches the daemon: the server dropped the
+  request field, so only the daemon-side setting could admit a shared target dir.
+  The shared-target warning has one wording everywhere — the daemon's refusal
+  and ack line, the lane board, and the dashboard's lane cell (other roots, full
+  text on hover) — and `hauler request` shows the daemon's warning in its summary
+  when the daemon admitted a shared target. The `hauler status` summary string
+  no longer carries extra warning lines the document never rendered; the lane
+  board is where the warning shows.
+  Detection no longer re-resolves already-canonical lane paths on every submit
+  and status poll.
+
+## 0.6.18
+
+### Patch Changes
+
+- d344246: The `cargo-hauler` skill no longer tells agents how to set `CARGO_TARGET_DIR`. The one bullet that did ("do not hand-roll `CARGO_TARGET_DIR` isolation … the daemon already serializes per (workspace, target dir)") read as if sharing one target dir across checkouts were safe because runs are serialized; it is not — cargo's `-C metadata` hash is relative to the workspace root, so worktrees of one repo with the same layout collide on artifact names and stale binaries run silently (#185). Target-dir policy belongs to the operator and, where hauler can detect the footgun, to the daemon, not to the prompt. (#186)
+
 ## 0.6.17
 
 ### Patch Changes

package/README.md

@@ -77,8 +77,8 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 
 | Command | Behavior |
 | --- | --- |
-| `hauler exec [--session ID] [--host HOST] [--cwd DIR] [--bg] [--after TICKET[,TICKET…]] -- <cargo …>` | Submit Cargo through the daemon and stream output; hooks rewrite commands to this form. A relative `--cwd` is resolved against the caller's directory. `--after` (repeatable or comma-separated) keeps the request queued until every named ticket has finished; it fails with `prerequisite cc-N <status>` if one of them fails or is killed, and an unknown ticket is rejected as a bad intent. Exits with cargo's code; `130`/`143` after a SIGINT/SIGTERM (the ticket is killed first); `75` when auto-backgrounded. |
-| `hauler status [--limit N] [--cwd DIR] [--session ID] [--lane KEY] [--ticket ID …] [--status S …] [--command-contains TEXT]` | Queue, active runs, lanes, admission, kache, optionally filtered. Rows are bounded summaries: no row carries an output tail; a running row carries `outputPreview`, the last 8 lines (at most 512 bytes) of its live output, cut at a line boundary, and every other row has `outputPreview: null`. Read a ticket's whole tail with `hauler result`. |
+| `hauler exec [--session ID] [--host HOST] [--cwd DIR] [--bg] [--after TICKET[,TICKET…]] [--allow-shared-target] -- <cargo …>` | Submit Cargo through the daemon and stream output; hooks rewrite commands to this form. A relative `--cwd` is resolved against the caller's directory. `--after` (repeatable or comma-separated) keeps the request queued until every named ticket has finished; it fails with `prerequisite cc-N <status>` if one of them fails or is killed, and an unknown ticket is rejected as a bad intent. `--allow-shared-target` accepts the stale-artifact risk described below and prints a warning. Exits with cargo's code; `130`/`143` after a SIGINT/SIGTERM (the ticket is killed first); `75` when auto-backgrounded; `69` when the daemon connection was lost and the ticket could not be reattached (see below). |
+| `hauler status [--limit N] [--cwd DIR] [--session ID] [--lane KEY] [--ticket ID …] [--status S …] [--command-contains TEXT]` | Queue, active runs, lanes, admission, kache, optionally filtered. Lanes sharing one external target directory across workspace roots carry `sharedTargetWith` and render a warning naming the target and roots. Rows are bounded summaries: no row carries an output tail; a running row carries `outputPreview`, the last 8 lines (at most 512 bytes) of its live output, cut at a line boundary, and every other row has `outputPreview: null`. Read a ticket's whole tail with `hauler result`. |
 | `hauler log [--limit N]` | Recent requests from the ledger, as the same bounded summary rows. |
 | `hauler last` | The most recent request, as a detail record (from the daemon while it is running, otherwise from the ledger) — its output tail included. |
 | `hauler await <ticket> [--max-wait-ms N]` | Long-poll until the ticket finishes or the wait expires (default 30 s, ceiling 2 h per call — the daemon's await ceiling; call again to keep waiting). A host with its own per-call deadline still bounds one call: Codex stops a tool call at `tool_timeout_sec` (60 s unless raised). |
@@ -187,6 +187,14 @@ arms defer admission under load. Attached requests (riders) do not hold
 permits; the admission meter counts permit holders and reports riders
 separately.
 
+Different workspace roots must not share a target directory outside the
+requesting workspace by default. Cargo's `-C metadata` hash is relative to the
+workspace root, so same-layout git worktrees can write identical artifact
+filenames there; whichever worktree compiled last may then be treated as fresh
+and run by another. This is a stale-binary collision, not a kache miss. Use a
+target directory per worktree, or opt in with `--allow-shared-target` /
+`CARGO_HAULER_ALLOW_SHARED_TARGET=1` when that risk is intentional.
+
 Within a lane, the daemon can reduce work in three ways:
 
 1. **Identity attachment:** a byte-identical request attaches to an in-flight
@@ -327,6 +335,7 @@ own `-j` flag or `CARGO_BUILD_JOBS` always wins over both.
 | --- | --- |
 | Work sharing | Identical requests attach, covered checks and compile-only `test --no-run` requests attach, and compatible queued compile or test requests fold. |
 | Lane isolation | A workspace-root and target-directory pair is serialized independently from other lanes. |
+| Shared target safety | If different workspace roots use the same target directory outside the requesting workspace, the daemon refuses the later request unless explicitly allowed and status flags both lanes. |
 | Admission | Per-core load, Linux CPU PSI, Linux memory PSI and `MemAvailable`, macOS VM pressure, configured thresholds, and the global permit cap control new starts. |
 | Parallelism | One daemon-owned jobserver FIFO shared by every spawned Cargo; a per-run `CARGO_BUILD_JOBS` grant only when the FIFO could not be armed. |
 | Scheduling | Per-phase EWMA estimates (compile vs execute), optional kache priors, fan-out, dependency topology, recent edits, and request age determine lane order; `--after cc-N` holds a request until the named tickets settle. |
@@ -381,9 +390,32 @@ answer, and exits `130` or `143`; in a direct run it terminates the cargo
 process group the same way. A ticket that ends other than `done` is reported
 on stderr as `ticket cc-N <status>[ (signal)][: reason]`, and its exit code is
 cargo's, `128 + signal` for a signaled run, or `1` when the daemon could not
-start cargo at all. If the connection drops after the ticket was accepted, the
-client prints `connection to daemon lost; ticket cc-N continues — hauler
-result cc-N` and exits `1`; the daemon finishes the ticket on its own.
+start cargo at all.
+
+If the connection drops after the ticket was accepted (a daemon restart or
+replacement, a dropped socket), the client keeps the ticket rather than the
+connection: it prints `connection to daemon lost; reattaching to ticket
+cc-N…`, reconnects — starting the daemon again if it is gone, a few attempts
+one second apart — and sends `reattach`. The daemon meanwhile holds a ticket
+whose submitter vanished: one still queued keeps its place for
+`CARGO_HAULER_REATTACH_GRACE_MS` (30 s; it may start in the meantime) and is
+killed as `killed while queued: submitter disconnected and did not reattach
+within 30s` only if nobody comes back; one already running continues, marked
+orphaned as before. A reattach rebinds the ticket to the new connection,
+clears the orphan flag, replays the output the client had not yet received
+from the replay buffer, and streams the rest, so the exit code is cargo's as
+if nothing had happened; output the buffer no longer holds is announced as
+`N bytes of output missed while reconnecting; full log: <path>` rather than
+invented. A ticket that finished in the meantime yields its exit code and log
+path. When the ticket cannot be reattached — it never ran cargo and was
+killed at the daemon's shutdown, `orphaned by daemon restart`, unknown to the
+daemon that answered, the daemon predates the message, or no daemon answered
+within the budget — the client exits `69` (`EX_UNAVAILABLE`) with `brokered
+run aborted: daemon connection lost; ticket cc-N <reason>`; it never claims
+the build ran. `CARGO_HAULER_REATTACH_GRACE_MS=0` restores the earlier policy
+of killing a queued ticket the moment its connection closes. `--bg` and
+auto-backgrounded tickets are detached, not owned, and are untouched by any
+of this.
 
 A deadlocked test binary holds its lane for ever at 0% CPU with nothing on
 stdout, and neither the estimate overrun nor the output silence alone can
@@ -606,6 +638,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
+| `CARGO_HAULER_ALLOW_SHARED_TARGET` | `0` | Allow different workspace roots to use one external target directory. The daemon still warns and status flags the lanes because Cargo artifacts can collide. Set on the request as `1`, or in the daemon environment to allow all requests. |
 | `CARGO_HAULER_JOBS_GRANT` | `max(4, cores / max concurrent)` | `CARGO_BUILD_JOBS` added to each Cargo process only while the shared jobserver FIFO is not armed; an armed daemon injects `MAKEFLAGS` instead and leaves `CARGO_BUILD_JOBS` unset. `0` disables injection. |
 | `CARGO_HAULER_JOBSERVER` | `auto` | Machine-wide fifo jobserver for daemon-spawned cargo: `auto` arms it only when the host `make` is 4.4+ (or absent) because older makes reject `--jobserver-auth=fifo:` in build scripts; `fifo` forces it on, `off` disables it (per-run `CARGO_BUILD_JOBS` grants apply instead). |
 | `CARGO_HAULER_LOAD_THRESHOLD` | Disabled | Per-core one-minute load threshold for deferring new admissions. |
@@ -625,6 +658,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 | `CARGO_HAULER_STALL_ESTIMATE_FACTOR` | `3` | A running ticket becomes a stall candidate once its elapsed time exceeds this multiple of its estimate. |
 | `CARGO_HAULER_STALL_IDLE_MS` | `600000` | Window with no process-tree CPU time and no output after which a stall candidate is flagged `stalled`; `0` or `off` disables stall detection. |
 | `CARGO_HAULER_STALL_AUTO_KILL` | Enabled | Kill a stalled ticket automatically once the connection that submitted it has disconnected. `0`, `false`, `off`, or `no` only flags it. |
+| `CARGO_HAULER_REATTACH_GRACE_MS` | `30000` | How long a queued ticket keeps its place after its submitting connection dropped, waiting for the client to `reattach`; then it is killed as abandoned. `0` kills it the moment the connection closes. |
 | `CARGO_HAULER_STOP_WAIT_MS` | `30000` | Maximum wait for one stop-hook invocation; values above the 7200000 ms await ceiling are clamped. |
 | `CARGO_HAULER_LEDGER_RETENTION_DAYS` | `30` | Finished ledger rows older than this many days are deleted when the daemon starts; `0` disables the age limit. |
 | `CARGO_HAULER_LEDGER_MAX_ROWS` | `50000` | Total ledger rows beyond which the oldest finished rows are deleted when the daemon starts; `0` disables the row cap. Pruned rows take their `tickets/<ticket>.log` files with them. |

package/dist/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","source":"./","version":"0.6.17"}]}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler-marketplace","owner":{"name":"cargo-hauler"},"plugins":[{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","source":"./","version":"0.7.0"}]}

package/dist/.claude-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.6.17"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","name":"cargo-hauler","version":"0.7.0"}

package/dist/.codex-plugin/plugin.json

@@ -1 +1 @@
-{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.6.17"}
+{"author":{"name":"cargo-hauler"},"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","hooks":"./.codex-plugin/hooks.json","interface":{"capabilities":["mcp","hooks","skills"],"category":"Productivity","defaultPrompt":["Help me use cargo-hauler."],"developerName":"cargo-hauler","displayName":"cargo-hauler","longDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","shortDescription":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks."},"mcpServers":"./.codex-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.0"}

package/dist/.cursor-plugin/plugin.json

@@ -1 +1 @@
-{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.6.17"}
+{"description":"Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.","displayName":"cargo-hauler","hooks":"./.cursor-plugin/hooks.json","mcpServers":"./.cursor-plugin/mcp.json","name":"cargo-hauler","skills":"./skills/","version":"0.7.0"}

package/dist/INSTALL.md

@@ -2,7 +2,7 @@
 
 Coalesce, schedule, and stream cargo so concurrent agent sessions share compiles instead of fighting locks.
 
-Version: `0.6.17`
+Version: `0.7.0`
 
 Run these commands from this bundle directory. The bundle is self-contained: every command below is
 a host command or the bundled installer, and nothing requires the `agent-bundle` CLI. Where that CLI is

package/dist/README.md

@@ -77,8 +77,8 @@ The CLI is `hauler` on PATH from `npm i -g cargo-hauler`. Never run
 
 | Command | Behavior |
 | --- | --- |
-| `hauler exec [--session ID] [--host HOST] [--cwd DIR] [--bg] [--after TICKET[,TICKET…]] -- <cargo …>` | Submit Cargo through the daemon and stream output; hooks rewrite commands to this form. A relative `--cwd` is resolved against the caller's directory. `--after` (repeatable or comma-separated) keeps the request queued until every named ticket has finished; it fails with `prerequisite cc-N <status>` if one of them fails or is killed, and an unknown ticket is rejected as a bad intent. Exits with cargo's code; `130`/`143` after a SIGINT/SIGTERM (the ticket is killed first); `75` when auto-backgrounded. |
-| `hauler status [--limit N] [--cwd DIR] [--session ID] [--lane KEY] [--ticket ID …] [--status S …] [--command-contains TEXT]` | Queue, active runs, lanes, admission, kache, optionally filtered. Rows are bounded summaries: no row carries an output tail; a running row carries `outputPreview`, the last 8 lines (at most 512 bytes) of its live output, cut at a line boundary, and every other row has `outputPreview: null`. Read a ticket's whole tail with `hauler result`. |
+| `hauler exec [--session ID] [--host HOST] [--cwd DIR] [--bg] [--after TICKET[,TICKET…]] [--allow-shared-target] -- <cargo …>` | Submit Cargo through the daemon and stream output; hooks rewrite commands to this form. A relative `--cwd` is resolved against the caller's directory. `--after` (repeatable or comma-separated) keeps the request queued until every named ticket has finished; it fails with `prerequisite cc-N <status>` if one of them fails or is killed, and an unknown ticket is rejected as a bad intent. `--allow-shared-target` accepts the stale-artifact risk described below and prints a warning. Exits with cargo's code; `130`/`143` after a SIGINT/SIGTERM (the ticket is killed first); `75` when auto-backgrounded; `69` when the daemon connection was lost and the ticket could not be reattached (see below). |
+| `hauler status [--limit N] [--cwd DIR] [--session ID] [--lane KEY] [--ticket ID …] [--status S …] [--command-contains TEXT]` | Queue, active runs, lanes, admission, kache, optionally filtered. Lanes sharing one external target directory across workspace roots carry `sharedTargetWith` and render a warning naming the target and roots. Rows are bounded summaries: no row carries an output tail; a running row carries `outputPreview`, the last 8 lines (at most 512 bytes) of its live output, cut at a line boundary, and every other row has `outputPreview: null`. Read a ticket's whole tail with `hauler result`. |
 | `hauler log [--limit N]` | Recent requests from the ledger, as the same bounded summary rows. |
 | `hauler last` | The most recent request, as a detail record (from the daemon while it is running, otherwise from the ledger) — its output tail included. |
 | `hauler await <ticket> [--max-wait-ms N]` | Long-poll until the ticket finishes or the wait expires (default 30 s, ceiling 2 h per call — the daemon's await ceiling; call again to keep waiting). A host with its own per-call deadline still bounds one call: Codex stops a tool call at `tool_timeout_sec` (60 s unless raised). |
@@ -187,6 +187,14 @@ arms defer admission under load. Attached requests (riders) do not hold
 permits; the admission meter counts permit holders and reports riders
 separately.
 
+Different workspace roots must not share a target directory outside the
+requesting workspace by default. Cargo's `-C metadata` hash is relative to the
+workspace root, so same-layout git worktrees can write identical artifact
+filenames there; whichever worktree compiled last may then be treated as fresh
+and run by another. This is a stale-binary collision, not a kache miss. Use a
+target directory per worktree, or opt in with `--allow-shared-target` /
+`CARGO_HAULER_ALLOW_SHARED_TARGET=1` when that risk is intentional.
+
 Within a lane, the daemon can reduce work in three ways:
 
 1. **Identity attachment:** a byte-identical request attaches to an in-flight
@@ -327,6 +335,7 @@ own `-j` flag or `CARGO_BUILD_JOBS` always wins over both.
 | --- | --- |
 | Work sharing | Identical requests attach, covered checks and compile-only `test --no-run` requests attach, and compatible queued compile or test requests fold. |
 | Lane isolation | A workspace-root and target-directory pair is serialized independently from other lanes. |
+| Shared target safety | If different workspace roots use the same target directory outside the requesting workspace, the daemon refuses the later request unless explicitly allowed and status flags both lanes. |
 | Admission | Per-core load, Linux CPU PSI, Linux memory PSI and `MemAvailable`, macOS VM pressure, configured thresholds, and the global permit cap control new starts. |
 | Parallelism | One daemon-owned jobserver FIFO shared by every spawned Cargo; a per-run `CARGO_BUILD_JOBS` grant only when the FIFO could not be armed. |
 | Scheduling | Per-phase EWMA estimates (compile vs execute), optional kache priors, fan-out, dependency topology, recent edits, and request age determine lane order; `--after cc-N` holds a request until the named tickets settle. |
@@ -381,9 +390,32 @@ answer, and exits `130` or `143`; in a direct run it terminates the cargo
 process group the same way. A ticket that ends other than `done` is reported
 on stderr as `ticket cc-N <status>[ (signal)][: reason]`, and its exit code is
 cargo's, `128 + signal` for a signaled run, or `1` when the daemon could not
-start cargo at all. If the connection drops after the ticket was accepted, the
-client prints `connection to daemon lost; ticket cc-N continues — hauler
-result cc-N` and exits `1`; the daemon finishes the ticket on its own.
+start cargo at all.
+
+If the connection drops after the ticket was accepted (a daemon restart or
+replacement, a dropped socket), the client keeps the ticket rather than the
+connection: it prints `connection to daemon lost; reattaching to ticket
+cc-N…`, reconnects — starting the daemon again if it is gone, a few attempts
+one second apart — and sends `reattach`. The daemon meanwhile holds a ticket
+whose submitter vanished: one still queued keeps its place for
+`CARGO_HAULER_REATTACH_GRACE_MS` (30 s; it may start in the meantime) and is
+killed as `killed while queued: submitter disconnected and did not reattach
+within 30s` only if nobody comes back; one already running continues, marked
+orphaned as before. A reattach rebinds the ticket to the new connection,
+clears the orphan flag, replays the output the client had not yet received
+from the replay buffer, and streams the rest, so the exit code is cargo's as
+if nothing had happened; output the buffer no longer holds is announced as
+`N bytes of output missed while reconnecting; full log: <path>` rather than
+invented. A ticket that finished in the meantime yields its exit code and log
+path. When the ticket cannot be reattached — it never ran cargo and was
+killed at the daemon's shutdown, `orphaned by daemon restart`, unknown to the
+daemon that answered, the daemon predates the message, or no daemon answered
+within the budget — the client exits `69` (`EX_UNAVAILABLE`) with `brokered
+run aborted: daemon connection lost; ticket cc-N <reason>`; it never claims
+the build ran. `CARGO_HAULER_REATTACH_GRACE_MS=0` restores the earlier policy
+of killing a queued ticket the moment its connection closes. `--bg` and
+auto-backgrounded tickets are detached, not owned, and are untouched by any
+of this.
 
 A deadlocked test binary holds its lane for ever at 0% CPU with nothing on
 stdout, and neither the estimate overrun nor the output silence alone can
@@ -606,6 +638,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 | `CARGO_HAULER_CARGO_BIN` | `$CARGO_HOME/bin/cargo` | Cargo binary for daemon-started work; bare `cargo` is the last fallback. Never resolved through `PATH`. Read from the daemon's own environment (export it where the daemon starts, or before `hauler daemon start`); clients do not forward it. |
 | `CARGO_HAULER_MAX_CONCURRENT` | cores ÷ 8, clamped to 5–16 | Global admission permits for Cargo processes across all lanes; an integer >= 1. |
 | `CARGO_HAULER_OVERLAP_EXECUTION` | `1` | Hand a lane to its next request once a `test`/`nextest`/`bench`/`run` leader reports its build finished, overlapping the next compile with the leader's execution phase. `0` keeps a lane strictly one process at a time. |
+| `CARGO_HAULER_ALLOW_SHARED_TARGET` | `0` | Allow different workspace roots to use one external target directory. The daemon still warns and status flags the lanes because Cargo artifacts can collide. Set on the request as `1`, or in the daemon environment to allow all requests. |
 | `CARGO_HAULER_JOBS_GRANT` | `max(4, cores / max concurrent)` | `CARGO_BUILD_JOBS` added to each Cargo process only while the shared jobserver FIFO is not armed; an armed daemon injects `MAKEFLAGS` instead and leaves `CARGO_BUILD_JOBS` unset. `0` disables injection. |
 | `CARGO_HAULER_JOBSERVER` | `auto` | Machine-wide fifo jobserver for daemon-spawned cargo: `auto` arms it only when the host `make` is 4.4+ (or absent) because older makes reject `--jobserver-auth=fifo:` in build scripts; `fifo` forces it on, `off` disables it (per-run `CARGO_BUILD_JOBS` grants apply instead). |
 | `CARGO_HAULER_LOAD_THRESHOLD` | Disabled | Per-core one-minute load threshold for deferring new admissions. |
@@ -625,6 +658,7 @@ Per-host notes and hook timeouts are in [docs/install.md](docs/install.md).
 | `CARGO_HAULER_STALL_ESTIMATE_FACTOR` | `3` | A running ticket becomes a stall candidate once its elapsed time exceeds this multiple of its estimate. |
 | `CARGO_HAULER_STALL_IDLE_MS` | `600000` | Window with no process-tree CPU time and no output after which a stall candidate is flagged `stalled`; `0` or `off` disables stall detection. |
 | `CARGO_HAULER_STALL_AUTO_KILL` | Enabled | Kill a stalled ticket automatically once the connection that submitted it has disconnected. `0`, `false`, `off`, or `no` only flags it. |
+| `CARGO_HAULER_REATTACH_GRACE_MS` | `30000` | How long a queued ticket keeps its place after its submitting connection dropped, waiting for the client to `reattach`; then it is killed as abandoned. `0` kills it the moment the connection closes. |
 | `CARGO_HAULER_STOP_WAIT_MS` | `30000` | Maximum wait for one stop-hook invocation; values above the 7200000 ms await ceiling are clamped. |
 | `CARGO_HAULER_LEDGER_RETENTION_DAYS` | `30` | Finished ledger rows older than this many days are deleted when the daemon starts; `0` disables the age limit. |
 | `CARGO_HAULER_LEDGER_MAX_ROWS` | `50000` | Total ledger rows beyond which the oldest finished rows are deleted when the daemon starts; `0` disables the row cap. Pruned rows take their `tickets/<ticket>.log` files with them. |