Fleet dispatch hardening: retire raw-nohup hunts (timeout, heartbeat, durable logs, sweep-adoptable records)

[aarontrowbridge]

Closes #426

What

The registry could model crashed/orphaned hunts — nothing created records for them, so dispatch stayed fire-and-forget and status stayed ps-grep. This lands the wrapper path, end to end:

• amico fleet launch --session <id> --pid <n> (packages/amico-run/src/fleet_verb.ts) — record creation for a self-held holder. A wrapper is its own harness: the record is born running, pid/host stamped (that pair is what makes a dead holder sweep-detectable), no spooling, no handoff, and deliberately no liveness probe — an orphan at birth is sweep's call, not the verb's. CREATES ONCE: an existing record is refused byte-identical, so creation can never race a second writer.
• amico fleet finish --session <id> --outcome settled|crashed --pid <n> [--step <s>] — the holder's terminal write, pid-identity-guarded (only the pid the record names may write it), through the same pure machine (settle/crash apply only to running). pid 0 is refused at both verbs — an unsweepable record is the bug, not a default. Runtime frozen at the holder's last tick; pid zeroed by the write.
• ops/hunt.sh — the wrapper: timeout -k bounded (TERM-then-KILL babysitter where GNU timeout is absent, the fleet-status.sh pattern), heartbeat file under the hunt dir (mtime is liveness), durable logs under ~/.amico/ops/hunts/<id>/, one fleet record per run (launch → settled/crashed), re-runs uniquify the id, --bg detaches without losing the lifecycle. Killed -9 / host reboot → dead-pid running record → amico fleet sweep on that host adopts it: the registry's designed orphan path.
• ops/install.sh deploys hunt.sh; ops/README.md documents the one usage block (retired nohup line beside its replacement, status via fleet list, erlich copy via ssh + scp).

Record-creation path choice: a CLI verb owned by the registry code (not bash-written TOML) — schema-drift armor; the extension has no existing creation path to reuse (its fleet files are topology config), so launch/finish are that path.

Acceptance criteria

• hunt wrapper: timeout -k bounded, heartbeat file, logs under ~/.amico/ops/hunts/<id>/
• hunts create fleet records at launch; fleet sweep adopts orphans (pid-liveness guarded)
• status table reads records, not ps-grep (amico fleet list)
• qec-autoresearch skill's dispatch-section rewrite — out of scope here by design (staged server-side, not in this repo; tracked by the director)

Tests

• fleet_verb.test.ts +11: create-once, holder guard (pid mismatch/unknown), machine authority on non-running records, pid-0 refusal, dead-pid launch → sweep adoption end to end, no signals from finish.
• hunt_wrapper.test.ts (new, 7): E2E of the wrapper through a stubbed CLI — lifecycle ordering + same holder pid on both writes, bounded overrun → crashed, durable log/heartbeat artifacts, id uniquify, --bg detach, abort-before-run when launch refuses.
• Full package suite green (1075 passed; the one agent_spawn failure is pre-existing on pristine main — dev-machine environment bleed, verified on a baseline worktree of HEAD).

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d71c957a-bb4e-40a4-8264-9f11a08921cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}