weir-harness 1.2.0 → 1.2.2

package/src/edit-lock/peer-client.js

@@ -1,3 +1,4 @@
+import { asBindingFailure } from './binding-guidance.js'
 import { canonicalRequestData } from './request-data.js'
 import { PEER_KINDS } from './peer.js'
 
@@ -39,15 +40,21 @@ export function createEditLockPeerClient(stream, hooks = {}) {
         try { hooks.onEvent?.(message.event) } catch { /* notices never imply consent */ }
         continue
       }
+      const frameKeys = !message || typeof message !== 'object' ? '' : Object.keys(message).sort().join(',')
+      // The error frame carries the structured binding refusal as an additive
+      // optional field (change edit-lock-deepening, design D2).
       if (!message || typeof message.callId !== 'string' || typeof message.ok !== 'boolean'
-        || Object.keys(message).sort().join(',') !== (message.ok ? 'callId,ok,outcome' : 'callId,error,ok')
+        || (message.ok ? frameKeys !== 'callId,ok,outcome' : frameKeys !== 'callId,error,ok' && frameKeys !== 'bindingFailure,callId,error,ok')
         || (!message.ok && typeof message.error !== 'string')) { close(); return }
       const entry = pending.get(message.callId)
       if (!entry) { close(); return }
       pending.delete(message.callId)
       entry.cleanup()
       if (message.ok) entry.resolve(message.outcome)
-      else entry.reject(new Error(message.error))
+      else {
+        const failure = asBindingFailure(message.bindingFailure)
+        entry.reject(Object.assign(new Error(message.error), failure ? { bindingFailure: failure } : {}))
+      }
     }
   }
   stream.on('data', receive)

package/src/edit-lock/peer-transport.js

@@ -1,3 +1,4 @@
+import { asBindingFailure } from './binding-guidance.js'
 import { canonicalRequestData } from './request-data.js'
 
 /** Attach ONLY an authenticated, host-owned byte stream. Never accepts public
@@ -54,7 +55,12 @@ export function serveEditLockPeer(stream, peer) {
       const callId = request.callId
       void peer.receive(request).then(
         outcome => { try { send({callId, ok:true, outcome:outcome ?? null}) } catch { close() } },
-        error => { try { send({callId, ok:false, error:String(error?.message ?? error).slice(0,4096)}) } catch { close() } },
+        error => {
+          // The wire carries the structured binding refusal additively (change
+          // edit-lock-deepening, design D2); the text stays for display.
+          const failure = asBindingFailure(/** @type {any} */ (error)?.bindingFailure)
+          try { send({ callId, ok: false, error: String(/** @type {any} */ (error)?.message ?? error).slice(0, 4096), ...(failure ? { bindingFailure: failure } : {}) }) } catch { close() }
+        },
       )
     }
   }

package/src/edit-lock/remote.js

@@ -3,7 +3,7 @@ import { lstatSync, realpathSync, unlinkSync } from 'node:fs'
 import { createConnection, createServer } from 'node:net'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
-import { bindingGuidance, bindingRefusal } from './binding-guidance.js'
+import { asBindingFailure, bindingGuidance, bindingRefusal } from './binding-guidance.js'
 import { createEditLockPeer } from './peer.js'
 import { serveEditLockPeer } from './peer-transport.js'
 import { createEditLockPeerClient } from './peer-client.js'
@@ -275,12 +275,16 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
     for (let attempt = 0; ; attempt++) {
       try { return await openChannel(agent, retry) } catch (error) {
         if (/** @type {any} */ (error)?.answeredRefusal !== true) throw error
-        if (!retry && /session already bound/.test(String(/** @type {any} */ (error)?.message)) && attempt < 20) {
+        // The retry budget classifies on the STRUCTURED refusal field, never on
+        // the display text (change edit-lock-deepening, design D2): only an
+        // answered, publisher-classified duplicate binding is retried — the
+        // publisher may not yet have processed the earlier channel's death.
+        if (!retry && /** @type {any} */ (error)?.bindingFailure?.code === 'binding-duplicate' && attempt < 20) {
           await new Promise(resolve => setTimeout(resolve, 50))
           continue
         }
         const reason = String(/** @type {any} */ (error)?.message ?? error)
-        const guidance = bindingGuidance(agent.id, reason)
+        const guidance = bindingGuidance(agent.id, /** @type {any} */ (error)?.bindingFailure)
         throw Object.assign(new Error(`edit lock duplicate session binding: ${guidance} (publisher answered: ${reason})`), { bindingFailure: /** @type {any} */ (error)?.bindingFailure })
       }
     }
@@ -317,7 +321,10 @@ export function createRemoteEditLockDomain(endpoint, hooks) {
       let opened
       try {
         opened = await channel.client.request('open', 'open', { sessionId: agent.id, nonce, pid: process.pid, bindingFailures: true, retry }, never)
-        if (opened?.state === 'unavailable' && opened.bindingFailure?.code === 'binding-duplicate') throw Object.assign(new Error(opened.reason), { bindingFailure: opened.bindingFailure })
+        // The answered refusal's structured field is validated on receipt;
+        // only the exact minted shape becomes decision input.
+        const refused = opened?.state === 'unavailable' ? asBindingFailure(opened.bindingFailure) : undefined
+        if (refused) throw Object.assign(new Error(opened.reason), { bindingFailure: refused })
       } catch (error) {
         const message = String(/** @type {any} */ (error)?.message ?? error)
         // No answer ever arrived — the channel died mid-open or the request

package/src/edit-lock/state.js

@@ -24,6 +24,7 @@
  * @typedef {{ now?: number, singleMaxMs: number, cumulativeMaxMs: number }} HoldCaps
  */
 
+import { settleHoldFacts } from './derived-facts.js'
 /** Private transfer seam; no raw hydration is exported. */
 const cores = new WeakMap()
 /** @param {string} managerIncarnation */
@@ -165,10 +166,7 @@ export function createEditLockState(managerIncarnation) {
       const held = holds.get(sessionId)
       if (!held) return Object.freeze({ sessionId, held: false, expired: false, holdUntil: null, remainingMs: 0, holdCumulativeMs: 0 })
       const owns = [...locks.values()].some(lock => lock.owner === sessionId)
-      const remainingMs = held.holdUntil === null ? 0 : Math.max(0, held.holdUntil - now)
-      const holding = held.holding && owns
-      return Object.freeze({ sessionId, held: holding, expired: holding && held.holdUntil !== null && remainingMs === 0,
-        holdUntil: held.holdUntil, remainingMs, holdCumulativeMs: held.holdCumulativeMs })
+      return Object.freeze(settleHoldFacts(sessionId, held, owns, now))
     },
   }
 

package/src/edit-lock/view.js

@@ -10,6 +10,7 @@
  * in `technical` and per-lock `detail`, for the expandable detail only.
  */
 import { isAbsolute, relative, sep } from 'node:path'
+import { revokedOwner, settleHoldFacts } from './derived-facts.js'
 
 /** Session states the panel renders, in precedence order. */
 export const VIEW_STATES = Object.freeze(['revoked', 'unavailable', 'stopped', 'attention', 'confirm', 'holding', 'editing', 'idle'])
@@ -140,21 +141,19 @@ export function buildColdView({ image, sessionId, cwd, root, autoResume = true,
   const locks = (Array.isArray(image?.locks) ? image.locks : []).filter(lock => lock !== null && typeof lock === 'object')
   const holds = Array.isArray(image?.holds) ? image.holds : []
   const recoveries = Array.isArray(image?.recovery) ? image.recovery : []
-  const adminRecoveries = Array.isArray(image?.adminRecoveries) ? image.adminRecoveries : []
   const session = sessions.find(row => row?.sessionId === sessionId) ?? null
   // The manager derives the revoked flag from the administrative ledger at
-  // status time (revokedOwner); the cold read applies the same rule to the image.
-  const revoked = session != null && adminRecoveries.some(row => row?.owner === sessionId && Number.isSafeInteger(row?.revokedEpoch) && session.executionEpoch <= row.revokedEpoch)
-  // Read-time retention settlement, byte-equivalent to the kernel's settleHold:
-  // a hold counts only while the session owns a lock, and the remaining budget
-  // is computed against the read instant, so a missed expiry timer can never
-  // leave stale ownership behind a status read.
+  // status time (revokedOwner); the cold read applies the SAME shared rule in
+  // its deliberately tolerant partial mode (design D1).
+  const revoked = revokedOwner(image, sessionId, { partial: true })
+  // Read-time retention settlement through the shared derived fact (design D5,
+  // partial mode — byte-equivalent to the kernel's settleHold): a hold counts
+  // only while the session owns a lock, and the remaining budget is computed
+  // against the read instant, so a missed expiry timer can never leave stale
+  // ownership behind a status read. No hold row settles to no retention (null).
   const held = holds.find(row => row?.sessionId === sessionId) ?? null
   const owns = locks.some(lock => lock.owner === sessionId)
-  const remainingMs = held?.holdUntil == null ? 0 : Math.max(0, held.holdUntil - now)
-  const holding = held?.holding === true && owns
-  const retention = held ? { sessionId, held: holding, expired: holding && held.holdUntil !== null && remainingMs === 0,
-    holdUntil: held.holdUntil, remainingMs, holdCumulativeMs: held.holdCumulativeMs } : null
+  const retention = held ? settleHoldFacts(sessionId, held, owns, now, { partial: true }) : null
   const status = {
     sessionId,
     // Interrupted records a stopped session (a restarted host interrupts every

package/src/lsp/admin.js

@@ -4,40 +4,18 @@
 // resolve through ctx.get so the module mounts harmlessly in compositions
 // without them (headless).
 import { buildRegistry, DEFAULT_SERVERS, displayInstallCommand, installSpecFor, languageIdsForFamily } from './registry.js'
-import { npmGlobalPrefix, resolveExecutable as extendedResolveExecutable, runBounded, spawnArgv } from './child-process.js'
+import { npmGlobalPrefix, resolveExecutable as extendedResolveExecutable, runBounded, spawnArgv } from '../process/index.js'
+import { jsonResponse, readJsonBody } from '../shared/http-json.js'
 
 const name = 'weir-lsp-admin'
 const inject = []
 const DEFAULT_INSTALL_TIMEOUT_MS = 600_000
 const VERSION_PROBE_TIMEOUT_MS = 8_000
 
-export function jsonResponse(payload, status = 200) {
-  return new Response(JSON.stringify(payload), {
-    status,
-    headers: { 'content-type': 'application/json' },
-  })
-}
-
 export function errorResponse(message, status = 400) {
   return jsonResponse({ ok: false, error: { code: `weir-lsp/${status === 400 ? 'invalid' : 'internal'}`, message } }, status)
 }
 
-/** Read the JSON body of a connection request (Request-like or stream). */
-export async function readJsonBody(request) {
-  try {
-    if (typeof request?.json === 'function') return await request.json()
-  } catch {
-    return null
-  }
-  try {
-    const chunks = []
-    for await (const chunk of request?.body ?? []) chunks.push(Buffer.from(chunk))
-    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
-  } catch {
-    return null
-  }
-}
-
 /** Accept only lines that plausibly carry a version (stack traces and
  *  paths from servers without --version support are dropped). */
 export function looksLikeVersion(line) {

package/src/lsp/index.js

@@ -8,7 +8,7 @@
 // ESM, ctx-only.
 import { createLspManager, LSP_DEFAULTS } from './manager.js'
 import { buildRegistry } from './registry.js'
-import { resolveExecutable as extendedResolveExecutable } from './child-process.js'
+import { resolveExecutable as extendedResolveExecutable } from '../process/index.js'
 import { createLspTools } from './tools.js'
 
 const name = 'weir-lsp'

package/src/lsp/manager.js

@@ -2,7 +2,7 @@
 // lazy start, full-document sync, idle shutdown, per-session holder refcounts.
 import { createLspClient, handshake, shutdownClient } from './client.js'
 import { familyForLanguageId } from './registry.js'
-import { childEnvironment, spawnArgv } from './child-process.js'
+import { childEnvironment, spawnArgv } from '../process/index.js'
 import { pathToUri } from './uri.js'
 
 export const LSP_DEFAULTS = {

package/src/notify/permissions-admin.js

@@ -4,7 +4,7 @@
 // connection service resolves from that scope (S20). The platform and the
 // process spawner are injected for tests.
 import { execFile as nodeExecFile } from 'node:child_process'
-import { jsonResponse, readJsonBody } from '../lsp/admin.js'
+import { jsonResponse, readJsonBody } from '../shared/http-json.js'
 import { ACTIONS, readNotificationPermission, runPermissionAction, SENDER } from './permissions.js'
 
 const STATUS_PATH = '/api/weir-notify/permissions/status'

package/src/{lsp/child-process.js → process/index.js}

@@ -1,15 +1,21 @@
-// Executable resolution for LSP servers and installers. The desktop app is
+// Generic process machinery: executable resolution, launch-shape
+// adjudication, and deadline-bounded runs — one concept, three stages
+// (resolve → launch shape → bounded run). The desktop app is
 // a GUI process launched by LaunchServices, so its PATH is the minimal
 // `/usr/bin:/bin:/usr/sbin:/sbin` — Homebrew (/opt/homebrew, /usr/local),
 // nvm, cargo, go, pipx and npm-global bins are all missing, and
 // ctx.subprocess.resolveExecutable() fails for them (S21). This helper
-// falls back to scanning well-known installation directories so servers and
-// their installers resolve the same way they do in the user's shell.
+// falls back to scanning well-known installation directories so spawned
+// tools resolve the same way they do in the user's shell.
 //
 // Windows resolves through the same helper with a different dialect: npm puts
 // its global shims in `%APPDATA%\npm` (not `~/.npm-global/bin`), bare names
 // carry a PATHEXT extension, and the PATH separator is `;`.
-// Renamed-and-expanded from executable.js (design D1): one concept, three stages — resolve → launch shape → bounded run.
+//
+// No LSP-specific semantics live here: the LSP subsystem (server lifecycle,
+// version probe, panel installer) and the worktree git runner are peer
+// consumers. Moved verbatim out of src/lsp/child-process.js
+// (subsystem-seam-hygiene, D1); npm install POLICY stays in src/lsp/.
 import { accessSync, constants, existsSync, mkdirSync, readdirSync, readFileSync, statSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { dirname, join, join as nodeJoin } from 'node:path'
@@ -77,13 +83,22 @@ export function extraBinDirectories(env = process.env, platform = process.platfo
  * User-writable npm global prefix for panel installs: `npm --prefix <dir>
  * install -g …` lands servers here instead of a possibly root-owned global
  * prefix, and this directory is already part of the extended scan.
+ *
+ * `create` is a test seam: the win32 layout assertion must be runnable on any
+ * host WITHOUT materializing a literal `C:\Users\...` directory in the
+ * process CWD (the artifact that used to pollute the package directory after
+ * every unit run). Production callers keep the default (create the prefix).
+ * @param {Record<string, string | undefined>} [env]
+ * @param {string} [platform] - 'win32' | 'darwin' | 'linux' (process.platform values)
+ * @param {{ create?: boolean }} [options]
+ * @returns {string}
  */
-export function npmGlobalPrefix(env = process.env, platform = process.platform) {
+export function npmGlobalPrefix(env = process.env, platform = process.platform, options = {}) {
   const home = env.HOME ?? homedir()
   const prefix = platform === 'win32'
     ? join(env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'npm')
     : join(home, '.npm-global')
-  mkdirSync(prefix, { recursive: true })
+  if (options.create !== false) mkdirSync(prefix, { recursive: true })
   return prefix
 }
 
@@ -304,6 +319,7 @@ function expandShimToken(token, text, shimDirectory, join) {
 function tokenizeShimLine(line) {
   const tokens = []
   let current = ''
+  /** @type {string | null} */
   let quote = null
   let escaped = false
   for (const character of line) {
@@ -495,6 +511,7 @@ export async function runBounded(subprocess, { argv, timeoutMs, unref = false })
   })
   let timedOut = false
   let timer
+  /** @type {Promise<void>} */
   const deadline = new Promise((resolve) => {
     timer = setTimeout(() => {
       timedOut = true

package/src/settings/env-admin.js

@@ -4,7 +4,7 @@
 // settings row through ctx.inject so no new package subpath is needed (S19),
 // same pattern as wireLspAdmin / wireNotifyPermissions. The platform is
 // injected for tests.
-import { jsonResponse } from '../lsp/admin.js'
+import { jsonResponse } from '../shared/http-json.js'
 
 const ENV_PATH = '/api/weir-settings/env'
 

package/src/settings/index.js

@@ -9,7 +9,7 @@
 // config contains only the values the user actually set, so the settings
 // service can overlay them over preset-row config without clobbering
 // bundle-shipped defaults (layering: module defaults ← row config ← service).
-import { createWhitelistDefaultsCache, DEFAULT_WHITELIST_PATH } from '../shared/whitelist-defaults.js'
+import { createWhitelistDefaultsCache, DEFAULT_WHITELIST_PATH } from '../delegate/whitelist-defaults.js'
 import { configValue } from './volatile.js'
 import { computeSections } from './sections.js'
 import { wireLspAdmin } from '../lsp/admin.js'

package/src/settings/sections.js

@@ -149,60 +149,6 @@ export const FIELD_DEFAULTS = Object.freeze({
   blackboardWriteTokenTtlMinutes: 60,
 })
 
-/** Resolved Edit Lock retention policy. The keys are declared above; this is the
- * ONE place that turns them into the values the lifecycle consumes, so defaults
- * and validation cannot drift apart. */
-export const EDIT_LOCK_DEFAULTS = Object.freeze({
-  holdDefaultMinutes: 30,
-  holdSingleMaxMinutes: 30,
-  holdCumulativeMaxMinutes: 120,
-  nudgeAttempts: 2,
-  nudgeFallback: 'release',
-})
-
-/** Overlay one Edit Lock section onto the defaults. A key the user never set
- * falls back to its default; a key that is present but unusable (alone or in
- * combination) throws with the flat settings key named, because silently clamping
- * a retention cap would change how long other sessions stay blocked from those
- * files. The Edit Lock composition refuses retention requests with that error and
- * runs every other path (settling, status, release, stop, unlock) on defaults.
- * @param {any} section */
-export function editLockLimits(section) {
-  const value = section && typeof section === 'object' ? section : {}
-  /** @type {{holdDefaultMinutes: number, holdSingleMaxMinutes: number, holdCumulativeMaxMinutes: number, nudgeAttempts: number, nudgeFallback: 'release'|'abnormal'}} */
-  const limits = { ...EDIT_LOCK_DEFAULTS }
-  /** @param {'holdDefaultMinutes'|'holdSingleMaxMinutes'|'holdCumulativeMaxMinutes'} key @param {string} name */
-  const take = (key, name) => {
-    const input = value[key]
-    if (input === undefined) return
-    if (typeof input !== 'number' || !Number.isFinite(input) || input <= 0) {
-      throw new Error(`weir-settings: ${name} must be a positive number`)
-    }
-    limits[key] = input
-  }
-  take('holdDefaultMinutes', 'editLockHoldDefaultMinutes')
-  take('holdSingleMaxMinutes', 'editLockHoldSingleMaxMinutes')
-  take('holdCumulativeMaxMinutes', 'editLockHoldCumulativeMaxMinutes')
-  if (limits.holdDefaultMinutes > limits.holdSingleMaxMinutes) {
-    throw new Error('weir-settings: editLockHoldDefaultMinutes must not exceed editLockHoldSingleMaxMinutes')
-  }
-  if (limits.holdCumulativeMaxMinutes < limits.holdSingleMaxMinutes) {
-    throw new Error('weir-settings: editLockHoldCumulativeMaxMinutes must be at least editLockHoldSingleMaxMinutes')
-  }
-  if (value.nudgeAttempts !== undefined) {
-    if (!Number.isSafeInteger(value.nudgeAttempts) || value.nudgeAttempts < 0) {
-      throw new Error('weir-settings: editLockNudgeAttempts must be a non-negative integer')
-    }
-    limits.nudgeAttempts = value.nudgeAttempts
-  }
-  if (value.nudgeFallback !== undefined) {
-    if (value.nudgeFallback !== 'release' && value.nudgeFallback !== 'abnormal') {
-      throw new Error('weir-settings: editLockNudgeFallback must be "release" or "abnormal"')
-    }
-    limits.nudgeFallback = value.nudgeFallback
-  }
-  return Object.freeze(limits)
-}
 const zs = z
 
 function fieldSchema(type) {

package/src/shared/audit.js

@@ -35,10 +35,19 @@ export const AUDIT_TYPES = Object.freeze({
   // identity, feed census and provider status, never skill names; the receipt
   // itself stays the only effective-state authority.
   capabilityRead: 'capability-read',
+  // The pending model-facing capability notice (durable-pending-notice D7):
+  // queue / degrade / deliver / clear outcomes of the durable notice unit.
+  // Counts only, never names — the same rule as capability-read above; the
+  // accepted selection record stays the only effective-state authority.
+  capabilityNotice: 'capability-notice',
   // Session blackboard release facts (design D3): one record per key release
   // that had waiting subscribers; the emission lives in the blackboard plugin
   // and never touches a session log.
   blackboard: 'blackboard',
+  // Child-composition spawn facts (DSH 0.2.1 delegate shim): one record per
+  // spawn carrying the composition the child's creation window applies, so a
+  // host restart can replay it — the shim itself is runtime-only state.
+  delegate: 'delegate',
 })
 /**
  * Known dynamic sub-event kinds: `<type>/<kind>` events emitted beside a base
@@ -53,6 +62,9 @@ export const AUDIT_SUBTYPES = Object.freeze({
   // family, plus reconciliation reports.
   worktree: Object.freeze(['open', 'setup', 'bind', 'checked', 'check', 'invalidate', 'ask', 'decline', 'conflict', 'land', 'cleanup', 'abandon', 'reconcile', 'watch']),
   blackboard: Object.freeze(['released']),
+  // Child-composition spawn facts: one record per spawn, replayed on cold
+  // resume from this same channel (audit only — never a session log).
+  delegate: Object.freeze(['spawn']),
 })
 
 /**

package/src/shared/child-scope.js

@@ -59,7 +59,9 @@ export const CHILD_DENY_TOOLS = [
  * returned unchanged — allow semantics stay untouched. Deny-list or absent
  * filters get CHILD_DENY_TOOLS merged in, deduped. Same merge pattern as
  * supervisedToolFilter in src/delegate/spawn-adapter.js, applied AFTER the
- * lane transform at the single request-assembly point.
+ * lane transform at the single activation-assembly point, and re-applied by
+ * the DSH 0.2.1 creation-window shim (src/delegate/child-composition.js) with
+ * the CHILD scope's restrictable names before tools.restrict().
  *
  * DSH's tools.restrict() REJECTS deny names the composition never registered
  * (e.g. ask_user_question/present/edit_lock_* are absent from a headless

package/src/shared/http-json.js

@@ -0,0 +1,28 @@
+// Generic HTTP JSON helpers for the host-side admin endpoints: Response
+// shaping and request-body reading shared by the lsp, settings, and notify
+// admin modules. Sunk verbatim out of src/lsp/admin.js
+// (subsystem-seam-hygiene, D2); the LSP-specific error namespace
+// (errorResponse) and endpoint assembly (wireLspAdmin) stay in src/lsp/.
+
+export function jsonResponse(payload, status = 200) {
+  return new Response(JSON.stringify(payload), {
+    status,
+    headers: { 'content-type': 'application/json' },
+  })
+}
+
+/** Read the JSON body of a connection request (Request-like or stream). */
+export async function readJsonBody(request) {
+  try {
+    if (typeof request?.json === 'function') return await request.json()
+  } catch {
+    return null
+  }
+  try {
+    const chunks = []
+    for await (const chunk of request?.body ?? []) chunks.push(Buffer.from(chunk))
+    return JSON.parse(Buffer.concat(chunks).toString('utf8'))
+  } catch {
+    return null
+  }
+}

package/src/{delegate/audit-readers.js → shared/terminal-evidence.js}

@@ -1,9 +1,39 @@
-// Best-effort cold readers for supervision rebuild: the audit JSONL tail and a
-// child's final assistant text. These are the only node: consumers in the
-// delegate subsystem's cold path — the composition root stays node:-free.
+// Terminal evidence — the single definition site for what proves a supervised
+// child reached a terminal state: the STATUS/REPORT parser, the terminal-status
+// predicate (its JSDoc carries the one blocked-vs-terminal rule every consumer
+// refers to), and the two best-effort cold readers (the bounded audit-JSONL
+// tail; a child log's final assistant text). Delegate supervision and worktree
+// zombie-lane reconciliation both import from here, so neither subsystem
+// reaches into the other for this concept.
+//
+// Load-bearing tolerance semantics (zombie-lane safety): readAuditTail's 256KB
+// bounded window and error tolerance (missing/unreadable → [], a partial first
+// line dropped, malformed lines skipped) make an aged-out fact degrade to "no
+// evidence", never to a wrong release. Keep them byte-exact.
+//
+// Ports & adapters: the readers take their services as parameters (never ctx).
+// node: imports are the src/shared precedent (audit.js);
+// the node:-free constraint guards the delegate composition root, not shared.
 import { openSync, readSync, closeSync, statSync } from 'node:fs'
 import { join } from 'node:path'
-import { contentText } from '../shared/content-text.js'
+import { contentText } from './content-text.js'
+
+/** Parse a child's final assistant text into a terminal status, or null. */
+export function parseTerminalStatus(text) {
+  if (typeof text !== 'string' || text.length === 0) return null
+  const match = /^STATUS:[ \t]*(completed|blocked)[ \t]*$/m.exec(text)
+  if (!match) return null
+  const reportMatch = /^REPORT:[ \t]*([\s\S]*)$/m.exec(text.slice(match.index))
+  return { status: match[1], report: (reportMatch?.[1] ?? '').trim() }
+}
+
+/**
+ * Single exit for the terminal-status predicate: statuses that count toward
+ * group completion (blocked waits for a resume, so it is NOT terminal here).
+ */
+export function isTerminalStatus(status) {
+  return status === 'completed' || status === 'terminated'
+}
 
 /** Audit JSONL location for one session (cold-safe channel; may not exist). */
 export function auditFilePathOf(session) {

package/src/worktree/errors.js

@@ -18,6 +18,9 @@ export const WORKTREE_CODES = Object.freeze({
   UNKNOWN_LANE: 'UNKNOWN_LANE',
   ILLEGAL_TRANSITION: 'ILLEGAL_TRANSITION',
   LANE_NOT_DISPATCHABLE: 'LANE_NOT_DISPATCHABLE',
+  // The binding commit's reservation is gone (force-reclaim / reconcile
+  // --rebuild) or the lane left `working` before the commit landed.
+  LANE_RESERVATION_LOST: 'LANE_RESERVATION_LOST',
   LANE_BUSY: 'LANE_BUSY',
   NOT_LANDABLE: 'NOT_LANDABLE',
   STALE_LANDABLE: 'STALE_LANDABLE',

package/src/worktree/index.js

@@ -19,8 +19,7 @@ import { DEFAULT_ROOT } from './rules.js'
 import { LANES_CONTEXT_NAME, LANES_CONTEXT_ORDER, LANES_SECTION_NAME, LANES_SECTION_TEXT, LANES_VARIABLE_NAME } from './prompts.js'
 import { DEFAULT_WATCH_TIMEOUT_MINUTES } from './watches.js'
 import { APPROVE_MODES, WORKTREE_PROJECTION_KEY, foldWorktreeState, initialWorktreeState, worktreeStateSchema, worktreeView, worktreeViewSchema } from './projection.js'
-import { readAuditTail, readChildFinalText } from '../delegate/audit-readers.js'
-import { isTerminalStatus, parseTerminalStatus } from '../delegate/group-coordinator.js'
+import { isTerminalStatus, parseTerminalStatus, readAuditTail, readChildFinalText } from '../shared/terminal-evidence.js'
 
 const name = 'weir-worktree'
 // subprocess is a host-plane service every composition mounts; it is a hard