fix(delegate): admission covers a rowless target and the installed parent of an incidental .mam (Issue #72, review round 2)

R1: a target with no registry row skipped the target gate. Its cwd is now
read from the live agent on the server delivery uses (resolve_herdr_session),
through the real herdr only when that server is running, so no server is
started; a herdr that cannot answer refuses before registration.

R2: any .mam counted as a workspace and stopped the walk, so B/sub/.mam hid
an installed B and the row's control_plane root was dropped. Workspaces are
now update.sh's installed trees (.mam_deploy/remove.sh or remove.sh): every
installed ancestor of the cwd, plus the recorded control_plane root.

lib_py.update target-workspaces prints them one per line; the wrapper holds
each on fds 20.. until the record is written.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.agents/skills/multi-agent-mux-delegate-job/multi-agent-mux-delegate-job

@@ -302,17 +302,24 @@ cmd_submit() {
   if [[ "$DRY_RUN" == "1" ]]; then reg_dry=(--dry-run); fi
 
   # Issue #72: no job is registered while an update of this registry's
-  # workspace or of the target's (its row's workspace, lib_py.update
-  # target-workspace) runs; held until the record is written (lib.sh
+  # workspace or of one the target is in (lib_py.update target-workspaces:
+  # its row's, or with no row the live agent's on the server delivery uses)
+  # runs; each is held, fd 7 then 20.., until the record is written (lib.sh
   # mam_update_admit). A dry-run record is never dispatched and is not
   # counted by the update.
+  local admit_fds=() target_ws tws fd=20
   if [[ "$DRY_RUN" != "1" ]]; then
-    local target_ws
     target_ws="$(MAM_STATE_JSON="$(load_state_json)" PYTHONPATH="$SKILL_DIR:${PYTHONPATH:-}" "$PY" -m lib_py.update \
-      target-workspace --workspace "$WORKSPACE_ROOT" --agent-session "$AGENT_SESSION")" \
-      || { echo "ERROR: cannot resolve the workspace of $AGENT_SESSION" >&2; exit 1; }
+      target-workspaces --workspace "$WORKSPACE_ROOT" --agent-session "$AGENT_SESSION" \
+      --server "$(_is_remote "$AGENT_SESSION" || resolve_herdr_session "${AGENT_SESSION#herdr:}" "$WORKDIR" 2>/dev/null)" \
+      --herdr "$(_resolve_real_herdr_path || true)")" \
+      || { echo "ERROR: cannot resolve the workspace of $AGENT_SESSION; nothing was registered" >&2; exit 1; }
     mam_update_admit "$WORKSPACE_ROOT" || exit 1
-    if [[ -n "$target_ws" ]]; then mam_update_admit "$target_ws" 8 || exit 1; fi
+    while IFS= read -r tws; do
+      [[ -n "$tws" ]] || continue
+      mam_update_admit "$tws" "$fd" || exit 1
+      admit_fds+=("$fd"); fd=$((fd + 1))
+    done <<< "$target_ws"
   fi
   # 1) register job (prints the new job id)
   JOB_ID="$("$PY" "$SCRIPT_DIR/scripts/registry.py" --registry-dir "$REGISTRY_DIR" register \
@@ -323,7 +330,10 @@ cmd_submit() {
       --job-type "$TYPE" --reviewer "$REVIEWER" --reviewer-session "$REVIEWER_SESSION" \
       --max-iterations "$MAX_ITERATIONS" ${reg_parent[@]+"${reg_parent[@]}"} ${reg_dry[@]+"${reg_dry[@]}"})"
   echo "registered job: $JOB_ID"
-  [[ "$DRY_RUN" == "1" ]] || { mam_update_admit_release; mam_update_admit_release 8; }
+  if [[ "$DRY_RUN" != "1" ]]; then
+    mam_update_admit_release
+    for fd in ${admit_fds[@]+"${admit_fds[@]}"}; do mam_update_admit_release "$fd"; done
+  fi
 
   # 1-1) Provision job directory and write direct brief.md (MAM Job Restructuring)
   local job_dir="$REGISTRY_DIR/$JOB_ID"