loop-daemon: driver units need a repo slug — multi-repo user cross-adopts drivers #227

Observed (live, BusyBee, 2026-08-06)

Two loops now run under ONE Unix user (recode-agent): reCode and reDeploy
(consolidated topology). On its very first start, reDeploy's daemon logged:

loop-daemon: startup re-attach: found active driver unit 'pr-loop-driver-cifix-pr226'
from a previous daemon (ci-fix pr=226) — waiting instead of spawning a new one

pr-loop-driver-cifix-pr226 belongs to the reCode loop (reCode has open PR #226;
reDeploy has no PR 226 at all). Driver unit names carry only the verdict shape and
number — no repo identity — and list_active_driver_units globs pr-loop-driver-*
across the whole user manager, so any daemon adopts any other repo's drivers.

Consequences

1. reattach_orphaned_drivers blocks the adopting daemon's first tick for up to the
   foreign driver's lifetime (90m default).
2. On the foreign driver's exit it appends a ledger line for the OTHER repo's PR/issue
   (append_ledger ... reattached=true) into its own loop-ticks.jsonl — polluting
   attempt accounting if a same-numbered PR/issue ever exists locally.
3. loop-halt.sh --drivers / --all stops ALL pr-loop-driver-* units: halting one
   repo's loop kills the other repo's in-flight drivers.
4. Symmetric: every daemon restart while the sibling loop has a driver active
   re-triggers 1–2.

Proposed fix

Include the repo slug (same slug arm-loop.sh already uses for the daemon unit,
repo dir name lowercased) in driver unit names — e.g.
pr-loop-driver-<slug>-cifix-pr<N> — and scope both the daemon's re-attach glob and
loop-halt.sh's matching to pr-loop-driver-<slug>-*. Migration: on startup, treat
old-style unslugged units as matching only when exactly one registered repo exists,
else leave them alone with a log line. Update loop-daemon.test.sh and
loop-halt.test.sh shapes accordingly (the verdict<->unit-name mapping comments in
loop-daemon.sh enumerate every collision pair — the slug must slot in without
breaking those non-collision arguments).

Found during the first consolidated-user arming; single-user-per-repo installs never
hit this because the user manager was the implicit namespace.