Fixes #5
Fixes #8
Fixes #11

Three small correctness fixes, batched because each is a focused few-line change.

up --force: ownership check + graceful kill (#5)

The port sweep kill -9'd whatever lsof found listening on the session's recorded ports. A stale recorded port (rebooted machine, auto-bump elsewhere, unrelated app) meant killing an innocent process — while the project ships whose-pid specifically to stop agents doing the same thing.

• each PID found by lsof is resolved via whose_pid::resolve scoped to this session; unowned listeners produce a warning ("kill it manually if intended") and are skipped
• owned processes get SIGTERM with a 2s grace, then SIGKILL — no more immediate -9
• the port sweep moved before the pid-file kill, so the pid files (the ownership evidence) still exist when ownership is checked

Behavior change to be aware of: --force no longer kills a manually-started, untracked process squatting the session's port — it warns instead. That is the point of #5, and the warning says exactly what to do.

ecluse sync: real worktree check instead of substring match (#8)

The cwd fallback accepted any directory whose path string contained the slug (/home/me/rapid-prototype matches slug api), plus any cwd under the repo root — including the main checkout, which sync would happily register as a session worktree. The fallback now requires the cwd to be inside a linked git worktree of this repo (is_inside_git_worktree + main_worktree_root == root, canonicalized) and uses that worktree's actual root.

Robustness batch (#11)

• acquire_shared returned an empty state when state.lock was missing even though state.json existed with live sessions (ls said "no active sessions" while everything ran), and had an .expect panic path. It now creates the dir + lock file the same way acquire does and reads the real state.
• ls no longer panics on a short/hand-edited started_at ([..16] byte-slice → .get(..16) fallback).
• .env.ecluse had four divergent parsers (shell skipped comments, env/up --json didn't — comment lines leaked into JSON as keys, process.rs had a fourth variant). One shared env::parse_env_file now backs all of them.

Tests

• acquire_shared_reads_state_when_lock_file_missing (fails on the old empty-state behavior)
• parse_env_file_*: comments/blanks skipped, first-= split, missing-file empty, file order preserved
• integration sync_rejects_repo_root_as_worktree

cargo fmt --check, cargo clippy -- -D warnings, cargo test (374 + 19) green.

https://claude.ai/code/session_017UcuvzMKHVfyBCcq8ipAko

Generated by Claude Code