@appchy/jarvis 0.1.83 → 0.1.85

package/harness/harness/architecture.py

@@ -2,7 +2,7 @@ from pathlib import Path
 
 from . import ids
 from .tree import BACKLOG_END, BACKLOG_START, assets_dir, die, find_work_root, rel
-from .model import locate
+from .model import locate, missing
 from .registry import (DOMAIN_ORDER, _citation_counts, definition_sites,
                        domains_for_owner, hosts, locate_domain, locate_system,
                        scan_systems, systems_for_code)
@@ -248,7 +248,7 @@ def cmd_rules(args) -> int:
         die("usage: jarvis work rules --task <name>")
     t = locate(root, name)
     if not t:
-        die(f"no task named '{name}'")
+        die(missing(root, name))
     systems = systems_for_code(root, t.code) if t.code else []
     domains = domains_for_owner(root, t.owner)
     if not systems and not domains:

package/harness/harness/autonomy.py

@@ -28,7 +28,7 @@ from datetime import date
 from .tree import (BLOCKED, BUCKETS, DEFAULT_AUTONOMY_CEILING, TIER3_OWNERS,
                    TIER_MEANING, TIERS, die, find_work_root, rel)
 from .frontmatter import as_list, parse_frontmatter, rewrite_file
-from .model import locate, record_session, scan
+from .model import locate, missing, record_session, scan
 from .generate import _sync
 from . import events, links
 
@@ -41,18 +41,30 @@ CEILING = DEFAULT_AUTONOMY_CEILING
 def derive_tier(owner: str, code: list, given=None) -> tuple:
     """A task's tier, and the one-line reason for it.
 
-    The floor comes from the tree, so it cannot be forgotten the way a hand-set
-    field can; `given` may raise it and is refused if it tries to lower it. Returns
-    `(tier, why)` — `why` is printed on refusal, because a floor that will not say
-    which signal set it is a floor people argue with.
+    Two numbers, and conflating them cost the vocabulary its bottom entry. The
+    DEFAULT is what a task gets when nobody says — an ordinary change, tier 1. The
+    FLOOR is the lowest anybody may set, and it comes from the tree so it cannot be
+    forgotten the way a hand-set field can. They are the same number only for an
+    owner that floors a task at 3.
+
+    Using the default as the floor made `--tier 0` refused every time, on a tier
+    that `TIERS` and `TIER_MEANING` both define and the method's own table
+    documents: reversible and local, a typo, a comment, a test name. Nothing about
+    autonomy changes — the ceiling is 2, so 0 and 1 are alike under it — and the
+    rule that matters is untouched: a task whose owner floors it at 3 still cannot
+    be talked down.
+
+    Returns `(tier, why)` — `why` is printed on refusal, because a floor that will
+    not say which signal set it is a floor people argue with.
     """
-    floor, why = 1, "default for an ordinary change"
+    floor, default, why = 0, 1, "default for an ordinary change"
     owner_root = (owner or "").split("/")[0]
     if owner_root in TIER3_OWNERS:
-        floor, why = 3, f"owner: {owner_root} — this domain is always tier 3"
+        floor = default = 3
+        why = f"owner: {owner_root} — this domain is always tier 3"
 
     if given is None:
-        return floor, why
+        return default, why
     try:
         want = int(str(given).strip())
     except ValueError:
@@ -63,7 +75,7 @@ def derive_tier(owner: str, code: list, given=None) -> tuple:
         die(f"--tier {want} is below this task's derived floor of {floor} ({why}).\n"
             f"       A tier may be raised, never lowered — a run that can talk its "
             f"own blast radius down has no ceiling at all.")
-    return want, ("as given" if want == floor else f"raised from {floor} ({why})")
+    return want, ("as given" if want == default else f"set from {default} ({why})")
 
 
 def tier_of(task) -> int:
@@ -129,7 +141,7 @@ def cmd_ask(args) -> int:
             "[--owner founder] [--durable]")
     task = locate(root, name)
     if not task:
-        die(f"no task named '{name}' found")
+        die(missing(root, name))
     if task.in_backlog:
         die(f"'{name}' is in backlog — a backlog task has no status to park. "
             f"Pull it into a version first.")
@@ -195,7 +207,7 @@ def cmd_answer(args) -> int:
         die("usage: jarvis work answer <task> --choose \"…\"")
     task = locate(root, name)
     if not task:
-        die(f"no task named '{name}' found")
+        die(missing(root, name))
     open_qs = _open_questions(task)
     if not open_qs:
         die(f"'{name}' has no open question — nothing to answer")

package/harness/harness/branches.py

@@ -82,8 +82,13 @@ def branches_of(repo, name: str) -> list:
     file and has never touched it is not where the work is happening. The trailers
     slice 1 started writing are what make this answerable at all.
     """
+    # `%at` rides along with `%aI` because the two answer different questions. The
+    # ISO stamp carries its author's own offset and is what a reader wants to see;
+    # comparing two of those AS TEXT compares wall clocks in different timezones, so
+    # a commit made earlier somewhere east presents as the newest. The epoch is the
+    # instant, and ordering is a question about instants.
     code, out, _ = git._git(
-        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an", "-E",
+        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an%x1f%at", "-E",
         f"--grep=^{git.ITEM}: {re.escape(name)}$", timeout=60)
     if code != 0 or not out.strip():
         return []
@@ -91,14 +96,19 @@ def branches_of(repo, name: str) -> list:
     seen = {}
     for line in out.splitlines():
         parts = line.split("\x1f")
-        if len(parts) < 3:
+        if len(parts) < 4:
             continue
         sha, when, who = parts[0], parts[1], parts[2]
+        try:
+            at = int(parts[3])
+        except ValueError:
+            continue
         for branch in _containing(repo, sha):
             prior = seen.get(branch)
-            if not prior or when > prior["when"]:
-                seen[branch] = {"branch": branch, "when": when, "by": who, "sha": sha[:12]}
-    return sorted(seen.values(), key=lambda b: b["when"], reverse=True)
+            if not prior or at > prior["at"]:
+                seen[branch] = {"branch": branch, "when": when, "by": who,
+                                "sha": sha[:12], "at": at}
+    return sorted(seen.values(), key=lambda b: b["at"], reverse=True)
 
 
 def _containing(repo, sha: str) -> list:
@@ -151,7 +161,11 @@ def refs_state(repo) -> dict:
     # back with the separator glued into its name and matched nothing. A space is
     # safe here because git forbids one in a ref name, and the strict date carries
     # none either.
-    code, out, _ = git._git(repo, "for-each-ref",
+    # GIT orders them, newest first. Sorting the strict ISO stamps here as text
+    # compared wall clocks rather than instants: each carries its author's own
+    # offset, so a ref committed at 10:00+03:00 sorted above one committed at
+    # 09:00+00:00 — two hours EARLIER — and `at` then read the wrong ref as current.
+    code, out, _ = git._git(repo, "for-each-ref", "--sort=-committerdate",
                             "--format=%(refname:short) %(committerdate:iso8601-strict)",
                             "refs/heads", "refs/remotes")
     refs = []
@@ -160,7 +174,6 @@ def refs_state(repo) -> dict:
             name, _, when = line.strip().partition(" ")
             if name and "HEAD" not in name:
                 refs.append({"ref": name, "when": when.strip()})
-    refs.sort(key=lambda r: r["when"], reverse=True)
     return {"refs": refs, "synced": synced, "current": current(repo)}
 
 

package/harness/harness/config.py

@@ -551,6 +551,11 @@ def _validate(cfg: dict) -> None:
         if Path(p).is_absolute() or ".." in Path(p).parts:
             raise ConfigError(f"git.paths entry {p!r} must be repo-relative and stay "
                               f"inside the repo")
+    shard = cfg["coverage"]["shard"]
+    if (not isinstance(shard, str) or not shard.strip()
+            or Path(shard).is_absolute() or ".." in Path(shard).parts):
+        raise ConfigError("coverage.shard must be a repo-relative directory where "
+                          "test runners drop their evidence, e.g. \".work/coverage\"")
     at = cfg["wrap"]["at_percent"]
     # 100 is refused along with 0: a reminder that arrives once the window is
     # already full has nowhere to write the handoff it is asking for.
@@ -608,7 +613,7 @@ def apply(cfg: dict) -> None:
     through `registry` → `ids`.
     """
     from . import (align, autonomy, coverage, gate, git, ids, kickoff, lint, registry,
-                   shift, task, tree)
+                   shard, shift, task, tree)
     ids.configure(cfg["ids"]["prefix"], tuple(cfg["ids"]["recognised"]),
                   bool(cfg["ids"]["undashed"]))
     git.GIT = dict(cfg["git"])
@@ -632,6 +637,11 @@ def apply(cfg: dict) -> None:
     tree.SKIP_DIRS = tree.SHIPPED_SKIP_DIRS | set(cfg["skip_dirs"])
     tree.TASK_TAGS_OK = tuple(cfg["tags"]["allowed"])
     coverage.VERIFY = dict(cfg["verify"])
+    # A DEFAULTED, DOCUMENTED key that nothing read: the reader hardcoded
+    # `.work/coverage`, so a repo that pointed its runners somewhere else got no
+    # error and no effect — and then `coverage` reported "no evidence" for every
+    # criterion a run had actually proved.
+    shard.DIR = cfg["coverage"]["shard"]
     gate.VERIFY = dict(cfg["verify"])
     task.PLANS_DIR = cfg["plans"]["dir"]
     autonomy.CEILING = cfg["autonomy"]["ceiling"]

package/harness/harness/coverage.py

@@ -31,6 +31,7 @@ from pathlib import Path
 
 from .lint import feature_ac_levels
 from .model import scan_features
+from . import shard
 from .shard import _load_run
 from .tree import find_work_root
 
@@ -81,7 +82,7 @@ def cmd_coverage(args) -> int:
         # that is why the scan in the suite checks command names too.
         lines = [f"    {cmd}" + (f"        ({name})" if name else "")
                  for name, cmd in sorted(VERIFY.items())]
-        print("\n  no run found — `.work/coverage/` is empty.\n"
+        print(f"\n  no run found — `{shard.DIR}/` is empty.\n"
               "  Evidence is a fresh run, so produce one first:\n"
               + ("\n".join(lines) if lines
                  else "    (no `verify` commands configured — add them to "
@@ -90,7 +91,8 @@ def cmd_coverage(args) -> int:
 
     only = args.get("feature")
     rows, totals = [], {"declared": 0, "built": 0, "proven": 0, "failed": 0,
-                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unlevelled": 0}
+                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unbuilt": 0,
+                        "unlevelled": 0}
     mismatched = []
 
     for md in sorted(scan_features(root)):
@@ -138,8 +140,15 @@ def cmd_coverage(args) -> int:
         totals["gap"] += len(gap)
         totals["ahead"] += len(ahead)
         totals["eyes"] += len(eyes)
+        # COUNTED, not derived from `declared - built`. An eyes-on criterion is
+        # built and comes out of the ratio, so subtracting the ratio's denominator
+        # reported every one of them as behaviour nobody had written yet.
+        totals["unbuilt"] += len(declared - built)
         totals["unlevelled"] += sum(1 for ac in declared if levels[ac][0] is None)
-        rows.append((name, len(built), len(proven), len(eyes),
+        # The column is the ratio's own denominator. Counting all of `built` here
+        # while the ratio counted `provable` made the table disagree with the number
+        # printed under it, by exactly the eyes-on criteria.
+        rows.append((name, len(provable), len(proven), len(eyes),
                      len(built & todo), len(declared - built),
                      sorted(failed), sorted(gap), sorted(ahead)))
 
@@ -189,7 +198,7 @@ def cmd_coverage(args) -> int:
           f"  excuse — no assertion is evidence about weight, colour or rhythm — so\n"
           f"  these sit beside the ratio with the dated ✔ in the feature file as their\n"
           f"  evidence, never inside it.\n")
-    print(f"  Not built yet: {t['declared'] - t['built']} of {t['declared']} promises. "
+    print(f"  Not built yet: {t['unbuilt']} of {t['declared']} promises. "
           f"That is a roadmap, NOT a coverage hole —\n"
           f"  an unticked criterion is behaviour nobody has written, so counting it\n"
           f"  against coverage measures ambition rather than honesty.\n")

package/harness/harness/epic.py

@@ -192,12 +192,17 @@ def cmd_epic_move(args) -> int:
             for t in moved:
                 shutil.move(str(dest / t.name), str(queue / t.name))
 
+    # Only a PLANNED epic has a plan doc to stamp. A released cut has had every
+    # `epic.md` removed, so an epic promoted out of one arrives with nothing to
+    # write — and reading it anyway raised after the folders had already moved,
+    # leaving a half-moved tree no CLI command could put back.
     md = dest / "epic.md"
-    rewrite_file(
-        md,
-        lambda d: d.update({"updated": date.today().isoformat()}),
-        EPIC_FM_ORDER,
-    )
+    if md.is_file():
+        rewrite_file(
+            md,
+            lambda d: d.update({"updated": date.today().isoformat()}),
+            EPIC_FM_ORDER,
+        )
     print(f"pulled epic '{name}' ({was}) -> {rel(dest, root)}  "
           f"with {len(moved)} task(s)")
     _sync(root)
@@ -211,6 +216,12 @@ def cmd_epic_release(root, version) -> int:
     holds the plan. Called from `cmd_release`, never on its own."""
     removed = []
     for e in version.epics:
+        # An epic with no plan doc is already in the shape this produces — a folder
+        # grouping tasks. Unlinking regardless raised AFTER `released:` had been
+        # stamped, so the cut read as released while every other epic kept the file
+        # this exists to remove.
+        if not e.planned:
+            continue
         e.md.unlink()
         removed.append(e.name)
     if removed:

package/harness/harness/events.py

@@ -49,6 +49,14 @@ LOG = ".events.jsonl"
 #: replicated one is a claim two endpoints both believe they have.
 HOLDS = ("claimed", "released-claim")
 
+#: Events no commit ever carries. The holds above, and a REFUSAL — which changed
+#: nothing, so there is no commit for it to ride on. Buffering a refusal made the
+#: git seam see work waiting for a commit while the tree was untouched, and report
+#: the change as "carried by a board write that committed a moment earlier": a
+#: refused completion, told its work was safely in git under somebody else's commit,
+#: when nothing had been written and nothing committed.
+UNCOMMITTED = HOLDS + ("gate-refused",)
+
 #: What this command has done so far, waiting for the commit that carries it. Only
 #: used under git; a process runs one command, so one buffer is one commit.
 _PENDING: list = []
@@ -90,9 +98,15 @@ def instance_id() -> str:
 def append(root: Path, kind: str, name: str, **fields) -> None:
     """Append one line. Never raises: a failure to record must not fail the work
     that was recorded — the mutation already happened, and dying here would leave
-    the tree changed and the caller told it failed."""
-    if kind not in KINDS:
-        raise ValueError(f"unknown event kind '{kind}' — one of {', '.join(KINDS)}")
+    the tree changed and the caller told it failed.
+
+    A kind outside `KINDS` is recorded anyway rather than refused. The closed list
+    still exists, and is still the point — a typo'd kind is a line that never shows
+    up in a digest — but the place to catch it is the SUITE, which reads every call
+    site out of this package's own source. Raising here caught it in front of a user
+    instead, after the tree had already changed, on a promise this docstring makes
+    in its first sentence.
+    """
     entry = {"ts": _now(), "event": kind, "name": name}
     who = instance_id()
     if who:
@@ -102,7 +116,7 @@ def append(root: Path, kind: str, name: str, **fields) -> None:
     # the bucket already states.
     entry.update({k: v for k, v in fields.items() if v not in (None, "", [], {})})
     if git.enabled():
-        if kind not in HOLDS:
+        if kind not in UNCOMMITTED:
             _PENDING.append(entry)
         return
     try:

package/harness/harness/gate.py

@@ -33,7 +33,7 @@ from pathlib import Path
 
 from .tree import die, find_work_root
 from .frontmatter import as_list, parse_frontmatter, rewrite_file, split_frontmatter
-from .model import locate
+from .model import locate, missing
 from .shard import _load_run
 from . import events, git, peers
 from .autonomy import tier_of
@@ -277,7 +277,7 @@ def _execute(root, name) -> tuple:
     _write_run(root, data)
 
     if name and not _record(root, name, results, ok, sha):
-        die(f"no task named '{name}' found")
+        die(missing(root, name))
     return results, ok, sha
 
 
@@ -530,7 +530,7 @@ def cmd_observed(args) -> int:
         die(f"--ac must look like 'AC-01' (got '{ac}')")
     task = locate(root, name)
     if not task:
-        die(f"no task named '{name}' found")
+        die(missing(root, name))
     entry = f"{date.today().isoformat()}  {ac}  {saw}"
     md = task.folder / "task.md"
 

package/harness/harness/git.py

@@ -78,15 +78,22 @@ def _flat(value) -> str:
     return str(value).replace("\n", " ").replace("\r", " ").replace(SEP, " - ")
 
 
-#: Commands that read the origin before they act. Performance only: what gets
-#: COMMITTED is driven by what actually changed, so a name missing from this set
-#: costs a stale pre-pull and can never cost a write. `sync` is absent because it
-#: refreshes on its own, and being in both places is two fetches for one command.
+#: EVERY COMMAND THAT CHANGES THE BOARD, and the whole of what the git seam acts on:
+#: these pull before they act and commit what they wrote, and no other command does
+#: either. A name missing from here is a command that mutates the tree and never
+#: lands it — the exact hole the commit-on-every-write guarantee exists to close — so
+#: adding a mutating command means adding it here, and the suite checks that every
+#: command outside this set leaves the tree untouched.
+#:
+#: `new` and `task-new` are one verb and both spellings are listed, because the
+#: dispatcher matches on what was typed. `sync` is absent although it reaches the
+#: origin: it refreshes and sends on its own, and being in both places is two fetches
+#: for one command.
 WRITES = frozenset({
-    "task-new", "epic-new", "feature-new", "version-new", "domain-new", "system-new",
-    "place", "move", "handoff", "plan", "session", "release", "archive",
-    "next", "drop", "ask", "answer", "verify", "observed", "id-new", "readme",
-    "migrate-owner",
+    "task-new", "new", "epic-new", "feature-new", "version-new", "domain-new",
+    "system-new", "place", "move", "handoff", "plan", "session", "release",
+    "archive", "next", "drop", "ask", "answer", "verify", "observed", "id-new",
+    "readme", "init", "migrate",
 })
 
 
@@ -658,20 +665,37 @@ def _push(repo) -> tuple:
                    f"`{cli()} sync` sends it when you can reach {remote}.")
 
 
+#: Git's own complaint, wherever it sits in the stream. It is extracted rather than
+#: read off the first line because the first lines are a fetch banner and a progress
+#: counter — and the counter carries no newline, so `Rebasing (1/1)error: could not
+#: apply …` arrives as ONE line with the reason buried at the end of it. Measured
+#: under four concurrent board writes: three refusals in a row explained themselves
+#: as "From /tmp/…/origin", "warning: fetch updated the current branch head.." and
+#: "Rebasing (1/4)." — three non-answers to the only question being asked.
+_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
+
+
 def _why_no_rebase(err: str) -> str:
     """Why the rebase onto the moved branch did not run, in the caller's terms.
 
-    The common case is not a conflict at all: the branch moved while the session had
-    uncommitted work open, and git declines to rebase over it. That reads as a scary
+    The common case is not a conflict at all: the branch moved while something in the
+    tree was uncommitted, and git declines to rebase over it. That reads as a scary
     failure and is an ordinary one, so it is named separately and says what to do —
     the board commit is already in git, and only the push is waiting.
     """
     if re.search(r"unstaged changes|uncommitted changes|cannot pull with rebase|"
                  r"cannot rebase.*(dirty|unstaged)", err, re.I):
-        return ("the branch moved, and your own uncommitted edits are in the way of "
-                "rebasing onto it — nothing was moved or stashed; commit them and the "
-                "next board write pushes both")
-    return f"the branch moved and the rebase onto it did not apply: {_tail(err)}"
+        # NOT "your own edits". Measured with four writers racing: what was in the
+        # way was another board write's task.md, created and not yet committed. A
+        # message that names the reader as the owner of somebody else's file sends
+        # them looking for work they do not have.
+        return ("the branch moved, and uncommitted changes in this checkout are in "
+                "the way of rebasing onto it — nothing was moved or stashed. They "
+                "may be yours or another board write that has not committed yet; "
+                "commit what is yours and the next board write pushes both")
+    m = _COMPLAINT.search(err or "")
+    return ("the branch moved and the rebase onto it did not apply: "
+            f"{m.group(1).strip()[:200] if m else _tail(err)}")
 
 
 def _message(item: str, rows: list) -> tuple:
@@ -755,6 +779,9 @@ def _events(record: str) -> list:
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
     out = []
+    # How many of this kind have been handed out already, so the second `verified`
+    # in a commit gets the second body line rather than the first's.
+    taken: dict = {}
     for kind in kinds:
         e = {"ts": _utc(when), "event": kind, "name": item, "sha": sha[:12],
              "author": author}
@@ -762,7 +789,11 @@ def _events(record: str) -> list:
             e["by"] = who
         if host:
             e["machine"] = host
-        e.update(details.get(kind) or {})
+        payloads = details.get(kind) or []
+        i = taken.get(kind, 0)
+        if i < len(payloads):
+            e.update(payloads[i])
+        taken[kind] = i + 1
         out.append(e)
     return out
 
@@ -822,27 +853,35 @@ def _trailers(message: str) -> dict:
 
 
 def _details(message: str, kinds) -> dict:
-    """The body's per-event payload, matched back to its event by name.
+    """The body's per-event payloads, matched back to their events by name — as a
+    LIST per kind, in the order the body carries them.
 
     A round trip rather than prose, so `log`, `digest` and `status` print the same
     thing whichever backend the repo runs. `_flat` is what makes it safe: the
     separator can never appear inside a value, so a question with an odd character
     in it comes back whole instead of splitting into a field nobody wrote.
+
+    One payload per KIND was the earlier shape, and a command can record two events
+    of one kind in a single commit — `verify` files one `verified` per gate. The
+    second line was dropped and both events came back wearing the first's fields, so
+    a digest read one gate's result twice and never reported the other at all. The
+    body is written one line per event in order, so position within a kind is exactly
+    the pairing.
     """
-    out = {}
+    out: dict = {}
     for line in message.splitlines():
         line = line.strip()
         if _TRAILER.match(line):
             continue
         head, _, rest = line.partition("  ")
-        if head not in kinds or not rest.strip() or head in out:
+        if head not in kinds:
             continue
         fields = {}
         for chunk in rest.split(SEP):
             key, sign, value = chunk.partition("=")
             if sign and key.strip():
                 fields[key.strip()] = value.strip()
-        out[head] = fields
+        out.setdefault(head, []).append(fields)
     return out
 
 

package/harness/harness/kickoff.py

@@ -23,7 +23,7 @@ assuming a fresh session infers it.
 """
 from pathlib import Path
 
-from .model import locate
+from .model import locate, missing
 from .tree import cli, die, find_work_root, rel
 
 #: `graph.mcp`, `session.mcp`, `session.tool`, `spine.*`, `instructions.skill` —
@@ -182,7 +182,7 @@ def cmd_kickoff(args) -> int:
     root = find_work_root()
     task = locate(root, args["name"])
     if not task:
-        die(f"no task named '{args['name']}' found")
+        die(missing(root, args["name"]))
     prompt = build_prompt(task, root, args.get("next"), args.get("watch"))
 
     # `--prompt-only` is the pipe. Everything else this command prints is

package/harness/harness/lint.py

@@ -12,7 +12,7 @@ from .tree import (
     TASK_REGION_CAP,
 )
 from .frontmatter import as_list, parse_frontmatter, split_frontmatter
-from .model import locate_feature, scan, scan_features
+from .model import locate_feature, scan, scan_features, scan_filed
 from .registry import code_vocabulary, locate_domain
 
 #: The MCP server this repo names as its graph engine, bound by `config.apply`.
@@ -318,10 +318,9 @@ def _owner_ref_lint(root: Path, s: dict) -> list:
     for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
         # The rename warning is ACTIVE work only — a completed task's frontmatter
         # is frozen history, and 90 lines of migration noise makes `list` unreadable.
-        # `migrate-owner` rewrites every task regardless of bucket.
         if t.legacy_product and t.status in (None,) + ACTIVE:
             warns.append(f"{t.name}: `product:` is the old spelling — rename the "
-                         f"key to `owner:` (`jarvis work migrate-owner` does it)")
+                         f"key to `owner:` in its task.md")
         value = t.owner
         if not value:
             continue  # empty is _graph_lint's warning, and only for active work
@@ -483,7 +482,13 @@ def _coverage_lint(root: Path, s: dict) -> list:
         return warns
 
     covered: dict = {}
-    for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
+    # The cuts that have LEFT the board carry evidence too — a criterion delivered
+    # by a task in a shipped cut is delivered. Reading the live board alone turned
+    # filing a cut into a permanent warning about every AC it delivered, with no
+    # way left to satisfy it.
+    filed = [task for v in scan_filed(root) for task in v.all_tasks()]
+    for t in ([task for v in s["versions"] for task in v.all_tasks()]
+              + s["backlog"] + filed):
         if t.status != "complete" or not t.covers:
             continue
         if t.owner: