[brettheap]

Lane: openRepoTools-3

← brettheap/new-workstation#22 (Amendment 12, ratified 2026-09-13) and #34 (Amendment 18 clause (h), ratified 2026-09-14)

A lane session works only while three names are one — the tmux WINDOW it runs in, the SESSION's own name, and the register ROW whose session cell ends on this transcript — and otherwise the prompt is refused. Brett Heap's ruling, in session, 2026-09-13, verbatim: "we need the session name and the lane name always the same. we need a gaurd on this and is must stop and refuse to work if they are not the same"; ratified the same day as "Ratify revision 2", with M1 "Type /rename into the pane".

Amendment 2 has said since 2026-09-05 that a lane is its window's name and its session's name. Nothing refused anything for eight days, and between 2026-09-10 and 2026-09-12 THIS lane ran as openRepoTools-3, -4, … -14 — a fresh title per /resume, in a window still named claude, in profiles that changed at every usage reset — and no row was ever written. session_start_block says which lane a window is and "ALWAYS exits 0"; window_session "decides nothing". This is the surface that decides.

The acts

1. lanes-edit.sh guard — the UserPromptSubmit hook. Reads the hook JSON on stdin; exits 0 silently when cwd is outside $PROJECTS_ROOT (D1), when the input carries agent_id, or when the three names agree; otherwise exits 2, which is what blocks a prompt, printing the triple as it stands and the ONE cure, filled in. One row of the (b) table per state, every message in the register's own spelling (Amendment 15):

found	done
window not a lane, session name parses as <repo>-<n>	lane-start --no-launch <repo> <n> — the 2026-09-10 case
neither name a lane	refuses; which lane this work is is the person's to say
window is a lane, this uuid is the row's last, session name is no lane name	THE LOCK RENAMES IT — types /rename <lane> into this pane
… differs from the row only by case	the lock renames it to the ROW's spelling (Amendment 15)
… is ANOTHER lane's, nameSource=user, newer than the binding	THE OFFER (D5)
uuid IN the cell but not last	a SUPERSEDED transcript: lane-start <repo> <n>
uuid in NO row	the recording act: lane-start --no-launch <repo> <n>
two rows differing only by case	refuses naming both and 15(d)'s merge
not inside tmux	refuses (D2)

THE LOCK types /rename <lane> into the session's own pane with tmux send-keys — M1's mechanism, and the only path a running session's name has — refusing that one prompt so the rename lands first. The pane's #{pane_current_command} is asked FIRST and nothing is typed into a pane running anything else; every other outcome prints the line for the person. A <lane> (N) title is a mismatch (D4) and the suffix is evidence a stale holder was live: the note names lanes-edit.sh forks and lane-end <lane> --retire <pid>, never a kill (Amendment 11 clause (k) rule (e)).

THE OFFER writes $CLAUDE_CONFIG_DIR/lanes/offers/<uuid> and asks. The next prompt is the answer, consumed and never reaching the model: yes renames the window FIRST — lane-start's step 3b veto 2 refuses a session in a window named for another lane, so without that order the lane would be started and this transcript left out of its cell — then runs lane-start --no-launch <repo2> <m>, appends this uuid to the new lane's cell (the section below says why lane-start may not), and writes MOVED → <repo2>-<m> on the lane it left; no types /rename <old lane> back; anything else re-offers.

FAIL CLOSED (clause (d)): a mismatch refuses, and so does an indeterminate read — records unreadable, tmux silent, register unreadable, a payload naming no cwd — naming the read. The row is read from origin/<branch> as this checkout last had it (R19) and the guard never fetches. --safe-mode is the one bypass and is named by the indeterminate refusals.

1b. Amendment 18(h) — one live process per transcript. lanes-edit.sh transcript-holders <uuid> sweeps every profile's sessions/ (a duplicate's record sits in another profile's — measured four times on 2026-09-14, the last at 18:14Z), matches a window by id AND session name (Amendment 11(h): tmux reuses ids), and gives each live process a verdict of here / companion / duplicate / unrelated. Three surfaces share the one read rather than implementing the rule three times:

• the guard refuses every prompt in a process sharing its id with another live one, naming the pid, its window or bg, its profile and lane-end <lane> --retire <pid>;
• lane-start counts the holders of the id it is about to bind (step 3b) or resume (the row-resume branch) and refuses rather than appending it to the row or launching a second resume of it;
• lane-end <lane> --retire <pid> retires a duplicate whose id IS the row's own — which forks cannot see, its criterion being "an id the row does NOT record", the exact gap lane-end --retire refuses a live duplicate process of the row's OWN session id (a --fork-session the launcher named as a fork before lane-start appended its id) — the retire act had to be a bare kill #39 was filed for — and refuses the window's own session by name.

2. lane-start --name "$LANE" on every launch case — ALREADY DONE, and nothing was added. Amendment 11's hotfix R-A11-1 did it: lane-start:1781 (resume by id), :1803 (resume by title), :1814 (new session), with the argv asserted at tests/test_lane_helpers.sh:698, 715, 730, 766, 772, 788, 796, 804, 819, 888, 1937, 1955, 2221, 2240, 2259, 2466, 2516 among others. Verified, reported, and left alone.

3. openRepoTools --install places the second entry — ~/projects/xFactory/lanes-edit.sh guard, timeout 5, no matcher (UserPromptSubmit has no source to match on) and no || true (on SessionStart that suffix is the whole safety property; here it would exit 0 for every code the command can produce, installing a guard that refuses nothing, silently). Both merges are computed into one staged file before either is placed, so the all-or-nothing rule covers the pair. The UserPromptSubmit arm keys on the verb guard with a boundary on both sides, not as a substring: ~/projects/xFactory/guard.sh is this estate's own usage guard, in every profile, and keyed loosely it would make every install refuse.

4. session_start_block gains clause (f)'s line — session name '<x>' was not the lane '<y>' — renamed — and types the rename itself ((h)1: its ONE act on a pane). Where another live process carries this id the block SAYS so and names the retire act. Still read-only against the register, still non-blocking, still always exit 0.

5–6. Tests and docs — below.

7. The hook is NOT installed live on Eagle here. That is adoption act 4, Brett Heap's first-live-case act, after this lands.

What the resume found, and it was one line

This branch began as five modified, uncommitted files from a session killed mid-work; 3befe7c records those bytes unchanged, before anything was done to them. No suite had ever been run against them, and the first run said why that mattered: transcript_holders never initialised th_here_prof, lanes-edit.sh runs under set -u (line 292), and pass 2's [ -z "$th_here_prof" ] is reached for the first record that is not this window's. 1468 passed, 124 failed — the WHOLE of the new Amendment 12 section, plus every lane-start case reaching step 3b's window binding, because dup_check reads that 1 as "the records could not be read" and refuses fail-closed.

An unbound variable under set -u exits the shell where it stands, so || : and || rc=$? at the call sites caught nothing, and the two hooks failed in the two directions neither may fail in:

• session-start exited 1 and printed no block at all — the hook breaking the session it exists to orient (R-A8-1);
• guard would exit 1, and a 1 does not block a UserPromptSubmit — only a 2 does. A fatal inside the guard let the prompt THROUGH, in silence, which is the one failure clause (d) forbids by name.

So the fix is not only the initialisation. The guard dispatcher arm runs guard_run in a subshell and maps every code but 0 and 2 to a 2; ssb_name_line runs transcript_holders in one and session_start_block calls ssb_name_line in one. Everything that must cross a subshell does — the offer file, lane-start, the register write, stderr — and the only thing lost is shell state nothing reads afterwards. Both properties are now asserted directly: the same unreadable-records fixture is given to both hooks, and the guard is given a register it cannot read and must answer 2, never the dispatcher's 1.

And one thing the suite found that no test was written for

After a yes, lane-start --no-launch cannot put this uuid in the new lane's cell, and the guard would then refuse for ever. Its step 3b veto 1 — Amendment 11 clause (d) rule 1 — never takes a uuid that belongs to ANOTHER row, and after the rename this uuid still belongs to the lane being left. Measured here: yes moved the window to repoGD-2, whose row then read STARTED by 7a01ae69… while the session was aaaa0012-1111…. The NEXT prompt therefore finds a lane window whose row does not name this transcript — the last row of the (b) table — and refuses with lane-start --no-launch repoGD 2, which vetoes for the same reason and changes nothing. A blocking hook that refuses for ever, on a state it created by obeying the person, is the worst outcome this surface has.

Clause (h) rule 2 names the end state and rule 3 repeats it — "window X, session X, row X stamped with this uuid" — so after lane-start returns, the guard makes that one write itself, with lane-start's own anchor discipline (the PUBLISHED last id, so a stale copy of the row refuses rather than writing a cell that no longer matches). The veto is right and stays: it exists for the take nobody asked for — "lane-start openXfactory-5 typed from a window named openRepoProject-1", Evidence 2(b) — and clause (h) rule 4's own limit is that the lock never moves a uuid between rows without the person's yes. Here there is one, on the record, answered at this very prompt. The suite asserts both halves: the cell ends on this transcript, and the guard SAYS it made that write.

Counts

	bash tests/test_lane_helpers.sh
main @ 92eab6c (this branch's base)	1500 passed, 0 failed
main @ 8345d2f (with Amendment 15, #41 — the merge base now)	1678 passed, 0 failed
this branch at the predecessor's state 3befe7c	1468 passed, 124 failed — unverified, never run by its author
this branch after the set -u fix, before the fixture and veto rounds	1750 passed, 20 failed — all 20 in the new section, nothing else red
this branch before Copilot round 1 (109186b)	1777 passed, 0 failed — 99 assertions the new section adds, and nothing else moved
this branch at eedb55f (round 1 taken, the two (b) rows that had no case)	1815 passed, 0 failed
this branch at 6cf5359 (round 2 taken)	1833 passed, 0 failed
this branch at e2b6694 (round 3 taken, three merges of main, the macOS fixture fixed)	1870 passed, 0 failed — every CI check green here, tests-macos included
this branch, head 9059f38 (round 4 taken)	1875 passed, 0 failed — and every CI check green here too, tests-macos in 23m39s

python3 -m pytest tests -q: 619 passed, 0 failed at the head, in 1231 s, on this workstation under the serialization lock (578 at 109186b, in 1103 s, before the three merges brought main's new tests) — which includes test_lane_helpers_suite.py running the whole bash suite a second time. At eedb55f every CI check passed — tests (the whole pytest suite) in 12m15s, tests-macos in 23m58s, tests-no-submodule, tests-windows and SonarCloud — which is the same suite this workstation's one pytest lock kept queueing locally (two local runs were killed from outside this worktree, at 144 and at 137). Seven test ids added, all in tests/test_install_skill_and_hook.py; every other change is to an existing case's docstring, its count or its fixture, so main @ 8345d2f collects 571.

The artifact count moves 18 → 19 everywhere it is derived or stated, because --install now merges TWO entries into one settings.json: derived in tests/test_openrepotools_command.py (ARTIFACTS = len(INSTALLED) + 2*len(SKILL_NAMES) + 2*len(COMMAND_NAMES) + HOOK_ENTRIES, the hand-kept + 1 now a named HOOK_ENTRIES = 2), stated in openRepoTools (six places, including "THE SEVEN ARTIFACTS THAT ARE NOT ONE OF THE ELEVEN FILES" → EIGHT), README.md and docs/README-lanes.md.

Tests

tests/test_lane_helpers.sh gains == Amendment 12: the name guard and the lock ==, placed before the Amendment 15 section so == the workstation seam == stays second-to-last. One case per row of the (b) table, fed a real hook payload on stdin: the agreeing case silent, exit 0, nothing typed; an out-of-scope cwd and an agent_id payload the same; the lock typed once and the logged send-keys -t %12 /rename repoGD-1 Enter asserted; <lane> (N) with the stale-holder note and no kill anywhere in it; a lowercase window resolving to the canonical row and every message and typed command carrying the register's spelling; both cell positions; two rows differing only by case; unreadable records; a payload with no cwd; the offer written, yes running lane-start --no-launch and writing MOVED →, no renaming back, a third answer re-offering; two live records on one id (one bg, in another profile's sessions/) refusing the prompt, refusing lane-start's bind, retiring under --retire <bg pid> and refusing --retire <window pid>; and clause (f)'s line typed by a SessionStart hook that still exits 0.

The sandbox's fake tmux gains two columns (%pane, the pane's current command) and two formats (#{session_name} for the agreement rule, #{pane_current_command} for M1's condition), logs send-keys as it always logged rename-window, and takes an opt-in sticky rename — opt-in because #W has been a constant for every case written before this one. The section captures the three FAKE_TMUX_* variables at its top and restores them at its bottom, so the Amendment 15 section below reads exactly what it read against main.

pytest: seven cases in tests/test_install_skill_and_hook.py — the entry byte-identical and carrying no matcher, the absent || true asserted on its own (copying the neighbouring string is the obvious way to write this and would pass every other test in the file), twice adding one entry, a differing guard entry refusing and placing nothing, ~/projects/xFactory/guard.sh not a conflict, the pair as ONE all-or-nothing merge (the conflict on the guard entry alone, so the cleanly-mergeable SessionStart entry must not be placed either), and one write placing both.

Docs

docs/README-lanes.md gains "The name guard and the lock (Amendment 12)": the triple, the table filled in, the lock and its pane conditions, the offer and its three answers, Amendment 18(h)'s duplicate read and its three callers, clause (f)'s line, fail-closed with the one bypass, and the scope. README.md's install paragraph names the second entry, what it does, and that a person's own UserPromptSubmit hooks are left where they are; cap 409 → 417 with a dated entry. AGENTS.md's lane paragraph promised, without qualification, that each of the four "refuses with exit 1 … where that file does not answer" — and guard deliberately answers 2, for the reason above; the sentence now carries the exception. Cap 224 → 228, also dated.

Notes for the reviewer

• git merge origin/main (8345d2f, Amendment 15), never a rebase — this branch was pushed before it landed. Five conflicts, all the two rounds writing in the same place about the same rule: the exit-code table's row 2 (both added a meaning; the count is now SIX and the paragraph below renumbered), rows_named_ci twice — the two rounds wrote the same function body for body, deliberately, and they collapsed into Amendment 15's — the *) subcommand list, and the suite's two new sections, both kept.
• Amendment 18 clauses (d) and (e) are a one-block comment where they plug in, not code: (d)'s answer IS Amendment 17(a)'s handoff under --exit (Amendment 17 tooling: lane-handoff + /handoff (swap kept as alias), PAUSED gains agent + transcript, lane-start --agent <name> resumes a lane from the handoff with any agent #36) and (e)'s line is written by the --force writer Amendment 18 tooling: one binding per lane — host/os/container sub-fields, lanes-edit.sh binding + request-handoff, HANDOFF-REQUESTED, the guard's two reads, lane-start/restart ask → wait → refuse → --force — after #25 and #36 #38 adds. A guard refusing on a line no writer in this estate can yet produce would be refusing on a read of a log that never carries it.
• Amendment 18 Addendum 2 (in force 2026-09-14T16:50:32Z) takes restart off a person's PATH; lane: one word lists the lanes and binds the one you pick — available → lane-start; LIVE here → attach (move-window + select-window; never a second process); bound elsewhere → request the handoff; bare lane-start becomes its alias (Amendment 18 Addendum 1, Brett Heap 2026-09-14) #43 removes the file. Nothing here names restart <lane> as an act — the one comment that resolved lane-start "the way restart finds lanes-edit.sh" now names this file's siblings instead. lane: one word lists the lanes and binds the one you pick — available → lane-start; LIVE here → attach (move-window + select-window; never a second process); bound elsewhere → request the handoff; bare lane-start becomes its alias (Amendment 18 Addendum 1, Brett Heap 2026-09-14) #43 and this PR both move the artifact count (it removes a file, this adds an entry); whichever lands second re-derives it — the count comes from the lists in both.

Copilot round 1 — four taken, eight declined

Round 1 arrived 2026-09-14T20:45:53Z: 7 inline threads and 5 findings suppressed into the review body, effort level Lite. Sourcery gave no review at all — its 7-day diff-character budget is spent, and it says so in place of one. Four findings are real and are taken in eedb55f; two of those four are checks that could not fire at all, which is the worst shape a fence has.

Taken

1. lane-start's row-resume branch could never refuse (lane-start:1415). 18(h) names that branch first — "the id it is about to RESUME or bind" — and it is reached only when row_sid != win_sid, so this window carries no record of the id being resumed and every live holder of it comes back unrelated, which dup_check dropped. unrelated now blocks in dup_check and nowhere else: the shared verdict keeps it silent so a rule about a transcript cannot overturn Amendment 8(f)'s orphan or forks, both of which ask about a LANE, while dup_check asks 18(h)'s own question about ONE id. At the window-binding call that id IS this window's session, so a here record exists and nothing is unrelated.
2. The companion is the bg record, not any record in this profile (lanes-edit.sh:5463). Amendment 8 ruling (g) names exactly one thing to pass over — "kind: bg, no tmux, no nameSource, its own pid, and THE SAME sessionId" — and keyed on the profile alone a second live INTERACTIVE record beside this window's own read as that companion. One profile resuming one transcript twice is the cheapest duplicate there is: no move, no swap, one --resume. record_fields_are_session is now asked here, so bg is a companion and interactive is a holder, in one reading for all three surfaces.
3. An answer is a prompt (suppressed, lanes-edit.sh:5758). The offer's yes/no was consumed in front of 18(h)'s count; a yes runs lane-start, writes a row and appends a uuid to a cell — out of a process that may not be writing at all, on an offer file the other process could equally have answered. The refusal now stands in front of the answer and the offer is kept, to be answered at the first prompt after the duplicate is retired.
4. The offer never runs a command it could not fill in (suppressed, lanes-edit.sh:6023). lane_start_args answers --dir <path> <lane> for a lane named before Rule 4's <repo>-<n> form — the register carries 22 of them — and <path> is a placeholder. Printing it in a diagnostic is honest; running it is not. The offer says what it cannot fill in, yes refuses with the act and the one word left to the person, and the offer is kept so no still answers.

Declined, one line each

• lane-end should read ownership from the here verdict (lane-end:684) — here is relative to the process ASKING: lane-end <lane> --retire <pid> is typed from wherever the person stands, and run from any window but the lane's nothing is here, so ownership-by-here would name no owner and the refusal lane-end --retire refuses a live duplicate process of the row's OWN session id (a --fork-session the launcher named as a fork before lane-start appended its id) — the retire act had to be a bare kill #39 asks for — the window's own session — would vanish exactly when the act is most likely to be used.
• --install reports present before it looks for a rival (openRepoTools:708, and the same at :722) — the shape predates this PR on the arm it is reported on (SessionStart is main's, under R-A9-8 and R-A9-14) and the guard arm mirrors it byte for byte; in that state --install adds nothing at all, so nothing is installed twice by the run. Whether conflict should beat present is one decision for both arms: filed as --install's hook conflict read answers present before it looks for a rival, so a settings file carrying BOTH our entry and another writer of the same hook installs in silence (both arms) #59, claimed by this lane.
• An unreadable register could produce a rename or a move (lanes-edit.sh:5717) — it cannot: both the lock and the offer sit behind [ -n "$gr_last" ] && [ "$G_ID" = "$gr_last" ], and a read that produced no rows produces no gr_last, so the prompt is refused by the table's last arm. What is wrong is the DIAGNOSIS, not the direction: filed as The name guard's two remaining indeterminate reads pick a branch of the (b) table instead of naming the read: the register's TEXT and the lane's binding log #60.
• A failed binding read authorises the move offer (lanes-edit.sh:5850) — it changes which REFUSAL the person gets and never whether the prompt runs: false → the lock (refuse, rename back), true → the offer (refuse, ask). Reading an unreadable log as "not newer" would silently rename a person's own /rename away, which is what clause (h) rule 4 forbids; asking is the conservative act. The message should say the log could not be read: The name guard's two remaining indeterminate reads pick a branch of the (b) table instead of naming the read: the register's TEXT and the lane's binding log #60.
• guard_bind_uuid's failure should hold the MOVED write and keep the offer (lanes-edit.sh:6031) — by that line the move HAS happened (lane-start returned 0: window renamed, row created, lane stamped), so MOVED → on the lane left is true; keeping the offer would consume the person's next prompt as an answer to a question already answered, and guard_bind_uuid prints the exact append-session-id act, which is Amendment 6(c)'s own remedy.
• A record that becomes unreadable mid-pass is silently skipped (suppressed, lanes-edit.sh:5422) — an unreadable record is already fail-closed one line above: xargs -0 grep -l … 2>"$th_err" and any stderr at all sets SESSION_FILES_ERR and returns 1. What the cat … || : passes over is a file that VANISHED between the grep and the read, which is a session that ended, and a record that is gone is not a live holder.
• under_projects_root's indeterminate answer should refuse (suppressed, lanes-edit.sh:5632) — that read answers clause (e)'s SCOPE, not the triple. This hook runs at every prompt of every session on the workstation, most of which are nobody's lane; refusing every prompt of a session we could not prove is ours is a larger failure than missing the guard in a session whose own cwd no longer exists. A $PROJECTS_ROOT that does not resolve is itself proof of "outside" — nothing is under a directory that is not there.
• The guard-entry conflict ordering (suppressed, openRepoTools:726) — the same finding as :708 above, same answer, same issue.

Two assertions changed, both with the citation and neither weakened. Amendment 8's lane-start does not refuse a lane over an orphan and …so it cannot refuse a lane either (a lone bg companion) now expect 1: the act that run makes next is claude --resume <the row's id>, and a live process already carries that file. Everything else those two cases assert is untouched and green — the orphan is REPORTED, named "orphaned holder, not a rival", given 6(d)'s act, and the rival refusal (take repoGH-2) is still absent, so the LANE is still not taken by it; what is refused is the second resume of its TRANSCRIPT, which is 18(h)'s own sentence. 8(f)'s rule does not reach that state either: it governs "a row's EARLIER session ids … still held by live but idle sessions", and this is the id the row ENDS on. Two has lines are added to each case, so the refusal they now take is asserted rather than assumed.

And two rows of the (b) table that had no case, found by reading the table against the section rather than by the review: not inside tmux at all (ratified decision D2) and a tmux that answers nothing, which is clause (d)'s indeterminate read and a different state with a different message. The first is the one cure in the table that cannot be filled in — which lane a windowless session belongs to is exactly what nothing there knows.

Copilot round 2 — four taken, four declined

Round 2 arrived 2026-09-14T21:53:00Z on the round-1 push: 3 inline threads and 5 findings suppressed into the review body, and it was NOT a restatement — two of its findings are in code round 1 wrote, which is the argument for reading a second round at all. Taken in 6cf5359; every thread replied to and resolved.

Taken

1. not a session record was too wide a test for "the harness's companion" (lanes-edit.sh:5485), and the counter-example is in this suite already: Amendment 11 clause (k)'s section writes an interactive fork with kind: user. Under round 1's spelling that record — and every kind a later harness invents — arrived at the guard as the benign bg companion, and two live processes on one transcript went unrefused. Ruling (g) names ONE shape to pass over, so the test is now kind = bg; everything else live on this id is a duplicate, including a record too old to carry a kind at all (pass 1 writes that down as interactive).
2. lane-end --retire <pid> selected its target by pid and never read the verdict (lane-end:691), so the one pid a person can reach for that is neither a duplicate nor the lane's own session — the harness's kind: bg COMPANION of that very session — was reported as a live duplicate and given Amendment 6(d)'s ending. It is the other half of the conversation that IS the lane, and it is now refused by name in ruling (g)'s own words, with transcript-holders named as the read that says which process is which.
3. The lock had a session to rename and no pane to type into (suppressed, lanes-edit.sh:5536). The pane comes from the live record's tmux field and the harness has been seen to write NONE for a process plainly in a window (ruling (g)'s third fact) — a record record_is_here still places HERE by the pane's process tree. Both hooks run INSIDE the session's own pane, so the fallback is tmux display-message -p '#{pane_id}', asked of tmux rather than guessed, with M1's condition still asked of whatever it resolves to.
4. M1's gate had no test (suppressed, lanes-edit.sh:5537) — "only while the pane's current command is claude" is the only barrier between this hook and somebody else's process. Both halves have one now: a pane running bash is not typed into and says so, and a pane whose command could not be READ is not typed into either.

Plus one line of documentation that was a promise the code does not keep: lane-end's usage offered --retire <pid|uuid> for both populations, and a duplicate cannot be named by a uuid — its uuid IS the row's own. The usage, the option block and the manual now say which form names which.

Declined, one line each

• A per-workstation lock spanning the resume (lane-start:1807) — 18(h) asks for a COUNT, not a lock; every read in this toolset is a snapshot and the protocol answers the race at other layers (the append-only cell behind its anchor, and 18(b)'s ASK before a second place binds); a lock that has to be released at the exec it protects protects nothing, and serialisation at launch is an amendment rather than a review round.
• (not asked) falls into the generic window arm (suppressed, lane-end:684) — that arm IS the documented intent and the behaviour asked for: (not asked) sets dr_own=1, which is what refusing to retire an unknown means (Amendment 18(b): a window that could not be asked about is unknown, not dead). The nit is the refusal's wording, reachable only with no tmux at all.
• The literal-prefix fast path in under_projects_root (suppressed, lanes-edit.sh:5278) — for the prefix to match while $PROJECTS_ROOT is missing, a LIVE session's own cwd would have to exist under a parent that does not; and the resolution beneath it exists for the launcher's symlinked projects root, where erring toward "inside" is deliberate.
• A uuid for a duplicate (suppressed, lane-end:26) — declined as code and taken as documentation, above.

Copilot round 3 — three taken, three declined, and the macOS job's own finding

Round 3 arrived 2026-09-14T22:51:22Z: 1 inline thread and 5 findings suppressed into the review body. Taken in 6519c1b, on a head that also carries three merges of main — b5244e2 (#44 and #46's pin), 66b4fb9 (#53), a954435 (#50) — and the fix for the three red lines tests-macos gave at 6cf5359.

THE macOS FAILURE WAS THE FIXTURE, NOT THE BEHAVIOUR. Round 2's case for the lock's pane fallback made the live record's pid a CHILD of the fake pane's, and pid_under climbs /proc to answer that — which macOS does not have. The record was "here" on Linux and nowhere on the macOS runner, so the guard refused with "no live session record in THIS window carries this session id" and the lock never ran. The fixture now gives the pane the record's OWN pid, which pid_under answers at its first step with no walk at all. Every other job was green at that commit; this is what the macOS job is for.

Taken

1. pending — set by the session's first act is the other text a session cell can carry (suppressed, lanes-edit.sh:6038), and it is exactly what a yes to a fresh lane can leave: veto 1 refuses this window's uuid because the row being LEFT still records it. The guard's own last write anchored only on none recorded, so there it could not be made at all — the loop this branch fixed one commit earlier, reached through the one cell text the fix did not list. Both texts are anchors now, with a case driving it end to end.
2. The lock typed into whatever pane the record named (suppressed, lanes-edit.sh:5475). here is true by the record's target OR by the pane's process tree, and tmux reuses window ids, so a record here BY ANCESTRY could carry another window's pane — and M1's gate cannot catch that, because that pane is running claude too. The pane now comes from the record only where its target names THIS window; otherwise guard_type asks tmux for the pane this hook runs in. ssb_name_line takes the same fence.
3. --install's three planning refusals described a plan that no longer exists (suppressed, openRepoTools:760): no jq, invalid JSON, a non-object hooks. All three name both entries and print both blocks.

Declined

• The companion should also require no tmux and no nameSource (lanes-edit.sh:5495) — it adds no detection (every duplicate this estate has met is a bg record with neither field) and it adds a way for a HARNESS RELEASE to block every prompt on a workstation, which this file's own window_session comment anticipates by name. kind is the field ruling (g) makes the discriminator.
• session_files's roots are hard-coded (suppressed, lanes-edit.sh:5433) — that read predates this PR and is shared by live_holder, forks, window-session and who.
• The destination log says RESUMED by <another id> after a move (suppressed, lanes-edit.sh:6106) — real, and filed as The offer's yes leaves the destination lane's log saying a transcript was RESUMED that nobody is in, because lane-start has no binding mode and the guard makes the cell write itself #70: the fix is a BINDING mode for lane-start, not a change to the guard. The cell every later read follows does end on the moved transcript.

Three merges of main, never a rebase. b5244e2 conflicted three times — --install's jq refusal (this branch named the pair; main added the regular-file check under it), its present arm (this branch split it per entry and made the write conditional; main gave it a chmod 600), and README.md's install paragraph with the cap that counts it (417 and 428 -> 436, both dated entries kept and a third naming the merge). 66b4fb9 and a954435 merged clean. Three counts main states in prose moved with the second hook entry, and the submodule is at the pin main brought.

Copilot round 4 — three taken, two declined, and the last round this lane takes

Round 4 arrived 2026-09-14T23:39:37Z: 2 inline threads and 3 findings suppressed. The reviews are not converging — 12 findings in round 1, 8 in round 2, 6 in round 3, 5 here — and what is left after this commit is either declined on the evidence above or filed as #59, #60 and #70.

Taken

1. node is not claude, and M1 named one command — "only while the pane's current command is claude". The gate read claude|node on the reasoning that the harness is a node program and #{pane_current_command} reports the process rather than the wrapper. MEASURED on Eagle at 23:4xZ across the twelve panes tmux had: eleven lane panes report claude, two report bash (a session under a launcher wrapper), one zsh, and none reports node. The second word bought nothing on the estate it was written for and would have let a Node REPL in a pane take /rename <lane> and an Enter as input. A pane the gate refuses still gets the line printed for the person — and on this estate the bash panes are exactly the windows where it will be read.
2. The SessionStart hook was undoing a person's own instruction before anybody was asked. Clause (f) types the rename for (h)1's DRIFT case, while (h) rule 2 makes a nameSource: user rename to another lane's name an INSTRUCTION answered yes/no at the next prompt — and this hook runs on every startup, resume, clear and fork, so a rename followed by a /clear had the name typed back before guard_run could put the question. It is said there now, in the words the guard will use, and left to the prompt that follows.
3. The installer test module's docstring still described one merged SessionStart entry, seven tests into the pair's own section.

Declined

• Classify the bg companion before the here branch (lanes-edit.sh:5535) — here and companion are the same answer to every caller (both are passed over in silence), so the order changes no outcome; what it would change is making this window's OWN companion a duplicate wherever the same-profile test does not hold, which is the false refusal round 2's narrowing exists to avoid. The duplicate this rule catches is never here.
• record_window_state should tell a silent tmux from a refuted window (suppressed, lanes-edit.sh:5510) — (gone) and (not asked) already differ and lane-end protects the second; telling a dead SERVER from a dead WINDOW needs a second question put to tmux, which is a read this file makes nowhere yet and a change to who's liveness reading as much as to this one.

Copilot round 5 — filed, not taken, and this lane stops here

Round 5 (2026-09-15T00:05:57Z, 4 inline + 2 suppressed) is where the rounds stop paying: four of its six restate declines already answered on their own threads, and the two that are new are of the same class as them — a surface that PRINTS a wrong instruction in a rare state while writing nothing, killing nothing and letting no prompt through. All three of that class are filed together as #73: the silent-tmux read labelled (gone), lane-end --retire selecting the harness's companion when the act is typed OUTSIDE the lane's window (the companion verdict is relative to the asking process), and the (b) table's first cure printing --dir <path> <lane> for a lane named before the <repo>-<n> rule. Every thread on this PR is replied to and resolved.

The count of findings by round: 12, 8, 6, 5, 6 — 11 taken, the rest declined with evidence in the thread and, where they are real, filed as #59, #60, #70 and #73.

Closes #25
Closes #39

Lane: openrepotools-3 (openRepoTools-3)

🤖 Generated with Claude Code

Summary by Sourcery

Enforce lane identity and transcript ownership across prompts and lane lifecycle operations, and install the new guard alongside the existing session-start hook.

New Features:

• Add a blocking UserPromptSubmit name guard that enforces agreement between the tmux window, session name, and register row, with automatic renames and interactive move offers.
• Add shared transcript-holder detection to prevent multiple live processes from using the same transcript across lane guard, lane-start, and lane-end.

Bug Fixes:

• Ensure hook failures fail closed for prompt submission while preserving SessionStart's non-blocking behavior.
• Complete accepted lane moves by recording the current transcript in the destination lane and marking the source lane as moved.

Enhancements:

• Add SessionStart reporting and rename behavior for session-name drift.
• Make installation merge both hook entries atomically and idempotently while preserving user hooks.
• Expand lane helper coverage for name mismatches, offers, duplicate holders, fail-closed reads, and hook behavior.

Documentation:

• Document the name guard, lock, move offer workflow, duplicate transcript rules, fail-closed behavior, and installation changes.
• Update installation artifact counts and clarify the guard's exit-code exception in project guidance.

Tests:

• Add comprehensive shell tests for the name guard, lock, offers, duplicate transcript handling, and SessionStart behavior.
• Add installer tests covering the UserPromptSubmit hook shape, conflicts, idempotence, and all-or-nothing settings updates.

[sourcery-ai]

Sorry @brettheap, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 3 days and 6 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's Guide

This PR implements Amendment 12's blocking lane name guard and rename/offer workflow, adds shared Amendment 18(h) duplicate-transcript enforcement across guard, lane-start, and lane-end, installs the guard atomically with the existing SessionStart hook, hardens hook failure handling, and adds comprehensive tests and documentation.

Sequence diagram for the lane name guard prompt check

sequenceDiagram
    participant Claude
    participant Guard as lanes-edit.sh guard
    participant Tmux
    participant Records as Session records
    participant Register as Lane register

    Claude->>Guard: UserPromptSubmit payload
    Guard->>Tmux: Read window and pane state
    Guard->>Records: transcript-holders(session_id)
    Guard->>Register: Read lane row
    alt Outside projects root or agent prompt
        Guard-->>Claude: Exit 0 silently
    else Three names agree
        Guard-->>Claude: Exit 0
    else Mismatch or indeterminate read
        Guard-->>Claude: Print refusal and cure
        Guard-->>Claude: Exit 2, prompt blocked
    end

Loading

Sequence diagram for automatic lane rename and user rename offer

sequenceDiagram
    participant User
    participant Guard as lanes-edit.sh guard
    participant Tmux
    participant LaneStart as lane-start
    participant Register

    alt Session name drifted from bound lane
        Guard->>Tmux: Read pane_current_command
        Guard->>Tmux: send-keys /rename lane Enter
        Guard-->>User: Refuse this prompt, send again
    else User renamed session to another lane
        Guard->>Guard: Write pending offer
        Guard-->>User: Ask yes or no, block prompt
        User->>Guard: Next prompt answer
        alt yes
            Guard->>Tmux: rename-window target lane
            Guard->>LaneStart: lane-start --no-launch repo n
            Guard->>Register: Append current uuid to target row
            Guard->>Register: Write MOVED → target lane
        else no
            Guard->>Tmux: send-keys /rename old lane Enter
        else Other answer
            Guard-->>User: Re-offer, block prompt
        end
    end

Loading

File-Level Changes

Change	Details	Files
Add a fail-closed UserPromptSubmit name guard that enforces lane identity across tmux window, live session name, and register row.	Parse hook payloads and apply project-root, subagent, tmux, register, row-position, and case-canonicalization rules. Return exit 2 for mismatches or indeterminate reads, with the observed triple and a filled-in remediation. Type /rename <lane> into the pane only when the pane command is eligible; otherwise provide a manual cure. Persist and consume person-initiated rename offers, handling yes/no answers and recording an approved move. Bind the current transcript UUID into the destination lane after an approved move and mark the source lane as moved.	lanes-edit.sh tests/test_lane_helpers.sh docs/README-lanes.md README.md AGENTS.md
Centralize detection of duplicate live processes holding the same transcript and enforce one-holder semantics across lane operations.	Sweep session records across all profiles and classify holders as here, companion, duplicate, or unrelated while validating tmux window identity by id and session name. Make the prompt guard refuse duplicate holders and name the appropriate retirement command. Make lane-start refuse duplicate binds/resumes and lane-end retire qualifying duplicates while rejecting retirement of the lane's own session. Harden hook callers against unreadable records and set -u failures without violating SessionStart's always-zero contract.	lanes-edit.sh lane-start lane-end tests/test_lane_helpers.sh docs/README-lanes.md
Install the new guard hook alongside SessionStart with pair-level atomic, idempotent settings merging.	Add the exact UserPromptSubmit command with a five-second timeout and no matcher or `
Extend SessionStart diagnostics to repair session-name drift while remaining non-blocking.	Reuse the duplicate-holder read and report competing live processes. Type the canonical /rename <lane> when possible and emit the clause (f) rename diagnostic. Contain failures so SessionStart continues to exit 0.	lanes-edit.sh tests/test_lane_helpers.sh docs/README-lanes.md
Expand coverage and update protocol-facing documentation for the new lane identity and transcript ownership rules.	Add end-to-end shell fixtures for every guard state, lock behavior, offers, fail-closed reads, duplicate holders, retirement, and SessionStart behavior. Add installer tests for hook shape, conflict handling, idempotency, boundary matching, atomicity, and permissions. Update README, lane documentation, AGENTS guidance, and hygiene/count assertions.	tests/test_lane_helpers.sh tests/test_install_skill_and_hook.py tests/test_openrepotools_command.py tests/test_repo_hygiene.py README.md docs/README-lanes.md AGENTS.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#39	Extend lane-end <lane> --retire <pid> to retire a live duplicate process whose session ID is the lane row's current session ID, while refusing to retire the lane window's own live session.	✅
#39	Make lane-start detect and refuse binding or resuming a transcript that is already held by multiple live processes, including duplicates found across profiles, rather than appending or launching another holder.	✅
#39	Have the relevant tooling identify and communicate the duplicate process and the appropriate lane-end --retire <pid> action, with tests covering one window holder, one background holder, and the same-session-ID collision.	✅

Possibly linked issues

• Name guard (lane protocol Amendment 12): lanes-edit.sh guard as a UserPromptSubmit hook, lane-start --name on every launch, --install places the hook — after #24 lands #25: The PR directly implements the issue's requested Amendment 12 tooling and tests, while also adding related duplicate-session protections.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in the guard, lifecycle commands, and hook installer.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

This PR enforces lane identity across tmux sessions and register rows, prevents duplicate transcript holders, and installs the related hooks.

Changes:

• Adds prompt guarding, rename locking, move offers, and SessionStart reporting.
• Adds duplicate-holder checks to lane lifecycle commands.
• Updates hook installation, tests, documentation, and artifact accounting.

File summaries

File	Summary
tests/test_repo_hygiene.py	Reviewed hygiene checks.
tests/test_openrepotools_command.py	Reviewed installer artifact accounting.
tests/test_lane_helpers.sh	Reviewed guard, holder, offer, and SessionStart coverage.
tests/test_install_skill_and_hook.py	Reviewed hook installation and conflict tests.
README.md	Reviewed installation documentation updates.
openRepoTools	Reviewed atomic hook installation; unresolved findings remain.
lanes-edit.sh	Reviewed guard, offers, holder detection, and binding; unresolved findings remain.
lane-start	Reviewed duplicate-holder validation; unresolved findings remain.
lane-end	Reviewed duplicate transcript retirement; unresolved findings remain.
docs/README-lanes.md	Reviewed lane protocol documentation.
AGENTS.md	Reviewed guard exit-code guidance.

Review details

Suppressed comments (5)

lanes-edit.sh:6023

• lane_start_args emits a literal <path> placeholder for lane names that do not match <repo>-<n>; that formatter is suitable for a diagnostic, not an executable argument list. Accepting an offer to an existing lane such as browser-ui-repair therefore invokes lane-start --dir <path> browser-ui-repair, fails to move, and leaves the offer retrying forever. Resolve the destination checkout directory (or ask the person for it) before invoking lane-start.

    # UNQUOTED ON PURPOSE: `lane_start_args` prints TWO words, `<repo> <n>` —
    # or `--dir <path> <lane>` for a lane named before the `<repo>-<n>` rule.
    # shellcheck disable=SC2046
    "$ga_start" --no-launch $(lane_start_args "$ga_to") >&2 || ga_rc=$?

lanes-edit.sh:5758

• The pending-offer branch runs before the Amendment 18 duplicate check. If another process starts carrying this transcript after the offer is written, the next yes/no is consumed and may rename or run lane-start instead of refusing every prompt for the duplicate; yes can also proceed into the move path. Check gr_others before consuming an offer and retain the offer while the duplicate is unresolved.

  # ---- THE PENDING OFFER, ANSWERED BEFORE ANYTHING ELSE IS JUDGED (clause
  # (h) rule 2). The answer prompt is the person's reply to a question this
  # guard asked, it is consumed here and never reaches the model, and the
  # triple still disagrees BECAUSE of the rename being answered — so this
  # cannot wait behind the table below.
  gr_off="$(guard_offer_file "$G_ID")"
  if [ -f "$gr_off" ]; then
    guard_answer "$gr_off" "$gr_prompt" "$gr_pane"
    return 2

lanes-edit.sh:5422

• A matched session record is read with cat ... || :, so a record that disappears or becomes unreadable after the grep pass is silently skipped and transcript_holders can return 8 as if no holder existed. lane-start then permits the bind/resume despite not completing the one-live-process read. Propagate this read failure as an indeterminate result instead of treating it as an absent record.

  while IFS= read -r th_f; do
    [ -n "$th_f" ] || continue
    th_blob="$(cat -- "$th_f" 2>/dev/null || :)"
    [ -n "$th_blob" ] || continue

lanes-edit.sh:5632

• under_projects_root returns the same nonzero status for a proven outside path and for an indeterminate failure to resolve the cwd or projects root. This || return 0 treats both as the D1 exemption, so a failed symlink/root or cwd read can silently let a prompt through even though Amendment 12(d) requires fail-closed behavior. Return a distinct indeterminate status and turn it into guard_refuse/exit 2; only a proven outside result should be silent.

  under_projects_root "$gr_cwd" "${PROJECTS_ROOT:-$HOME/projects}" || return 0

openRepoTools:726

• The guard conflict check has the same ordering bug: if the exact guard entry and a different guard entry coexist, index($c) returns present before the rival is examined, so installation succeeds with two prompt guards. Detect a differing guard command before treating the exact entry as idempotent.

	existing_guard="$(jq -r --arg c "$GUARD_COMMAND" '
		[ (.hooks.UserPromptSubmit // [])[]? | (.hooks // [])[]? | .command // empty ] as $cmds
		| if ($cmds | index($c)) then "present"
		  elif ($cmds | map(select(test("(^|\\s)guard(\\s|$)"))) | length) > 0 then "conflict"
		  else "absent" end' "$settings" 2>/dev/null || printf 'error')"

• Files reviewed: 11/11 changed files
• Comments generated: 7
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[brettheap]

Copilot round 1 is answered at eedb55f: four taken, eight declined, each thread replied to and resolved, and the body's new "Copilot round 1" section carries every one with its evidence in a line.

The five findings Copilot suppressed into its review body have no threads to reply in, so they are answered there too: two of them are taken (the offer's answer was consumed in front of Amendment 18(h)'s refusal; the offer would have RUN lane-start --dir <path> <lane> with a literal placeholder for a lane named before the <repo>-<n> rule), and three are declined — a record that becomes unreadable mid-pass is already fail-closed one line above it (grep -l … 2>"$th_err" and any stderr at all returns 1; what the cat … || : passes over is a file that VANISHED between two reads, which is a session that ended); under_projects_root's indeterminate answer is clause (e)'s SCOPE and not the triple, and this hook runs at every prompt of every session on the workstation, so refusing the ones we cannot prove are ours is the larger failure; and the guard-entry conflict ordering is the same finding as the SessionStart one, filed as #59.

Two assertions moved, both cited in the body and neither weakened: Amendment 8's orphan and lone-bg-companion cases now expect lane-start to exit 1, because the act it makes next is claude --resume <the row's id> and a live process already carries that file (Amendment 18(h), "never launches a second resume of it"). Everything else those cases assert is still green — the orphan is still reported, still "not a rival", still given 6(d)'s act, and the rival refusal is still absent.

bash tests/test_lane_helpers.sh: 1777 → 1815 passed, 0 failed.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in duplicate-process enforcement, retirement handling, and guard behavior.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (5)

lane-end:26

• The new usage line advertises a UUID as valid for retiring a duplicate, but the duplicate branch only matches retire_target against dr_pid (lines 688-691). Passing the row's UUID therefore falls through to the generic “neither” refusal even when a live duplicate exists. Either implement an unambiguous UUID-to-duplicate selection or document UUIDs only for forks and require a PID for duplicates.

#   lane-end <lane> --retire <pid|uuid>  # retire a live FORK or DUPLICATE; ends nothing

lane-end:684

• The (not asked) state is supposed to protect the process, but this wildcard also matches window ... (not asked). When tmux cannot be queried or the target has no usable window id, the target is therefore added to dup_own and --retire refuses it as the lane's own session instead of preserving the unknown state. Match (not asked) explicitly before the generic window case so only a resolved window is treated as the owner.

          case "$dr_where" in
            "window "*"(gone)") dr_own=0 ;;
            "window "*) dr_own=1 ;;
            *) dr_own=0 ;;
          esac

lanes-edit.sh:5278

• The literal-prefix fast path returns before resolving the root, so a missing or unreadable $PROJECTS_ROOT still classifies any matching cwd string as in scope. For example, with root /tmp/projects removed and cwd /tmp/projects/repo, the guard proceeds instead of treating the session as outside the projects root, contrary to the scope contract documented above. Resolve the root first, then apply the textual-prefix shortcut.

  case "$upr_c/" in "$upr_r"/*) return 0 ;; esac
  upr_cr="$(cd -- "$upr_c" 2>/dev/null && pwd -P)" || upr_cr=""
  upr_rr="$(cd -- "$upr_r" 2>/dev/null && pwd -P)" || upr_rr=""
  [ -n "$upr_cr" ] && [ -n "$upr_rr" ] || return 1

lanes-edit.sh:5536

• Records without a tmux field are explicitly supported by transcript_holders: a current record can be classified here from its pid, but the callers then leave gr_pane/snl_pane empty because they derive the pane only from the record target. guard_type returns 1 for that empty target, so the automatic /rename lock never runs for this valid record shape (and SessionStart cannot type it either). Fall back to the current pane id from tmux when the current record has no target.

  gt_pane="${1-}"; gt_text="${2-}"
  [ -n "$gt_pane" ] && [ -n "$gt_text" ] || return 1
  command -v tmux >/dev/null 2>&1 || return 1
  gt_cmd="$(tmux_window_field "$gt_pane" '#{pane_current_command}' 2>/dev/null || :)"
  [ -n "$gt_cmd" ] || return 8
  case "$gt_cmd" in claude|node) : ;; *) return 9 ;; esac

lanes-edit.sh:5537

• This new safety gate is not exercised by the Amendment 12 tests: every fake window uses the default claude command, so no case proves that a shell/editor (or an unreadable pane_current_command) causes guard_type to type nothing. Since this check is the only barrier against injecting /rename into an unrelated process, add focused cases for the non-accepted and indeterminate command results.

  gt_cmd="$(tmux_window_field "$gt_pane" '#{pane_current_command}' 2>/dev/null || :)"
  [ -n "$gt_cmd" ] || return 8
  case "$gt_cmd" in claude|node) : ;; *) return 9 ;; esac
  tmux send-keys -t "$gt_pane" "$gt_text" Enter 2>/dev/null || return 1

• Files reviewed: 11/11 changed files
• Comments generated: 3
• Review effort level: Lite

[brettheap]

Copilot round 2 is answered at 6cf5359: four taken, four declined, the three threads replied to and resolved. It was not a restatement of round 1 — two of its findings are in code round 1 wrote, which is the argument for reading a second round at all.

Taken. The companion test is now kind = bg and nothing else (not a session record was too wide by exactly the kinds nobody has ruled on — this suite's own interactive fork carries kind: user); lane-end --retire refuses the harness's own companion of the live session instead of reporting it as that session's duplicate; the lock types into the pane tmux names when the live record names none (the harness has been seen to write no tmux field for a process plainly in a window, and the lock was printing "tmux would not take the keys" for a name it could have fixed); and M1's gate — "only while the pane's current command is claude" — has cases for both of its halves, a pane running bash and a pane whose command could not be read, which is the only barrier between this hook and somebody else's process.

Declined, with the evidence.

• lane-end's usage advertises a uuid for a duplicate (suppressed, lane-end:26) — taken as documentation rather than code: a duplicate's uuid IS the row's own and could not pick between the processes carrying it, so the usage line, the option block and the manual now say a FORK is named by pid or uuid and a DUPLICATE by pid.
• (not asked) falls into the generic window arm (suppressed, lane-end:684) — that arm is the documented intent, and the behaviour asked for is the behaviour there: (not asked) sets dr_own=1, which is what refusing to retire an unknown means (Amendment 18(b): a window that could not be asked about is UNKNOWN and not dead, and only a (gone) this server actually refuted makes a record retirable). The nit is the refusal's wording — it says "IS lane X's own live session" where it means "could not be told apart from it" — and that is a message, reachable only with no tmux at all, where this act is being typed from a bare shell.
• The literal-prefix fast path in under_projects_root (suppressed, lanes-edit.sh:5278) — for the prefix to match while $PROJECTS_ROOT is missing, a LIVE session's own cwd would have to exist under a parent that does not, which cannot happen; and the resolution beneath it exists for the launcher's symlinked projects root, where erring toward "inside" is the deliberate direction (the other direction is the guard never firing at all).
• A per-workstation lock spanning the resume (lane-start:1807) — answered on its thread: 18(h) asks for a count, every read here is a snapshot, and a lock that has to be released at the exec it protects protects nothing.

bash tests/test_lane_helpers.sh: 1815 → 1833 passed, 0 failed. CI at eedb55f: tests (the whole pytest suite) passed in 12m15s, tests-no-submodule, tests-windows and SonarCloud passed.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain, including a duplicate-holder safety gap.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (5)

lanes-edit.sh:6038

• When the yes path creates a brand-new destination row, lane-start --no-launch can leave its session cell as pending — set by the session's first act: the current UUID belongs to the source row, so the bind veto prevents harness_sid, and a failed UUID mint leaves new_sid empty. This code recognizes only none recorded, so it cannot append the current UUID; the offer has already been removed and the source marked MOVED, leaving every subsequent prompt in the destination lane refused. Treat the exact pending marker as a valid anchor before consuming the offer.

  if [ -z "$gbu_anchor" ]; then
    gbu_cell="$(row_cell "$(row_of_lane "$gbu_to" 2>/dev/null || :)" 3 | sed -e 's/^ *//' -e 's/ *$//')"
    case "$gbu_cell" in
      "none recorded") gbu_anchor="none recorded" ;;
    esac

lanes-edit.sh:5475

• here is set either by a matching tmux window or by pid_under, so it can be yes even when th_tgt is a stale target for another window. The guard and SessionStart callers then extract the pane from that target and guard_type only checks that the target currently runs claude/node; a reused target can receive /rename instead of the asking session's pane. When ancestry is what proves here, resolve the current pane from the hook context (or validate that the recorded pane belongs to the current window) before typing.

    th_here=no
    if [ -n "$th_tgt" ] && [ -n "$LANES_THIS_WINDOW" ] && [ "${th_tgt%.*}" = "$LANES_THIS_WINDOW" ]; then
      th_here=yes
    elif pid_under "$th_pid" "$LANES_PANE_PID"; then
      th_here=yes

lanes-edit.sh:5433

• This new all-profile sweep delegates to session_files, whose roots are hard-coded to $HOME/.claude-profiles/profiles and $HOME/.claude/sessions; it does not honor the documented CLAUDE_PROFILES_HOME or an arbitrary CLAUDE_CONFIG_DIR. On a workstation using a custom profiles root, transcript_holders can return no records, causing the guard to refuse the real session and missing cross-profile duplicates. Make the sweep include the configured profile root and current config directory.

  if ! session_files > "$th_files"; then
    rm -f -- "$th_files" "$th_match" "$th_err"
    return 1
  fi

lanes-edit.sh:6106

• When the destination lane already has a recorded transcript, this invokes the normal lane-start --no-launch resume path. That path still appends a RESUMED by <destination-id> status even though no resume was launched, and guard_bind_uuid then appends the source session id to the cell. The destination log therefore claims a different transcript was resumed while the row ends on the moved session, leaving the move history inconsistent. Use a move/bind path that records the current $G_ID (or suppresses the normal resume stamp) instead of reusing the ordinary resume bookkeeping.

    "$ga_start" --no-launch $(lane_start_args "$ga_to") >&2 || ga_rc=$?
    if [ "$ga_rc" != 0 ]; then
      guard_refuse "\`lane-start --no-launch $(lane_start_args "$ga_to")\` exited $ga_rc (its own words are above), so this window has NOT moved and $ga_from has NOT been marked MOVED. The offer is KEPT, so answer \`yes\` again once that refusal is settled, or \`no\` to stay $ga_from."
      return 2
    fi
    rm -f -- "$ga_f"
    guard_triple
    note "MOVED: this window is now lane $ga_to — renamed, and stamped. The prompt that answered the question is consumed; send your work again."

openRepoTools:760

• The pair merge is new, but the planning failures above it (missing jq, invalid JSON, or a non-object hooks) still say they will merge one SessionStart entry and print only hook_block_text. When installation fails, the new UserPromptSubmit guard is therefore omitted from the diagnosis even though the all-or-nothing plan now covers both entries. Update all of those refusal messages to describe both entries and include the guard block.

	# BOTH MERGES ARE COMPUTED BEFORE EITHER IS PLACED, into one staged file, so
	# the all-or-nothing rule covers the PAIR: a settings file that took the
	# SessionStart entry and refused the guard is a half-install of a hook pair,
	# and nothing on screen would say which half.

• Files reviewed: 11/11 changed files
• Comments generated: 1
• Review effort level: Lite

[brettheap]

Copilot round 3 is answered at e2b6694, which also carries three merges of main — b5244e2 (#44's installer round and #46's pin), 66b4fb9 (#53) and a954435 (#50) — and the fix for the macOS job's three red lines at 6cf5359, which were this branch's own.

The macOS failure, and it was the fixture and not the behaviour. Round 2's case for the lock's pane fallback made the live record's pid a CHILD of the fake pane's, and pid_under climbs /proc to answer that — which macOS does not have. The record was "here" on Linux and nowhere on the macOS runner, so the guard refused with "no live session record in THIS window carries this session id" and the lock never ran. The fixture now gives the pane the record's OWN pid, which pid_under answers at its first step with no walk at all, and the case says so in its own comment. Every other job was green at that commit.

Taken from round 3 (three, all suppressed into the review body):

1. pending — set by the session's first act is the other text a session cell can carry (lanes-edit.sh:6038), and it is exactly the one a yes to a fresh lane can leave — veto 1 refuses this window's uuid because the row being LEFT still records it. The guard's own last write anchored only on none recorded, so on such a row it could not be made at all and the next prompt refused for ever on a state the guard created by obeying the person. That is the loop this branch fixed one commit earlier, reached through the one cell text the fix did not list. Both texts are anchors now, and a case drives it end to end.
2. The lock typed into whatever pane the record named (lanes-edit.sh:5475). here is true by the record's target OR by the pane's own process tree, and tmux reuses window ids — so a record here BY ANCESTRY could carry othersess:@5.%5 and /rename would land in somebody else's pane, which M1's gate cannot catch because that pane is running claude too. The pane is now taken from the record only where its target names THIS window; otherwise guard_type asks tmux for the pane this hook runs in. ssb_name_line takes the same fence.
3. --install's three planning refusals described a plan that no longer exists (openRepoTools:760) — no jq, invalid JSON, a non-object hooks — each said it would merge ONE SessionStart entry and printed one block. All three name both entries and print both blocks.

Declined (the inline one and two suppressed):

• The companion should also require no tmux and no nameSource (lanes-edit.sh:5495) — answered on the thread: it adds no detection (the duplicate this rule exists to catch is a bg record with neither field, measured four times on 2026-09-14) and it adds a way for a HARNESS RELEASE to block every prompt on a workstation, which this file's own window_session comment anticipates by name. kind is the field ruling (g) makes the discriminator.
• session_files's roots are hard-coded (lanes-edit.sh:5433) — that read predates this PR and is shared by live_holder, forks, window-session and who; changing which directories the estate's liveness reads sweep is a change to all of them and not to this one.
• The destination log says RESUMED by <another id> after a move (lanes-edit.sh:6106) — real, and filed as The offer's yes leaves the destination lane's log saying a transcript was RESUMED that nobody is in, because lane-start has no binding mode and the guard makes the cell write itself #70 rather than taken here: the fix is a BINDING mode for lane-start (the act clause (h) rule 2 actually asks for), not a change to the guard. The cell — which every later read follows — does end on the moved transcript, and the guard prints what it wrote.

bash tests/test_lane_helpers.sh on the merged tree: 1870 passed, 0 failed.

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings remain in the guard and session-start logic.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

lanes-edit.sh:5510

• record_window_state uses status 1 for both a positively rejected window and a tmux read that returned no answer, but this branch labels every status-1 result as (gone). With a silent/unavailable tmux server, lane-end --retire can consequently treat the lane's own session as non-owning and print a retire/rename act instead of refusing an indeterminate read. Preserve a distinct indeterminate result and only use (gone) after the window was actually refuted.

      case "$th_wrc" in
        0) th_where="window ${th_tgt%.*}" ;;
        1) th_where="window ${th_tgt%.*} (gone)" ;;
        *) th_where="window ${th_tgt%.*} (not asked)" ;;
      esac

lanes-edit.sh:6275

• This SessionStart path runs before the next-prompt guard and unconditionally types /rename $snl_lane for every name mismatch, including a newer nameSource:user rename. If a person renames a session to another lane and then resumes or clears it, this silently erases the choice before guard_run can create the promised move offer. Leave newer user renames for the prompt guard to offer, and auto-lock only derived/older drift.

  guard_type "$snl_pane" "/rename $snl_lane" || snl_trc=$?
  if [ "$snl_trc" = 0 ]; then
    printf "session name '%s' was not the lane '%s' — renamed\n" "$snl_name" "$snl_lane"
  else
    printf "session name '%s' is not the lane '%s' — run: /rename %s\n" "$snl_name" "$snl_lane" "$snl_lane"

tests/test_install_skill_and_hook.py:56

• The module docstring at lines 2–19 still describes a single merged SessionStart entry and a single hook, while this new block adds and tests a second UserPromptSubmit entry. Please update that module-level description so maintainers are not told that the installer/test contract contains only one hook entry.

#: AMENDMENT 12's SECOND ENTRY, adoption act 3: the NAME GUARD under
#: `UserPromptSubmit`, `~/projects/xFactory/lanes-edit.sh guard`, timeout 5.

• Files reviewed: 11/11 changed files
• Comments generated: 2
• Review effort level: Lite

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[brettheap]

Copilot round 4 is answered at 9059f38 — three taken, two declined, both threads replied to and resolved. This is the last round this lane takes: the reviews are not converging (12 findings in round 1, 8 in round 2, 6 in round 3, 5 here), and what is left is either declined on the evidence or filed.

Taken

1. node is not claude, and M1 named one command — "only while the pane's current command is claude". Measured tonight on Eagle across the twelve panes tmux had: eleven lane panes report claude, two report bash (a session under a launcher wrapper), one zsh, and none reports node. The second word bought nothing on the estate it was written for, and would have let a Node REPL in a pane take /rename <lane> as input. A pane the gate refuses still gets the line printed for the person — on this estate the bash panes are exactly where it will be read.
2. The SessionStart hook was undoing the person's own instruction before anybody was asked. Clause (f) types the rename for (h)1's case — DRIFT, a name that is no lane's — while (h) rule 2 makes a nameSource: user rename to another lane's name an INSTRUCTION answered at the next prompt. This hook runs on every startup, resume, clear and fork, so a rename followed by a /clear had the name typed back before guard_run could put the question. It is said there now and left to the prompt that follows.
3. tests/test_install_skill_and_hook.py's module docstring still told its next reader that --install merges one SessionStart entry, seven tests into the pair's own section.

Declined

• Classify the bg companion before the here branch (lanes-edit.sh:5535) — answered on the thread: here and companion are the same answer to every caller (both are passed over in silence), so the order changes no outcome; what it WOULD change is turning this window's own companion into a duplicate wherever the same-profile test does not hold, which is the false refusal round 2's narrowing exists to avoid. The duplicate this rule catches is never here.
• record_window_state should tell a silent tmux from a refuted window (suppressed, lanes-edit.sh:5510) — (gone) and (not asked) already differ and lane-end protects the second; separating a dead SERVER from a dead WINDOW needs a second question put to tmux, which is a read this file makes nowhere yet and a change to who's liveness reading as much as to this one. Worth doing, not worth doing inside a review round.

bash tests/test_lane_helpers.sh on the merged tree: 1875 passed, 0 failed. CI at e2b6694 (the commit under this one): every check green, tests-macos included (22m13s), which is the run that proves the fixture fix for the three red lines this branch had there.

[Copilot]

🟡 Changes recommended

Six unresolved findings remain, including four critical fail-closed and retirement issues and two moderate command and rename issues.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (2)

lanes-edit.sh:6166

• If tmux rename-window fails, this only logs a note and still invokes lane-start. When the old window name is unregistered (for example, claude), lane-start's window veto does not reject it, so the destination row can be stamped and the source marked MOVED while the actual window keeps its old name; the next prompt remains mismatched. Abort the yes path and keep the offer pending until the rename succeeds.

    if command -v tmux >/dev/null 2>&1; then
      tmux rename-window "$ga_to" 2>/dev/null ||
        note "the window could not be renamed to $ga_to, so lane-start may refuse to take this session as that lane's (its step 3b veto 2)."
    fi

lanes-edit.sh:5917

• When the session is named for an existing legacy lane such as legacy-ui, lane_start_args returns --dir <path> legacy-ui. This branch emits that placeholder after run: as the only cure, so the blocking refusal gives the person a command that cannot be run. Reuse the guard_args_filled/legacy-lane handling used by the offer and explain that the checkout path must be supplied instead of presenting the placeholder as a completed command.

      guard_refuse "this window is named '$G_WINNAME', which is no lane, while the SESSION is named for lane $G_SES_LANE — so nothing binds this conversation to a row, no surface would refuse a second window taking the same lane, and the handoff this session writes is one only this profile can find. THAT IS THE 2026-09-10 CASE, which ran for three days." "lane-start --no-launch $(lane_start_args "$G_SES_LANE")"

• Files reviewed: 11/11 changed files
• Comments generated: 4
• Review effort level: Lite