@appchy/jarvis 0.1.84 → 0.1.86

package/dist/bin.js

@@ -10114,7 +10114,7 @@ import { createRequire as createRequire2 } from "module";
 var _require = createRequire2(import.meta.url);
 var VERSION2 = _require("../package.json").version ?? "0.0.0";
 var IS_DEV = String(_require("../package.json").name ?? "").endsWith("-dev");
-var SHA = "797d33f";
+var SHA = "5acb5ea";
 var BUILT = "2026-09-11";
 var BUILD = SHA ?? "source";
 var BUILD_LABEL = `${SHA ? `${VERSION2} (${SHA}${BUILT ? ` ${BUILT}` : ""})` : `${VERSION2} (source)`}${IS_DEV ? " \u2014 development build" : ""}`;

package/harness/harness/autonomy.py

@@ -41,18 +41,30 @@ CEILING = DEFAULT_AUTONOMY_CEILING
 def derive_tier(owner: str, code: list, given=None) -> tuple:
     """A task's tier, and the one-line reason for it.
 
-    The floor comes from the tree, so it cannot be forgotten the way a hand-set
-    field can; `given` may raise it and is refused if it tries to lower it. Returns
-    `(tier, why)` — `why` is printed on refusal, because a floor that will not say
-    which signal set it is a floor people argue with.
+    Two numbers, and conflating them cost the vocabulary its bottom entry. The
+    DEFAULT is what a task gets when nobody says — an ordinary change, tier 1. The
+    FLOOR is the lowest anybody may set, and it comes from the tree so it cannot be
+    forgotten the way a hand-set field can. They are the same number only for an
+    owner that floors a task at 3.
+
+    Using the default as the floor made `--tier 0` refused every time, on a tier
+    that `TIERS` and `TIER_MEANING` both define and the method's own table
+    documents: reversible and local, a typo, a comment, a test name. Nothing about
+    autonomy changes — the ceiling is 2, so 0 and 1 are alike under it — and the
+    rule that matters is untouched: a task whose owner floors it at 3 still cannot
+    be talked down.
+
+    Returns `(tier, why)` — `why` is printed on refusal, because a floor that will
+    not say which signal set it is a floor people argue with.
     """
-    floor, why = 1, "default for an ordinary change"
+    floor, default, why = 0, 1, "default for an ordinary change"
     owner_root = (owner or "").split("/")[0]
     if owner_root in TIER3_OWNERS:
-        floor, why = 3, f"owner: {owner_root} — this domain is always tier 3"
+        floor = default = 3
+        why = f"owner: {owner_root} — this domain is always tier 3"
 
     if given is None:
-        return floor, why
+        return default, why
     try:
         want = int(str(given).strip())
     except ValueError:
@@ -63,7 +75,7 @@ def derive_tier(owner: str, code: list, given=None) -> tuple:
         die(f"--tier {want} is below this task's derived floor of {floor} ({why}).\n"
             f"       A tier may be raised, never lowered — a run that can talk its "
             f"own blast radius down has no ceiling at all.")
-    return want, ("as given" if want == floor else f"raised from {floor} ({why})")
+    return want, ("as given" if want == default else f"set from {default} ({why})")
 
 
 def tier_of(task) -> int:

package/harness/harness/branches.py

@@ -82,8 +82,13 @@ def branches_of(repo, name: str) -> list:
     file and has never touched it is not where the work is happening. The trailers
     slice 1 started writing are what make this answerable at all.
     """
+    # `%at` rides along with `%aI` because the two answer different questions. The
+    # ISO stamp carries its author's own offset and is what a reader wants to see;
+    # comparing two of those AS TEXT compares wall clocks in different timezones, so
+    # a commit made earlier somewhere east presents as the newest. The epoch is the
+    # instant, and ordering is a question about instants.
     code, out, _ = git._git(
-        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an", "-E",
+        repo, "log", "--all", "--format=%H%x1f%aI%x1f%an%x1f%at", "-E",
         f"--grep=^{git.ITEM}: {re.escape(name)}$", timeout=60)
     if code != 0 or not out.strip():
         return []
@@ -91,14 +96,19 @@ def branches_of(repo, name: str) -> list:
     seen = {}
     for line in out.splitlines():
         parts = line.split("\x1f")
-        if len(parts) < 3:
+        if len(parts) < 4:
             continue
         sha, when, who = parts[0], parts[1], parts[2]
+        try:
+            at = int(parts[3])
+        except ValueError:
+            continue
         for branch in _containing(repo, sha):
             prior = seen.get(branch)
-            if not prior or when > prior["when"]:
-                seen[branch] = {"branch": branch, "when": when, "by": who, "sha": sha[:12]}
-    return sorted(seen.values(), key=lambda b: b["when"], reverse=True)
+            if not prior or at > prior["at"]:
+                seen[branch] = {"branch": branch, "when": when, "by": who,
+                                "sha": sha[:12], "at": at}
+    return sorted(seen.values(), key=lambda b: b["at"], reverse=True)
 
 
 def _containing(repo, sha: str) -> list:
@@ -151,7 +161,11 @@ def refs_state(repo) -> dict:
     # back with the separator glued into its name and matched nothing. A space is
     # safe here because git forbids one in a ref name, and the strict date carries
     # none either.
-    code, out, _ = git._git(repo, "for-each-ref",
+    # GIT orders them, newest first. Sorting the strict ISO stamps here as text
+    # compared wall clocks rather than instants: each carries its author's own
+    # offset, so a ref committed at 10:00+03:00 sorted above one committed at
+    # 09:00+00:00 — two hours EARLIER — and `at` then read the wrong ref as current.
+    code, out, _ = git._git(repo, "for-each-ref", "--sort=-committerdate",
                             "--format=%(refname:short) %(committerdate:iso8601-strict)",
                             "refs/heads", "refs/remotes")
     refs = []
@@ -160,7 +174,6 @@ def refs_state(repo) -> dict:
             name, _, when = line.strip().partition(" ")
             if name and "HEAD" not in name:
                 refs.append({"ref": name, "when": when.strip()})
-    refs.sort(key=lambda r: r["when"], reverse=True)
     return {"refs": refs, "synced": synced, "current": current(repo)}
 
 

package/harness/harness/config.py

@@ -548,9 +548,13 @@ def _validate(cfg: dict) -> None:
         # would commit files nobody asked about. Refused at load, where it is one
         # message, rather than at the commit, where it is a surprise in somebody's
         # history.
-        if Path(p).is_absolute() or ".." in Path(p).parts:
+        if _escapes(p):
             raise ConfigError(f"git.paths entry {p!r} must be repo-relative and stay "
                               f"inside the repo")
+    shard = cfg["coverage"]["shard"]
+    if not isinstance(shard, str) or not shard.strip() or _escapes(shard):
+        raise ConfigError("coverage.shard must be a repo-relative directory where "
+                          "test runners drop their evidence, e.g. \".work/coverage\"")
     at = cfg["wrap"]["at_percent"]
     # 100 is refused along with 0: a reminder that arrives once the window is
     # already full has nowhere to write the handoff it is asking for.
@@ -582,6 +586,19 @@ def _validate(cfg: dict) -> None:
                           "session up, or null to remind without naming one")
 
 
+def _escapes(value: str) -> bool:
+    """Could this path reach outside the repo it is written in?
+
+    Every path a repo names in its config is joined onto the repo root, so an
+    absolute one silently becomes the whole answer and a `..` walks out. One reader
+    for the question, because the two places that ask it — what a board write
+    commits, and where the runners drop their evidence — would otherwise each carry
+    their own copy of the same two conditions.
+    """
+    p = Path(value)
+    return p.is_absolute() or ".." in p.parts
+
+
 def load(repo: Path) -> dict:
     """The merged config for a repo. Missing file → the defaults, which is a
     working configuration and not an error: a fresh install must run."""
@@ -608,7 +625,7 @@ def apply(cfg: dict) -> None:
     through `registry` → `ids`.
     """
     from . import (align, autonomy, coverage, gate, git, ids, kickoff, lint, registry,
-                   shift, task, tree)
+                   shard, shift, task, tree)
     ids.configure(cfg["ids"]["prefix"], tuple(cfg["ids"]["recognised"]),
                   bool(cfg["ids"]["undashed"]))
     git.GIT = dict(cfg["git"])
@@ -632,6 +649,11 @@ def apply(cfg: dict) -> None:
     tree.SKIP_DIRS = tree.SHIPPED_SKIP_DIRS | set(cfg["skip_dirs"])
     tree.TASK_TAGS_OK = tuple(cfg["tags"]["allowed"])
     coverage.VERIFY = dict(cfg["verify"])
+    # A DEFAULTED, DOCUMENTED key that nothing read: the reader hardcoded
+    # `.work/coverage`, so a repo that pointed its runners somewhere else got no
+    # error and no effect — and then `coverage` reported "no evidence" for every
+    # criterion a run had actually proved.
+    shard.DIR = cfg["coverage"]["shard"]
     gate.VERIFY = dict(cfg["verify"])
     task.PLANS_DIR = cfg["plans"]["dir"]
     autonomy.CEILING = cfg["autonomy"]["ceiling"]
@@ -1415,7 +1437,13 @@ def _cmd_config_write(args) -> int:
         # and refusing to remove it would leave the only tool that can fix it
         # refusing on the grounds that the thing being fixed is broken.
         parts = [seg for seg in dotted.split(".") if seg]
-        if args["_verb"] != "unset" or not _present(raw, parts):
+        # `not parts` is the empty key, and it is the one thing this branch must not
+        # take for a repair: `_present` answers True for a path of no segments — the
+        # file trivially "contains" nothing — so an empty name walked straight past
+        # the check and into `parts[-1]`, which is an IndexError traceback on the
+        # command an installer shells out to. A key that names nothing is refused
+        # with the message the loader already wrote for it.
+        if args["_verb"] != "unset" or not parts or not _present(raw, parts):
             raise
         unknown = True
 

package/harness/harness/coverage.py

@@ -31,6 +31,7 @@ from pathlib import Path
 
 from .lint import feature_ac_levels
 from .model import scan_features
+from . import shard
 from .shard import _load_run
 from .tree import find_work_root
 
@@ -81,7 +82,7 @@ def cmd_coverage(args) -> int:
         # that is why the scan in the suite checks command names too.
         lines = [f"    {cmd}" + (f"        ({name})" if name else "")
                  for name, cmd in sorted(VERIFY.items())]
-        print("\n  no run found — `.work/coverage/` is empty.\n"
+        print(f"\n  no run found — `{shard.DIR}/` is empty.\n"
               "  Evidence is a fresh run, so produce one first:\n"
               + ("\n".join(lines) if lines
                  else "    (no `verify` commands configured — add them to "
@@ -89,8 +90,16 @@ def cmd_coverage(args) -> int:
         return 0
 
     only = args.get("feature")
-    rows, totals = [], {"declared": 0, "built": 0, "proven": 0, "failed": 0,
-                        "todo": 0, "gap": 0, "ahead": 0, "eyes": 0, "unlevelled": 0}
+    # `built` is every criterion TICKED, and `provable` is the run-provable part of
+    # it — built minus the ones only a person can settle. They were one number under
+    # the name `built`, holding the value of `provable`, and that single misnomer is
+    # what produced both of the report's disagreements: the table's `built` column
+    # printed one of them while the ratio underneath divided by the other, and the
+    # roadmap line read `declared - built` and so counted every criterion a person
+    # had already looked at as behaviour nobody had written.
+    rows, totals = [], {"declared": 0, "built": 0, "provable": 0, "proven": 0,
+                        "failed": 0, "todo": 0, "gap": 0, "ahead": 0,
+                        "unlevelled": 0}
     mismatched = []
 
     for md in sorted(scan_features(root)):
@@ -123,7 +132,6 @@ def cmd_coverage(args) -> int:
         ahead = passed - built
         provable = built - eyes
         proven = (built & passed) - eyes
-
         for ac in sorted(declared):
             level = levels[ac][0]
             complaint = _wrong_level(level, runners.get(f"{name}/{ac}", set())) if level else None
@@ -131,15 +139,17 @@ def cmd_coverage(args) -> int:
                 mismatched.append(f"{name}/{ac}: {complaint}")
 
         totals["declared"] += len(declared)
-        totals["built"] += len(provable)
+        totals["built"] += len(built)
+        totals["provable"] += len(provable)
         totals["proven"] += len(proven)
         totals["failed"] += len(failed)
         totals["todo"] += len(built & todo)
         totals["gap"] += len(gap)
         totals["ahead"] += len(ahead)
-        totals["eyes"] += len(eyes)
         totals["unlevelled"] += sum(1 for ac in declared if levels[ac][0] is None)
-        rows.append((name, len(built), len(proven), len(eyes),
+        # The column is the ratio's own denominator, so it counts what the ratio
+        # divides by and not everything ticked.
+        rows.append((name, len(provable), len(proven), len(eyes),
                      len(built & todo), len(declared - built),
                      sorted(failed), sorted(gap), sorted(ahead)))
 
@@ -180,16 +190,20 @@ def cmd_coverage(args) -> int:
               f"{unbuilt:>8}   {note}")
 
     t = totals
-    rate = f"{100 * t['proven'] // t['built']}%" if t["built"] else "—"
-    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['built']} = {rate} "
+    # Every count the tail reports is DERIVED from the three the loop kept, because
+    # a total that can be worked out and is stored anyway is a total that can
+    # disagree with the ones it was worked out from.
+    eyes, unbuilt = t["built"] - t["provable"], t["declared"] - t["built"]
+    rate = f"{100 * t['proven'] // t['provable']}%" if t["provable"] else "—"
+    print(f"\n  BUILT COVERAGE  {t['proven']}/{t['provable']} = {rate} "
           f"— of the RUN-PROVABLE promises this app keeps, how many a run proves\n"
           f"  {t['gap']} claimed with nothing to show · {t['todo']} declared-but-unwritten · "
           f"{t['failed']} failing\n")
-    print(f"  Settled by eyes, not by a run: {t['eyes']}. A look is a level, not an\n"
+    print(f"  Settled by eyes, not by a run: {eyes}. A look is a level, not an\n"
           f"  excuse — no assertion is evidence about weight, colour or rhythm — so\n"
           f"  these sit beside the ratio with the dated ✔ in the feature file as their\n"
           f"  evidence, never inside it.\n")
-    print(f"  Not built yet: {t['declared'] - t['built']} of {t['declared']} promises. "
+    print(f"  Not built yet: {unbuilt} of {t['declared']} promises. "
           f"That is a roadmap, NOT a coverage hole —\n"
           f"  an unticked criterion is behaviour nobody has written, so counting it\n"
           f"  against coverage measures ambition rather than honesty.\n")

package/harness/harness/epic.py

@@ -192,12 +192,22 @@ def cmd_epic_move(args) -> int:
             for t in moved:
                 shutil.move(str(dest / t.name), str(queue / t.name))
 
-    md = dest / "epic.md"
-    rewrite_file(
-        md,
-        lambda d: d.update({"updated": date.today().isoformat()}),
-        EPIC_FM_ORDER,
-    )
+    # Only a PLANNED epic has a plan doc to stamp. A released cut has had every
+    # `epic.md` removed, so an epic promoted out of one arrives with nothing to
+    # write — and reading it anyway raised after the folders had already moved,
+    # leaving a half-moved tree no CLI command could put back.
+    #
+    # The model owns that fact and is asked for it, rather than re-stat'ing the
+    # moved path: `release` asks the same question the same way, and two
+    # implementations of "does this epic have a plan doc" is one more than there
+    # should be. The move relocates the file rather than replacing it, so what was
+    # read before it is still true after.
+    if epic.planned:
+        rewrite_file(
+            dest / "epic.md",
+            lambda d: d.update({"updated": date.today().isoformat()}),
+            EPIC_FM_ORDER,
+        )
     print(f"pulled epic '{name}' ({was}) -> {rel(dest, root)}  "
           f"with {len(moved)} task(s)")
     _sync(root)
@@ -211,6 +221,12 @@ def cmd_epic_release(root, version) -> int:
     holds the plan. Called from `cmd_release`, never on its own."""
     removed = []
     for e in version.epics:
+        # An epic with no plan doc is already in the shape this produces — a folder
+        # grouping tasks. Unlinking regardless raised AFTER `released:` had been
+        # stamped, so the cut read as released while every other epic kept the file
+        # this exists to remove.
+        if not e.planned:
+            continue
         e.md.unlink()
         removed.append(e.name)
     if removed:

package/harness/harness/events.py

@@ -49,6 +49,14 @@ LOG = ".events.jsonl"
 #: replicated one is a claim two endpoints both believe they have.
 HOLDS = ("claimed", "released-claim")
 
+#: Events no commit ever carries. The holds above, and a REFUSAL — which changed
+#: nothing, so there is no commit for it to ride on. Buffering a refusal made the
+#: git seam see work waiting for a commit while the tree was untouched, and report
+#: the change as "carried by a board write that committed a moment earlier": a
+#: refused completion, told its work was safely in git under somebody else's commit,
+#: when nothing had been written and nothing committed.
+UNCOMMITTED = HOLDS + ("gate-refused",)
+
 #: What this command has done so far, waiting for the commit that carries it. Only
 #: used under git; a process runs one command, so one buffer is one commit.
 _PENDING: list = []
@@ -90,9 +98,15 @@ def instance_id() -> str:
 def append(root: Path, kind: str, name: str, **fields) -> None:
     """Append one line. Never raises: a failure to record must not fail the work
     that was recorded — the mutation already happened, and dying here would leave
-    the tree changed and the caller told it failed."""
-    if kind not in KINDS:
-        raise ValueError(f"unknown event kind '{kind}' — one of {', '.join(KINDS)}")
+    the tree changed and the caller told it failed.
+
+    A kind outside `KINDS` is recorded anyway rather than refused. The closed list
+    still exists, and is still the point — a typo'd kind is a line that never shows
+    up in a digest — but the place to catch it is the SUITE, which reads every call
+    site out of this package's own source. Raising here caught it in front of a user
+    instead, after the tree had already changed, on a promise this docstring makes
+    in its first sentence.
+    """
     entry = {"ts": _now(), "event": kind, "name": name}
     who = instance_id()
     if who:
@@ -102,7 +116,7 @@ def append(root: Path, kind: str, name: str, **fields) -> None:
     # the bucket already states.
     entry.update({k: v for k, v in fields.items() if v not in (None, "", [], {})})
     if git.enabled():
-        if kind not in HOLDS:
+        if kind not in UNCOMMITTED:
             _PENDING.append(entry)
         return
     try:

package/harness/harness/git.py

@@ -78,15 +78,22 @@ def _flat(value) -> str:
     return str(value).replace("\n", " ").replace("\r", " ").replace(SEP, " - ")
 
 
-#: Commands that read the origin before they act. Performance only: what gets
-#: COMMITTED is driven by what actually changed, so a name missing from this set
-#: costs a stale pre-pull and can never cost a write. `sync` is absent because it
-#: refreshes on its own, and being in both places is two fetches for one command.
+#: EVERY COMMAND THAT CHANGES THE BOARD, and the whole of what the git seam acts on:
+#: these pull before they act and commit what they wrote, and no other command does
+#: either. A name missing from here is a command that mutates the tree and never
+#: lands it — the exact hole the commit-on-every-write guarantee exists to close — so
+#: adding a mutating command means adding it here, and the suite checks that every
+#: command outside this set leaves the tree untouched.
+#:
+#: `new` and `task-new` are one verb and both spellings are listed, because the
+#: dispatcher matches on what was typed. `sync` is absent although it reaches the
+#: origin: it refreshes and sends on its own, and being in both places is two fetches
+#: for one command.
 WRITES = frozenset({
-    "task-new", "epic-new", "feature-new", "version-new", "domain-new", "system-new",
-    "place", "move", "handoff", "plan", "session", "release", "archive",
-    "next", "drop", "ask", "answer", "verify", "observed", "id-new", "readme",
-    "migrate-owner",
+    "task-new", "new", "epic-new", "feature-new", "version-new", "domain-new",
+    "system-new", "place", "move", "handoff", "plan", "session", "release",
+    "archive", "next", "drop", "ask", "answer", "verify", "observed", "id-new",
+    "readme", "init", "migrate",
 })
 
 
@@ -661,16 +668,21 @@ def _push(repo) -> tuple:
 def _why_no_rebase(err: str) -> str:
     """Why the rebase onto the moved branch did not run, in the caller's terms.
 
-    The common case is not a conflict at all: the branch moved while the session had
-    uncommitted work open, and git declines to rebase over it. That reads as a scary
+    The common case is not a conflict at all: the branch moved while something in the
+    tree was uncommitted, and git declines to rebase over it. That reads as a scary
     failure and is an ordinary one, so it is named separately and says what to do —
     the board commit is already in git, and only the push is waiting.
     """
     if re.search(r"unstaged changes|uncommitted changes|cannot pull with rebase|"
                  r"cannot rebase.*(dirty|unstaged)", err, re.I):
-        return ("the branch moved, and your own uncommitted edits are in the way of "
-                "rebasing onto it — nothing was moved or stashed; commit them and the "
-                "next board write pushes both")
+        # NOT "your own edits". Measured with four writers racing: what was in the
+        # way was another board write's task.md, created and not yet committed. A
+        # message that names the reader as the owner of somebody else's file sends
+        # them looking for work they do not have.
+        return ("the branch moved, and uncommitted changes in this checkout are in "
+                "the way of rebasing onto it — nothing was moved or stashed. They "
+                "may be yours or another board write that has not committed yet; "
+                "commit what is yours and the next board write pushes both")
     return f"the branch moved and the rebase onto it did not apply: {_tail(err)}"
 
 
@@ -755,6 +767,9 @@ def _events(record: str) -> list:
     who = (trailers.get(SESSION) or [""])[0]
     host = (trailers.get(MACHINE) or [""])[0]
     out = []
+    # One pool per kind, drawn from in order, so the second `verified` in a commit
+    # gets the second body line rather than the first's.
+    pools = {kind: iter(payloads) for kind, payloads in details.items()}
     for kind in kinds:
         e = {"ts": _utc(when), "event": kind, "name": item, "sha": sha[:12],
              "author": author}
@@ -762,7 +777,7 @@ def _events(record: str) -> list:
             e["by"] = who
         if host:
             e["machine"] = host
-        e.update(details.get(kind) or {})
+        e.update(next(pools.get(kind, iter(())), {}))
         out.append(e)
     return out
 
@@ -822,27 +837,35 @@ def _trailers(message: str) -> dict:
 
 
 def _details(message: str, kinds) -> dict:
-    """The body's per-event payload, matched back to its event by name.
+    """The body's per-event payloads, matched back to their events by name — as a
+    LIST per kind, in the order the body carries them.
 
     A round trip rather than prose, so `log`, `digest` and `status` print the same
     thing whichever backend the repo runs. `_flat` is what makes it safe: the
     separator can never appear inside a value, so a question with an odd character
     in it comes back whole instead of splitting into a field nobody wrote.
+
+    One payload per KIND was the earlier shape, and a command can record two events
+    of one kind in a single commit — `verify` files one `verified` per gate. The
+    second line was dropped and both events came back wearing the first's fields, so
+    a digest read one gate's result twice and never reported the other at all. The
+    body is written one line per event in order, so position within a kind is exactly
+    the pairing.
     """
-    out = {}
+    out: dict = {}
     for line in message.splitlines():
         line = line.strip()
         if _TRAILER.match(line):
             continue
         head, _, rest = line.partition("  ")
-        if head not in kinds or not rest.strip() or head in out:
+        if head not in kinds:
             continue
         fields = {}
         for chunk in rest.split(SEP):
             key, sign, value = chunk.partition("=")
             if sign and key.strip():
                 fields[key.strip()] = value.strip()
-        out[head] = fields
+        out.setdefault(head, []).append(fields)
     return out
 
 
@@ -885,12 +908,31 @@ def cmd_sync(args=None) -> int:
     return 0 if pushed else 1
 
 
+#: Git saying what went wrong, wherever in its output that sits.
+_COMPLAINT = re.compile(r"(?:error|fatal): (.+)")
+
+
 def _tail(text: str) -> str:
-    """Git's first real complaint. The FIRST line, not the last: git follows a
-    `fatal:` with a paragraph of advice, and the closing line of that paragraph
-    ("…and the repository exists.") reads as gibberish on its own."""
-    for line in (text or "").splitlines():
-        line = line.strip()
-        if line and not line.startswith("hint:"):
-            return line[:200]
-    return "no reason given"
+    """Git's real complaint, in the words it used.
+
+    Never the LAST line: git follows a `fatal:` with a paragraph of advice, and the
+    closing line of that paragraph ("…and the repository exists.") reads as gibberish
+    on its own. And no longer the FIRST line either, because the first line is
+    routinely a banner — `To <url>` on a rejected push, `From <url>` on a fetch,
+    `Rebasing (1/4)` on a rebase — and the progress counter carries no newline, so
+    `Rebasing (1/1)error: could not apply …` arrives as ONE line with the reason
+    buried at the end of it.
+
+    Measured, both shapes: a rejected push explained itself as "To /tmp/…/o.git",
+    and three concurrent board writes explained their refusals as a fetch banner, a
+    warning and a progress counter — four non-answers to the only question being
+    asked. So the complaint is looked for first and the first line is the fallback,
+    which is what this always did and is still right when git leads with `fatal:`.
+    """
+    lines = [ln.strip() for ln in (text or "").splitlines()]
+    lines = [ln for ln in lines if ln and not ln.startswith("hint:")]
+    for line in lines:
+        found = _COMPLAINT.search(line)
+        if found:
+            return found.group(1).strip()[:200]
+    return lines[0][:200] if lines else "no reason given"

package/harness/harness/lint.py

@@ -12,7 +12,7 @@ from .tree import (
     TASK_REGION_CAP,
 )
 from .frontmatter import as_list, parse_frontmatter, split_frontmatter
-from .model import locate_feature, scan, scan_features
+from .model import locate_feature, scan, scan_features, scan_filed
 from .registry import code_vocabulary, locate_domain
 
 #: The MCP server this repo names as its graph engine, bound by `config.apply`.
@@ -318,10 +318,9 @@ def _owner_ref_lint(root: Path, s: dict) -> list:
     for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
         # The rename warning is ACTIVE work only — a completed task's frontmatter
         # is frozen history, and 90 lines of migration noise makes `list` unreadable.
-        # `migrate-owner` rewrites every task regardless of bucket.
         if t.legacy_product and t.status in (None,) + ACTIVE:
             warns.append(f"{t.name}: `product:` is the old spelling — rename the "
-                         f"key to `owner:` (`jarvis work migrate-owner` does it)")
+                         f"key to `owner:` in its task.md")
         value = t.owner
         if not value:
             continue  # empty is _graph_lint's warning, and only for active work
@@ -482,8 +481,23 @@ def _coverage_lint(root: Path, s: dict) -> list:
     if not product_dir.is_dir():
         return warns
 
+    # THE QUESTION FIRST, then the evidence for it. Only a `shipped` feature is
+    # checked, so a repo with none has nothing to answer and the gathering below is
+    # pure waste — and it is not free: this runs after every board write, and the
+    # filed-cut half of it grows with every release and never shrinks.
+    shipped = [md for md in scan_features(root)
+               if parse_frontmatter(md.read_text()).get("state") == "shipped"]
+    if not shipped:
+        return warns
+
     covered: dict = {}
-    for t in [task for v in s["versions"] for task in v.all_tasks()] + s["backlog"]:
+    # The cuts that have LEFT the board carry evidence too — a criterion delivered
+    # by a task in a shipped cut is delivered. Reading the live board alone turned
+    # filing a cut into a permanent warning about every AC it delivered, with no
+    # way left to satisfy it.
+    filed = [task for v in scan_filed(root) for task in v.all_tasks()]
+    for t in ([task for v in s["versions"] for task in v.all_tasks()]
+              + s["backlog"] + filed):
         if t.status != "complete" or not t.covers:
             continue
         if t.owner:
@@ -495,10 +509,8 @@ def _coverage_lint(root: Path, s: dict) -> list:
     # matched nothing and this whole rollup was dead code wearing a passing
     # test. `scan_features` is now the single owner of that glob, so the next
     # layout change cannot leave one caller behind.)
-    for feature_md in scan_features(root):
+    for feature_md in shipped:
         text = feature_md.read_text()
-        if parse_frontmatter(text).get("state") != "shipped":
-            continue
         have = covered.get(feature_md.stem, set())
         for ac in sorted(_feature_ac_ids(text)):
             if ac not in have: