space-architect 5.5.1 → 7.0.0

data/lib/space_architect/architect_project.rb

@@ -7,6 +7,8 @@ require "fileutils"
 require "pathname"
 require "tempfile"
 require "time"
+require "digest"
+require "shellwords"
 
 module Space::Architect
   # Manages an architect-loop project inside a space: one self-contained file per
@@ -42,12 +44,22 @@ module Space::Architect
     # Hard per-gate timeout. Generous relative to the full suite (~55s).
     DEFAULT_GATE_TIMEOUT = 900
 
-    # Flags for matching a changed path against a lane's touch_set globs.
-    # PATHNAME keeps a single `*` from crossing `/`; EXTGLOB enables `{a,b}`;
-    # DOTMATCH lets a glob reach dotfile segments, so a `dir/**` touch set covers
-    # `dir/.github/workflows/ci.yml` — the standard deliverable for a lane preparing
-    # a directory to become a repo root.
-    TOUCH_FNM = File::FNM_PATHNAME | File::FNM_EXTGLOB | File::FNM_DOTMATCH
+    # The scaffold's untouched placeholder AC1 line — templates/iteration.md.erb's
+    # Acceptance Criteria section (named, not line-numbered: a pinned line number
+    # here has already drifted twice). Pinned by contract with the authoring
+    # lane, which is forbidden from changing it, precisely so freeze!'s #73
+    # hard-refuse (below) can key on it.
+    AC1_PLACEHOLDER = "**AC1.** ..."
+
+    # Rehearsal's BROKEN heuristic (I09/AC5): a command-not-found exit code or a
+    # shell parse failure, distinct from a clean non-zero (RED — the gate
+    # discriminates). Advisory, not authoritative — see #classify_rehearsal.
+    BROKEN_STDERR_PATTERN = /\bsyntax error\b|unexpected end of file|unexpected eof/i
+
+    # I09/AC9(b): a gate `cmd` that carries a literal 'repos/<name>/' prefix
+    # with no `cwd` — legal, occasionally correct, but usually a leftover
+    # space-root-relative path since `cmd` already resolves against the repo tree.
+    BARE_REPO_PREFIX = %r{(?<![\w./-])repos/[^/\s'"]+/}
 
     # Legacy sentinel: worktree_add used to seed prompt.md with this placeholder
     # (dropped — the blind-overwrite tripped harness read-before-write guards, #48).
@@ -153,6 +165,7 @@ module Space::Architect
       block = space.data["project"] || {}
       architecture_dir = space.path.join("architecture")
       iteration_files = if architecture_dir.exist?
+        # paths:exempt - the /\AI\d+-.+\.md\z/ filter structurally cannot match a dotfile-prefixed name, so raw enumeration is already dotfile-safe here
         architecture_dir.children
           .select { |f| f.basename.to_s.match?(/\AI\d+-.+\.md\z/) }
           .map { |f| f.basename.to_s }.sort
@@ -166,7 +179,7 @@ module Space::Architect
     # any pending changes to the iteration file and records HEAD as freeze_sha. If
     # already frozen, refuses when the frozen region has changed since.
     # With force: true, re-freezes a changed frozen region if no lane is dispatched yet.
-    def freeze!(iteration, warnings: nil, message: nil, force: false)
+    def freeze!(iteration, warnings: nil, message: nil, force: false, skip_rehearse_reason: nil)
       entry = slice_entry(iteration)
       rel = entry["file"]
       path = space.path.join(rel)
@@ -179,6 +192,19 @@ module Space::Architect
       lint_gates!(text, warnings: warnings)
       lint_lanes!(text)
 
+      if untouched_ac_placeholder?(text)
+        raise Space::Core::Error,
+          "#{rel}'s Acceptance Criteria still carries the scaffold placeholder '#{AC1_PLACEHOLDER}' with no " \
+          "active gate — write the real Acceptance Criteria (a hand-authored prose-only AC without the " \
+          "placeholder still freezes) before freezing."
+      end
+
+      if skip_rehearse_reason
+        raise Space::Core::Error, "--skip-rehearse requires a non-empty REASON" if skip_rehearse_reason.to_s.strip.empty?
+      else
+        ensure_rehearsed!(iteration, entry, text)
+      end
+
       if entry["freeze_sha"]
         sha = entry["freeze_sha"]
         if frozen_region_changed?(sha, rel)
@@ -211,9 +237,17 @@ module Space::Architect
           next unless s["name"] == iteration
           s["freeze_sha"] = sha
           s["verdict"] ||= "pending"
+          s["rehearsal_skip_reason"] = skip_rehearse_reason.strip if skip_rehearse_reason
           lanes = s["lanes"] || []
           declared.each do |d|
             fields = { "name" => d["name"], "repo" => d["repo"], "touch_set" => Array(d["touch"]) }
+            # #89/AC3-AC4: the frozen lane's own tool grant, reviewable like every other
+            # boundary. Declared-only, like touch_set — worktree_add never touches these
+            # keys, so a re-materialize preserves them without threading them through
+            # recorded_lane_fields (unlike harness/model, which worktree_add resolves and
+            # overwrites on every call).
+            fields["allowed_tools"]        = d["allowed_tools"]        if d["allowed_tools"]
+            fields["append_allowed_tools"] = d["append_allowed_tools"] if d["append_allowed_tools"]
             existing = lanes.find { |l| l["name"] == d["name"] }
             existing ? existing.merge!(fields) : lanes << fields
           end
@@ -321,6 +355,9 @@ module Space::Architect
 
     # Transcribe a lane's scratch report (build/<id>[-<lane>]/report.md) VERBATIM into
     # the Builder Report section and commit. Byte-for-byte: no summarization, no judgment.
+    # Re-transcribing a lane replaces its existing "### <lane>" subsection in place
+    # (preserving the order lanes were already transcribed in) instead of appending a
+    # duplicate; a lane not yet present still appends.
     def transcribe_evidence!(iteration, lane: nil, message: nil)
       entry = slice_entry(iteration)
       rel = entry["file"]
@@ -333,8 +370,15 @@ module Space::Architect
       raw = report.read
       raise Space::Core::Error, "builder report is empty: #{report}" if raw.strip.empty?
 
-      block = lane ? "### #{lane}\n\n#{raw.rstrip}" : raw.rstrip
-      path.write(replace_section_body(path.read, "## Builder Report", block, append: !lane.nil?))
+      text = path.read
+      new_body =
+        if lane
+          lane_names = (entry["lanes"] || []).map { |l| l["name"] }
+          replace_lane_report(section_body(text, "## Builder Report").to_s, lane, raw.rstrip, lane_names)
+        else
+          raw.rstrip
+        end
+      path.write(replace_section_body(text, "## Builder Report", new_body, append: false))
 
       nn = format("%02d", entry["ordinal"] || 0)
       git_capture("-C", space.path.to_s, "commit", "-m",
@@ -366,7 +410,20 @@ module Space::Architect
     # the lane branch, then merge --no-ff into the repo's lane/<id> integration branch.
     # Runs NO gates and makes NO pass/fail decision. Refuses a mechanically-failing lane
     # (builder commits / out-of-bounds) and aborts cleanly on a merge conflict.
-    def merge_lane!(iteration, lane, message: nil, commit_mode: nil, into: nil)
+    #
+    # accept_bounds_reason overrides ONLY the in-bounds check — never no_builder_commits,
+    # which stays an unconditional refusal (a builder commit is tampering, not an authoring
+    # defect the architect can rule on). Modeled on freeze!'s --skip-rehearse: a non-empty
+    # REASON is required whenever passed, recorded in space.yaml beside the lane, and
+    # returned for the caller to echo — the override can never be silent. Recorded only
+    # for THIS lane, and only when its in-bounds check actually failed — integrate! passes
+    # the same reason to every lane in the set, but a lane that was already in bounds gets
+    # neither the record nor the echo.
+    def merge_lane!(iteration, lane, message: nil, commit_mode: nil, into: nil, accept_bounds_reason: nil)
+      if accept_bounds_reason
+        raise Space::Core::Error, "--accept-bounds requires a non-empty REASON" if accept_bounds_reason.to_s.strip.empty?
+      end
+
       entry = slice_entry(iteration)
       lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
       raise Space::Core::Error, "No lane '#{lane}' recorded for iteration '#{iteration}'" unless lane_entry
@@ -376,8 +433,10 @@ module Space::Architect
       if checks[:no_builder_commits] == false
         raise Space::Core::Error, "Lane '#{lane}' has builder commits — the worktree is tampered (hard rule 7). Reset and re-dispatch; do not merge."
       end
-      if checks[:in_bounds] == false
-        raise Space::Core::Error, "Lane '#{lane}' wrote outside its declared touch set — out-of-bounds fails the lane. Reset and re-dispatch."
+      if checks[:in_bounds] == false && !accept_bounds_reason
+        raise Space::Core::Error, "Lane '#{lane}' wrote outside its declared touch set — out-of-bounds fails the lane. Reset " \
+          "and re-dispatch, or `architect integrate #{iteration} --lanes #{lane} --accept-bounds REASON` to override when " \
+          "the touch-set declaration itself is the defect."
       end
 
       repo = lane_entry["repo"]
@@ -427,6 +486,8 @@ module Space::Architect
       merge_sha, = git_capture("-C", repo_path.to_s, "rev-parse", "HEAD")
       diffstat, = git_capture("-C", repo_path.to_s, "diff", "--stat", "#{base_sha}..HEAD")
 
+      bounds_override_reason = accept_bounds_reason.strip if accept_bounds_reason && checks[:in_bounds] == false
+
       update_architect_block do |b|
         b["integration_branch"] = integration_branch
         (b["iterations"] || []).each do |s|
@@ -435,34 +496,46 @@ module Space::Architect
             next unless l["name"] == lane
             l["integration_branch"] = integration_branch
             l["integrate_sha"] = integrate_sha
+            l["bounds_override_reason"] = bounds_override_reason if bounds_override_reason
           end
         end
         b
       end
 
-      { lane: lane, repo: repo, integration_branch: integration_branch,
-        merge_sha: merge_sha.strip, base_sha: base_sha, diffstat: diffstat.strip, gates_run: false }
+      { lane: lane, repo: repo, integration_branch: integration_branch, merge_sha: merge_sha.strip,
+        base_sha: base_sha, diffstat: diffstat.strip, gates_run: false,
+        bounds_override_reason: bounds_override_reason }
     end
 
     # Loop merge_lane! over the architect-supplied passing set, in order. Stops on the
     # first conflict (a disjointness defect). Never decides which lanes pass. With no
     # lanes and teardown: true, tears down every lane recorded for the iteration instead
     # (the second, teardown-only call in the loop's integrate-then-teardown rhythm).
-    def integrate!(iteration, lanes: nil, teardown: false, message: nil, commit_mode: nil, into: nil)
+    #
+    # merge_lane!/teardown_lanes! only save integration_branch/integrate_sha/worktree to
+    # space.yaml on disk (update_architect_block never commits) — one commit per call,
+    # here, by pathspec, so which lanes merged survives independently of whether a
+    # Verdict follows (I13/A3). Always attempted, success or raise, so a conflict that
+    # stops the loop midway doesn't lose the lanes already merged.
+    def integrate!(iteration, lanes: nil, teardown: false, message: nil, commit_mode: nil, into: nil,
+                   accept_bounds_reason: nil, force: false)
       lanes = Array(lanes)
-      return teardown_lanes!(iteration, slice_entry(iteration)["lanes"] || []) if lanes.empty? && teardown
+      return teardown_lanes!(iteration, slice_entry(iteration)["lanes"] || [], force: force) if lanes.empty? && teardown
       raise Space::Core::Error, "No lanes given to integrate" if lanes.empty?
 
       merged = []
       lanes.each do |lane|
-        merged << merge_lane!(iteration, lane, message: message, commit_mode: commit_mode, into: into)
+        merged << merge_lane!(iteration, lane, message: message, commit_mode: commit_mode, into: into,
+          accept_bounds_reason: accept_bounds_reason)
       rescue Space::Core::Error => e
         done = merged.map { |m| m[:lane] }.join(", ")
         raise Space::Core::Error, "Integrated #{done.empty? ? "(none)" : done} then stopped at '#{lane}': #{e.message}"
       end
 
-      teardown_lanes!(iteration, merged) if teardown
+      teardown_lanes!(iteration, merged, force: force) if teardown
       merged
+    ensure
+      commit_metadata_mutation!(iteration, message: message)
     end
 
     # Run the iteration's frozen Acceptance Criteria gate commands. Each gate is
@@ -470,7 +543,10 @@ module Space::Architect
     # a hard timeout, and evaluated against its `expect` block. Returns an array
     # of result hashes with :status (:pass/:fail) and :reason in addition to the
     # raw :stdout/:stderr/:exit_code. The mechanical verdict belongs here; the AC
-    # verdict remains the architect's.
+    # verdict remains the architect's. WHERE the gate text comes from (the frozen
+    # commit) is resolved here; HOW gates execute is #execute_gates, shared
+    # byte-for-byte with #rehearse so the two can never run gates through
+    # different instruments (I09/AC3).
     def run_gates(iteration, lane: nil)
       entry = slice_entry(iteration)
       freeze_sha = entry["freeze_sha"]
@@ -498,37 +574,50 @@ module Space::Architect
         end
       raise Space::Core::Error, "directory does not exist: #{base_dir}" unless base_dir.exist?
 
-      gates.map do |gate|
-        g   = gate.transform_keys(&:to_s)
-        dir =
-          if (cwd = g["cwd"])
-            gate_cwd = space.path.join(cwd)
-            if lane && repo_root && (gate_cwd == repo_root || gate_cwd.to_s.start_with?("#{repo_root}/"))
-              base_dir.join(gate_cwd.relative_path_from(repo_root)).cleanpath
-            else
-              gate_cwd
-            end
-          else
-            base_dir
-          end
-        raise Space::Core::Error, "directory does not exist: #{dir}" unless dir.exist?
+      execute_gates(gates, base_dir: base_dir, lane: lane, repo_root: repo_root)
+    end
 
-        effective = g["timeout"] || DEFAULT_GATE_TIMEOUT
-        captured = capture_with_timeout(g["cmd"], dir: dir, timeout: effective)
+    # Rehearse the DRAFTED gates in the WORKING-TREE iteration file — before the
+    # freeze, while they can still be fixed — through the identical execution
+    # path #run_gates uses at judge time (#execute_gates). space.yaml records no
+    # lanes until freeze! writes them (#freeze!, :~209), so the run directory is
+    # resolved from the DRAFTED ```lanes``` block instead of the recorded one;
+    # rehearsal always runs in the repo checkout (repos/<repo>), never a lane
+    # worktree, because lane worktrees are not provisioned until after the
+    # freeze. Classifies each result RED/GREEN/BROKEN (I09/AC5) and stamps the
+    # iteration as rehearsed, keyed to the gates block's content (I09/AC7) — the
+    # stamp records that the architect looked, never that gates passed.
+    def rehearse(iteration, now: Time.now)
+      entry = slice_entry(iteration)
+      rel = entry["file"]
+      path = space.path.join(rel)
+      raise Space::Core::Error, "#{rel} does not exist — run `architect new #{iteration}` first" unless path.exist?
+      text = path.read
 
-        if captured[:timed_out]
-          status = :fail
-          reason = "timed out after #{effective}s"
+      gates = parse_gates(text)
+      repo, base_dir, gate_results, scope_report =
+        if gates.empty?
+          [nil, nil, [], nil]
         else
-          ev     = GateEvaluator.call(stdout: captured[:stdout], exit_code: captured[:exit_code], expect: g["expect"] || {})
-          status = ev.pass? ? :pass : :fail
-          reason = ev.reason
+          r   = resolve_rehearsal_repo(iteration, text, gates)
+          dir = r ? space.path.join("repos", r) : nil
+          raise Space::Core::Error, "directory does not exist: #{dir}" if dir && !dir.exist?
+          results = execute_gates(gates, base_dir: dir, lane: nil, repo_root: nil)
+                    .map { |g| g.merge(rehearsal: classify_rehearsal(g)) }
+          [r, dir, results, scope_asymmetry_report(results, text)]
         end
 
-        { id: g["id"], ac: g["ac"].to_s, cmd: g["cmd"], expect: g["expect"],
-          stdout: captured[:stdout], stderr: captured[:stderr], exit_code: captured[:exit_code],
-          dir: dir, status: status, reason: reason }
+      digest = gates_digest(text)
+      update_architect_block do |b|
+        (b["iterations"] || []).each do |s|
+          next unless s["name"] == iteration
+          s["rehearsal"] = { "gates_digest" => digest, "at" => now.iso8601 }
+        end
+        b
       end
+
+      { iteration: iteration, repo: repo, base_dir: base_dir, gates: gate_results,
+        empty: gates.empty?, placeholder: untouched_ac_placeholder?(text), scope_asymmetry: scope_report }
     end
 
     # Emit grounding reads for the architect's SessionStart hook.
@@ -607,8 +696,15 @@ module Space::Architect
       repos.map { |r| sync_one_repo(r["name"]) }
     end
 
-    def worktree_add(repo, iteration, lane, base: nil, harness: nil, model: nil, variant: false,
-                     effort: nil, touch: nil, force: false, err: $stderr)
+    # base_explicit distinguishes an operator-given --base (enforce it — refuse or
+    # re-point per #88's three cases) from an auto-materializing call (just attach
+    # whatever's there, never refuse, never move a branch nobody asked to move).
+    # Defaults from whether base: itself was given, which is exactly right for a
+    # direct `worktree_add`/CLI `worktree add --base` call; ensure_lane_materialized
+    # always resolves SOME base internally (it has to, to create a lane from
+    # scratch), so it overrides this explicitly to false.
+    def worktree_add(repo, iteration, lane, base: nil, base_explicit: !base.nil?, harness: nil, model: nil,
+                     variant: false, effort: nil, touch: nil, force: false, err: $stderr)
       model, suffix_level = Harness.parse_model_suffix(model)
       harness, model = resolve_harness_model(harness, model)
       resolved_level = effort || suffix_level || project_defaults["effort"]
@@ -631,6 +727,7 @@ module Space::Architect
       base_sha = base_sha.strip
 
       branch = "lane/#{id}-#{lane}"
+      recorded_base = (entry["lanes"] || []).find { |l| l["name"] == lane }&.dig("base_sha")
 
       # Guard: an existing directory that is not a registered worktree is ambiguous.
       if wt_path.exist? && !worktree_registered?(repo_path, wt_path)
@@ -643,16 +740,8 @@ module Space::Architect
         end
       end
 
-      # Skip git worktree add when the branch and worktree already exist (idempotent re-run).
-      unless branch_exists?(repo_path, branch) && worktree_registered?(repo_path, wt_path)
-        if branch_exists?(repo_path, branch)
-          # The worktree was removed but its lane branch survived — re-attach the branch
-          # (carrying its own tip) instead of `-b`, which would fail "branch already exists".
-          git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
-        else
-          git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, "-b", branch, base_sha)
-        end
-      end
+      outcome, base_sha, discarded = attach_lane_branch!(repo_path, wt_path, branch, base_ref, base_sha, recorded_base,
+                                              base_explicit: base_explicit, force: force)
 
       new_fields = {
         "name" => lane,
@@ -682,7 +771,7 @@ module Space::Architect
         b
       end
 
-      { worktree: wt_path, base_sha: base_sha }
+      { worktree: wt_path, base_sha: base_sha, outcome: outcome, discarded: discarded }
     end
 
     # Declare a variant set for an iteration: one competing lane per (harness, model) pair,
@@ -761,7 +850,13 @@ module Space::Architect
       }
     end
 
-    def worktree_remove(iteration, lane)
+    # #88 (smaller, same area): a removed worktree does not touch its lane branch —
+    # remove-then-provision re-points that surviving branch (or refuses if it has
+    # its own commits), it is not a reset. Names it in the return so a human
+    # reading `worktree remove`'s output isn't misled into thinking it is.
+    # Never deletes the branch itself: that would discard lane work with no
+    # confirmation.
+    def worktree_remove(iteration, lane, force: false)
       entry = slice_entry(iteration)
       lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
       raise Space::Core::Error, "No lane '#{lane}' recorded for iteration '#{iteration}'" unless lane_entry
@@ -774,6 +869,16 @@ module Space::Architect
         space.path.join("build", "#{iteration_id(entry)}-#{lane}", "wt")
       end
 
+      branch = worktree_branch(repo_path, wt_path) || "lane/#{iteration_id(entry)}-#{lane}"
+
+      dirty = dirty_file_count(repo_path, wt_path)
+      if dirty && !force
+        raise Space::Core::Error,
+          "Refusing to remove lane '#{lane}' worktree — #{dirty} uncommitted change(s) (untracked files " \
+          "included) would be discarded. Integrate the lane first, or re-run with --force to discard them " \
+          "and remove it."
+      end
+
       git_run("-C", repo_path.to_s, "worktree", "remove", "--force", wt_path.to_s)
       git_run("-C", repo_path.to_s, "worktree", "prune")
 
@@ -784,19 +889,25 @@ module Space::Architect
         end
         b
       end
+
+      { lane: lane, branch: branch, branch_survives: branch_exists?(repo_path, branch), discarded: dirty }
     end
 
     def worktree_list
       wt_base = space.path.join("build")
       return [] unless wt_base.exist?
-      wt_base.children.select(&:directory?).map { |p| p.basename.to_s }.sort
+      Space::Core::Paths.layout_children(wt_base).select(&:directory?).map { |p| p.basename.to_s }.sort
     end
 
     # Materialize the iteration's declared lanes: for each lane (or the one named via
     # `lane:`), create its worktree + lane/<id>-<lane> branch from the resolved base and
-    # record worktree/base_sha/integration_branch. Idempotent — an already-materialized
-    # lane is skipped, not re-created. Refuses until the iteration is frozen, because
-    # declarations are not authoritative until then.
+    # record worktree/base_sha/integration_branch. Idempotent — a bare re-run (no
+    # explicit --base) over an already-materialized lane changes nothing. An explicit
+    # --base is always enforced, even against an already-materialized lane (#88's
+    # "blind spot" — a short-circuit that trusted the recorded state without checking
+    # it against what was actually asked for). Refuses until the iteration is frozen,
+    # because declarations are not authoritative until then. outcome on each result is
+    # :created / :unchanged / :repointed (#88/AC4 — tellable apart by a human reader).
     def provision(iteration, base: nil, lane: nil, force: false)
       entry = slice_entry(iteration)
       raise Space::Core::Error,
@@ -807,17 +918,15 @@ module Space::Architect
       lanes = lanes.select { |l| l["name"] == lane } if lane
       raise Space::Core::Error, "No lane '#{lane}' declared for iteration '#{iteration}'" if lane && lanes.empty?
 
+      base_explicit = !base.nil?
+      refuse_repoint_if_dirty!(iteration, lanes, base, iteration_id(entry)) if base_explicit && !force
+
       lanes.map do |l|
         name = l["name"]
-        repo_path = space.path.join("repos", l["repo"])
-        wt_path = space.path.join(l["worktree"] || "build/#{iteration_id(entry)}-#{name}/wt")
-        if wt_path.exist? && worktree_registered?(repo_path, wt_path)
-          { lane: name, worktree: wt_path, base_sha: l["base_sha"], created: false }
-        else
-          result = worktree_add(l["repo"], iteration, name, base: resolve_lane_base(l["repo"], base),
-                                force: force, **recorded_lane_fields(l))
-          { lane: name, worktree: result[:worktree], base_sha: result[:base_sha], created: true }
-        end
+        result = worktree_add(l["repo"], iteration, name, base: resolve_lane_base(l["repo"], base),
+                              base_explicit: base_explicit, force: force, **recorded_lane_fields(l))
+        { lane: name, worktree: result[:worktree], base_sha: result[:base_sha], outcome: result[:outcome],
+          discarded: result[:discarded] }
       end
     end
 
@@ -830,7 +939,8 @@ module Space::Architect
     end
 
     def dispatch(iteration, lane, model: nil, max_turns: 200,
-                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil, force: false, quiet: false,
+                 claude_bin: nil, harness: nil, opencode_bin: nil, effort: nil,
+                 allowed_tools: nil, append_allowed_tools: nil, force: false, quiet: false,
                  detach: false, push_url: nil, push_token: nil, push_host: nil, run_creator: nil,
                  push_client: nil, timeout: nil, prompt: nil, now: Time.now)
       raise Space::Core::Error, "Specify --push-host or --push-url, not both" if push_host && push_url
@@ -847,6 +957,9 @@ module Space::Architect
 
       resolved_harness, resolved_model, resolved_effort =
         resolve_dispatch_harness(lane_entry, model: model, harness: harness, effort: effort, force: force, err: err)
+      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
+        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
+      err.puts(tools_provenance) if replace_tools || append_tools
 
       raise Space::Core::Error, "--push-host is only supported with the claude-code harness" \
         if push_host && resolved_harness != "claude-code"
@@ -866,22 +979,29 @@ module Space::Architect
 
       bin = resolved_harness == "claude-code" ? claude_bin : opencode_bin
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns, bin: bin,
-                                                  config_dir: build_dir, effort: resolved_effort, force: force, err: err)
-
-      # Stamp launch time and the resolved harness/model/effort onto the lane entry:
-      # after every preflight validation has passed (a dispatch that raises above
-      # records nothing) and before the blocking run or a detached dispatch returns.
-      # A re-dispatch overwrites the prior values, so `architect status` always reads
-      # what actually ran on the last dispatch.
+                                                  config_dir: build_dir, effort: resolved_effort,
+                                                  allowed_tools: resolved_allowed_tools, force: force, err: err)
+
+      # Stamp launch time and the resolved harness/model/effort/allowed_tools onto the
+      # lane entry: after every preflight validation has passed (a dispatch that raises
+      # above records nothing) and before the blocking run or a detached dispatch
+      # returns. A re-dispatch overwrites the prior values, so `architect status`
+      # always reads what actually ran on the last dispatch. #89/AC8: the resolved
+      # tool grant is recorded the same way, so a denial traces back to a grant a
+      # human can read — replace_tools/append_tools are the pre-composition components
+      # (not the harness's expanded ClaudeCodeHarness.resolve_tools result), so a later
+      # bare re-dispatch re-resolves from the same components instead of compounding.
       update_architect_block do |b|
         (b["iterations"] || []).each do |s|
           next unless s["name"] == iteration
           (s["lanes"] || []).each do |l|
             next unless l["name"] == lane
-            l["dispatched_at"] = now.iso8601
-            l["harness"]       = resolved_harness
-            l["model"]         = resolved_model
-            l["effort"]        = resolved_effort if resolved_effort
+            l["dispatched_at"]         = now.iso8601
+            l["harness"]               = resolved_harness
+            l["model"]                 = resolved_model
+            l["effort"]                = resolved_effort if resolved_effort
+            l["allowed_tools"]         = replace_tools    if replace_tools
+            l["append_allowed_tools"]  = append_tools     if append_tools
           end
         end
         b
@@ -930,7 +1050,8 @@ module Space::Architect
     # transcript lives server-side. jobs_client: is the injectable seam (mirrors
     # dispatch's run_creator:).
     def dispatch_as_job(iteration, lane, host:, token:, backend_url:, model: nil, harness: nil,
-                        max_turns: 200, effort: nil, force: false, quiet: false,
+                        max_turns: 200, effort: nil, allowed_tools: nil, append_allowed_tools: nil,
+                        force: false, quiet: false,
                         job_model: nil, api_key_ref: nil, prompt: nil, jobs_client: nil, now: Time.now)
       err = quiet ? File.open(File::NULL, "w") : $stderr
 
@@ -945,6 +1066,12 @@ module Space::Architect
         unless resolved_harness == "claude-code"
       raise Space::Core::Error, "--job-model is required with --as-job" unless job_model
 
+      # #89: same replace/append resolution as the local dispatch path — the sandboxed
+      # executor still runs `claude -p` with harness_args server-side.
+      resolved_allowed_tools, replace_tools, append_tools, tools_provenance =
+        resolve_allowed_tools(lane_entry, allowed_tools: allowed_tools, append_allowed_tools: append_allowed_tools)
+      err.puts(tools_provenance) if replace_tools || append_tools
+
       id = iteration_id(entry)
       wt_path = space.path.join(lane_entry["worktree"] || "build/#{id}-#{lane}/wt")
       raise Space::Core::Error, "Worktree directory does not exist: #{wt_path}" unless wt_path.exist?
@@ -955,7 +1082,8 @@ module Space::Architect
 
       repo_path   = space.path.join("repos", lane_entry["repo"])
       harness_obj = Harness.for(resolved_harness, model: resolved_model, max_turns: max_turns,
-                                                  effort: resolved_effort, force: force, err: err)
+                                                  effort: resolved_effort, allowed_tools: resolved_allowed_tools,
+                                                  force: force, err: err)
 
       spec = job_spec(iteration: iteration, lane: lane, wt_path: wt_path, build_dir: build_dir,
         repo_path: repo_path, prompt_content: prompt_path.read, backend_url: backend_url,
@@ -1002,19 +1130,61 @@ module Space::Architect
       body.empty? ? composed : "#{composed}\n\n#{body}"
     end
 
+    # integrate!'s own space.yaml commit, by pathspec — like record_verdict!'s sweep, so
+    # other uncommitted work in the space isn't pulled in. A call that mutated nothing
+    # (teardown-only over lanes with no worktree, or a call that raised before touching
+    # anything) leaves git commit with nothing staged for that path; tolerate that exit
+    # via git_capture the way write_section! tolerates a no-op frozen-section commit,
+    # never git_run it.
+    def commit_metadata_mutation!(iteration, message:)
+      entries = (space.data["project"] || {})["iterations"] || []
+      ordinal = entries.find { |s| s["name"] == iteration }&.dig("ordinal") || 0
+      nn = format("%02d", ordinal)
+      git_capture("-C", space.path.to_s, "commit", "-m",
+        compose_message("I#{nn} integrate:", "I#{nn}: record integration", message),
+        "--", Space::Core::Space::METADATA_FILE)
+    end
+
     # Remove each lane's worktree and safe-delete (`-d`) its lane branch. Accepts
     # either merge_lane! results (symbol keys) or recorded lane entries (string
     # keys) — both carry a lane name and a repo.
-    def teardown_lanes!(iteration, lane_entries)
+    def teardown_lanes!(iteration, lane_entries, force: false)
       id = iteration_id(slice_entry(iteration))
+      refuse_teardown_if_dirty!(iteration, lane_entries, id) unless force
+
       lane_entries.map do |l|
         lane = l[:lane] || l["name"]
         repo = l[:repo] || l["repo"]
-        worktree_remove(iteration, lane)
+        removal = worktree_remove(iteration, lane, force: true)
         lane_branch = "lane/#{id}-#{lane}"
         git_capture("-C", space.path.join("repos", repo).to_s, "branch", "-d", lane_branch)
-        { lane: lane, repo: repo, lane_branch: lane_branch }
+        { lane: lane, repo: repo, lane_branch: lane_branch, discarded: removal[:discarded] }
+      end
+    end
+
+    # Every lane a teardown-only call would touch is checked for
+    # uncommitted work BEFORE any lane is removed — a dirty lane discovered late
+    # in the recorded set can never leave an earlier lane already torn down.
+    # Lanes reached via a merge-then-teardown call are always clean here
+    # (merge_lane! commits the worktree first), so this never fires on the
+    # normal integrate-then-teardown rhythm.
+    def refuse_teardown_if_dirty!(iteration, lane_entries, id)
+      entry = slice_entry(iteration)
+      dirty = lane_entries.filter_map do |l|
+        lane = l[:lane] || l["name"]
+        repo = l[:repo] || l["repo"]
+        recorded = (entry["lanes"] || []).find { |le| le["name"] == lane }
+        wt_path = space.path.join(recorded&.dig("worktree") || "build/#{id}-#{lane}/wt")
+        count = dirty_file_count(space.path.join("repos", repo), wt_path)
+        count ? [lane, count] : nil
       end
+      return if dirty.empty?
+
+      names = dirty.map { |n, c| "#{n} (#{c})" }.join(", ")
+      raise Space::Core::Error,
+        "Refusing to tear down '#{iteration}' — lane(s) #{names} hold uncommitted work (untracked files " \
+        "included) that would be discarded (worktree removed, branch deleted). Integrate them first, or " \
+        "re-run with --force to discard it."
     end
 
     # Resolve the in-flight iteration file for ground output.
@@ -1035,6 +1205,7 @@ module Space::Architect
         end
       end
 
+      # paths:exempt - the /\AI\d+-.+\.md\z/ filter structurally cannot match a dotfile-prefixed name, so raw enumeration is already dotfile-safe here
       candidates = arch_dir.children.select { |f| f.basename.to_s.match?(/\AI\d+-.+\.md\z/) }
       return nil if candidates.empty?
       candidates.max_by { |f| f.basename.to_s[/\AI(\d+)/, 1].to_i }
@@ -1046,7 +1217,7 @@ module Space::Architect
     def capture_with_timeout(cmd, dir:, timeout:)
       out_f = Tempfile.new(["gate-stdout", ".log"])
       err_f = Tempfile.new(["gate-stderr", ".log"])
-      pid   = Process.spawn(cmd, pgroup: true, chdir: dir.to_s, out: out_f.path, err: err_f.path)
+      pid   = Process.spawn("/bin/sh", "-c", cmd, pgroup: true, chdir: dir.to_s, out: out_f.path, err: err_f.path)
 
       deadline  = Time.now + timeout
       status    = nil
@@ -1076,6 +1247,332 @@ module Space::Architect
       err_f&.close!
     end
 
+    # HOW gates execute — the one instrument #run_gates (judge time) and
+    # #rehearse (pre-freeze) both call, byte-for-byte: same cwd-remap semantics,
+    # same shell (capture_with_timeout's Process.spawn), same GateEvaluator,
+    # same timeout handling (I09/AC3). repo_root/lane are nil outside a lane
+    # context (rehearsal never has one — it always runs in the repo checkout).
+    def execute_gates(gates, base_dir:, lane:, repo_root:)
+      gates.map do |gate|
+        g   = gate.transform_keys(&:to_s)
+        dir =
+          if (cwd = g["cwd"])
+            gate_cwd = space.path.join(cwd)
+            if lane && repo_root && (gate_cwd == repo_root || gate_cwd.to_s.start_with?("#{repo_root}/"))
+              base_dir.join(gate_cwd.relative_path_from(repo_root)).cleanpath
+            else
+              gate_cwd
+            end
+          else
+            base_dir
+          end
+        raise Space::Core::Error, "directory does not exist: #{dir}" unless dir.exist?
+
+        effective = g["timeout"] || DEFAULT_GATE_TIMEOUT
+        captured = capture_with_timeout(g["cmd"], dir: dir, timeout: effective)
+
+        if captured[:timed_out]
+          status = :fail
+          reason = "timed out after #{effective}s"
+        else
+          ev     = GateEvaluator.call(stdout: captured[:stdout], exit_code: captured[:exit_code], expect: g["expect"] || {})
+          status = ev.pass? ? :pass : :fail
+          reason = ev.reason
+        end
+
+        { id: g["id"], ac: g["ac"].to_s, cmd: g["cmd"], expect: g["expect"],
+          stdout: captured[:stdout], stderr: captured[:stderr], exit_code: captured[:exit_code],
+          dir: dir, status: status, reason: reason, timed_out: captured[:timed_out] }
+      end
+    end
+
+    # I09/AC4, #90/AC5-AC6: resolve the repo to default for gates that declare no
+    # `cwd` of their own — only those gates need one, and only they are ambiguous
+    # when the drafted ```lanes``` block names more than one repo. A gate with its
+    # own `cwd` rehearses in its own declared directory regardless of how many
+    # repos are declared, so an iteration whose gates all declare `cwd` never
+    # needs a default and never reaches this method's refusals. Never resolves
+    # from space.yaml (no lanes are recorded there pre-freeze).
+    def resolve_rehearsal_repo(iteration, text, gates)
+      needing_default = gates.reject { |g| g.transform_keys(&:to_s)["cwd"] }
+      return nil if needing_default.empty?
+
+      ids = needing_default.map { |g| g.transform_keys(&:to_s)["id"] }
+      declared = parse_lanes(text).filter_map { |l| l["repo"] }.uniq
+      return declared.first if declared.size == 1
+
+      if declared.empty?
+        tracked = space.repos.map { |r| r["name"] }
+        return tracked.first if tracked.size == 1
+        raise Space::Core::Error,
+          "Cannot resolve a repo to rehearse '#{iteration}' against — no lane declares a repo and the space " \
+          "tracks #{tracked.size} repos (#{tracked.join(', ')}). Declare a ```lanes``` block in the " \
+          "Specification naming the repo, or give gate(s) #{ids.join(', ')} an explicit `cwd`."
+      end
+
+      raise Space::Core::Error,
+        "Cannot default a repo for gate(s) #{ids.join(', ')} — the drafted lanes block names multiple repos " \
+        "(#{declared.join(', ')}) and #{ids.size == 1 ? "it declares" : "they declare"} no `cwd`. Give " \
+        "#{ids.size == 1 ? "it" : "them"} an explicit `cwd`, or narrow the ```lanes``` block to one repo."
+    end
+
+    # I09/AC5: RED (clean non-zero — discriminates) vs GREEN (passes on base) vs
+    # BROKEN (127, timeout, or a shell parse failure). BROKEN is advisory, not
+    # authoritative: a correct RED can look broken (e.g. `grep -q x new_file`
+    # exits 2 — "No such file" — when the file is one the lane will write); the
+    # CLI names this suspicion, the architect confirms it.
+    def classify_rehearsal(result)
+      return :broken if result[:timed_out] || result[:exit_code] == 127
+      return :broken if BROKEN_STDERR_PATTERN.match?(result[:stderr].to_s)
+      result[:status] == :pass ? :green : :red
+    end
+
+    # grep-family binaries this check recognizes in a gate's shell command.
+    SCOPE_GREP_BINARIES = %w[grep egrep fgrep].freeze
+
+    # Shellwords treats shell syntax — pipes, `&&`/`||`/`;`, `$(...)`, control
+    # keywords — as ordinary word characters, not structure (its own docs say
+    # plainly this isn't a command-line parser). These are the markers
+    # #shell_segments splits a token stream on, once #pad_shell_operators has
+    # made sure none of them can arrive glued to an adjacent word.
+    SCOPE_BOUNDARY_TOKENS = %w[| || && ; $( ( ) if elif then else fi do done while until case esac].freeze
+
+    # Flags that change what a pattern matches and this check actually replays
+    # verbatim against the real grep binary — mode (E/F/G/P) and w, both
+    # threaded through to #whole_repo_grep_matches below — vs flags that only
+    # change what's printed (irrelevant to a files-with-matches re-run). A flag
+    # belongs here only once something below replays it.
+    SCOPE_MATCH_FLAGS = %w[E F G P w].freeze
+    SCOPE_NOOP_FLAGS = %w[c i n o q r l z H h].freeze
+
+    # Recognized flags git grep has no equivalent for (-w and -x are not
+    # symmetric) — declined as not-analyzable, reason naming the flag, rather
+    # than replayed wrong or silently dropped.
+    SCOPE_DECLINED_FLAGS = { "x" => "-x (whole-line match) has no git-grep equivalent" }.freeze
+
+    # git grep, not a raw recursive grep: it skips .git's own object store (a
+    # raw `grep -r .` would trawl it) and matches "the tree" the way the rest
+    # of this corpus's git-based gates already do (diff-scope's own gates are
+    # git diff, not find/grep). Small fixed budget — runs once per recognized
+    # invocation, not per gate.
+    SCOPE_SEARCH_TIMEOUT = 30
+
+    # I12/AC3: rehearse's scope-asymmetry check. I11 shipped a bug its own new
+    # boundary discipline could not catch: a gate's grep-family search covered
+    # only `lib`, while the identifier it renamed also lived in a `test/` file
+    # no lane declared — three consistent statements, all drawn from the same
+    # too-narrow grep. For each gate whose command is a recognizable
+    # file-scoped grep invocation, re-run its own pattern across the whole repo
+    # and report anything that matches outside the gate's own declared paths,
+    # flagging loudest whatever also lies outside every declared lane's touch
+    # set (I12/AC4) — the file no lane may legally fix. touch_globs is that
+    # union; parse_lanes returns [] with no ```lanes``` block, which still
+    # yields the outside-every-lane half of the report. Reports only: never
+    # touches rehearse's exit code, RED/GREEN/BROKEN, or the rehearsal stamp.
+    #
+    # #90/AC7: takes the already-EXECUTED gate results, not a single base_dir —
+    # each gate's own resolved `dir` (execute_gates already computed it, per gate)
+    # is what the re-run replays against, so a cross-repo iteration is covered
+    # gate-by-gate in its own repo, and each finding names the repo it came from.
+    def scope_asymmetry_report(gate_results, text)
+      touch_globs = parse_lanes(text).flat_map { |l| l["touch"] || [] }
+      findings = []
+      not_analyzable = []
+
+      gate_results.each do |g|
+        grep_invocations(g[:cmd].to_s).each do |inv|
+          if inv[:status] != :recognized
+            not_analyzable << { id: g[:id], reason: inv[:reason] }
+            next
+          end
+
+          finding = scope_finding(inv, g[:dir], touch_globs)
+          if finding
+            findings << finding.merge(id: g[:id], repo: repo_name_for(g[:dir]))
+          else
+            not_analyzable << { id: g[:id], reason: "whole-repo re-run failed" }
+          end
+        end
+      end
+
+      { findings: findings, not_analyzable: not_analyzable }
+    end
+
+    # Best-effort label for a scope-asymmetry finding: the repos/<name> a gate's
+    # resolved dir sits under, or nil for a `cwd` outside repos/ entirely (legal —
+    # #test_run_gates_honors_cwd_outside_repo — just not attributable to one repo).
+    def repo_name_for(dir)
+      repos_root = space.path.join("repos")
+      return nil unless dir.to_s.start_with?("#{repos_root}/")
+      dir.relative_path_from(repos_root).to_s.split("/").first
+    end
+
+    # Re-runs a recognized invocation's own pattern across the whole repo and
+    # splits what it finds into: the gate's own declared scope (expected —
+    # that's what the gate already searches, so it's not reported), elsewhere
+    # but inside some lane's touch set, and elsewhere outside every lane's
+    # touch set. nil signals the re-run itself failed (caller counts it as
+    # not-analyzable rather than reporting a guess).
+    def scope_finding(inv, base_dir, touch_globs)
+      matched = whole_repo_grep_matches(inv, base_dir)
+      return nil unless matched
+
+      elsewhere = matched.reject { |f| within_declared_scope?(f, inv[:paths], base_dir) }
+      within_lanes, outside_lanes = elsewhere.partition { |f| in_touch_set?(f, touch_globs) }
+      { pattern: inv[:pattern], paths: inv[:paths], outside_lanes: outside_lanes.sort, within_lanes: within_lanes.sort }
+    end
+
+    # The files (relative paths) an invocation's own pattern matches anywhere
+    # in the repo, via the real git-grep binary with the same
+    # matching-relevant flags — never a Ruby reimplementation of grep's
+    # pattern semantics. nil on anything other than a clean "matched"/"no
+    # matches" outcome (exit 0/1); [] is a real, examined zero.
+    def whole_repo_grep_matches(inv, base_dir)
+      flags = ["-l", "-I"]
+      flags << "-i" if inv[:case_insensitive]
+      flags << "-w" if inv[:word_boundary]
+      flags << "-#{inv[:mode]}" unless inv[:mode] == "G"
+      cmd = "git grep #{flags.join(' ')} -- #{Shellwords.escape(inv[:pattern])}"
+      captured = capture_with_timeout(cmd, dir: base_dir, timeout: SCOPE_SEARCH_TIMEOUT)
+      return [] if captured[:exit_code] == 1
+      return nil if captured[:timed_out] || captured[:exit_code] != 0
+
+      captured[:stdout].each_line.map(&:chomp).reject(&:empty?)
+    end
+
+    # Is relative_path inside one of an invocation's own declared search
+    # paths? A declared path that's a real directory at rehearsal time covers
+    # anything under it; a file (or a path a lane hasn't written yet, same
+    # BROKEN-adjacent case #classify_rehearsal already names) covers only
+    # itself.
+    def within_declared_scope?(relative_path, declared_paths, base_dir)
+      declared_paths.any? do |p|
+        p = p.sub(%r{/\z}, "")
+        relative_path == p || (base_dir.join(p).directory? && relative_path.start_with?("#{p}/"))
+      end
+    end
+
+    # Every grep-family invocation recognized in one gate's shell command. A
+    # command that never mentions grep/egrep/fgrep isn't this check's concern
+    # at all (silently absent, same as e.g. `bundle exec rake test`) — only a
+    # command that DOES attempt one and can't be cleanly recognized is
+    # reported not-analyzable (I12/AC4's "counted and identifiable").
+    def grep_invocations(cmd)
+      return [] unless cmd.match?(/\b(?:#{SCOPE_GREP_BINARIES.join('|')})\b/)
+
+      segments = shell_segments(cmd)
+      return [{ status: :not_analyzable, reason: "unparseable command" }] unless segments
+
+      found = segments.filter_map { |seg| grep_invocation(seg) }
+      return [{ status: :not_analyzable, reason: "could not locate a recognizable grep invocation" }] if found.empty?
+
+      found
+    end
+
+    # Splits a gate's shell command into simple-command segments at pipes,
+    # `&&`/`||`/`;`, command substitution, and control keywords (see
+    # SCOPE_BOUNDARY_TOKENS). Returns nil on anything Shellwords itself can't
+    # tokenize (an unmatched quote), so the caller counts it instead of
+    # guessing at it.
+    def shell_segments(cmd)
+      tokens = expand_quoted_substitutions(shell_tokenize(cmd))
+      segments = [[]]
+      tokens.each do |tok|
+        if SCOPE_BOUNDARY_TOKENS.include?(tok)
+          segments << []
+        else
+          segments.last << tok
+        end
+      end
+      segments.reject(&:empty?)
+    rescue ArgumentError
+      nil
+    end
+
+    def shell_tokenize(cmd)
+      Shellwords.split(pad_shell_operators(cmd))
+    end
+
+    # Shellwords treats shell operator/substitution punctuation as ordinary
+    # word characters whenever it isn't whitespace-separated (its own docs
+    # warn this isn't a command-line parser) — pads whitespace around
+    # `$(` `&&` `||` `;` `|` `(` `)` and folds a bare newline to `;` (its own
+    # statement terminator, otherwise invisible to Shellwords as anything but
+    # whitespace) so each always surfaces as its own token. Quoted spans and
+    # backslash-escapes are passed through untouched, so a pattern's own `|`
+    # or `$` — inside a quote — is never mistaken for shell syntax.
+    def pad_shell_operators(text)
+      out = String.new
+      text.scan(/'[^']*'|"(?:[^"\\]|\\.)*"|\\.|[^'"\\]+/m) do |chunk|
+        if chunk.start_with?("'", '"', "\\")
+          out << chunk
+        else
+          out << chunk.gsub(/\$\(|&&|\|\||[();|\n]/) { |op| op == "\n" ? " ; " : " #{op} " }
+        end
+      end
+      out
+    end
+
+    # A token that is ITSELF a whole `$(...)` survives #pad_shell_operators
+    # intact only when the substitution sat inside a still-open quote
+    # (protected, so nothing inside it got space-padded) — recurse into its
+    # contents exactly as the top-level command was tokenized.
+    def expand_quoted_substitutions(tokens)
+      tokens.flat_map do |tok|
+        m = tok.match(/\A\$\((.*)\)\z/m)
+        next [tok] unless m
+
+        ["$("] + expand_quoted_substitutions(shell_tokenize(m[1])) + [")"]
+      end
+    end
+
+    # Recognizes one simple-command segment as a file-scoped grep-family
+    # invocation, or declines with a specific reason. Never guesses: `-v`
+    # inverts per-line matching (fine for filtering a computed list, wrong for
+    # "does this pattern occur elsewhere") so it's declined rather than
+    # silently reinterpreted; so is any unsupported flag or a path operand
+    # that still carries an unresolved shell variable.
+    def grep_invocation(segment)
+      i = 0
+      i += 1 while segment[i] == "!"
+      return nil unless segment[i] && SCOPE_GREP_BINARIES.include?(segment[i])
+      i += 1
+
+      flag_chars = []
+      loop do
+        tok = segment[i]
+        break unless tok
+        if tok == "--"
+          i += 1
+          break
+        elsif tok.start_with?("-") && tok != "-"
+          flag_chars.concat(tok.delete_prefix("-").chars)
+          i += 1
+        else
+          break
+        end
+      end
+
+      unsupported = flag_chars - (SCOPE_MATCH_FLAGS + SCOPE_NOOP_FLAGS + SCOPE_DECLINED_FLAGS.keys)
+      return { status: :not_analyzable, reason: "unsupported flag(s): #{unsupported.uniq.join(', ')}" } if unsupported.any?
+      return { status: :not_analyzable, reason: "-v (inverted match) semantics not safely reinterpreted" } if flag_chars.include?("v")
+
+      declined = (flag_chars & SCOPE_DECLINED_FLAGS.keys).uniq
+      return { status: :not_analyzable, reason: declined.map { |f| SCOPE_DECLINED_FLAGS[f] }.join("; ") } if declined.any?
+
+      modes = (flag_chars & %w[E F G P]).uniq
+      return { status: :not_analyzable, reason: "ambiguous pattern flags: #{modes.join(', ')}" } if modes.size > 1
+      return { status: :not_analyzable, reason: "no pattern operand" } unless segment[i]
+
+      pattern = segment[i]
+      paths = segment[(i + 1)..] || []
+      return { status: :not_analyzable, reason: "no path operand (pipeline/stdin search)" } if paths.empty?
+      return { status: :not_analyzable, reason: "path operand contains an unresolved shell variable" } if paths.any? { |p| p.include?("$") }
+
+      { status: :recognized, pattern: pattern, paths: paths, case_insensitive: flag_chars.include?("i"),
+        word_boundary: flag_chars.include?("w"), mode: modes.first || "G" }
+    end
+
     def iteration_id(entry)
       "I#{format('%02d', entry['ordinal'])}-#{entry['name']}"
     end
@@ -1091,6 +1588,10 @@ module Space::Architect
     # identically to `provision` (same base resolution, same worktree_add primitive)
     # so no dispatch/integrate/gate path dead-ends on a missing worktree. Returns the
     # (possibly refreshed) lane entry; a no-op when already materialized or undeclared.
+    # base_explicit: false — this call never had an operator-given --base to honor, so
+    # a surviving lane branch (e.g. dispatched work, worktree since removed) is always
+    # just reattached at its own tip, never refused or re-pointed (#88 is about an
+    # explicit ask being dropped; this path never has one to drop).
     def ensure_lane_materialized(iteration, lane)
       entry = slice_entry(iteration)
       lane_entry = (entry["lanes"] || []).find { |l| l["name"] == lane }
@@ -1102,7 +1603,7 @@ module Space::Architect
       return lane_entry if wt_path.exist? && worktree_registered?(repo_path, wt_path)
 
       worktree_add(lane_entry["repo"], iteration, lane, base: resolve_lane_base(lane_entry["repo"], nil),
-                   **recorded_lane_fields(lane_entry))
+                   base_explicit: false, **recorded_lane_fields(lane_entry))
       (slice_entry(iteration)["lanes"] || []).find { |l| l["name"] == lane }
     end
 
@@ -1168,6 +1669,35 @@ module Space::Architect
       [resolved_harness, resolved_model, resolved_effort]
     end
 
+    # #89/AC1-AC5: resolve the claude-code --allowedTools grant for a dispatch (local or
+    # --as-job), shared so both paths resolve precedence identically. The CLI flag beats
+    # the lane's recorded allowed_tools:/append_allowed_tools: (frozen-declaration or a
+    # prior dispatch's stamp) — resolved independently for replace vs. append, so a flag
+    # on one axis and a lane value on the other both apply (Objective A). Meaningless for
+    # opencode/pi (no equivalent grant mechanism) — still resolved/recorded for visibility,
+    # but Harness.for only wires it into the claude-code branch's argv.
+    def resolve_allowed_tools(lane_entry, allowed_tools:, append_allowed_tools:)
+      replace, replace_from =
+        if allowed_tools
+          [allowed_tools, "--allowed-tools flag"]
+        elsif lane_entry["allowed_tools"]
+          [lane_entry["allowed_tools"], "lane's allowed_tools:"]
+        else
+          [nil, "default"]
+        end
+
+      append, append_from =
+        if append_allowed_tools
+          [append_allowed_tools, "--append-allowed-tools flag"]
+        elsif lane_entry["append_allowed_tools"]
+          [lane_entry["append_allowed_tools"], "lane's append_allowed_tools:"]
+        end
+
+      final = Harness::ClaudeCodeHarness.resolve_tools(replace: replace, append: append)
+      provenance = "allowed-tools: #{replace_from}#{append_from ? " + #{append_from}" : ""} → #{final}"
+      [final, replace, append, provenance]
+    end
+
     # Compose a dispatch --as-job spec per the space-server's job contract: prompt +
     # workspace.dir (the lane worktree) + environment (deps/network/mounts/env or
     # secrets) + harness (claude/backend/args) + provenance. mounts are src:dst with
@@ -1310,13 +1840,30 @@ module Space::Architect
 
     # Is a changed path inside a lane's declared touch set? Single-sourced so the
     # in-bounds check (d) and merge_lane!'s conflict classification can never drift.
-    # A trailing `dir/**` is matched twice: bare (PATHNAME stops it at direct
-    # children) and as `dir/**/*`, whose whole-component `**/` does cross `/`.
     def in_touch_set?(path, globs)
-      globs.any? do |g|
-        File.fnmatch(g, path, TOUCH_FNM) ||
-          (g.end_with?("/**") && File.fnmatch("#{g}/*", path, TOUCH_FNM))
-      end
+      globs.any? { |g| Space::Core::Paths.touch_match?(g, path) }
+    end
+
+    # Merge a lane's verbatim block into the current "## Builder Report" body for
+    # #transcribe_evidence!: replace its own "### <lane>" subsection in place if
+    # present (preserving the order lanes were already transcribed in), else append
+    # a new one after the others. Subsection boundaries are matched against the
+    # iteration's declared lane names (like KNOWN_HEADINGS for top-level sections),
+    # not any "### " line, so a verbatim report containing its own "### " heading
+    # can't fool the parser.
+    def replace_lane_report(body, lane, raw, lane_names)
+      block = "### #{lane}\n\n#{raw}"
+      return block if placeholder_body?(body)
+
+      headings = lane_names.map { |n| "### #{n}" }
+      lines = body.lines
+      start = lines.index { |l| l.chomp == "### #{lane}" }
+      return "#{body.strip}\n\n#{block}" unless start
+
+      finish = ((start + 1)...lines.length).find { |i| headings.include?(lines[i].chomp) } || lines.length
+      before = lines[0...start].join.strip
+      after = lines[finish..].join.strip
+      [before, block, after].reject(&:empty?).join("\n\n")
     end
 
     # Replace (or, with append:, extend) the body of a "## Heading" section, leaving
@@ -1365,18 +1912,58 @@ module Space::Architect
       lines[(start + 1)...finish].join.strip
     end
 
+    # The raw (unparsed) text inside the fenced ```gates block, or nil when the
+    # block itself is absent. Single-sourced so #parse_gates and the rehearsal
+    # stamp's content digest (#gates_digest) can never read two different
+    # slices of the same section.
+    def gates_block_source(text)
+      body = section_body(text, "## Acceptance Criteria")
+      return nil unless body
+      match = body.match(/^```gates\n(.*?)^```/m)
+      match && match[1]
+    end
+
     # Extract and parse the fenced ```gates block from the Acceptance Criteria section.
     # Returns an array of gate hashes (string-keyed). Returns [] when the block is
     # absent, empty, or contains only YAML comments.
     def parse_gates(text)
-      body = section_body(text, "## Acceptance Criteria")
-      return [] unless body
-      match = body.match(/^```gates\n(.*?)^```/m)
-      return [] unless match
-      parsed = YAML.safe_load(match[1], aliases: false)
+      raw = gates_block_source(text)
+      return [] unless raw
+      parsed = YAML.safe_load(raw, aliases: false)
       parsed.is_a?(Array) ? parsed : []
     end
 
+    # A stable digest of the gates block's raw content — the key the I09/AC7
+    # rehearsal stamp is validated against. Any byte edit to the fenced block
+    # (add, remove, reorder, reword) changes this and invalidates the stamp.
+    def gates_digest(text)
+      Digest::SHA256.hexdigest(gates_block_source(text).to_s)
+    end
+
+    # #73, narrowly (I09/AC8): true only when the AC section still carries the
+    # scaffold's untouched placeholder AND there is no active gate — a
+    # hand-authored prose-only AC (placeholder replaced, still no gates) is not
+    # this. Call only after lint_gates! has validated the block parses cleanly.
+    def untouched_ac_placeholder?(text)
+      body = section_body(text, "## Acceptance Criteria")
+      return false unless body
+      body.include?(AC1_PLACEHOLDER) && parse_gates(text).empty?
+    end
+
+    # I09/AC7: freeze! refuses without a fresh rehearsal stamp — one whose
+    # gates_digest matches the CURRENT (about-to-be-frozen) gates block. Stale
+    # (gates edited since) or absent (never rehearsed) both refuse identically;
+    # the stamp records that the architect looked, never that gates passed.
+    def ensure_rehearsed!(iteration, entry, text)
+      stamp = entry["rehearsal"]
+      return if stamp && stamp["gates_digest"] == gates_digest(text)
+
+      raise Space::Core::Error,
+        "Iteration '#{iteration}' has not been rehearsed against its current gates — " \
+        "run `architect rehearse #{iteration}` first, or `architect freeze #{iteration} " \
+        "--skip-rehearse REASON` to skip deliberately."
+    end
+
     # Extract and parse the fenced ```lanes block from the Specification section.
     # Returns an array of lane declaration hashes (string-keyed). Returns [] when the
     # block is absent, empty, or contains only YAML comments (back-compat).
@@ -1429,8 +2016,26 @@ module Space::Architect
         return
       end
       result = GateLint.call(gates)
-      return if result.success?
-      raise Space::Core::Error, "ill-formed gates block:\n#{result.failure.join("\n")}"
+      raise Space::Core::Error, "ill-formed gates block:\n#{result.failure.join("\n")}" unless result.success?
+
+      warn_bare_repo_prefix!(gates, warnings) if warnings
+    end
+
+    # I09/AC9(b), #39: a gate whose `cmd` carries a literal `repos/<name>/` prefix
+    # with no `cwd` set is warned about, not failed — `cmd` already resolves
+    # against the repo tree (`cwd` is what's space-root-relative), so this
+    # pattern is usually a leftover space-root-relative path, but is legal and
+    # occasionally correct. Threaded through the same warnings: channel
+    # lint_gates! already carries, never a second channel.
+    def warn_bare_repo_prefix!(gates, warnings)
+      gates.each do |g|
+        g = g.transform_keys(&:to_s)
+        next if g["cwd"]
+        next unless g["cmd"].to_s.match?(BARE_REPO_PREFIX)
+        warnings << "gate '#{g["id"]}': cmd contains a literal 'repos/<name>/' path with no cwd set — " \
+          "cmd already resolves against the repo tree, so this is likely a leftover space-root-relative " \
+          "path (legal, occasionally correct — verify it)"
+      end
     end
 
     # Raises if any lane in the entry has been dispatched (dispatched_at or integrate_sha set).
@@ -1533,10 +2138,145 @@ module Space::Architect
       st.success?
     end
 
+    # Uncommitted work in a lane worktree — untracked files
+    # included. Hard rule 7 forbids builder commits, so this is the only
+    # signal an in-flight or completed-but-unintegrated lane's output ever
+    # leaves behind; "no commits on the branch" is the EXPECTED state, not
+    # evidence the worktree is empty. nil when the worktree doesn't exist,
+    # isn't a registered git worktree, or is clean; otherwise the number of
+    # changed/untracked entries `git status --porcelain` reports (a count is
+    # enough — callers never dump the whole status).
+    def dirty_file_count(repo_path, wt_path)
+      return nil unless wt_path.exist? && worktree_registered?(repo_path, wt_path)
+      out, _, st = git_capture("-C", wt_path.to_s, "status", "--porcelain")
+      return nil unless st.success?
+      count = out.each_line.count { |l| !l.strip.empty? }
+      count.zero? ? nil : count
+    end
+
+    # Would re-pointing `branch`'s worktree to base_sha actually run `git
+    # reset --hard` over uncommitted work? nil when there's nothing to lose
+    # (branch absent, worktree unregistered, already at base_sha, or clean);
+    # otherwise the #dirty_file_count that would be discarded. Read-only —
+    # used by provision's multi-lane preflight (#refuse_repoint_if_dirty!),
+    # never by the mutating path itself (attach_lane_branch! already has
+    # tip_sha in scope and calls #dirty_file_count directly).
+    def repoint_dirty_count(repo_path, wt_path, branch, base_sha)
+      return nil unless branch_exists?(repo_path, branch) && worktree_registered?(repo_path, wt_path)
+      tip_out, _, tip_st = git_capture("-C", repo_path.to_s, "rev-parse", branch)
+      tip_sha = tip_st.success? ? tip_out.strip : nil
+      return nil if tip_sha == base_sha
+      dirty_file_count(repo_path, wt_path)
+    end
+
+    # Multi-lane atomicity for provision's re-point path — every
+    # declared lane is checked for uncommitted work BEFORE any lane's
+    # worktree_add runs, so a dirty lane discovered late in the set can never
+    # leave an earlier lane already re-pointed.
+    def refuse_repoint_if_dirty!(iteration, lanes, base, id)
+      dirty = lanes.filter_map do |l|
+        repo_path = space.path.join("repos", l["repo"])
+        wt_path = space.path.join(l["worktree"] || "build/#{id}-#{l["name"]}/wt")
+        branch = "lane/#{id}-#{l["name"]}"
+        resolved, _, st = git_capture("-C", repo_path.to_s, "rev-parse", resolve_lane_base(l["repo"], base))
+        next nil unless st.success?
+        count = repoint_dirty_count(repo_path, wt_path, branch, resolved.strip)
+        count ? [l["name"], count] : nil
+      end
+      return if dirty.empty?
+
+      names = dirty.map { |n, c| "#{n} (#{c})" }.join(", ")
+      raise Space::Core::Error,
+        "Refusing to provision '#{iteration}' — re-pointing to the requested base would discard uncommitted " \
+        "work (untracked files included) in: #{names}. Dispatch or integrate the lane(s) first, or re-run " \
+        "with --force to discard it and re-point."
+    end
+
     def worktree_registered?(repo_path, wt_path)
       out, _, _ = git_capture("-C", repo_path.to_s, "worktree", "list", "--porcelain")
       real = File.exist?(wt_path.to_s) ? File.realpath(wt_path.to_s) : wt_path.to_s
       out.lines.any? { |l| l.start_with?("worktree ") && l.chomp.delete_prefix("worktree ") == real }
     end
+
+    # The branch checked out at wt_path, per `git worktree list --porcelain`
+    # (read before removal, since the entry disappears once the worktree is
+    # gone) — nil if wt_path isn't a registered worktree of repo_path at all.
+    def worktree_branch(repo_path, wt_path)
+      out, _, _ = git_capture("-C", repo_path.to_s, "worktree", "list", "--porcelain")
+      real = File.exist?(wt_path.to_s) ? File.realpath(wt_path.to_s) : wt_path.to_s
+      entry = out.split("\n\n").find { |e| e.lines.any? { |l| l.chomp == "worktree #{real}" } }
+      entry&.lines&.find { |l| l.start_with?("branch ") }&.chomp&.delete_prefix("branch refs/heads/")
+    end
+
+    # #88: attach `branch` at wt_path, choosing among the three lane-branch states
+    # the issue distinguishes — absent (create), present with no commits beyond the
+    # base it was recorded from (safe to re-point — the fast-follow case), or
+    # present with commits of its own (refuse unless force). Returns [outcome,
+    # base_sha], where base_sha is the commit the worktree actually ends up on —
+    # never the freshly-resolved one when nothing about the tree moved (the
+    # provenance half of the bug).
+    #
+    # base_explicit: false short-circuits to "just attach whatever's there" —
+    # never refuses, never re-points, and preserves the previously recorded
+    # base_sha instead of overwriting it with a base nobody asked for (see
+    # ensure_lane_materialized).
+    def attach_lane_branch!(repo_path, wt_path, branch, base_ref, base_sha, recorded_base, base_explicit:, force:)
+      unless branch_exists?(repo_path, branch)
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, "-b", branch, base_sha)
+        return [:created, base_sha, nil]
+      end
+
+      registered = worktree_registered?(repo_path, wt_path)
+      tip_out, _, tip_st = git_capture("-C", repo_path.to_s, "rev-parse", branch)
+      tip_sha = tip_st.success? ? tip_out.strip : nil
+
+      unless base_explicit
+        return [:unchanged, recorded_base || base_sha, nil] if registered
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
+        return [:created, recorded_base || tip_sha, nil]
+      end
+
+      if tip_sha == base_sha
+        return [:unchanged, base_sha, nil] if registered
+        git_run("-C", repo_path.to_s, "worktree", "add", wt_path.to_s, branch)
+        return [:created, base_sha, nil]
+      end
+
+      # Hard rule 7 forbids builder commits, so an in-flight lane's
+      # entire output is uncommitted working-tree state — carries_own_commits?
+      # below can't see it (no commits to count). Checked first: it's the more
+      # common loss (partial — reset --hard spares untracked files) and the one
+      # this iteration exists to close.
+      dirty = dirty_file_count(repo_path, wt_path)
+      if dirty && !force
+        raise Space::Core::Error,
+          "Lane branch '#{branch}' worktree has #{dirty} uncommitted change(s) (untracked files included) — " \
+          "re-pointing to '#{base_ref}' (#{base_sha[0, 8]}) would run `git reset --hard` and discard them. " \
+          "Dispatch or integrate it first, or re-run with --force to discard them and re-point."
+      end
+
+      if !force && carries_own_commits?(repo_path, recorded_base, tip_sha)
+        raise Space::Core::Error,
+          "Lane branch '#{branch}' carries commits of its own — it is at #{tip_sha ? tip_sha[0, 8] : "?"}, but " \
+          "base '#{base_ref}' (#{base_sha[0, 8]}) was requested. Re-pointing would discard its commits — " \
+          "dispatch or integrate it first, or re-run with --force to discard them and re-point onto the new base."
+      end
+
+      if registered
+        git_run("-C", wt_path.to_s, "reset", "--hard", base_sha)
+      else
+        git_run("-C", repo_path.to_s, "worktree", "add", "-B", branch, wt_path.to_s, base_sha)
+      end
+      [:repointed, base_sha, dirty]
+    end
+
+    # #88/AC2-AC3: does the branch carry commits beyond the base it was recorded
+    # from? Unrecorded provenance can't be proven safe, so it counts as "carries
+    # its own" — conservative by design, not merely by omission.
+    def carries_own_commits?(repo_path, recorded_base, tip_sha)
+      return true if recorded_base.nil? || tip_sha.nil?
+      out, _, st = git_capture("-C", repo_path.to_s, "rev-list", "--count", "#{recorded_base}..#{tip_sha}")
+      !(st.success? && out.strip.to_i.zero?)
+    end
   end
 end