fix(state): pending sessions — stop holding the exclusive lock through provisioning

[hefgi]

Fixes #1

Problem

cmd_up acquired the exclusive state lock and held it through the entire bring_up — docker pulls, compose up, worktree creation, and user-defined hooks (no timeout) — and lock acquisition times out after 10s. Consequences for the core use case (N agents in parallel):

• two simultaneous ecluse ups serialized; the second failed with LockTimeout whenever the first took >10s (first-time image pull, migration hook)
• ls / env / status / shell (shared lock) failed while any up was in flight
• down/shutdown showed interactive prompts while holding the exclusive lock — an unanswered prompt blocked every ecluse command in the repo

Design

Sessions get a status: active | pending field (#[serde(default)] + skipped when active, so existing state.json files round-trip byte-identical).

up (new session): short exclusive section → allocate slot → commit a pending session (reserves slug + slot against concurrent ups) → release lock → provision → re-acquire → swap in the real session, or drop the reservation on failure (bring_up already rolled its resources back, see #2/#19).

up (resume): same pattern — mark pending, release, health-check + start services, re-acquire, replace or restore.

down: resolve target from a shared-lock snapshot, mark pending in a short exclusive section, prompt and tear down without the lock, then remove (or restore as active if teardown failed).

shutdown: per-session prompts and teardown all run outside the lock, with re-verification under the lock before each marking.

Pending sessions:

• still reserve their slot (used_slots unchanged)
• show as slug (pending) in ls (and "status": "pending" in --json)
• up/env/status/shell against them error actionably ("operation in progress… run ecluse down <slug> if it crashed")
• down works on them — that's the recovery path for an up that crashed between reserve and finalize

Tests

• state: status serde round-trip, old-state-file default to active, active-not-serialized (byte compat), pending-reserves-slot
• integration (real binary, slow post_up = "sleep 3" hook):
  • ls_works_while_up_is_provisioning — ls returns promptly with the (pending) marker while up sleeps; this timed out after 10s before the fix
  • up_on_pending_session_errors_actionably — concurrent up on the same slug can't race the reservation
  • failed_up_removes_pending_reservation — failed provisioning frees the slot and leaves ls empty

cargo fmt --check, cargo clippy -- -D warnings, cargo test (373 + 21) green.

Note: this updates the AGENTS.md-stated invariant "the lock is held for the entire duration of up and down" in spirit — the docs file itself is fixed in the docs-drift PR for #15. cmd_sync still does its (fast, discovery-only) work under the lock; unchanged here.

https://claude.ai/code/session_017UcuvzMKHVfyBCcq8ipAko

---

Generated by Claude Code