Open work only; entries are removed by the change that resolves them.
- Orphan re-adoption without the bounce: after a daemon crash, re-adopt live orphan servers (pid + start-time match, resume spool tailing) instead of group-kill + restart. Blocked on: exit codes are unknowable for non-children; needs a design for degraded forensics.
- Reverse proxy on :80/:443 routing by host signature, making ports disappear from
*.localhostURLs (Valet/Herd territory). Ephemeralworktree-*.<preferred>.localhosthosts are the unprivileged addressing half; the proxy would drop ports from URLs entirely. - MenuBarExtraAccess (orchetect) if
.windowpresentation quirks bite in practice. - Populate Apple Developer ID + App Store Connect API secrets for
.github/workflows/release-dmg.yml(and a Homebrew tap) so the Release→DMG dispatch can notarize on Actions; until then, mint locally (SIGN_IDENTITY=… make dmg+scripts/notarize.sh+gh release upload).v1.3.0already has a stapled DMG from the local path. - App Intents / Shortcuts wrappers over the existing
DeepLinkverbs (open,ensure,stop,why) for Siri / Gemini-Siri and Control Center. Thedevctl://URL table andDeepLinkRunnerare the shared surface; intents should call the runner, not reimplement dispatch. Also the next plausible path for Spotlight ranking (IndexedEntity) once Core Spotlight levers are exhausted. - swift-subprocess 0.5 occasionally fatals in its kqueue AsyncIO cleanup at process exit ("Failed to close kqueue fds: Bad file descriptor"), seen once under parallel test load; harmless to the long-lived daemon but track against upstream releases (pinned revision in Package.swift).
- Lock-release false
crashed(2026-07-25 pnpm monorepo, healthy then exit 0 in ~230ms): unreproducible on fixture rapid acquire/release (N=20), grandchild fixture, and live pirllock d1cycles (2026-07-28). Resume now settles until the PortClaim is free or refuses to spawn dirty. Reopen with a failing repro that names exiting pid vs resumed pid before changing the exit classifier. - Spotlight thumbnails: confirm config icons render in the real Spotlight UI. Within-app ranking levers are maxed (lastUsed preserved across sync, incremental index updates, live/pinned rankingHint, alternateNames). Outranking filesystem / Cursor Top Hits remains an Apple ceiling; do not chase without a new system API.
- Machine-wide resource lock opt-in: locks are already path-scoped (
canonicalPath::resource) and pause only that path's declarers. A rare shared system resource (one Docker Postgres, a fixed system daemon) may still want an explicit machine-wide scope so two projects serialize. Not the Cloudflare worktree pause case (that was misread against path-scoped keys); defer until a concrete cross-project shared-resource incident. healthcheck.type: "http"with nourlsilently degrades to a TCP probe on the declared port, or to.none(EffectiveHealthcheck.resolve), with no config-check warning. A typo in theurlkey yields a green server that was never HTTP-probed. The validator should warn (or error) ontype: httpwith no resolvable url.shell: truejoins argv with spaces (ServerSupervisor.effectiveArgv), so any argv word containing a space or glob is re-split by zsh. The two spawn modes are not equivalent; a shell-quoting pass (or documenting the limit) would close the gap.IntegrationTestsis a singleplaceholder()whiledocs/design.mdpromises a real end-to-end suite there (port-conflict from a second project, concurrent double-ensure). Those now live inscripts/smoke.shand unit suites; either build the integration target out or retire the promise in the design doc.- The
<slug>algorithm exists twice, byte-identical: inline inPaths.serverLogDirandProjectConfigLoader.defaultSlug. Consolidate to one home. CLAUDE.md's codebase map listsSwitch,Lock,Linkas files underSources/devctlandPortGuardunderHealth/; the first three are structs inside the ~1500-lineCLI.swiftandPortGuardsits inHealthProber.swift. Either fix the map or split those command structs into their own files (which also bringsCLI.swiftback under the size where splitting is worth asking about).