create-claude-cabinet 0.44.0 → 0.45.0

package/templates/mux/__tests__/worktree-dirty-check.test.mjs

@@ -0,0 +1,35 @@
+// Guard test for the shared worktree dirty-detection seam (act:04bdcc6b).
+//
+// Drives worktree-dirty-check.fixture.sh, which builds a throwaway git repo
+// + worktrees under mktemp with HOME overridden — it never touches the real
+// ~/.mux/worktrees, ~/.config/mux, or any live worktree.
+//
+// Covers:
+//   - `mux worktree refresh` preserves uncommitted .claude/plans/ edits
+//     (authored-record carve-out; artifacts-of-thought)
+//   - modified tracked .mcp.json => dirty in BOTH bin/mux and the
+//     pane-exited cleanup hook (one implementation, same verdict)
+//   - lockfile-only churn => clean in both paths
+//   - missing/failed helper degrades to fail-DIRTY (never deletes)
+
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const fixture = path.join(
+  path.dirname(fileURLToPath(import.meta.url)),
+  'worktree-dirty-check.fixture.sh'
+);
+
+test('worktree dirty-detection + refresh carve-out (sandboxed fixture suite)', () => {
+  const res = spawnSync('bash', [fixture], { encoding: 'utf8', timeout: 120_000 });
+  const output = `${res.stdout}\n${res.stderr}`;
+  assert.strictEqual(
+    res.status,
+    0,
+    `fixture suite reported failures:\n${output}`
+  );
+  assert.match(output, /RESULT: \d+ passed, 0 failed/);
+});

package/templates/mux/bin/mux

@@ -234,38 +234,16 @@ create_worktree() {
     }
   }
 
-  # Copy .claude/ infra into the worktree so CC sees worktree-local paths in
-  # its system context (a symlink makes CC resolve through to the main repo
-  # path, leaking it into every Read/Edit/Write). EXCEPT the authored project
-  # record — .claude/plans/ and .claude/methodology/ — which is real work that
-  # must commit from the worktree. Those stay as normal git-tracked files,
-  # left exactly as `git worktree add` checked them out from HEAD. See
-  # .claude/rules/artifacts-of-thought.md.
-  git -C "$wt_path" ls-files .claude/ 2>/dev/null \
-    | grep -vE '^\.claude/(plans|methodology)/' \
-    | while IFS= read -r f; do
-        git -C "$wt_path" update-index --assume-unchanged "$f" 2>/dev/null || true
-      done
-  if [[ -d "$proj_path/.claude" ]]; then
-    # Refresh infra subdirs from main, one top-level entry at a time, never
-    # the authored-record dirs (leave the worktree's HEAD-checked-out copies).
-    local entry name
-    for entry in "$proj_path"/.claude/*; do
-      [[ -e "$entry" ]] || continue
-      name=$(basename "$entry")
-      [[ "$name" == "plans" || "$name" == "methodology" ]] && continue
-      rm -rf "$wt_path/.claude/$name"
-      cp -R "$entry" "$wt_path/.claude/$name"
-    done
-    # Hide infra from the worktree's git status, but keep authored records
-    # visible so new design docs created in a worktree show up and commit.
-    local wt_gitdir
-    wt_gitdir=$(git -C "$wt_path" rev-parse --git-dir 2>/dev/null)
-    if [[ -n "$wt_gitdir" ]]; then
-      mkdir -p "$wt_gitdir/info"
-      { echo '.claude/*'; echo '!.claude/plans/'; echo '!.claude/methodology/'; } >> "$wt_gitdir/info/exclude"
-    fi
-  fi
+  # .claude/ infra is copied into the worktree (not symlinked — a symlink
+  # makes CC resolve through to the main repo path, leaking it into every
+  # Read/Edit/Write) by the health check below, which runs with --refresh.
+  # The authored/infra classification lives in exactly one place —
+  # worktree-session-health.sh: ANY tracked .claude/ file is authored project
+  # record (plans, methodology, rules, cabinet docs, anything committed) that
+  # stays exactly as `git worktree add` checked it out and is never frozen
+  # with assume-unchanged, so worktree edits commit; only gitignored infra
+  # (skills, agents, settings copies) is copied from main and hidden from
+  # status. See .claude/rules/artifacts-of-thought.md.
   for f in .mcp.json .claudeignore; do
     [[ -f "$proj_path/$f" ]] && ln -sf "$proj_path/$f" "$wt_path/$f"
   done
@@ -285,9 +263,10 @@ create_worktree() {
 
   worktree_registry_add "$project" "$task_slug" "$branch_name" "$wt_path"
 
-  # Validate the worktree we just created
+  # Populate .claude/ infra (--refresh forces sync_claude_infra) and validate
+  # the worktree we just created.
   local health_output health_ok
-  health_output=$(worktree_health_check "$proj_path" "$wt_path" 2>&1) && health_ok=1 || health_ok=0
+  health_output=$(worktree_health_check "$proj_path" "$wt_path" --refresh 2>&1) && health_ok=1 || health_ok=0
   if [[ "$health_ok" -eq 0 ]]; then
     echo "⚠ Worktree health issues:" >&2
     echo "$health_output" >&2
@@ -299,8 +278,10 @@ create_worktree() {
 }
 
 worktree_health_check() {
+  # Extra args pass through (e.g. --refresh forces an infra re-sync).
   local proj_path="$1" wt_path="$2"
-  "${HOME}/.config/mux/worktree-session-health.sh" "$proj_path" "$wt_path" 2>&1
+  shift 2
+  "${HOME}/.config/mux/worktree-session-health.sh" "$proj_path" "$wt_path" "$@" 2>&1
 }
 
 worktree_cleanup() {
@@ -325,11 +306,25 @@ worktree_cleanup() {
     fi
   fi
 
-  local has_commits has_uncommitted
-  has_commits=$(git -C "$wt_path" log "$(git -C "$wt_path" merge-base HEAD "$(git -C "$proj_path" rev-parse HEAD)")..HEAD" --oneline 2>/dev/null | wc -l | tr -d ' ')
-  has_uncommitted=$(git -C "$wt_path" status --porcelain 2>/dev/null | grep -vE '^\?\? \.claude/|^.T \.mcp\.json$' | wc -l | tr -d ' ')
+  # Shared dirty detection — single source of truth in
+  # ~/.config/mux/worktree-dirty-check.sh (the tmux pane-exited cleanup hook
+  # delegates to the same helper, so both paths reach the same verdict from
+  # one implementation). Fail-DIRTY: a missing or failing helper classifies
+  # the worktree dirty — never clean on the strength of a failed check.
+  local dirty_check="${MUX_CONFIG_DIR}/worktree-dirty-check.sh"
+  local dirty_line="" kv has_commits="?" has_uncommitted="?" verdict="dirty"
+  if [[ -x "$dirty_check" ]]; then
+    dirty_line=$("$dirty_check" "$wt_path" "$proj_path" 2>/dev/null) || dirty_line=""
+  fi
+  for kv in $dirty_line; do
+    case "$kv" in
+      commits=*) has_commits="${kv#commits=}" ;;
+      uncommitted=*) has_uncommitted="${kv#uncommitted=}" ;;
+      verdict=*) verdict="${kv#verdict=}" ;;
+    esac
+  done
 
-  if [[ "$has_commits" -eq 0 ]] && [[ "$has_uncommitted" -eq 0 ]]; then
+  if [[ "$verdict" == "clean" ]]; then
     git -C "$proj_path" worktree remove "$wt_path" 2>/dev/null || rm -rf "$wt_path"
     git -C "$proj_path" branch -d "$branch_name" 2>/dev/null || true
     worktree_registry_remove "$project" "$task_slug"
@@ -340,8 +335,9 @@ worktree_cleanup() {
 
   echo ""
   echo "Session '${task_slug}' has work to merge:"
-  [[ "$has_uncommitted" -gt 0 ]] && echo "  ${has_uncommitted} uncommitted file(s)"
-  [[ "$has_commits" -gt 0 ]] && echo "  ${has_commits} commit(s) ahead"
+  # Counts may be "?" when the dirty-check could not determine them (fail-DIRTY).
+  [[ "$has_uncommitted" != "0" ]] && echo "  ${has_uncommitted} uncommitted file(s)"
+  [[ "$has_commits" != "0" ]] && echo "  ${has_commits} commit(s) ahead"
   echo ""
   echo "What do you want to do?"
   echo "  1) Merge to main branch"
@@ -354,7 +350,7 @@ worktree_cleanup() {
 
   case "$choice" in
     1)
-      if [[ "$has_uncommitted" -gt 0 ]]; then
+      if [[ "$has_uncommitted" != "0" ]]; then
         git -C "$wt_path" add -A
         git -C "$wt_path" commit -m "mux: work from ${task_slug} session"
       fi
@@ -373,7 +369,7 @@ worktree_cleanup() {
       fi
       ;;
     2)
-      if [[ "$has_uncommitted" -gt 0 ]]; then
+      if [[ "$has_uncommitted" != "0" ]]; then
         git -C "$wt_path" add -A
         git -C "$wt_path" commit -m "mux: parked work from ${task_slug} session"
       fi
@@ -406,7 +402,7 @@ worktree_cleanup() {
 }
 
 queue_claude_start() {
-  local target="$1" prompt="$2" win_path="$3"
+  local target="$1" prompt="$2" win_path="$3" auto_orient="${4:-1}"
   # Resolve window index immediately (names can be unreliable in background)
   local sess win_idx
   sess=$(tmux display-message -t "$target" -p '#{session_name}' 2>/dev/null)
@@ -414,11 +410,18 @@ queue_claude_start() {
   local stable="${sess}:${win_idx}"
   tmux set-window-option -t "$stable" @mux_claude 1 2>/dev/null || true
   tmux send-keys -t "$stable" "cd '${win_path}' && claude" Enter
+  # auto_orient=1 (default): inject the canned /orient-quick before the prompt
+  # — the standard "start a session" sequence. auto_orient=0: inject ONLY the
+  # prompt, for callers whose prompt orchestrates its own orient (e.g.
+  # `mux handoff`, whose seed runs /orient then the seeded work thread —
+  # QA drains stay with window 1's standing station, never the seed).
   (
     sleep 5
-    tmux send-keys -t "$stable" "/orient-quick" Enter
-    sleep 2
-    tmux send-keys -t "$stable" -l "$prompt"
+    if [[ "$auto_orient" == "1" ]]; then
+      tmux send-keys -t "$stable" "/orient-quick" Enter
+      sleep 2
+    fi
+    [[ -n "$prompt" ]] && tmux send-keys -t "$stable" -l "$prompt"
   ) &
   disown
 }
@@ -606,6 +609,26 @@ create_work_worktree() {
   return 1
 }
 
+# Can this desk get an isolated worktree at all? Requires a registered mux
+# project whose directory is a git repository. When isolation is impossible
+# BY DESIGN (unregistered desk, non-git project dir), callers fall through to
+# the main checkout LOUDLY — a visible warning naming why — instead of dying.
+# die is reserved for real worktree-creation failures on isolation-capable
+# desks. On failure, echoes the human-readable reason; on success, nothing.
+worktree_isolation_capable() {
+  local project="$1" proj_path
+  proj_path=$(project_path "$project" 2>/dev/null) || proj_path=""
+  if [[ -z "$proj_path" ]]; then
+    echo "this desk isn't a registered mux project"
+    return 1
+  fi
+  if ! git -C "$proj_path" rev-parse --git-dir >/dev/null 2>&1; then
+    echo "project directory isn't a git repository: ${proj_path}"
+    return 1
+  fi
+  return 0
+}
+
 # --- Subcommands ---
 
 cmd_picker() {
@@ -793,9 +816,18 @@ cmd_new() {
     queue_claude_start "=${session}:${win_name}" "$prompt" "$win_path"
   else
     if has_active_claude "$session"; then
-      local win_name win_path
+      local win_name win_path skip_reason
       win_name="window-$(date +%s | tail -c 5)"
-      win_path=$(create_worktree "$session" "$win_name") || win_path="$path"
+      if skip_reason=$(worktree_isolation_capable "$session"); then
+        # Never fall back to main — a second session landing next to a live
+        # Claude is the exact collision worktrees exist to prevent.
+        win_path=$(create_worktree "$session" "$win_name") \
+          || die "Couldn't create a worktree for '${win_name}' — refusing to run work on the main checkout. Try: mux worktree ls"
+      else
+        # Isolation impossible by design — fall through loudly, never silently.
+        echo "⚠ No worktree isolation for this window (${skip_reason}) — opening on the main checkout." >&2
+        win_path="$path"
+      fi
       tmux new-window -n "$win_name" -c "$win_path"
       if [[ "$win_path" == "$MUX_WORKTREES_DIR/"* ]]; then
         tmux set-window-option -t "=${session}:${win_name}" @mux_worktree 1 2>/dev/null || true
@@ -1219,16 +1251,16 @@ cmd_worktree() {
       [[ -d "$wt_path" ]] || die "Worktree not found: $wt_path"
       [[ -d "$proj_path/.claude" ]] || die "Main repo has no .claude/"
 
-      rm -rf "$wt_path/.claude"
-      cp -R "$proj_path/.claude" "$wt_path/.claude"
-      # Re-exclude from git status
-      local wt_gitdir
-      wt_gitdir=$(git -C "$wt_path" rev-parse --git-dir 2>/dev/null)
-      if [[ -n "$wt_gitdir" ]]; then
-        mkdir -p "$wt_gitdir/info"
-        grep -q '^\.claude/$' "$wt_gitdir/info/exclude" 2>/dev/null || echo '.claude/' >> "$wt_gitdir/info/exclude"
+      # Delegate to the shared health script's carve-out-aware sync (the
+      # worktree_health_check → worktree-session-health.sh consolidation).
+      # Never wholesale `rm -rf .claude/` here — that destroys uncommitted
+      # edits to the authored project record (any tracked .claude/ file).
+      # See .claude/rules/artifacts-of-thought.md.
+      if worktree_health_check "$proj_path" "$wt_path" --refresh; then
+        echo "Refreshed .claude/ infra from main repo (authored records preserved)."
+      else
+        echo "Refreshed .claude/ infra, but health issues remain — see above." >&2
       fi
-      echo "Refreshed .claude/ from main repo."
       ;;
     *)
       echo "Usage: mux worktree [ls|cleanup|remove|health|refresh] [project] [task]"
@@ -1376,6 +1408,94 @@ qa_cmd_clear() {
   echo "Cleared queued QA handoffs for ${project}."
 }
 
+# --- Session handoff (session-handoff skill, phase 2) ---
+#
+# Open the NEXT session in a NEW window on the MAIN checkout, seeded with an
+# operator-approved prompt. This is the FORWARD handoff (close one session →
+# start the next), distinct from `mux qa dispatch`'s BACKWARD handoff (route a
+# merge to the live QA station). /session-handoff persists the seed to disk and
+# only calls this on approval, so a launch failure can't lose the seed.
+#
+# Why a new window on MAIN (not a worktree): the seed tells the next session to
+# run /orient then `mux qa drain`, and acting on drained QA (e2e / publish /
+# deploy) needs the main checkout. The window is named by work-context, NEVER
+# by the prompt (cmd_new's prompt path slugifies prompt→name + forces a
+# worktree — the wrong path; we deliberately don't use it).
+#
+# Descriptor JSON: { project (mux desk), project_path (repo root),
+#                    name (window name), seed_prompt }
+cmd_handoff() {
+  require_python
+  require_tmux
+  local descriptor="${1:-}"
+  [[ -f "$descriptor" ]] || die "mux handoff: descriptor file not found: ${descriptor}"
+
+  local project ppath name prompt
+  project=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("project",""))' "$descriptor" 2>/dev/null)
+  ppath=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("project_path",""))' "$descriptor" 2>/dev/null)
+  name=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("name",""))' "$descriptor" 2>/dev/null)
+  prompt=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1])).get("seed_prompt",""))' "$descriptor" 2>/dev/null)
+  [[ -n "$prompt" ]] || die "mux handoff: descriptor missing 'seed_prompt'"
+  [[ -n "$name" ]]   || name="next-session"
+
+  # `project` should be the mux DESK (tmux session). Desk short-names often
+  # differ from the repo dir name, so if it isn't a live session but the
+  # descriptor's project_path matches a desk's MUX_PROJECT_PATH, remap to that
+  # desk (same fallback as qa dispatch).
+  if [[ -z "$project" ]] || ! tmux has-session -t "=$project" 2>/dev/null; then
+    if [[ -n "$ppath" ]]; then
+      local desk mp
+      while IFS= read -r desk; do
+        mp=$(tmux show-environment -t "$desk" MUX_PROJECT_PATH 2>/dev/null | sed 's/^MUX_PROJECT_PATH=//')
+        if [[ "$mp" == "$ppath" ]]; then project="$desk"; break; fi
+      done < <(tmux list-sessions -F '#{session_name}' 2>/dev/null)
+    fi
+  fi
+  [[ -n "$project" ]] && tmux has-session -t "=$project" 2>/dev/null \
+    || die "mux handoff: desk '${project:-?}' isn't open — seed not launched (it's saved; open the desk and paste it)."
+
+  # Main checkout path: prefer the descriptor's project_path, else the desk's
+  # registered project dir, else the current dir.
+  local main_path="$ppath"
+  [[ -n "$main_path" ]] || main_path=$(project_path "$project" 2>/dev/null) || main_path="$PWD"
+
+  # Worktree, not main: the seeded session is a SECOND session on this desk,
+  # so mux's core isolation rule applies — main stays window 1's standing
+  # station. Two sessions sharing the main checkout sweep each other's
+  # in-progress edits into unrelated commits (the 1adc5ef incident). Tracked
+  # .claude/ files commit normally from worktrees since the 40cc831
+  # carve-out, so the authoring work a seed carries is safe there. The
+  # seeded session merges to main when done; main-only tail work (dogfood
+  # reinstall, propagation, publish) happens post-merge or is dispatched to
+  # window 1, consistent with "QA drains belong to window 1".
+  local win_path where skip_reason
+  if skip_reason=$(worktree_isolation_capable "$project"); then
+    win_path=$(create_worktree "$project" "$name") \
+      || die "mux handoff: couldn't create a worktree for '${name}' — refusing to seed a second session onto the main checkout. Seed is saved; try: mux worktree ls"
+    where="a fresh worktree of ${project}"
+  else
+    # Isolation impossible by design (non-git / unregistered) — fall through
+    # loudly, never silently.
+    echo "⚠ No worktree isolation for this handoff (${skip_reason}) — opening on the main checkout." >&2
+    win_path="$main_path"
+    where="${project}'s main checkout (no isolation: ${skip_reason})"
+  fi
+
+  # -P -F gives an unambiguous session:index target (window names can
+  # collide — option-setting by NAME hits the first match, act:c6f6bfd1).
+  # queue_claude_start with auto_orient=0: inject only the seed; the seed
+  # itself runs /orient.
+  local target
+  target=$(tmux new-window -t "=$project" -n "$name" -c "$win_path" -P -F '#{session_name}:#{window_index}')
+  [[ -n "$target" ]] || die "mux handoff: couldn't open a window on ${project} — seed is saved; open the desk and paste it."
+  if [[ "$win_path" == "$MUX_WORKTREES_DIR/"* ]]; then
+    tmux set-window-option -t "$target" @mux_worktree 1 2>/dev/null || true
+    tmux set-window-option -t "$target" @wt_healthy 1 2>/dev/null || true
+  fi
+  queue_claude_start "=$target" "$prompt" "$win_path" 0
+  echo "✓ Next session launched: window '${name}' on ${where}, seeded (it will /orient, then pick up the seeded work thread; it merges to main when done — QA handoffs and main-only tail work stay with window 1)."
+}
+
 cmd_setup() {
   echo "=== mux setup ==="
   echo ""
@@ -1617,22 +1737,53 @@ cmd_resume() {
   require_tmux
   in_tmux || die "You need to be in a desk first. Try: mux <project-name>"
   [[ -n "$session_id" ]] || die "Usage: mux resume <session-id>"
+  # The raw id flows into a branch name, a worktree path, and a send-keys
+  # line — refuse anything that isn't id-shaped before it gets there.
+  [[ "$session_id" =~ ^[0-9a-fA-F-]{8,}$ ]] \
+    || die "That doesn't look like a Claude session id: '${session_id}'. Expected hex-and-dashes (8+ chars), e.g. a UUID."
 
   local session
   session=$(tmux display-message -p '#{session_name}')
   local path
   path=$(project_path "$session" 2>/dev/null || tmux display-message -p '#{pane_current_path}')
 
-  local win_name win_path
+  local win_name win_path wt_path skip_reason
   win_name="resume-$(echo "$session_id" | cut -c1-8)"
 
   if has_active_claude "$session"; then
-    win_path=$(create_worktree "$session" "$win_name") || win_path="$path"
+    if skip_reason=$(worktree_isolation_capable "$session"); then
+      wt_path="${MUX_WORKTREES_DIR}/${session}-${win_name}"
+      if [[ -d "$wt_path" ]]; then
+        # The resume-<id8> slug is deterministic — a second resume of the
+        # same session REUSES its existing worktree (it holds that session's
+        # prior work). Only an invalid leftover at that path is an error.
+        if git -C "$wt_path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+          win_path="$wt_path"
+        else
+          die "Worktree path ${wt_path} already exists but isn't a valid git worktree — refusing to resume on the main checkout. Try: rm -rf '${wt_path}' && mux resume ${session_id}"
+        fi
+      else
+        # Never fall back to main — that would dump the resumed session onto
+        # the clean station next to a live Claude.
+        win_path=$(create_worktree "$session" "$win_name") \
+          || die "Couldn't create a worktree for '${win_name}' — refusing to run work on the main checkout. Try: mux worktree ls"
+      fi
+    else
+      # Isolation impossible by design — fall through loudly, never silently.
+      echo "⚠ No worktree isolation for this resume (${skip_reason}) — opening on the main checkout." >&2
+      win_path="$path"
+    fi
   else
+    # No active Claude on this desk — resuming on the main checkout is the
+    # intended landing (nothing to isolate from). By design, not a fallback.
     win_path="$path"
   fi
 
   tmux new-window -n "$win_name" -c "$win_path"
+  if [[ "$win_path" == "$MUX_WORKTREES_DIR/"* ]]; then
+    tmux set-window-option -t "=${session}:${win_name}" @mux_worktree 1 2>/dev/null || true
+    tmux set-window-option -t "=${session}:${win_name}" @wt_healthy 1 2>/dev/null || true
+  fi
   queue_claude_resume "=${session}:${win_name}" "$session_id" "$win_path"
 }
 
@@ -1660,6 +1811,7 @@ main() {
     portal)    shift; cmd_portal "${1:-}" ;;
     worktree)  shift; cmd_worktree "$@" ;;
     qa)        shift; cmd_qa "$@" ;;
+    handoff)   shift; cmd_handoff "$@" ;;
     setup)     cmd_setup ;;
     help)      cmd_help ;;
     -h|--help) cmd_help ;;

package/templates/mux/config/worktree-cleanup.sh

@@ -25,11 +25,32 @@ branch_name="mux/${WINDOW}"
 
 [[ -d "$wt_path" ]] || exit 0
 
-# Check for real changes
-has_commits=$(git -C "$wt_path" log "$(git -C "$wt_path" merge-base HEAD "$(git -C "$proj_path" rev-parse HEAD)" 2>/dev/null)..HEAD" --oneline 2>/dev/null | wc -l | tr -d ' ')
-has_uncommitted=$(git -C "$wt_path" status --porcelain 2>/dev/null | grep -cvE '(^\?\? \.claude$|^\?\? \.claude/|\.mcp\.json$)' || true)
+# Check for real changes via the shared dirty detection — single source of
+# truth in worktree-dirty-check.sh (`mux worktree cleanup` delegates to the
+# same helper, so both paths reach the same verdict from one implementation).
+#
+# FAIL-DIRTY: this hook silently DELETES worktrees, so a failed or missing
+# check must never authorize a deletion. If the helper is absent, errors, or
+# its output is unparseable, we classify the worktree dirty and fall through
+# to the note-leaving branch. Every fallible step is guarded so that under
+# set -e this degrades to fail-DIRTY rather than aborting silently.
+DIRTY_CHECK="${HOME}/.config/mux/worktree-dirty-check.sh"
+dirty_line=""
+if [[ -x "$DIRTY_CHECK" ]]; then
+  dirty_line=$("$DIRTY_CHECK" "$wt_path" "$proj_path" 2>/dev/null) || dirty_line=""
+fi
+has_commits="?"
+has_uncommitted="?"
+verdict="dirty"
+for kv in $dirty_line; do
+  case "$kv" in
+    commits=*) has_commits="${kv#commits=}" ;;
+    uncommitted=*) has_uncommitted="${kv#uncommitted=}" ;;
+    verdict=*) verdict="${kv#verdict=}" ;;
+  esac
+done
 
-if [[ "$has_commits" -eq 0 ]] && [[ "$has_uncommitted" -eq 0 ]]; then
+if [[ "$verdict" == "clean" ]]; then
   # Clean — silently remove
   # Clean up project identity symlink
   projects_dir="$HOME/.claude/projects"
@@ -40,18 +61,41 @@ if [[ "$has_commits" -eq 0 ]] && [[ "$has_uncommitted" -eq 0 ]]; then
   git -C "$proj_path" branch -d "$branch_name" 2>/dev/null || true
   python3 "$MUX_LIB" worktree-remove "$SESSION" "$WINDOW" 2>/dev/null || true
 else
-  # Dirty — create urgent watchtower inbox item + sticky note
+  # Dirty — create urgent watchtower inbox item + sticky note.
+  # Counts may be "?" when the check could not determine them (fail-DIRTY).
   detail=""
-  [[ "$has_uncommitted" -gt 0 ]] && detail="${has_uncommitted} uncommitted"
-  [[ "$has_commits" -gt 0 ]] && detail="${detail:+$detail, }${has_commits} commit(s)"
+  if [[ "$has_uncommitted" != "0" && "$has_uncommitted" != "?" ]]; then
+    detail="${has_uncommitted} uncommitted"
+  fi
+  if [[ "$has_commits" != "0" && "$has_commits" != "?" ]]; then
+    detail="${detail:+$detail, }${has_commits} commit(s)"
+  fi
+  if [[ -z "$detail" ]]; then
+    detail="changes the dirty-check could not verify (treated as dirty)"
+  fi
 
   # Watchtower inbox item (if watchtower is installed)
   WATCHTOWER_QUEUE="${HOME}/.claude-cabinet/watchtower/scripts/watchtower-queue.mjs"
+  WATCHTOWER_LIB="${HOME}/.claude-cabinet/watchtower/scripts/watchtower-lib.mjs"
   if [[ -f "$WATCHTOWER_QUEUE" ]]; then
     NODE_BIN="${WATCHTOWER_NODE_PATH:-$(command -v node 2>/dev/null || true)}"
     if [[ -n "$NODE_BIN" ]]; then
       "$NODE_BIN" --input-type=module -e "
         import { createItem, listPending } from '${WATCHTOWER_QUEUE}';
+        // project must be the watchtower config key, not the mux desk name —
+        // /inbox and the rings group by config key; desk-name keying
+        // ('cabinet' vs 'claude-cabinet') filed items nobody could find.
+        // The desk name is preserved in its own field.
+        // Dynamic import with fallback: this script (mux-setup) and the lib
+        // (/watchtower install) ship on different installers — a static named
+        // import against an older lib without the export is an ESM hard
+        // failure that would kill the whole filing silently. Degrade to the
+        // old desk-name keying instead; the key migration re-keys it later.
+        let resolveProjectIdentity, loadConfig;
+        try { ({ resolveProjectIdentity, loadConfig } = await import('${WATCHTOWER_LIB}')); } catch {}
+        let config = null;
+        try { config = loadConfig?.() ?? null; } catch {}
+        const identity = resolveProjectIdentity?.('${proj_path}', config) ?? null;
         const existing = listPending({ category: 'worktree-unmerged' });
         const isDup = existing.some(i =>
           i.evidence?.branch === '${branch_name}' &&
@@ -59,8 +103,10 @@ else
         );
         if (!isDup) {
           createItem({
-            project: '${SESSION}',
-            project_path: '${proj_path}',
+            project: identity?.name || '${SESSION}',
+            project_path: identity?.path || '${proj_path}',
+            desk: '${SESSION}',
+            ...(identity ? {} : { project_unresolved: true }),
             filed_by: 'pane-close',
             category: 'worktree-unmerged',
             urgency: 'urgent',