@appchy/jarvis 0.1.128 → 0.1.130

package/harness/harness/autonomy.py

@@ -359,13 +359,10 @@ def cmd_digest(args) -> int:
     answered = names("answered")
     refused = [e for e in rows if e["event"] == "gate-refused"]
     released = names("released")
-    # What was WORKED ON is a task moving into in-progress, not a lease being taken.
-    # A claim is one way to arrive there and it is not the only one — a person who
-    # moved three tasks by hand read as an idle shift, and under git a claim is not
-    # recorded at all, because a hold belongs to a machine rather than to a branch.
+    # What was WORKED ON is a task moving into in-progress — the take itself, whoever
+    # made it, a shift or a person moving it by hand.
     worked = sorted({e["name"] for e in rows
-                     if e["event"] == "claimed"
-                     or (e["event"] == "moved" and e.get("to") == "in-progress")})
+                     if e["event"] == "moved" and e.get("to") == "in-progress"})
 
     print(f"DIGEST  {len(rows)} event(s)"
           + (f" since {since}" if since else "") + "\n")

package/harness/harness/config.py

@@ -176,10 +176,6 @@ DEFAULTS = {
         # default: a harness that ships with no ceiling is a harness whose safety
         # depends on nobody having configured it.
         "ceiling": 2,
-        # How long an instance's claim on a task is good for. Long enough that real
-        # work finishes inside it; short enough that a crashed shift's task is
-        # takeable the same day.
-        "lease_minutes": 240,
     },
     "graph": {
         # The MCP server serving this repo's governance↔code graph, or null. Null is
@@ -466,9 +462,6 @@ def _validate(cfg: dict) -> None:
     if not isinstance(ceiling, int) or isinstance(ceiling, bool) or not 0 <= ceiling <= 3:
         raise ConfigError("autonomy.ceiling must be an integer 0–3 (the highest "
                           "task tier an unattended run may act on alone)")
-    lease = cfg["autonomy"]["lease_minutes"]
-    if not isinstance(lease, int) or isinstance(lease, bool) or lease < 1:
-        raise ConfigError("autonomy.lease_minutes must be a positive integer")
     mcp = cfg["graph"]["mcp"]
     if mcp is not None and not isinstance(mcp, str):
         raise ConfigError("graph.mcp must be a server name or null")
@@ -657,7 +650,6 @@ def apply(cfg: dict) -> None:
     gate.VERIFY = dict(cfg["verify"])
     task.PLANS_DIR = cfg["plans"]["dir"]
     autonomy.CEILING = cfg["autonomy"]["ceiling"]
-    shift.LEASE_MINUTES = cfg["autonomy"]["lease_minutes"]
     # `shift` reads the ceiling it was imported with, so bind it there too — a
     # module-level `from … import CEILING` captures the value, not the name.
     shift.CEILING = cfg["autonomy"]["ceiling"]

package/harness/harness/events.py

@@ -1,10 +1,13 @@
 """The record of what the harness DID — a file, or the commits themselves.
 
-**History, never state.** Nothing in the harness reads this record to decide what is
-true now: status is the bucket, a version's status is derived from its tasks, a
-rule lives in the domain that owns it. That line is the whole design, and blurring
-it would rebuild the central ledger `P-1` dissolved — one file that answers
-everything, which is one file to disagree with the tree.
+**History, never state — with one answer derived from it.** Status is the bucket, a
+version's status is derived from its tasks, a rule lives in the domain that owns it,
+and none of that is read from here: blurring that line would rebuild the central
+ledger `P-1` dissolved — one file that answers everything, which is one file to
+disagree with the tree. The one exception is **who is on an item**. A take IS an
+event, the commit that records it is the only record every machine shares, and the
+lease that answered the question separately was a second record that disagreed — so
+`holders` derives it from here, and nothing else does.
 
 **Two backends, and which one is the repo's call.** With `git.commit` off — the
 default, and what every consumer that has not asked for anything else gets — the
@@ -15,11 +18,10 @@ writes to git therefore has no `.events.jsonl` at all, which is the point — th
 file records a session id rather than a machine or a branch, and it appends at the
 end, so two active branches conflict on it every time.
 
-Two kinds of event never reach git. A **hold** (`claimed`, `released-claim`) is
-coordination, and coordination that replicates is two machines holding one item with
-neither knowing. A **refusal** changed nothing, so there is no commit for it to ride
-on and no board history for it to be part of; `status` loses its "refused twice"
-warning under git, which is a deliberate trade rather than an oversight.
+One kind of event never reaches git: a **refusal** changed nothing, so there is no
+commit for it to ride on and no board history for it to be part of; `status` loses
+its "refused twice" warning under git, which is a deliberate trade rather than an
+oversight.
 
 What it buys is the thing a tree cannot hold: *time*. A tree remembers only now, so
 it cannot say what shipped overnight, how long something sat blocked, or which
@@ -44,18 +46,13 @@ from . import git
 
 LOG = ".events.jsonl"
 
-#: Events about a hold rather than about the board. They never enter git — not as a
-#: file, not as a trailer — because a claim belongs to a machine and a moment, and a
-#: replicated one is a claim two endpoints both believe they have.
-HOLDS = ("claimed", "released-claim")
-
-#: Events no commit ever carries. The holds above, and a REFUSAL — which changed
-#: nothing, so there is no commit for it to ride on. Buffering a refusal made the
-#: git seam see work waiting for a commit while the tree was untouched, and report
-#: the change as "carried by a board write that committed a moment earlier": a
-#: refused completion, told its work was safely in git under somebody else's commit,
-#: when nothing had been written and nothing committed.
-UNCOMMITTED = HOLDS + ("gate-refused",)
+#: Events no commit ever carries: a REFUSAL, which changed nothing, so there is no
+#: commit for it to ride on. Buffering a refusal made the git seam see work waiting
+#: for a commit while the tree was untouched, and report the change as "carried by a
+#: board write that committed a moment earlier": a refused completion, told its work
+#: was safely in git under somebody else's commit, when nothing had been written and
+#: nothing committed.
+UNCOMMITTED = ("gate-refused",)
 
 #: What this command has done so far, waiting for the commit that carries it. Only
 #: used under git; a process runs one command, so one buffer is one commit.
@@ -70,8 +67,6 @@ KINDS = (
     "blocked",        # parked, waiting on a human
     "asked",          # a question was filed against a task
     "answered",       # and resolved
-    "claimed",        # an instance leased a task
-    "released-claim", # ...and gave it back, or the lease expired
     "verified",       # verify.* ran — with its exit codes
     "observed",       # an eyes-on record against an AC
     "gate-refused",   # completion was refused, and why
@@ -134,11 +129,15 @@ def pending() -> list:
     return list(_PENDING)
 
 
-def read(root: Path, since: str = "", name: str = "") -> list:
+def read(root: Path, since: str = "", name: str = "", eventless: bool = False) -> list:
     """Every event, oldest first. A malformed line is skipped silently — a
-    half-written record from a killed process must not break `digest`."""
+    half-written record from a killed process must not break `digest`.
+
+    `eventless` also returns, under git, each commit that recorded a run on an item
+    without recording an event — what taking an item already in progress writes. The
+    holder derivation asks for it; the activity log never shows one."""
     if git.enabled():
-        return git.read(root.parent, since=since, name=name)
+        return git.read(root.parent, since=since, name=name, eventless=eventless)
     p = root / LOG
     if not p.is_file():
         return []

package/harness/harness/gate.py

@@ -43,8 +43,8 @@ from .autonomy import tier_of
 VERIFY: dict = {}
 
 #: The run in flight, beside the board it is proving. Never enters git — it names a
-#: pid on one machine at one moment, exactly like `.claim`, and `git.py` drops it by
-#: filename for the same reason.
+#: pid on one machine at one moment, and `git.py` drops it by filename for that
+#: reason.
 RUN = ".verify"
 
 

package/harness/harness/generate.py

@@ -47,6 +47,10 @@ def _version_section(v: Version, root: Path) -> str:
     }.get(status, status)
     link = f"[{v.title}]({_relpath_from_readme(v.md, root)})"
     head = f"### Version — {link} _( {badge} )_"
+    over = v.over_ceiling()
+    if over:
+        head += (f"\n\n**Over its ceiling by {over}** — {len(v.open_tasks())} open; "
+                 f"a reshape is owed before it closes.")
     if v.outcome:
         head += f"\n\n{v.outcome}"
     parts = []

package/harness/harness/git.py

@@ -27,10 +27,9 @@ Four things read that format, so it is a rule rather than a convention — see t
 repo's own architecture docs. Who, when and which branch are NOT trailers: git
 already knows them, and a second copy is a second thing to drift.
 
-**Coordination never enters git.** A `.claim` belongs to a machine and a moment, not
-to a branch, and a `.verify` naming the pid running this checkout's gates is the same
-kind of fact. Both are filtered out of every commit here, whatever the configured
-paths say.
+**A run in flight never enters git.** A `.verify` names the pid running this
+checkout's gates — a fact about one machine at one moment, not about a branch — so it
+is filtered out of every commit here, whatever the configured paths say.
 
 **What a commit contains, exactly.** Only the configured paths, committed with a
 pathspec, so a session's unrelated staged code is neither swept in nor disturbed.
@@ -56,13 +55,10 @@ GIT: dict = {"commit": False, "push": False, "remote": "origin", "paths": ["work
 #: format that drifts breaks the record silently rather than loudly.
 ITEM, EVENT, MACHINE, SESSION = "Work-Item", "Work-Event", "Work-Machine", "Work-Session"
 
-#: Never committed, whatever `git.paths` says. A claim is coordination: it lives on
-#: the machine that granted it, for as long as it is good for, and a replicated one
-#: is two machines holding the same item with neither knowing. A verify run is the
-#: same kind of fact — a pid on one box, true for the minutes it takes — and a
-#: committed one would tell every other checkout a build is running inside it.
-CLAIM = ".claim"
-LOCAL = frozenset({CLAIM, ".verify"})
+#: Never committed, whatever `git.paths` says. A verify run is a fact about one box
+#: at one moment — a pid, true for the minutes it takes — and a committed one would
+#: tell every other checkout a build is running inside it.
+LOCAL = frozenset({".verify"})
 
 _NET_TIMEOUT = 120
 _ATTEMPTS = 3
@@ -259,7 +255,7 @@ def _hold(repo):
     """Serialise the commit against other board writes on this machine.
 
     In the git directory rather than the work tree, because it is machine-local
-    coordination and belongs where `.claim` belongs — nowhere near a branch. A lock
+    coordination and belongs on this machine — nowhere near a branch. A lock
     that cannot be taken is WAITED for and then ignored: the commit is the thing
     that matters, and blocking a board write forever to protect a lock would be the
     lock winning over the work it exists to protect.
@@ -860,7 +856,7 @@ def _session() -> str:
 _FORMAT = "%x00%H%x1f%aI%x1f%an%x1f%B"
 
 
-def _log(repo, *extra) -> list:
+def _log(repo, *extra, eventless=False) -> list:
     """Board events out of `git log`, oldest first. One parser for every caller, so
     what `digest` reads and what a pull reports can never be two different shapes."""
     code, out, _ = _git(repo, "log", "--reverse", f"--format={_FORMAT}", "-E",
@@ -870,22 +866,26 @@ def _log(repo, *extra) -> list:
     rows = []
     for record in out.split("\0"):
         if record.strip():
-            rows.extend(_events(record))
+            rows.extend(_events(record, eventless))
     return rows
 
 
-def read(repo, since: str = "", name: str = "") -> list:
+def read(repo, since: str = "", name: str = "", eventless: bool = False) -> list:
     """The board's history, oldest first, read back out of the commits.
 
     Local: `git log` reads this clone and nothing else, so history costs no network
     and has no rate limit. There is no index and no cache — a fact that can be
     derived is not stored, and this one can.
+
+    `eventless` also returns each commit that recorded a run on an item without
+    recording an event, as a row whose `event` is empty — see `_events`.
     """
-    rows = _log(repo, *([f"--since={_since(since)}"] if since else []))
+    rows = _log(repo, *([f"--since={_since(since)}"] if since else []),
+                eventless=eventless)
     return [r for r in rows if not name or r.get("name") == name]
 
 
-def _events(record: str) -> list:
+def _events(record: str, eventless: bool = False) -> list:
     """Every event one commit carried, back in the shape the readers expect."""
     parts = record.split("\x1f")
     if len(parts) < 4:
@@ -894,11 +894,22 @@ def _events(record: str) -> list:
     trailers = _trailers(message)
     item = (trailers.get(ITEM) or [""])[0]
     kinds = trailers.get(EVENT) or []
-    if not item or not kinds:
-        return []
-    details = _details(message, kinds)
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
+    if not item:
+        return []
+    if not kinds:
+        # Absent from the activity log on purpose (see `_message`), and handed only to
+        # a reader that asks: recording a run on an item already in progress writes
+        # exactly this commit, and to the question of who is on an item it is a take.
+        if not (eventless and who):
+            return []
+        row = {"ts": _utc(when), "event": "", "name": item, "sha": sha[:12],
+               "author": author, "by": who}
+        if host:
+            row["machine"] = host
+        return [row]
+    details = _details(message, kinds)
     out = []
     # One pool per kind, drawn from in order, so the second `verified` in a commit
     # gets the second body line rather than the first's.

package/harness/harness/holders.cases.json

@@ -0,0 +1,173 @@
+{
+  "why": [
+    "Who is on an item is derived from commit trailers, by two readers in two languages: the harness",
+    "(`harness/holders.py`, over what `git._events` parses) and the board (`packages/board/src/holders.ts`,",
+    "over what `board.git.ts` reads). Two parsers and two derivations of one answer is exactly where the",
+    "terminal and the board come to name different holders for the same item, so both suites run THESE",
+    "commits and assert THIS answer. A drift is a red test in both.",
+    "",
+    "Each case is an item's board history, oldest first, as commits. `expect` maps an item to its holders",
+    "in order: the session that took it (or, with none, who git says made the commit), the machine, and",
+    "which holder that take followed, when it followed one."
+  ],
+  "cases": [
+    {
+      "name": "a move into progress is a take",
+      "commits": [
+        {
+          "sha": "a1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved thing\n\nmoved  from=queue · to=in-progress\n\nWork-Item: thing\nWork-Event: moved\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        }
+      ],
+      "expect": {
+        "thing": [
+          { "session": "11111111-1111-4111-8111-111111111111", "machine": "box-a", "tookOverFrom": null }
+        ]
+      }
+    },
+    {
+      "name": "creating an item, verifying it and moving it elsewhere are its history, not a claim on it",
+      "commits": [
+        {
+          "sha": "b1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): created thing\n\ncreated  epic=an-epic\n\nWork-Item: thing\nWork-Event: created\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        },
+        {
+          "sha": "b2",
+          "when": "2026-09-12T11:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved thing\n\nmoved  from=in-progress · to=complete\n\nWork-Item: thing\nWork-Event: moved\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        }
+      ],
+      "expect": {}
+    },
+    {
+      "name": "recording a run on an item already in progress is a take, and it follows the first",
+      "commits": [
+        {
+          "sha": "c1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved thing\n\nmoved  from=queue · to=in-progress\n\nWork-Item: thing\nWork-Event: moved\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        },
+        {
+          "sha": "c2",
+          "when": "2026-09-12T12:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): changed thing\n\nWork-Item: thing\nWork-Machine: box-b\nWork-Session: 22222222-2222-4222-8222-222222222222\n"
+        }
+      ],
+      "expect": {
+        "thing": [
+          { "session": "11111111-1111-4111-8111-111111111111", "machine": "box-a", "tookOverFrom": null },
+          {
+            "session": "22222222-2222-4222-8222-222222222222",
+            "machine": "box-b",
+            "tookOverFrom": "11111111-1111-4111-8111-111111111111"
+          }
+        ]
+      }
+    },
+    {
+      "name": "renewing your own take is not a second holder, and keeps the place you first took",
+      "commits": [
+        {
+          "sha": "d1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved thing\n\nmoved  from=queue · to=in-progress\n\nWork-Item: thing\nWork-Event: moved\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        },
+        {
+          "sha": "d2",
+          "when": "2026-09-12T11:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): changed thing\n\nWork-Item: thing\nWork-Machine: box-b\nWork-Session: 22222222-2222-4222-8222-222222222222\n"
+        },
+        {
+          "sha": "d3",
+          "when": "2026-09-12T12:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): changed thing\n\nWork-Item: thing\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        }
+      ],
+      "expect": {
+        "thing": [
+          { "session": "11111111-1111-4111-8111-111111111111", "machine": "box-a", "tookOverFrom": null },
+          {
+            "session": "22222222-2222-4222-8222-222222222222",
+            "machine": "box-b",
+            "tookOverFrom": "11111111-1111-4111-8111-111111111111"
+          }
+        ]
+      }
+    },
+    {
+      "name": "a take that names no run is still a take, by whoever git says made it",
+      "commits": [
+        {
+          "sha": "e1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "A Person",
+          "message": "docs(work): moved thing\n\nmoved  from=queue · to=in-progress\n\nWork-Item: thing\nWork-Event: moved\nWork-Machine: box-a\n"
+        },
+        {
+          "sha": "e2",
+          "when": "2026-09-12T11:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): changed thing\n\nWork-Item: thing\nWork-Machine: box-b\nWork-Session: 22222222-2222-4222-8222-222222222222\n"
+        }
+      ],
+      "expect": {
+        "thing": [
+          { "session": "", "machine": "box-a", "tookOverFrom": null },
+          {
+            "session": "22222222-2222-4222-8222-222222222222",
+            "machine": "box-b",
+            "tookOverFrom": "A Person"
+          }
+        ]
+      }
+    },
+    {
+      "name": "a commit carrying neither a run nor an event is somebody's hand edit, not a take",
+      "commits": [
+        {
+          "sha": "f1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): changed thing\n\nWork-Item: thing\nWork-Machine: box-a\n"
+        }
+      ],
+      "expect": {}
+    },
+    {
+      "name": "two items in one history keep separate holders",
+      "commits": [
+        {
+          "sha": "g1",
+          "when": "2026-09-12T10:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved one\n\nmoved  from=queue · to=in-progress\n\nWork-Item: one\nWork-Event: moved\nWork-Machine: box-a\nWork-Session: 11111111-1111-4111-8111-111111111111\n"
+        },
+        {
+          "sha": "g2",
+          "when": "2026-09-12T11:00:00+03:00",
+          "author": "Danny",
+          "message": "docs(work): moved two\n\nmoved  from=queue · to=in-progress\n\nWork-Item: two\nWork-Event: moved\nWork-Machine: box-b\nWork-Session: 22222222-2222-4222-8222-222222222222\n"
+        }
+      ],
+      "expect": {
+        "one": [
+          { "session": "11111111-1111-4111-8111-111111111111", "machine": "box-a", "tookOverFrom": null }
+        ],
+        "two": [
+          { "session": "22222222-2222-4222-8222-222222222222", "machine": "box-b", "tookOverFrom": null }
+        ]
+      }
+    }
+  ]
+}

package/harness/harness/holders.py

@@ -0,0 +1,72 @@
+"""Who is on an item, and who was — derived from the commits that took it.
+
+The same derivation the board's TypeScript runs (`packages/board/src/holders.ts`),
+because the terminal and the board are two doors onto one answer. They disagreed on
+exactly the case this settles: a take on an item already in progress changes no
+bucket, so a reader that counted only moves hid the second taker the board was naming.
+Both run `holders.cases.json`, so a drift between the two languages is a red test in
+both suites rather than two names for one holder.
+
+Nothing is stored and nothing expires. A take is a moment, so how long ago is derived
+by whoever asks, and whether that session is still there is `peers`'s question.
+
+Pure: it reads rows and returns dicts, so both event backends feed it the same way.
+"""
+
+
+def to_holders(rows: list) -> list:
+    """Everyone who has taken ONE item, in the order they first took it.
+
+    `rows` is that item's history, oldest first, as `events.read(..., eventless=True)`
+    returns it. Two shapes count as taking it, and nothing else does: a move INTO
+    in-progress, and a commit for this item carrying a run but no event — what
+    recording a session writes, and the only record a take on an item already in
+    progress leaves. `created`, `verified` and the rest are this item's history
+    without being a claim on it.
+
+    One entry per session, carrying its latest take, so renewing your own work is not
+    a second holder standing beside you. A take that followed somebody else's names
+    them, so an override is visible without anybody having flagged it.
+    """
+    takes, commits = [], set()
+    for row in rows:
+        sha = row.get("sha")
+        if sha and sha in commits:
+            continue
+        moved = row.get("event") == "moved" and row.get("to") == "in-progress"
+        recorded = not row.get("event") and bool(row.get("by"))
+        if not (moved or recorded):
+            continue
+        if sha:
+            commits.add(sha)
+        takes.append({"session": str(row.get("by", "")),
+                      "machine": str(row.get("machine", "")),
+                      "by": str(row.get("author", "")),
+                      "taken": str(row.get("ts", ""))})
+
+    # Keyed by session, falling back to who git says made it, and a later take
+    # replaces an earlier one IN PLACE — a dict keeps where a key was first set,
+    # which is what the TypeScript side's Map does, so both list holders in one order.
+    distinct = {}
+    for take in takes:
+        distinct[take["session"] or take["by"]] = take
+    holders = list(distinct.values())
+
+    for previous, current in zip(holders, holders[1:]):
+        current["took_over_from"] = previous["session"] or previous["by"]
+    return holders
+
+
+def to_holders_by_item(rows: list) -> dict:
+    """Everyone on every item a history names, in one pass — `{item: [holder, ...]}`.
+
+    The board is read as a page of items, so this is the question both readers ask.
+    Rows arrive oldest first and keep that order within each item, because an
+    override is derived from the order of the takes.
+    """
+    by_item = {}
+    for row in rows:
+        name = row.get("name")
+        if name:
+            by_item.setdefault(name, []).append(row)
+    return {name: to_holders(history) for name, history in by_item.items()}

package/harness/harness/lint.py

@@ -12,6 +12,7 @@ from .tree import (
     TASK_REGION_CAP,
 )
 from .frontmatter import as_list, parse_frontmatter, split_frontmatter
+from . import tree as _tree
 from .model import locate_feature, scan, scan_features, scan_filed
 from .registry import code_vocabulary, locate_domain
 
@@ -193,6 +194,41 @@ def _shape_lint(root: Path, s: dict) -> list:
                 f"fits — or, if this goal genuinely needs only these, say why in "
                 f"`one_goal:`")
 
+    # 3c — a FAT epic: more open tasks than an epic's ceiling. The other end of the
+    #      floor above and the same concept — an epic is a size a person can plan
+    #      together. OPEN tasks only: an epic whose work has mostly shipped is not hard
+    #      to plan, and counting finished work would warn on every long-lived goal
+    #      about tasks nobody is still doing. Same skips as the floor, same escape.
+    #
+    #      Splitting an epic changes no cut's total, so this bound can never make the
+    #      cut ceiling worse. It buys a readable plan, not a release that closes.
+    for e in [e for v in s["versions"] for e in v.epics]:
+        if not e.planned or e.done_tier:
+            continue
+        n = sum(t.status in ACTIVE for t in e.all_tasks())
+        if n > _tree.EPIC_TASK_CEILING and not e.one_goal:
+            warns.append(
+                f"epic {e.name}: {n} open task(s) — past {_tree.EPIC_TASK_CEILING} an "
+                f"epic is no longer a goal you plan together. Split it along its "
+                f"goals, or, if this size is deliberate, say why in `one_goal:`")
+
+    # 3d — a FULL cut: more open tasks, summed across its epics, than a cut's
+    #      ceiling. Flagged — never refused and never routed. Where a task belongs is
+    #      a planning call, and a harness that moved work out of a cut on its own
+    #      would be deciding which half of a goal ships. So this names what is owed
+    #      and the two ways out, and says whose call it is. Printed after every board
+    #      write, so whoever files into a full cut reads it on the spot. Epic COUNT is
+    #      deliberately not bounded; only the sum is.
+    for v in s["versions"]:
+        over = v.over_ceiling()
+        if over:
+            warns.append(
+                f"cut {v.name}: {len(v.open_tasks())} open tasks, {over} past its "
+                f"ceiling of {_tree.CUT_TASK_CEILING} — a reshape is owed so it does "
+                f"not close half-built: move work to a later cut, or reshape an epic. "
+                f"That is a person's call; an agent parks it. If the size is "
+                f"deliberate, say why in `one_goal:` in its version.md")
+
     # 3b — a task inside an epic carrying its own plan.md. The design is settled
     #      ONCE in `epic.md` §Plan; a second design doc per task is the
     #      re-analyse-per-task cost the tier exists to remove. Warn, don't block:

package/harness/harness/migrate.py

@@ -46,11 +46,26 @@ def _uncommitted(repo: Path, work: Path) -> list:
         if len(line) <= 3:
             continue
         p = (repo / line[3:].strip().strip('"')).resolve()
+        # A leftover lease file is untracked by design and is exactly what this
+        # migration removes, so it cannot also be the reason it refuses to run.
+        if p.name == STALE_CLAIM:
+            continue
         if work.resolve() == p or work.resolve() in p.parents:
             dirty.append(str(p.relative_to(repo)))
     return sorted(dirty)
 
 
+#: The file the deleted lease left beside a task. Nothing reads or writes one any
+#: more and git no longer filters it out of a commit, so a leftover would be committed
+#: by the next board write in its folder unless a migration removes it first.
+STALE_CLAIM = ".claim"
+
+
+def _stale_claims(root: Path) -> list:
+    """Every leftover lease file under the work tree."""
+    return sorted(root.rglob(STALE_CLAIM))
+
+
 def _archived_cuts(root: Path) -> list:
     """Cuts sitting in the archive's former home, `work/archive/versions/<cut>/`.
 
@@ -81,6 +96,7 @@ def cmd_migrate(args) -> int:
     archive = archive_dir(root)
     complete = complete_dir(root)
     cuts = _archived_cuts(root)
+    stale = _stale_claims(root)
 
     # The hard refusals. Two of anything means somebody has already started this,
     # or a repo has grown a second copy — and merging two trees is a judgement
@@ -104,6 +120,8 @@ def cmd_migrate(args) -> int:
         todo.append("versions/archive/ is created")
     if not complete.is_dir():
         todo.append("versions/complete/ is created")
+    if stale:
+        todo.append(f"{len(stale)} leftover lease file(s) are removed")
     if not todo:
         print(f"{rel(root, root)} is already on the current layout — nothing to do")
         return 0
@@ -116,6 +134,8 @@ def cmd_migrate(args) -> int:
             print(f"  {sum(1 for _ in old.rglob('task.md'))} task(s) would move")
         for c in cuts:
             print(f"  archived: {c.name}")
+        for p in stale:
+            print(f"  leftover lease file: {rel(p, root)}")
         return 0
 
     dirty = _uncommitted(repo, root)
@@ -182,6 +202,17 @@ def cmd_migrate(args) -> int:
         elif stale_home.is_dir() and not any(stale_home.iterdir()):
             stale_home.rmdir()
 
+    # Found again rather than reused: moving the backlog above carries any leftover
+    # inside it to a new path, and that branch reuses the name `stale` for its own list.
+    leftovers = _stale_claims(root)
+    if leftovers:
+        # Removed rather than moved: a lease said who held an item for a few hours,
+        # the commit history answers that for good now, and nothing reads one.
+        for p in leftovers:
+            p.unlink()
+        print(f"removed {len(leftovers)} leftover lease file(s) — who is on an item is "
+              f"read from the commit history now")
+
     print("done — commit this, then every machine working this repo needs a CLI "
           "new enough to read it")
     return 0