create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/fleet-origin-follower.js

@@ -0,0 +1,252 @@
+'use strict';
+// WP-3 (docs/fleet-origin-main-sync-skill-2026-10-31.html §5 R-8, §6.5, §8 WP-3): the CTM origin
+// follower.
+//
+// R-8: "the pull half runs itself". ONE unref'd interval per process; each tick runs the
+// repository's OWN `land sync --pull-only --json` (§6.2), so there is never a second implementation
+// of the fetch/fast-forward machine — and `land sync` itself schedules the idle restart (§6.4, via
+// lib/fleet-update.js `scheduleLocalApply`) when it moves main. A tick that is still running when
+// the next one fires is SKIPPED, never stacked; the timer callback never throws, so a failed child
+// cannot kill the loop.
+//
+// The follower is a NO-OP (a handle carrying a `reason`, armed with no timer) whenever this process
+// must not pull for this checkout:
+//   dev-<tag>    a dev instance never touches the real repository's main;
+//   not_configured  the target tree's `.ctm.json` has no `landing.publish` — R-1 is only in force
+//                   where the repository opted in;
+//   follow_disabled `landing.publish.follow === false` — the box wants publish without the pull half;
+//   not_main     repoRoot is not a git checkout whose current branch is `main` (a scratch repo, a
+//                release checkout, or a session worktree on a feature branch).
+//
+// Nothing here writes state: the verdict of every tick is already recorded by `land sync` in
+// `<common>/landing/sync-state.json` (`recordSyncVerdict`), which is what the box's own
+// `/api/fleet/status` reads back as `originSync.lastSync`.
+
+const path = require('node:path');
+const { spawn } = require('node:child_process');
+const { loadTargetLandingConfig } = require('./landing/config');
+const { runGitRaw } = require('./landing/git');
+
+// §6.1 default cadence: 900 000 ms = 15 min. The normalized config always carries a positive
+// integer, so this is only the defensive fallback for a caller that injects a hand-built config.
+const DEFAULT_FOLLOW_INTERVAL_MS = 900000;
+// §6.5: the pull is bounded — a fetch that has not finished in 120 s is killed (the child, not this
+// process), and the next tick starts fresh.
+const LAND_TIMEOUT_MS = 120000;
+// The repo-relative path of the CLI this follower drives, from the repository root.
+const LAND_SCRIPT_REL = path.join('coding-task-manager', 'bin', 'land.js');
+
+/** Absolute path of the `land` CLI inside `repoRoot` — the process the follower spawns. */
+function landScriptPath(repoRoot) {
+  return path.join(String(repoRoot || ''), LAND_SCRIPT_REL);
+}
+
+/**
+ * §6.2/§5 R-8: the follower's argv. `--pull-only` never merges and never pushes (a diverged box is
+ * reported `diverged` with `hint: land sync`, exit 1, for a human to run), and `--json` makes the
+ * verdict machine-readable instead of parsed out of a human line.
+ *
+ * §13.4 R-R1 (WP-8): when the resolver policy is `session` the follower runs the FULL `land sync`,
+ * which merges a clean divergence and pushes it itself — the resolver session only exists for the
+ * conflict/gate_failed case (see `start`).
+ */
+function landArgv({ pullOnly = true } = {}) {
+  return pullOnly ? ['sync', '--pull-only', '--json'] : ['sync', '--json'];
+}
+
+/** The verdict out of `land sync --json`'s stdout; '' when it is not a payload we understand. */
+function verdictOf(stdout) {
+  const text = String(stdout == null ? '' : stdout).trim();
+  if (!text) return '';
+  try {
+    const payload = JSON.parse(text);
+    return payload && typeof payload.verdict === 'string' ? payload.verdict : '';
+  } catch {
+    // HANDLE: a child killed mid-write (or a stray progress line on stdout) is not a verdict — the
+    // tick reports "unknown" and the next tick tries again.
+    return '';
+  }
+}
+
+/**
+ * The production tick body: `process.execPath <repoRoot>/coding-task-manager/bin/land.js sync
+ * [--pull-only] --json`, cwd `repoRoot`, no shell, killed after `timeoutMs`. Resolves (never rejects)
+ * with `{ verdict, code, error }` so a spawn failure is reported like any other bad verdict.
+ */
+function runLandOnce({ repoRoot = '', timeoutMs = LAND_TIMEOUT_MS, env = process.env, pullOnly = true } = {}) {
+  return new Promise((resolve) => {
+    let child = null;
+    try {
+      child = spawn(process.execPath, [landScriptPath(repoRoot), ...landArgv({ pullOnly })], {
+        cwd: repoRoot, env, timeout: timeoutMs, shell: false, stdio: ['ignore', 'pipe', 'pipe'],
+      });
+    } catch (error) {
+      resolve({ verdict: '', code: null, error: (error && error.message) || String(error) });
+      return;
+    }
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const finish = (payload) => { if (!settled) { settled = true; resolve(payload); } };
+    child.stdout.on('data', (chunk) => { stdout += String(chunk); });
+    child.stderr.on('data', (chunk) => { stderr += String(chunk); });
+    child.on('error', (error) => finish({ verdict: '', code: null, error: (error && error.message) || String(error) }));
+    child.on('close', (code, signal) => finish({
+      verdict: verdictOf(stdout),
+      code: Number.isInteger(code) ? code : null,
+      signal: signal || null,
+      stderr: stderr.trim(),
+    }));
+  });
+}
+
+/**
+ * One log line per tick, stamped with the caller's clock (`now`) so a 15-minute cadence is readable
+ * in a long log: the verdict when the child produced one, else why it did not.
+ */
+function tickLine(at, result) {
+  const when = new Date(Number(at) || 0).toISOString();
+  const verdict = String((result && result.verdict) || '');
+  if (verdict) return `${when} origin-follow: sync ${verdict}`;
+  const detail = (result && result.error) || (result && result.signal) || `exit ${(result && result.code) == null ? '?' : result.code}`;
+  return `${when} origin-follow: sync unknown (${detail})`;
+}
+
+/** True iff `repoRoot` is a git work tree whose current branch is `main` (R-8: the fleet target). */
+function isOnMain(repoRoot) {
+  try {
+    const inside = runGitRaw(repoRoot, ['rev-parse', '--is-inside-work-tree']);
+    if (inside.status !== 0 || inside.stdout.trim() !== 'true') return false;
+    const branch = runGitRaw(repoRoot, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    return branch.status === 0 && branch.stdout.trim() === 'main';
+  } catch {
+    // HANDLE: no git on PATH, or a path that cannot be spawned in — "not a main checkout", which is
+    // the no-op answer, never a throw out of boot.
+    return false;
+  }
+}
+
+/**
+ * §6.5: arm the follower. Returns `{ stop(), started, reason, intervalMs }`; `started: false` with a
+ * `reason` means this process must not follow (see the module header). Never throws.
+ *
+ * Injected surfaces (all optional, production defaults in parentheses):
+ *   loadConfig       (lib/landing/config.js `loadTargetLandingConfig`) — read from the TARGET tree
+ *   runLand          (`runLandOnce`) — `({ repoRoot, timeoutMs, env, pullOnly }) -> Promise<{ verdict, code }>`
+ *   resolverTick     (lib/fleet-resolver-tick.js, WP-8) — `{ busy(), after() }`, both async
+ *   setIntervalImpl  (`setInterval`) — the ONE timer, unref'd when the host returns a Timeout
+ *   now              (`Date.now`) — the tick log's clock
+ *   log              (`console.log`) — one line per tick
+ */
+function start({
+  repoRoot = '',
+  dataDir = '',
+  port = null,
+  env = process.env,
+  loadConfig = loadTargetLandingConfig,
+  runLand = runLandOnce,
+  resolverTick = null,
+  setIntervalImpl = setInterval,
+  now = Date.now,
+  log = (line) => console.log(line),
+} = {}) {
+  const root = String(repoRoot || '');
+  // `land sync` schedules the idle restart only when its env names this CTM (CTM_DATA_DIR +
+  // CTM_PORT, lib/fleet-update.js scheduleLocalApply guard (a)). The process env cannot be trusted
+  // to carry them: the MacBook Pro's launchd plist sets CTM_PORT but not CTM_DATA_DIR (observed
+  // 2026-10-31; a `pulled` tick there ended restart.reason "no_env"). So the follower hands the child
+  // the values this server actually runs with. The follower keeps no state of its own: the verdict
+  // lives in the landing sync state, written by `land sync` itself.
+  const childEnv = { ...(env || {}) };
+  if (dataDir) childEnv.CTM_DATA_DIR = String(dataDir);
+  if (port != null && port !== '') childEnv.CTM_PORT = String(port);
+  const write = typeof log === 'function' ? log : () => {};
+
+  const noop = (reason) => ({ started: false, reason, intervalMs: 0, stop() {} });
+
+  const tag = String((env && env.CTM_INSTANCE_TAG) || '');
+  if (tag.startsWith('dev-')) return noop('dev_instance');
+
+  let config = null;
+  try {
+    config = loadConfig(root);
+  } catch (error) {
+    // HANDLE: not a repository, no target branch, or an unreadable/invalid `.ctm.json` — there is
+    // nothing to follow, and a boot must not fail over an optional background timer.
+    void error;
+    return noop('config_unreadable');
+  }
+  const publish = config && config.publish;
+  if (!publish) return noop('not_configured');
+  if (publish.follow !== true) return noop('follow_disabled');
+  if (!isOnMain(root)) return noop('not_main');
+
+  const intervalMs = Number.isInteger(publish.followIntervalMs) && publish.followIntervalMs > 0
+    ? publish.followIntervalMs
+    : DEFAULT_FOLLOW_INTERVAL_MS;
+
+  // §13.4 R-R1 (WP-8): `session` means this box's own resolver session handles a blocked sync, so the
+  // follower runs the FULL `land sync` (merge + gate + push a clean divergence) and arms the resolver
+  // hooks below. Anything else (including a missing `resolve` before WP-6 lands) keeps the rev-2
+  // `--pull-only` behaviour. The full sync is bounded by the gate's own timeout plus 10 min of slack,
+  // because it runs the configured gates inside the child.
+  const fullSync = publish.resolve === 'session';
+  const gate0 = Array.isArray(config.gates) ? config.gates[0] : null;
+  const gateTimeoutSeconds = (gate0 && Number(gate0.timeoutSeconds)) || 10800;
+  const timeoutMs = fullSync ? gateTimeoutSeconds * 1000 + 600000 : LAND_TIMEOUT_MS;
+  const ticker = resolverTick && typeof resolverTick === 'object' ? resolverTick : null;
+
+  let running = false;
+  let stopped = false;
+  const stamp = () => new Date(Number(now()) || 0).toISOString();
+
+  const tick = async () => {
+    if (stopped) return;
+    if (running) {
+      write(`${stamp()} origin-follow: skipped (previous tick still running)`);
+      return;
+    }
+    running = true;
+    try {
+      if (fullSync && ticker && typeof ticker.busy === 'function' && await ticker.busy()) {
+        // R-R7: a live resolver owns the slot — do not race it with a second land sync; still give
+        // it the same `after()` pass the ordinary path gets.
+        write(`${stamp()} origin-follow: skipped land sync (resolver active)`);
+      } else {
+        const result = await runLand({ repoRoot: root, timeoutMs, env: childEnv, pullOnly: !fullSync });
+        write(tickLine(Number(now()) || 0, result));
+      }
+      if (ticker && typeof ticker.after === 'function') await ticker.after();
+    } catch (error) {
+      // REPORT: a throwing runLand (or resolver hook) is one bad tick, logged with its verdict slot
+      // left empty; the timer keeps its cadence and the next tick retries.
+      write(`${stamp()} origin-follow: sync unknown (${(error && error.code) || 'error'}: ${(error && error.message) || error})`);
+    } finally {
+      running = false;
+    }
+  };
+
+  const timer = setIntervalImpl(() => { void tick(); }, intervalMs);
+  if (timer && typeof timer.unref === 'function') timer.unref();
+
+  return {
+    started: true,
+    reason: 'started',
+    intervalMs,
+    stop() {
+      stopped = true;
+      if (timer && typeof clearInterval === 'function') clearInterval(timer);
+    },
+  };
+}
+
+module.exports = {
+  DEFAULT_FOLLOW_INTERVAL_MS,
+  LAND_TIMEOUT_MS,
+  isOnMain,
+  landArgv,
+  landScriptPath,
+  runLandOnce,
+  start,
+  verdictOf,
+};

package/template/coding-task-manager/lib/fleet-resolver-effects.js

@@ -0,0 +1,147 @@
+'use strict';
+// WP-8 (docs/fleet-origin-main-sync-skill-2026-10-31.html §13.4 R-R2/R-R7/R-R8/R-R10, §13.7 S-R12) +
+// WP-12 (§14.3 R-14.3/R-14.4/R-14.5): the resolver's EFFECTS — the four things lib/fleet-resolver.js
+// `start()` needs to open a visible resolver session with its brief already submitted, plus
+// `sessionAlive`. This is a new module on purpose: the wiring must not grow server.js past its
+// file-size ceiling, so server.js only hands over the functions below.
+//
+// There is NO new session-create path here, and no queue:
+//
+//   prepareWorkspace  `_prepareCreatedSessionWorkspace` (server.js) — the same call best-of makes,
+//                     plus a branch rename so the checkout lands on exactly `sync/origin-<tip12>`
+//                     (the resolver lane the pre-commit hook matches on that string, WP-6).
+//   resolvePick       `resolveSubagentPick` (lib/session-create/subagent-pick.js) — the delegate
+//                     pick, i.e. the same model CTM would give a delegate worker, turned into argv
+//                     (`--model <model>`; R-14.5).
+//   createSession     `handleCreatePrepared(null, {…})` — the prepared-create entry point, with the
+//                     brief as the CLI's POSITIONAL prompt argument (`args = [...argv, prompt]`,
+//                     R-14.3). The rev-3 queue lane is gone: the queue engine writes text and never
+//                     Enter (E-5), so a server-started session's prompt sat unsubmitted forever.
+//                     No nudge, no queue, no timer, no race with TUI readiness (R-14.4).
+//   notify            `dispatchMobileNotification(mobileNotifications.notifyWaitingInput(…))` — the
+//                     R-R8 give-up ping.
+//
+// `server` is the object server.js passes in; every member is a function, so a test can supply
+// fakes and never touch CTM.
+
+const { runGitAsync } = require('./fleet-resolver-tick');
+// R-15.5: the resolver and best-of share ONE launch-prompt shape (REPLACE IN PLACE) — the argv
+// builder lives in lib/agent-capabilities.js beside the per-agent declaration it reads.
+const { launchPromptArgv } = require('./agent-capabilities');
+
+const WORKTREE_NAMESPACE = 'claude';
+// §14.3 R-14.5: the model flag a Claude resolver gets when no native pick names a concrete model —
+// the CLI's own "default" alias, which overrides a managed `opusplan` pin (E-6).
+const CLAUDE_DEFAULT_MODEL_ARGV = Object.freeze(['--model', 'default']);
+const CLAUDE_AGENT = 'claude';
+
+function typedError(code, message) {
+  const error = new Error(message || code);
+  error.code = code;
+  return error;
+}
+
+/**
+ * Build the four effects (+ `sessionAlive`) from the server functions.
+ *
+ * `opts.runGit` is the async git runner used for the one branch check/rename; production omits it
+ * (lib/fleet-resolver-tick.js `runGitAsync`), a test injects a recorder.
+ */
+function createResolverEffects(server = {}, { runGit = runGitAsync } = {}) {
+  const s = server || {};
+
+  /**
+   * R-R10: a fresh worktree based on `baseRef`, then force the branch name to EXACTLY `branchName`.
+   * The prepared-create path may pick its own name (or reuse a suffixed one); the resolver lane the
+   * pre-commit hook reads matches `sync/origin-*` literally, so a mismatch is renamed in place.
+   */
+  async function prepareWorkspace({ repoRoot, baseRef, worktreeName, branchName }) {
+    const id = s.randomUUID();
+    const workspace = await s.prepareCreatedSessionWorkspace(
+      { id, cwd: repoRoot, title: worktreeName },
+      { cwd: repoRoot, baseRef, worktreeName, branchName, namespace: WORKTREE_NAMESPACE },
+    );
+    const cwd = workspace && workspace.cwd ? workspace.cwd : '';
+    if (!cwd) throw typedError('workspace_failed', 'prepareWorkspace returned no worktree path');
+    if (branchName) {
+      const current = String(await runGit(['rev-parse', '--abbrev-ref', 'HEAD'], { cwd }) || '').trim();
+      if (current !== branchName) {
+        // `git -C <cwd> branch -m <branchName>` — an exact-match rename, never a checkout (the
+        // worktree is brand new, so the branch is not checked out anywhere else).
+        await runGit(['branch', '-m', branchName], { cwd });
+      }
+    }
+    return { cwd, branch: branchName || (workspace && workspace.branch) || '' };
+  }
+
+  /**
+   * OQ-R1 (decided) + §14.3 R-14.5: ONLY a native pick with a concrete model is honoured, and it
+   * rides the launch argv as `--model <model>`. A routed pick (or any error, or no pick) falls back
+   * to the agent's own default: for Claude that is the CLI's `default` alias — an EMPTY model id
+   * lets a managed `opusplan` pin win (E-6) — and for every other agent (codex et al.) no model flag
+   * at all, so the CLI's own config decides.
+   */
+  async function resolvePick({ agent }) {
+    try {
+      const pick = await s.resolveSubagentPick({ agent, ctmSessionId: '' });
+      if (pick && pick.kind === 'native' && pick.model) {
+        return { model: pick.model, source: pick.source || 'session', argv: ['--model', pick.model] };
+      }
+    } catch (error) {
+      /* REPORT: a failed pick read is not a reason to skip the resolver — the default model is fine */
+      void error;
+    }
+    if (String(agent || '') === CLAUDE_AGENT) {
+      return { model: '', source: 'cli_default_alias', argv: [...CLAUDE_DEFAULT_MODEL_ARGV] };
+    }
+    return { model: '', source: 'agent_default', argv: [] };
+  }
+
+  /**
+   * §14.3 R-14.3: the prepared-create entry point (same call best-of makes), then assert the session
+   * exists. `args` is `[...argv, prompt]`: the brief is the CLI's positional prompt operand, LAST,
+   * and it is never preceded by `--` (lib/create/resolve-launch-params.js declines its approval-hook
+   * injection for an argv whose real terminator is not last, :327). An empty prompt is a caller bug,
+   * not a session to open, so it throws `prompt_required`.
+   */
+  async function createSession({ cwd, agent, model, title, argv, prompt }) {
+    if (!prompt) throw typedError('prompt_required', 'a resolver session needs its brief as the launch prompt');
+    const id = s.randomUUID();
+    await s.handleCreatePrepared(null, {
+      id,
+      title,
+      label: title,
+      titleIntent: 'default',
+      cmd: agent,
+      args: [...(argv || []), ...launchPromptArgv(agent, prompt)],
+      cwd,
+      agentType: agent,
+      model_id: model || '',
+    });
+    if (!s.getSession(id)) throw typedError('session_start_failed', `session ${id} was not created`);
+    return { sessionId: id };
+  }
+
+  /** R-R8: one mobile "needs you" ping, plus a stderr line an operator reading the log sees. */
+  async function notify({ title, body, sessionId }) {
+    console.warn(`[fleet-resolver] ${title}: ${body}`);
+    if (!s.mobileNotifications || typeof s.dispatchMobileNotification !== 'function') return;
+    s.dispatchMobileNotification(s.mobileNotifications.notifyWaitingInput({
+      sessionId,
+      source: 'fleet-resolver',
+      privatePreview: `${title}: ${body}`,
+      stateKey: `fleet-resolver:${sessionId}`,
+    }));
+  }
+
+  /** R-R7: "is the resolver's session still in CTM's map" — the ONE liveness fact `decide()` reads. */
+  function sessionAlive(id) {
+    return Boolean(id && s.getSession(id));
+  }
+
+  return { prepareWorkspace, resolvePick, createSession, notify, sessionAlive };
+}
+
+module.exports = {
+  createResolverEffects,
+};

package/template/coding-task-manager/lib/fleet-resolver-tick.js

@@ -0,0 +1,148 @@
+'use strict';
+// WP-8 (docs/fleet-origin-main-sync-skill-2026-10-31.html §13.4 R-R1/R-R7/R-R8, §13.7 S-R10/S-R11):
+// the CTM-side half of the fleet-sync resolver — the two hooks the origin follower calls on every
+// tick: `busy()` (is a resolver already running on this box?) and `after()` (read the verdict the
+// tick just wrote and act on it).
+//
+// This module owns NO decisions: `decide()`/`start()`/`apply()` live in lib/fleet-resolver.js and are
+// pure/injected there (WP-7). Everything here is I/O — resolve the git common dir, read
+// `<common>/landing/sync-state.json` and the job record it names, read `resolver.json`, and hand the
+// three to `decide()`.
+//
+// Async I/O only, on purpose: this runs on CTM's main thread, so bin/main-thread-lint.js must never
+// see a sync fs/child_process call here. The one git call (`rev-parse --git-common-dir`) goes through
+// execFile promisified to a local alias, the same shape lib/codesign-identity.js uses.
+
+const fsp = require('node:fs/promises');
+const path = require('node:path');
+const { execFile } = require('node:child_process');
+const { promisify } = require('node:util');
+const resolver = require('./fleet-resolver');
+
+const execFileAsync = promisify(execFile);
+// A rev-parse is local and instant; anything slower is a broken repo, not a slow one.
+const GIT_TIMEOUT_MS = 5000;
+// §13.4 R-R7: a `current` record in one of these states owns the box's resolver slot. Mirrors
+// lib/fleet-resolver.js's own LIVE_STATES (not exported there — repeated rather than widening WP-7).
+const LIVE_STATES = Object.freeze(['starting', 'resolving']);
+// Queue/job ids are Crockford-base32 (`lib/landing/queue.js`); this only keeps a corrupt sync-state
+// file from pointing the read at a path outside `<common>/landing/jobs/`.
+const JOB_ID_RE = /^[A-Za-z0-9_-]+$/;
+
+/** The one async git read this module needs: stdout, trimmed. Throws on a non-zero exit. */
+async function runGitAsync(args, { cwd, timeout = GIT_TIMEOUT_MS } = {}) {
+  const { stdout } = await execFileAsync('git', args, { cwd, timeout, encoding: 'utf8' });
+  return String(stdout == null ? '' : stdout).trim();
+}
+
+// `--git-common-dir` cannot change while this process runs; memoize only successes, like
+// lib/landing/git.js `commonDir`. Keyed by resolved repoRoot so a test can hand over a temp dir.
+const COMMON_DIR_CACHE = new Map();
+
+async function resolveCommonDir(repoRoot, runGit) {
+  const key = path.resolve(String(repoRoot || ''));
+  const cached = COMMON_DIR_CACHE.get(key);
+  if (cached !== undefined) return cached;
+  const value = await runGit(['rev-parse', '--path-format=absolute', '--git-common-dir'], { cwd: repoRoot });
+  const resolved = String(value == null ? '' : value).trim();
+  if (resolved) COMMON_DIR_CACHE.set(key, resolved);
+  return resolved;
+}
+
+/** Read and parse one JSON file; a missing or unreadable one is `null`, never a throw. */
+async function readJson(file) {
+  let raw;
+  try {
+    raw = await fsp.readFile(file, 'utf8');
+  } catch (error) {
+    /* expected: the file has not been written yet (or is mid-rename) -> "nothing to read" */
+    void error;
+    return null;
+  }
+  try {
+    return JSON.parse(raw);
+  } catch (error) {
+    /* REPORT: a torn/corrupt state file must never stop the tick; the next write heals it */
+    void error;
+    return null;
+  }
+}
+
+/**
+ * The follower's per-tick resolver hooks (injected into lib/fleet-origin-follower.js `start`).
+ *
+ *   repoRoot  the checkout whose `<common>/landing/` holds sync-state.json, resolver.json and jobs/;
+ *   publish   the normalized `config.publish` (`resolve`, `resolveAgent`, `resolveMaxMinutes`);
+ *   deps      the effects lib/fleet-resolver.js `start`/`apply` call, plus `sessionAlive(id)`;
+ *   now       the tick's clock (ms epoch), so `decide()` stays pure;
+ *   log       one line per resolver action;
+ *   runGit    injectable async git (`(args, { cwd }) -> stdout`) — production is `runGitAsync`.
+ *
+ * Returns `{ busy, after }`. Both resolve; a git/fs failure inside `busy()` reads as "not busy"
+ * (the tick then runs `land sync`, which is where the truth comes from), and a throw out of `after()`
+ * is caught by the follower and reported in its tick line.
+ */
+function createResolverTick({ repoRoot = '', publish = null, deps = {}, now = Date.now, log = (line) => console.log(line), runGit = runGitAsync } = {}) {
+  const effects = deps || {};
+  let commonPromise = null;
+  const commonDir = () => {
+    if (!commonPromise) commonPromise = resolveCommonDir(repoRoot, runGit).catch((error) => {
+      /* HANDLE: an unresolvable common dir reads as "no landing state" — the tick just runs land sync */
+      void error;
+      return '';
+    });
+    return commonPromise;
+  };
+
+  /** R-R7: a live resolver (state `starting|resolving`) with a session CTM still holds owns the slot. */
+  async function busy() {
+    const common = await commonDir();
+    if (!common) return false;
+    const state = await resolver.readState(common);
+    const current = state && state.current;
+    if (!current || !LIVE_STATES.includes(current.state)) return false;
+    // WP-13: a /fleet-sync session that claimed this key is resolving it; the tick must not run land sync under it.
+    if (resolver.claimedBySession(current)) return true;
+    try {
+      return Boolean(await effects.sessionAlive(current.sessionId));
+    } catch (error) {
+      /* HANDLE: an unreadable session map reads as "not alive" -> not busy, so the tick runs land sync */
+      void error;
+      return false;
+    }
+  }
+
+  /** §13.4 R-R1/R-R7/R-R8: read the tick's verdict and execute whatever `decide()` says. */
+  async function after() {
+    const common = await commonDir();
+    if (!common) return;
+    const syncState = await readJson(path.join(common, 'landing', 'sync-state.json'));
+    if (!syncState || typeof syncState !== 'object') return; // no sync has run yet -> nothing to decide
+    const jobId = syncState.lastSync && syncState.lastSync.jobId ? String(syncState.lastSync.jobId) : '';
+    const job = jobId && JOB_ID_RE.test(jobId)
+      ? await readJson(path.join(common, 'landing', 'jobs', `${jobId}.json`))
+      : null;
+    const resolverState = await resolver.readState(common);
+    const decision = resolver.decide({
+      syncState,
+      resolverState,
+      job,
+      publish,
+      now: now(),
+      sessionAlive: effects.sessionAlive,
+    });
+    if (!decision || decision.action === 'none') return;
+    await resolver.apply({ decision, repoRoot, commonDir: common, deps: effects });
+    log(`origin-follow: resolver ${decision.action} (${decision.reason})`);
+  }
+
+  return { busy, after };
+}
+
+module.exports = {
+  GIT_TIMEOUT_MS,
+  LIVE_STATES,
+  createResolverTick,
+  resolveCommonDir,
+  runGitAsync,
+};