@appchy/jarvis 0.1.84 → 0.1.85

package/dist/bin.js

@@ -10114,7 +10114,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "797d33f";
+var SHA = "f9f9db3";
 var BUILT = "2026-09-11";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/autonomy.py

@@ -41,18 +41,30 @@ CEILING = DEFAULT_AUTONOMY_CEILING
 def derive_tier(owner: str, code: list, given=None) -> tuple:
     """A task's tier, and the one-line reason for it.
 
-    The floor comes from the tree, so it cannot be forgotten the way a hand-set
-    field can; `given` may raise it and is refused if it tries to lower it. Returns
-    `(tier, why)` — `why` is printed on refusal, because a floor that will not say
-    which signal set it is a floor people argue with.
+    Two numbers, and conflating them cost the vocabulary its bottom entry. The
+    DEFAULT is what a task gets when nobody says — an ordinary change, tier 1. The
+    FLOOR is the lowest anybody may set, and it comes from the tree so it cannot be
+    forgotten the way a hand-set field can. They are the same number only for an
+    owner that floors a task at 3.
+
+    Using the default as the floor made `--tier 0` refused every time, on a tier
+    that `TIERS` and `TIER_MEANING` both define and the method's own table
+    documents: reversible and local, a typo, a comment, a test name. Nothing about
+    autonomy changes — the ceiling is 2, so 0 and 1 are alike under it — and the
+    rule that matters is untouched: a task whose owner floors it at 3 still cannot
+    be talked down.
+
+    Returns `(tier, why)` — `why` is printed on refusal, because a floor that will
+    not say which signal set it is a floor people argue with.
     """
-    floor, why = 1, "default for an ordinary change"
+    floor, default, why = 0, 1, "default for an ordinary change"
     owner_root = (owner or "").split("/")[0]
     if owner_root in TIER3_OWNERS:
-        floor, why = 3, f"owner: {owner_root} — this domain is always tier 3"
+        floor = default = 3
+        why = f"owner: {owner_root} — this domain is always tier 3"
 
     if given is None:
-        return floor, why
+        return default, why
     try:
         want = int(str(given).strip())
     except ValueError:
@@ -63,7 +75,7 @@ def derive_tier(owner: str, code: list, given=None) -> tuple:
         die(f"--tier {want} is below this task's derived floor of {floor} ({why}).\n"
             f"       A tier may be raised, never lowered — a run that can talk its "
             f"own blast radius down has no ceiling at all.")
-    return want, ("as given" if want == floor else f"raised from {floor} ({why})")
+    return want, ("as given" if want == default else f"set from {default} ({why})")
 
 
 def tier_of(task) -> int:

package/harness/harness/branches.py

@@ -82,8 +82,13 @@ def branches_of(repo, name: str) -> list:
     file and has never touched it is not where the work is happening. The trailers
     slice 1 started writing are what make this answerable at all.
     """
+    # `%at` rides along with `%aI` because the two answer different questions. The
+    # ISO stamp carries its author's own offset and is what a reader wants to see;
+    # comparing two of those AS TEXT compares wall clocks in different timezones, so
+    # a commit made earlier somewhere east presents as the newest. The epoch is the
+    # instant, and ordering is a question about instants.
     code, out, _ = git._git(
-        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an", "-E",
+        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an%x1f%at", "-E",
         f"--grep=^{git.ITEM}: {re.escape(name)}$", timeout=60)
     if code != 0 or not out.strip():
         return []
@@ -91,14 +96,19 @@ def branches_of(repo, name: str) -> list:
     seen = {}
     for line in out.splitlines():
         parts = line.split("\x1f")
-        if len(parts) < 3:
+        if len(parts) < 4:
             continue
         sha, when, who = parts[0], parts[1], parts[2]
+        try:
+            at = int(parts[3])
+        except ValueError:
+            continue
         for branch in _containing(repo, sha):
             prior = seen.get(branch)
-            if not prior or when > prior["when"]:
-                seen[branch] = {"branch": branch, "when": when, "by": who, "sha": sha[:12]}
-    return sorted(seen.values(), key=lambda b: b["when"], reverse=True)
+            if not prior or at > prior["at"]:
+                seen[branch] = {"branch": branch, "when": when, "by": who,
+                                "sha": sha[:12], "at": at}
+    return sorted(seen.values(), key=lambda b: b["at"], reverse=True)
 
 
 def _containing(repo, sha: str) -> list:
@@ -151,7 +161,11 @@ def refs_state(repo) -> dict:
     # back with the separator glued into its name and matched nothing. A space is
     # safe here because git forbids one in a ref name, and the strict date carries
     # none either.
-    code, out, _ = git._git(repo, "for-each-ref",
+    # GIT orders them, newest first. Sorting the strict ISO stamps here as text
+    # compared wall clocks rather than instants: each carries its author's own
+    # offset, so a ref committed at 10:00+03:00 sorted above one committed at
+    # 09:00+00:00 — two hours EARLIER — and `at` then read the wrong ref as current.
+    code, out, _ = git._git(repo, "for-each-ref", "--sort=-committerdate",
                             "--format=%(refname:short) %(committerdate:iso8601-strict)",
                             "refs/heads", "refs/remotes")
     refs = []
@@ -160,7 +174,6 @@ def refs_state(repo) -> dict:
             name, _, when = line.strip().partition(" ")
             if name and "HEAD" not in name:
                 refs.append({"ref": name, "when": when.strip()})
-    refs.sort(key=lambda r: r["when"], reverse=True)
     return {"refs": refs, "synced": synced, "current": current(repo)}
 
 

package/harness/harness/config.py

@@ -551,6 +551,11 @@ def _validate(cfg: dict) -> None:
         if Path(p).is_absolute() or ".." in Path(p).parts:
             raise ConfigError(f"git.paths entry {p!r} must be repo-relative and stay "
                               f"inside the repo")
+    shard = cfg["coverage"]["shard"]
+    if (not isinstance(shard, str) or not shard.strip()
+            or Path(shard).is_absolute() or ".." in Path(shard).parts):
+        raise ConfigError("coverage.shard must be a repo-relative directory where "
+                          "test runners drop their evidence, e.g. \".work/coverage\"")
     at = cfg["wrap"]["at_percent"]
     # 100 is refused along with 0: a reminder that arrives once the window is
     # already full has nowhere to write the handoff it is asking for.
@@ -608,7 +613,7 @@ def apply(cfg: dict) -> None:
     through `registry` → `ids`.
     """
     from . import (align, autonomy, coverage, gate, git, ids, kickoff, lint, registry,
-                   shift, task, tree)
+                   shard, shift, task, tree)
     ids.configure(cfg["ids"]["prefix"], tuple(cfg["ids"]["recognised"]),
                   bool(cfg["ids"]["undashed"]))
     git.GIT = dict(cfg["git"])
@@ -632,6 +637,11 @@ def apply(cfg: dict) -> None:
     tree.SKIP_DIRS = tree.SHIPPED_SKIP_DIRS | set(cfg["skip_dirs"])
     tree.TASK_TAGS_OK = tuple(cfg["tags"]["allowed"])
     coverage.VERIFY = dict(cfg["verify"])
+    # A DEFAULTED, DOCUMENTED key that nothing read: the reader hardcoded
+    # `.work/coverage`, so a repo that pointed its runners somewhere else got no
+    # error and no effect — and then `coverage` reported "no evidence" for every
+    # criterion a run had actually proved.
+    shard.DIR = cfg["coverage"]["shard"]
     gate.VERIFY = dict(cfg["verify"])
     task.PLANS_DIR = cfg["plans"]["dir"]
     autonomy.CEILING = cfg["autonomy"]["ceiling"]

package/harness/harness/coverage.py

@@ -31,6 +31,7 @@ from pathlib import Path
 
 from .lint import feature_ac_levels
 from .model import scan_features
+from . import shard
 from .shard import _load_run
 from .tree import find_work_root
 
@@ -81,7 +82,7 @@ def cmd_coverage(args) -> int:
         # that is why the scan in the suite checks command names too.
         lines = [f"    {cmd}" + (f"        ({name})" if name else "")
                  for name, cmd in sorted(VERIFY.items())]
-        print("\n  no run found — `.work/coverage/` is empty.\n"
+        print(f"\n  no run found — `{shard.DIR}/` is empty.\n"
               "  Evidence is a fresh run, so produce one first:\n"
               + ("\n".join(lines) if lines
                  else "    (no `verify` commands configured — add them to "
@@ -90,7 +91,8 @@ def cmd_coverage(args) -> int:
 
     only = args.get("feature")
     rows, totals = [], {"declared": 0, "built": 0, "proven": 0, "failed": 0,
-                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unlevelled": 0}
+                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unbuilt": 0,
+                        "unlevelled": 0}
     mismatched = []
 
     for md in sorted(scan_features(root)):
@@ -138,8 +140,15 @@ def cmd_coverage(args) -> int:
         totals["gap"] += len(gap)
         totals["ahead"] += len(ahead)
         totals["eyes"] += len(eyes)
+        # COUNTED, not derived from `declared - built`. An eyes-on criterion is
+        # built and comes out of the ratio, so subtracting the ratio's denominator
+        # reported every one of them as behaviour nobody had written yet.
+        totals["unbuilt"] += len(declared - built)
         totals["unlevelled"] += sum(1 for ac in declared if levels[ac][0] is None)
-        rows.append((name, len(built), len(proven), len(eyes),
+        # The column is the ratio's own denominator. Counting all of `built` here
+        # while the ratio counted `provable` made the table disagree with the number
+        # printed under it, by exactly the eyes-on criteria.
+        rows.append((name, len(provable), len(proven), len(eyes),
                      len(built & todo), len(declared - built),
                      sorted(failed), sorted(gap), sorted(ahead)))
 
@@ -189,7 +198,7 @@ def cmd_coverage(args) -> int:
           f"  excuse — no assertion is evidence about weight, colour or rhythm — so\n"
           f"  these sit beside the ratio with the dated ✔ in the feature file as their\n"
           f"  evidence, never inside it.\n")
-    print(f"  Not built yet: {t['declared'] - t['built']} of {t['declared']} promises. "
+    print(f"  Not built yet: {t['unbuilt']} of {t['declared']} promises. "
           f"That is a roadmap, NOT a coverage hole —\n"
           f"  an unticked criterion is behaviour nobody has written, so counting it\n"
           f"  against coverage measures ambition rather than honesty.\n")

package/harness/harness/epic.py

@@ -192,12 +192,17 @@ def cmd_epic_move(args) -> int:
             for t in moved:
                 shutil.move(str(dest / t.name), str(queue / t.name))
 
+    # Only a PLANNED epic has a plan doc to stamp. A released cut has had every
+    # `epic.md` removed, so an epic promoted out of one arrives with nothing to
+    # write — and reading it anyway raised after the folders had already moved,
+    # leaving a half-moved tree no CLI command could put back.
     md = dest / "epic.md"
-    rewrite_file(
-        md,
-        lambda d: d.update({"updated": date.today().isoformat()}),
-        EPIC_FM_ORDER,
-    )
+    if md.is_file():
+        rewrite_file(
+            md,
+            lambda d: d.update({"updated": date.today().isoformat()}),
+            EPIC_FM_ORDER,
+        )
     print(f"pulled epic '{name}' ({was}) -> {rel(dest, root)}  "
           f"with {len(moved)} task(s)")
     _sync(root)
@@ -211,6 +216,12 @@ def cmd_epic_release(root, version) -> int:
     holds the plan. Called from `cmd_release`, never on its own."""
     removed = []
     for e in version.epics:
+        # An epic with no plan doc is already in the shape this produces — a folder
+        # grouping tasks. Unlinking regardless raised AFTER `released:` had been
+        # stamped, so the cut read as released while every other epic kept the file
+        # this exists to remove.
+        if not e.planned:
+            continue
         e.md.unlink()
         removed.append(e.name)
     if removed:

package/harness/harness/events.py

@@ -49,6 +49,14 @@ LOG = ".events.jsonl"
 #: replicated one is a claim two endpoints both believe they have.
 HOLDS = ("claimed", "released-claim")
 
+#: Events no commit ever carries. The holds above, and a REFUSAL — which changed
+#: nothing, so there is no commit for it to ride on. Buffering a refusal made the
+#: git seam see work waiting for a commit while the tree was untouched, and report
+#: the change as "carried by a board write that committed a moment earlier": a
+#: refused completion, told its work was safely in git under somebody else's commit,
+#: when nothing had been written and nothing committed.
+UNCOMMITTED = HOLDS + ("gate-refused",)
+
 #: What this command has done so far, waiting for the commit that carries it. Only
 #: used under git; a process runs one command, so one buffer is one commit.
 _PENDING: list = []
@@ -90,9 +98,15 @@ def instance_id() -> str:
 def append(root: Path, kind: str, name: str, **fields) -> None:
     """Append one line. Never raises: a failure to record must not fail the work
     that was recorded — the mutation already happened, and dying here would leave
-    the tree changed and the caller told it failed."""
-    if kind not in KINDS:
-        raise ValueError(f"unknown event kind '{kind}' — one of {', '.join(KINDS)}")
+    the tree changed and the caller told it failed.
+
+    A kind outside `KINDS` is recorded anyway rather than refused. The closed list
+    still exists, and is still the point — a typo'd kind is a line that never shows
+    up in a digest — but the place to catch it is the SUITE, which reads every call
+    site out of this package's own source. Raising here caught it in front of a user
+    instead, after the tree had already changed, on a promise this docstring makes
+    in its first sentence.
+    """
     entry = {"ts": _now(), "event": kind, "name": name}
     who = instance_id()
     if who:
@@ -102,7 +116,7 @@ def append(root: Path, kind: str, name: str, **fields) -> None:
     # the bucket already states.
     entry.update({k: v for k, v in fields.items() if v not in (None, "", [], {})})
     if git.enabled():
-        if kind not in HOLDS:
+        if kind not in UNCOMMITTED:
             _PENDING.append(entry)
         return
     try:

package/harness/harness/git.py

@@ -78,15 +78,22 @@ def _flat(value) -> str:
     return str(value).replace("\n", " ").replace("\r", " ").replace(SEP, " - ")
 
 
-#: Commands that read the origin before they act. Performance only: what gets
-#: COMMITTED is driven by what actually changed, so a name missing from this set
-#: costs a stale pre-pull and can never cost a write. `sync` is absent because it
-#: refreshes on its own, and being in both places is two fetches for one command.
+#: EVERY COMMAND THAT CHANGES THE BOARD, and the whole of what the git seam acts on:
+#: these pull before they act and commit what they wrote, and no other command does
+#: either. A name missing from here is a command that mutates the tree and never
+#: lands it — the exact hole the commit-on-every-write guarantee exists to close — so
+#: adding a mutating command means adding it here, and the suite checks that every
+#: command outside this set leaves the tree untouched.
+#:
+#: `new` and `task-new` are one verb and both spellings are listed, because the
+#: dispatcher matches on what was typed. `sync` is absent although it reaches the
+#: origin: it refreshes and sends on its own, and being in both places is two fetches
+#: for one command.
 WRITES = frozenset({
-    "task-new", "epic-new", "feature-new", "version-new", "domain-new", "system-new",
-    "place", "move", "handoff", "plan", "session", "release", "archive",
-    "next", "drop", "ask", "answer", "verify", "observed", "id-new", "readme",
-    "migrate-owner",
+    "task-new", "new", "epic-new", "feature-new", "version-new", "domain-new",
+    "system-new", "place", "move", "handoff", "plan", "session", "release",
+    "archive", "next", "drop", "ask", "answer", "verify", "observed", "id-new",
+    "readme", "init", "migrate",
 })
 
 
@@ -658,20 +665,37 @@ def _push(repo) -> tuple:
                    f"`{cli()} sync` sends it when you can reach {remote}.")
 
 
+#: Git's own complaint, wherever it sits in the stream. It is extracted rather than
+#: read off the first line because the first lines are a fetch banner and a progress
+#: counter — and the counter carries no newline, so `Rebasing (1/1)error: could not
+#: apply …` arrives as ONE line with the reason buried at the end of it. Measured
+#: under four concurrent board writes: three refusals in a row explained themselves
+#: as "From /tmp/…/origin", "warning: fetch updated the current branch head.." and
+#: "Rebasing (1/4)." — three non-answers to the only question being asked.
+_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
+
+
 def _why_no_rebase(err: str) -> str:
     """Why the rebase onto the moved branch did not run, in the caller's terms.
 
-    The common case is not a conflict at all: the branch moved while the session had
-    uncommitted work open, and git declines to rebase over it. That reads as a scary
+    The common case is not a conflict at all: the branch moved while something in the
+    tree was uncommitted, and git declines to rebase over it. That reads as a scary
     failure and is an ordinary one, so it is named separately and says what to do —
     the board commit is already in git, and only the push is waiting.
     """
     if re.search(r"unstaged changes|uncommitted changes|cannot pull with rebase|"
                  r"cannot rebase.*(dirty|unstaged)", err, re.I):
-        return ("the branch moved, and your own uncommitted edits are in the way of "
-                "rebasing onto it — nothing was moved or stashed; commit them and the "
-                "next board write pushes both")
-    return f"the branch moved and the rebase onto it did not apply: {_tail(err)}"
+        # NOT "your own edits". Measured with four writers racing: what was in the
+        # way was another board write's task.md, created and not yet committed. A
+        # message that names the reader as the owner of somebody else's file sends
+        # them looking for work they do not have.
+        return ("the branch moved, and uncommitted changes in this checkout are in "
+                "the way of rebasing onto it — nothing was moved or stashed. They "
+                "may be yours or another board write that has not committed yet; "
+                "commit what is yours and the next board write pushes both")
+    m = _COMPLAINT.search(err or "")
+    return ("the branch moved and the rebase onto it did not apply: "
+            f"{m.group(1).strip()[:200] if m else _tail(err)}")
 
 
 def _message(item: str, rows: list) -> tuple:
@@ -755,6 +779,9 @@ def _events(record: str) -> list:
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
     out = []
+    # How many of this kind have been handed out already, so the second `verified`
+    # in a commit gets the second body line rather than the first's.
+    taken: dict = {}
     for kind in kinds:
         e = {"ts": _utc(when), "event": kind, "name": item, "sha": sha[:12],
              "author": author}
@@ -762,7 +789,11 @@ def _events(record: str) -> list:
             e["by"] = who
         if host:
             e["machine"] = host
-        e.update(details.get(kind) or {})
+        payloads = details.get(kind) or []
+        i = taken.get(kind, 0)
+        if i < len(payloads):
+            e.update(payloads[i])
+        taken[kind] = i + 1
         out.append(e)
     return out
 
@@ -822,27 +853,35 @@ def _trailers(message: str) -> dict:
 
 
 def _details(message: str, kinds) -> dict:
-    """The body's per-event payload, matched back to its event by name.
+    """The body's per-event payloads, matched back to their events by name — as a
+    LIST per kind, in the order the body carries them.
 
     A round trip rather than prose, so `log`, `digest` and `status` print the same
     thing whichever backend the repo runs. `_flat` is what makes it safe: the
     separator can never appear inside a value, so a question with an odd character
     in it comes back whole instead of splitting into a field nobody wrote.
+
+    One payload per KIND was the earlier shape, and a command can record two events
+    of one kind in a single commit — `verify` files one `verified` per gate. The
+    second line was dropped and both events came back wearing the first's fields, so
+    a digest read one gate's result twice and never reported the other at all. The
+    body is written one line per event in order, so position within a kind is exactly
+    the pairing.
     """
-    out = {}
+    out: dict = {}
     for line in message.splitlines():
         line = line.strip()
         if _TRAILER.match(line):
             continue
         head, _, rest = line.partition("  ")
-        if head not in kinds or not rest.strip() or head in out:
+        if head not in kinds:
             continue
         fields = {}
         for chunk in rest.split(SEP):
             key, sign, value = chunk.partition("=")
             if sign and key.strip():
                 fields[key.strip()] = value.strip()
-        out[head] = fields
+        out.setdefault(head, []).append(fields)
     return out
 
 

package/harness/harness/lint.py

@@ -12,7 +12,7 @@ from .tree import (
     TASK_REGION_CAP,
 )
 from .frontmatter import as_list, parse_frontmatter, split_frontmatter
-from .model import locate_feature, scan, scan_features
+from .model import locate_feature, scan, scan_features, scan_filed
 from .registry import code_vocabulary, locate_domain
 
 #: The MCP server this repo names as its graph engine, bound by `config.apply`.
@@ -318,10 +318,9 @@ def _owner_ref_lint(root: Path, s: dict) -> list:
     for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
         # The rename warning is ACTIVE work only — a completed task's frontmatter
         # is frozen history, and 90 lines of migration noise makes `list` unreadable.
-        # `migrate-owner` rewrites every task regardless of bucket.
         if t.legacy_product and t.status in (None,) + ACTIVE:
             warns.append(f"{t.name}: `product:` is the old spelling — rename the "
-                         f"key to `owner:` (`jarvis work migrate-owner` does it)")
+                         f"key to `owner:` in its task.md")
         value = t.owner
         if not value:
             continue  # empty is _graph_lint's warning, and only for active work
@@ -483,7 +482,13 @@ def _coverage_lint(root: Path, s: dict) -> list:
         return warns
 
     covered: dict = {}
-    for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
+    # The cuts that have LEFT the board carry evidence too — a criterion delivered
+    # by a task in a shipped cut is delivered. Reading the live board alone turned
+    # filing a cut into a permanent warning about every AC it delivered, with no
+    # way left to satisfy it.
+    filed = [task for v in scan_filed(root) for task in v.all_tasks()]
+    for t in ([task for v in s["versions"] for task in v.all_tasks()]
+              + s["backlog"] + filed):
         if t.status != "complete" or not t.covers:
             continue
         if t.owner:

package/harness/harness/report.py

@@ -1,13 +1,10 @@
-import re
-import subprocess
 import sys
 from pathlib import Path
 
-from .tree import find_work_root, rel
-from .frontmatter import _eol, read_item, split_frontmatter, write_item
+from .tree import find_work_root
 from .model import Task, _ordered, scan, scan_shipped
 from .lint import lint_warnings
-from .generate import _regen_readme, _sync, settle_epic_tier
+from .generate import _regen_readme, settle_epic_tier
 from .align import (_align_acceptance, _align_agents, _align_citations,
                     _align_definitions, _align_domains, _align_hosts,
                     _align_ledger_index, _align_retired, _align_single_feature,
@@ -192,52 +189,3 @@ def cmd_align(args) -> int:
     print(f"\n  {len(warns)} warning(s) · {len(errors)} error(s){tail} · exit 0   "
           f"(report-only — the flip to blocking is its own task)")
     return 0
-def cmd_migrate_owner(args) -> int:
-    """Mechanical, one-way: `product:` becomes `owner:`, and the retired `infra`
-    sentinel becomes the `operations` domain. Skips files with uncommitted
-    changes unless --force: the tree is shared, and silently rewriting another
-    session's open edit is how a rename eats work that was never committed."""
-    root = find_work_root()
-    repo = root.parent
-    dirty = set()
-    try:
-        out = subprocess.run(["git", "status", "--porcelain"], cwd=repo,
-                             capture_output=True, text=True, check=True).stdout
-        for line in out.splitlines():
-            if len(line) > 3:
-                dirty.add((repo / line[3:].strip().strip('"')).resolve())
-    except Exception:
-        pass  # not a git repo, or git unavailable — migrate everything
-
-    def _is_dirty(md: Path) -> bool:
-        """Git reports an untracked DIRECTORY as the directory, not its files, so
-        a plain membership test misses `work/.../new-task/task.md` inside a folder
-        another session just created. Match the path or any parent."""
-        p = md.resolve()
-        return any(d == p or d in p.parents for d in dirty)
-
-    changed, skipped = [], []
-    for md in sorted(root.rglob("task.md")):
-        text = read_item(md)
-        fm, body = split_frontmatter(text)
-        if fm is None or not re.search(r"^product:", fm, re.MULTILINE):
-            continue
-        if _is_dirty(md) and not args.get("force"):
-            skipped.append(rel(md, root))
-            continue
-        # Only the KEY is rewritten — the value and its spacing are untouched, so
-        # 105 files change one word each instead of churning frontmatter layout.
-        new_fm = re.sub(r"^product:", "owner:", fm, flags=re.MULTILINE)
-        eol = _eol(text)
-        write_item(md, f"---{eol}{new_fm}{eol}---{eol}{body}")
-        changed.append(rel(md, root))
-
-    print(f"renamed product: -> owner: in {len(changed)} task.md")
-    if skipped:
-        print(f"SKIPPED {len(skipped)} with uncommitted changes (another session "
-              f"may be editing them) — rerun after they land, or pass --force:")
-        for f in skipped:
-            print(f"  {f}")
-    if changed:
-        _sync(root)
-    return 0

package/harness/harness/safety.py

@@ -106,10 +106,21 @@ def cmd_id_new(args) -> int:
     # Walk forward rather than retrying the same number: a loser in the race wants
     # the NEXT number, and a leftover lock from a crashed session must not wedge the
     # allocator forever.
+    #
+    # THE SCAN IS REPEATED UNDER THE CLAIM, and that is what makes the lock work at
+    # all. The scan above is slow and happens outside it; the lock is released the
+    # moment the heading is written. So a second session that scanned before the
+    # first one wrote, and claimed after it released, found the number free twice
+    # and both wrote the same `### D-nn`. Re-deriving here costs one extra tree read
+    # on the one command that allocates, and it is the only moment at which the
+    # question "is this number still free" can be asked and acted on atomically.
     for candidate in range(n, n + 1000):
-        if _claim(root, candidate):
+        if not _claim(root, candidate):
+            continue
+        if candidate >= _next_free(root):
             n = candidate
             break
+        _release(root, candidate)
     else:                                             # pragma: no cover — defensive
         die("could not claim an id after 1000 attempts — check .work/ids/")
 

package/harness/harness/shard.py

@@ -14,6 +14,12 @@ from pathlib import Path
 from typing import NamedTuple
 
 
+#: Where runners drop their shards, from `coverage.shard` — set by `config.apply()`,
+#: the same way `coverage.VERIFY` is. A module global rather than an import, because
+#: this module is imported by three readers and importing config from here would
+#: close a cycle.
+DIR = ".work/coverage"
+
 #: Precedence when several sites claim one criterion — the SAME rank both
 #: reporters already apply within a single runner. Anything unrecognised ranks
 #: below `passed`, so a shard that learns a new status can never silently
@@ -72,7 +78,7 @@ def _load_run(repo: Path) -> Run:
     runners separately is exactly the drift this module ended.
     """
     read = Run({}, {}, [], [], [])
-    d = repo / ".work" / "coverage"
+    d = repo / DIR
     if not d.is_dir():
         return read
     for p in sorted(d.glob("*.json")):

package/harness/harness/shift.py

@@ -56,9 +56,15 @@ def read_claim(folder: Path):
     try:
         data = json.loads(p.read_text())
         expires = datetime.fromisoformat(str(data["expires"]))
-    except (OSError, ValueError, KeyError, json.JSONDecodeError):
-        return None
-    if expires <= _now():
+        # TypeError is in the list because the comparison below throws it, not the
+        # parse: a claim written without a timezone reads fine and then cannot be
+        # compared against an aware `now`. That raised out of a function whose whole
+        # contract is that an unreadable claim reads as absent — so a single
+        # malformed `.claim` took down every command that asks who holds an item,
+        # which is the fail-closed lock this was written to avoid being.
+        if expires <= _now():
+            return None
+    except (OSError, TypeError, ValueError, KeyError, json.JSONDecodeError):
         return None
     return data
 

package/harness/harness/task.py

@@ -16,7 +16,7 @@ from .scaffold import _check_kebab, _check_owner_ref, _check_priority, _check_un
 from .epic import _bucketed, cmd_epic_move, epic_for_task
 from .generate import _sync
 from .gate import delivery_gate, report_gate
-from .autonomy import derive_tier
+from .autonomy import _open_questions, derive_tier
 from . import events
 
 #: Where this repo keeps approved plan files, from `plans.dir` in config. None means
@@ -276,14 +276,20 @@ def cmd_move(args) -> int:
     to = args["status"]
     if to not in BUCKETS:
         die(f"status must be one of {', '.join(BUCKETS)}")
-    if to == BLOCKED:
-        die(f"`move {name} blocked` is not how a task blocks — a blocked task "
-            f"without a recorded question is one nobody can unblock. Use "
-            f"`jarvis work ask {name} --question \"…\"`.")
 
     task = locate(root, name)
     if not task:
         die(missing(root, name))
+    # The rule is right and the test used to be the wrong one: it asked whether you
+    # had just called `ask`, rather than whether the item has a question nobody has
+    # answered. So a task carrying its question in its own frontmatter — showing in
+    # `needs` at that moment — could not be put back into `blocked/` after somebody
+    # moved it out, which is exactly what a session does when it picks one up and
+    # finds the question still open.
+    if to == BLOCKED and not _open_questions(task):
+        die(f"`move {name} blocked` is not how a task blocks — a blocked task "
+            f"without a recorded question is one nobody can unblock. Use "
+            f"`jarvis work ask {name} --question \"…\"`.")
     if task.in_backlog:
         die(f"'{name}' is in backlog — pull it into a version first "
             f"(jarvis work place {name} --version <v>)")