@appchy/jarvis 0.1.84 → 0.1.86

package/harness/test_work.py

@@ -6203,6 +6203,740 @@ def test_migrate_refuses_a_repo_holding_two_backlogs():
         assert (Path(tmp) / "backlog").is_dir(), "it moved something before refusing"
 
 
+
+def test_an_epic_whose_plan_doc_is_gone_still_moves_into_a_cut():
+    # `release` removes every `epic.md`, so an epic promoted out of a released cut
+    # arrives with no plan doc to stamp. Reading it anyway raised AFTER the folders
+    # had already moved — a half-moved tree, and no CLI command that could put it
+    # back.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        v = _tree(tmp, "26-cut", released="2026-08-01")
+        (root / "versions" / "27-next").mkdir(parents=True)
+        (root / "versions" / "27-next" / "version.md").write_text(
+            "---\ncreated: 2026-08-01\norder: 27\noutcome: y\n---\n\n# Next\n")
+        e = _epic(v, "no-plan-left")
+        (e / "queue").mkdir()
+        _task(e / "queue", "still-to-do")
+        (e / "epic.md").unlink()                     # what release leaves behind
+
+        os.environ["WORK_DIR"] = tmp
+        try:
+            epic.cmd_epic_move({"name": "no-plan-left", "version": "27-next"})
+        finally:
+            os.environ.pop("WORK_DIR", None)
+
+        dest = root / "versions" / "27-next" / "no-plan-left"
+        assert (dest / "queue" / "still-to-do" / "task.md").is_file()
+        assert not (v / "no-plan-left").exists(), "the source was left behind"
+
+
+def test_releasing_a_cut_holding_an_epic_with_no_plan_doc_still_releases_it():
+    # The unlink ran on every epic, so one without a plan doc raised — and it raised
+    # AFTER `released:` was stamped, leaving the cut reading as released while every
+    # other epic kept the file release exists to remove.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp)
+        v = _tree(tmp)
+        planned = _epic(v, "publish-under-your-name")
+        _task(planned / "complete", "author-a-lesson")
+        bare = _epic(v, "no-plan-left")
+        _task(bare / "complete", "shipped-already")
+        (bare / "epic.md").unlink()
+
+        os.environ["WORK_DIR"] = tmp
+        try:
+            version.cmd_release({"name": "26-cut"})
+        finally:
+            os.environ.pop("WORK_DIR", None)
+
+        after = model.locate_version(root, "26-cut")
+        assert after.released, "the cut never got its released stamp"
+        assert not (after.folder / "publish-under-your-name" / "epic.md").exists() \
+            and not (after.folder / "complete" / "publish-under-your-name" / "epic.md").exists(), \
+            "a plan doc survived the release"
+
+
+def test_a_shipped_criterion_delivered_by_a_filed_cut_is_still_covered():
+    # Filing a cut used to turn every AC it delivered into a warning nothing could
+    # ever satisfy: the rollup read the live board only, and a shipped cut is not on
+    # it. The work did not stop being the evidence when the cut left the board.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = Path(tmp) / "work"
+        (root / "product").mkdir(parents=True)
+        (root / "product" / "search.md").write_text(
+            "---\ntype: feature\nstate: shipped\n---\n\n"
+            "## Acceptance criteria\n- [x] AC-01 (unit): a\n")
+        filed = root / "versions" / "complete" / "26-cut"
+        filed.mkdir(parents=True)
+        (filed / "version.md").write_text(
+            "---\ncreated: 2026-08-01\norder: 26\noutcome: x\n"
+            "released: 2026-09-01\n---\n\n# Cut\n")
+        e = _epic(filed, "an-epic")
+        _task(e / "complete", "did-the-work",
+              fm="priority: P1\nowner: search\ncovers: [AC-01]\n")
+
+        assert lint._coverage_lint(root, model.scan(root)) == []
+
+
+def test_the_config_comes_from_the_repo_whose_tree_is_being_written():
+    # Both variables set at once is the ordinary Claude Code case, and the two
+    # searches read them in opposite orders: the tree came from WORK_DIR while the
+    # config came from CLAUDE_PROJECT_DIR. So a command mutated one repo's board
+    # while every id, standard and gate ran in another repo's dialect.
+    with tempfile.TemporaryDirectory() as tmp:
+        holds_the_tree = Path(tmp) / "b"
+        (holds_the_tree / "work" / "versions").mkdir(parents=True)
+        _repo_with_config(str(holds_the_tree), {"ids": {"prefix": "BEE"}})
+        elsewhere = Path(tmp) / "a"
+        (elsewhere / "work" / "versions").mkdir(parents=True)
+        _repo_with_config(str(elsewhere), {"ids": {"prefix": "AY"}})
+
+        was = {k: os.environ.get(k) for k in ("CLAUDE_PROJECT_DIR", "WORK_DIR")}
+        os.environ["WORK_DIR"] = str(holds_the_tree / "work")
+        os.environ["CLAUDE_PROJECT_DIR"] = str(elsewhere)
+        try:
+            assert entry._project_root({}) == holds_the_tree.resolve()
+            assert config.load(entry._project_root({}))["ids"]["prefix"] == "BEE", \
+                "config resolved from a repo other than the one holding the tree"
+            assert tree.find_work_root().parent == holds_the_tree.resolve(), \
+                "fixture: the tree search did not read WORK_DIR"
+        finally:
+            for k, v in was.items():
+                os.environ.pop(k, None)
+                if v is not None:
+                    os.environ[k] = v
+
+
+def test_a_refused_completion_is_not_told_its_work_is_in_somebody_elses_commit():
+    # A refusal changed nothing, so there is nothing for a commit to carry. It was
+    # buffered like any other event, so the seam saw work waiting with an untouched
+    # tree and reported the change as "carried by a board write that committed a
+    # moment earlier" — telling a session its work was safely in git under another
+    # item's commit, when nothing had been written and nothing committed.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            e = _provable_task(repo)
+            events._PENDING.clear()
+            with _work_dir(str(repo / "work")):
+                assert task.cmd_move({"name": "alpha", "status": "complete",
+                                      "delivered": "it ships",
+                                      "not-included": "nothing"}) == 1, \
+                    "fixture: the gate was supposed to refuse"
+            assert (e / "in-progress" / "alpha").is_dir()
+
+            committed, pushed, note = _board_write(repo, "alpha", events.pending())
+            assert note == "", f"a refusal was told: {note}"
+            assert not committed
+            assert events.pending() == [], "a refusal is queued for a commit"
+        finally:
+            events._PENDING.clear()
+            config.apply(config.DEFAULTS)
+
+
+def _item_on_at(repo, ref, name, when):
+    """`_item_on`, with the commit stamped at a given instant-with-offset. Git reads
+    both dates from the environment, and they have to move together: one sort reads
+    the committer date and the other the author date."""
+    was = {k: os.environ.get(k) for k in ("GIT_AUTHOR_DATE", "GIT_COMMITTER_DATE")}
+    os.environ["GIT_AUTHOR_DATE"] = when
+    os.environ["GIT_COMMITTER_DATE"] = when
+    try:
+        return _item_on(repo, ref, "an-epic", "in-progress", name)
+    finally:
+        for k, v in was.items():
+            os.environ.pop(k, None)
+            if v is not None:
+                os.environ[k] = v
+
+
+def test_a_ref_from_another_timezone_does_not_present_as_the_newest():
+    # Both sorts compared strict ISO stamps AS TEXT, and each carries its author's
+    # own offset — so 10:00+03:00 sorted above 09:00+00:00 while actually being two
+    # hours EARLIER. A colleague one timezone east made every ref of theirs look
+    # like the most recent one, and `at` then read the wrong branch as current.
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = _git_repo(tmp, push=False)
+        _item_on_at(repo, "east", "one-thing", "2026-09-01T10:00:00+03:00")   # 07:00Z
+        _item_on_at(repo, "west", "one-thing", "2026-09-01T09:00:00+00:00")   # 09:00Z
+
+        order = [r["ref"] for r in branches.refs_state(repo)["refs"]]
+        assert order.index("west") < order.index("east"), \
+            f"the later commit is not first: {order}"
+
+        found = [b["branch"] for b in branches.branches_of(repo, "one-thing")]
+        assert found[0] == "west", f"the later commit is not first: {found}"
+
+
+def _coverage_fixture(tmp: str, body: str, shard: dict = None) -> Path:
+    """A work root with one feature and, optionally, one runner's shard."""
+    root = Path(tmp) / "work"
+    (root / "product").mkdir(parents=True)
+    (root / "product" / "viewer.md").write_text(
+        "---\ntype: feature\nstate: building\n---\n\n## Acceptance criteria\n" + body)
+    if shard is not None:
+        src = root.parent / "pkg" / "x.test.ts"
+        src.parent.mkdir(parents=True, exist_ok=True)
+        src.write_text("//\n")
+        d = root.parent / ".work" / "coverage"
+        d.mkdir(parents=True)
+        (d / "vitest.json").write_text(json.dumps(
+            {"source": "pkg/x.test.ts", "runner": "vitest", "covered": shard}))
+    return root
+
+
+def _coverage_report(root: Path) -> str:
+    import contextlib, io
+    buf = io.StringIO()
+    with _work_dir(str(root)):
+        with contextlib.redirect_stdout(buf):
+            assert coverage.cmd_coverage({}) == 0
+    return buf.getvalue()
+
+
+def test_a_criterion_only_a_person_can_settle_is_not_reported_as_unbuilt():
+    # Eyes-on comes OUT of the ratio, which the denominator already did. "Not built
+    # yet" was then derived by subtracting that denominator from everything
+    # declared — so every criterion a person had already looked at came back
+    # reported as behaviour nobody has written.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = _coverage_fixture(
+            tmp,
+            "- [x] AC-01 (unit): a thing a test proves\n"
+            "- [x] AC-02 (eyes-on): a thing only a person can settle\n"
+            "- [ ] AC-03 (unit): nobody has written this\n",
+            {"viewer/AC-01": {"status": "passed"}})
+        out = _coverage_report(root)
+        assert "Not built yet: 1 of 3" in out, out
+        assert "Settled by eyes, not by a run: 1" in out, out
+
+
+def test_the_built_column_counts_what_the_ratio_divides_by():
+    # The column showed every built criterion while the ratio divided by the
+    # run-provable ones, so a feature with an eyes-on criterion printed a table that
+    # disagreed with the headline directly under it.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = _coverage_fixture(
+            tmp,
+            "- [x] AC-01 (unit): a thing a test proves\n"
+            "- [x] AC-02 (eyes-on): a thing only a person can settle\n",
+            {"viewer/AC-01": {"status": "passed"}})
+        out = _coverage_report(root)
+        row = next(l for l in out.splitlines() if l.strip().startswith("viewer"))
+        built = int(row.split()[1])
+        headline = next(l for l in out.splitlines() if "BUILT COVERAGE" in l)
+        assert f"{built}/{built}" in headline, f"{row!r} disagrees with {headline!r}"
+        assert built == 1, row
+
+
+def _git_repo_cli(tmp):
+    """`_git_repo`, with git mode written into the repo's own config file so the
+    ENTRY resolves it — driving `main()` re-reads that file, and a fixture that only
+    called `config.apply` would have git switched off by the time the command ran."""
+    repo = _git_repo(tmp, push=False)
+    (repo / ".claude" / "work.config.json").write_text(json.dumps(
+        {"git": {"commit": True, "push": False, "remote": "origin",
+                 "paths": ["work"]}}))
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", "git mode on")
+    return repo
+
+
+def _entry(repo, *argv):
+    """One command through the entry point, against `repo`. Returns its exit code,
+    or the SystemExit's — a refusal is an answer, and it still must not write."""
+    import contextlib, io
+    was = sys.argv
+    sys.argv = ["work.py", *argv]
+    buf = io.StringIO()
+    try:
+        with _work_dir(str(repo / "work")):
+            with contextlib.redirect_stdout(buf), contextlib.redirect_stderr(buf):
+                try:
+                    return entry.main()
+                except SystemExit as e:
+                    return e.code
+    finally:
+        sys.argv = was
+
+
+def test_a_command_that_only_looks_never_commits_the_board():
+    # The commit used to sit in a `finally:` every command drove, so `list`,
+    # `status`, `where` and `context` all landed whatever the person happened to
+    # have open in work/ at that moment — as "docs(work): board edits", under no
+    # item, at a moment nobody chose.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            (repo / "work" / "product" / "README.md").write_text("a hand edit\n")
+            before = _git(repo, "rev-parse", "HEAD").stdout.strip()
+
+            for verb in ("list", "status", "align", "context", "remind"):
+                _entry(repo, verb)
+                assert _git(repo, "rev-parse", "HEAD").stdout.strip() == before, \
+                    f"`{verb}` committed the board"
+
+            assert "work/product/README.md" in _git(repo, "status", "--porcelain").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_command_that_writes_the_board_still_commits_it():
+    # The other half of the same rule, and the one that must never regress: a write
+    # is not done until it is in git.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            v = repo / "work" / "versions" / "26-cut"
+            v.mkdir(parents=True)
+            (v / "version.md").write_text(
+                "---\ncreated: 2026-08-01\norder: 26\noutcome: x\n---\n\n# Cut\n")
+            _epic(v, "an-epic")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "a cut to work in")
+
+            assert _entry(repo, "new", "a-thing", "--epic", "an-epic") == 0
+            landed = _git(repo, "log", "-1", "--format=%s%n%b").stdout
+            assert "a-thing" in landed, landed
+            assert "Work-Item: a-thing" in landed, landed
+            assert _git(repo, "status", "--porcelain").stdout.strip() == "", \
+                "the scaffold is still sitting uncommitted"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_every_command_outside_the_write_set_leaves_the_tree_alone():
+    # What keeps the set above honest. A command that mutates the board and is not
+    # in `git.WRITES` now writes the tree and never lands it, which is worse than
+    # what this replaced — so the guard is not "reads do not commit" but "a
+    # non-write does not WRITE".
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            v = repo / "work" / "versions" / "26-cut"
+            v.mkdir(parents=True)
+            (v / "version.md").write_text(
+                "---\ncreated: 2026-08-01\norder: 26\noutcome: x\n---\n\n# Cut\n")
+            e = _epic(v, "an-epic")
+            _task(e / "in-progress", "a-thing", fm="priority: P1\nowner: product\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "a board with work on it")
+
+            for verb in sorted(set(entry.SUBCOMMANDS) - set(git.WRITES)):
+                _entry(repo, verb)
+                dirty = _git(repo, "status", "--porcelain").stdout.strip()
+                assert dirty == "", f"`{verb}` changed the tree:\n{dirty}"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def _bare_git_repo(tmp, cfg):
+    """A clone with an origin and a config file, and NO work tree yet — the state
+    `init` and `migrate` are the only two commands that act on."""
+    import subprocess
+    base = Path(tmp)
+    origin, repo = base / "origin.git", base / "repo"
+    subprocess.run(["git", "init", "-q", "--bare", str(origin)], check=True)
+    subprocess.run(["git", "clone", "-q", str(origin), str(repo)], check=True,
+                   capture_output=True)
+    for k, v in (("user.email", "t@t"), ("user.name", "T")):
+        subprocess.run(["git", "-C", str(repo), "config", k, v], check=True)
+    (repo / ".claude").mkdir(parents=True)
+    (repo / ".claude" / "work.config.json").write_text(json.dumps(cfg))
+    _git(repo, "add", "-A")
+    _git(repo, "commit", "-qm", "a repo with no board")
+    _git(repo, "push", "-q", "-u", "origin", "HEAD:main")
+    return repo
+
+
+_GIT_ON = {"git": {"commit": True, "push": False, "remote": "origin",
+                   "paths": ["work"]}}
+
+
+def test_scaffolding_a_board_lands_in_git():
+    # `init` writes a whole tree and was not in the write set, so scoping the commit
+    # to that set would have left a fresh board sitting uncommitted — the exact hole
+    # committing on every write exists to close, opened by closing another one.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _bare_git_repo(tmp, _GIT_ON)
+            assert _entry(repo, "init") == 0
+            assert (repo / "work" / "README.md").is_file(), "fixture: nothing scaffolded"
+            assert _git(repo, "status", "--porcelain").stdout.strip() == "", \
+                "a scaffolded board is sitting uncommitted"
+            assert "work/README.md" in _git(repo, "log", "-1", "--name-only",
+                                            "--format=").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_layout_migration_lands_in_git():
+    # Same shape as `init`: `migrate` moves folders and was outside the write set,
+    # so the one command that restructures somebody's whole board would have left it
+    # restructured and uncommitted.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _bare_git_repo(tmp, _GIT_ON)
+            old = repo / "work" / "backlog" / "an-epic"
+            old.mkdir(parents=True)
+            (old / "epic.md").write_text("---\ntype: epic\n---\n\n# E\n")
+            (repo / "work" / "versions").mkdir(parents=True)
+            (repo / "work" / "README.md").write_text(
+                f"# Work\n\n{tree.BACKLOG_START}\n{tree.BACKLOG_END}\n")
+            _git(repo, "add", "-A")
+            _git(repo, "commit", "-qm", "a board on the old layout")
+
+            assert _entry(repo, "migrate") == 0
+            assert (repo / "work" / "versions" / "backlog" / "an-epic").is_dir(), \
+                "fixture: nothing moved"
+            assert _git(repo, "status", "--porcelain").stdout.strip() == "", \
+                "a migrated board is sitting uncommitted"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_session_that_scanned_before_the_other_wrote_gets_the_next_id_not_the_same_one():
+    # The lock could not prevent the race it exists for. The slow tree scan happened
+    # OUTSIDE it and the lock came off the moment the heading was written — so a
+    # second session that scanned before the first one wrote, and claimed after it
+    # released, found the number free twice. Two `### D-nn` headings, one number.
+    with tempfile.TemporaryDirectory() as tmp:
+        root = _initialised(tmp)
+        os.environ["WORK_DIR"] = str(root)
+        real = safety._next_free
+        try:
+            safety.cmd_id_new({"host": "quality", "title": "the first one"})
+            stale = real(root) - 1          # what the other session is still holding
+
+            seen = {"n": 0}
+
+            def scanned_earlier(r):
+                """The other session's OUTER scan, taken before the write above. Every
+                later call is the real thing — including the one under the claim."""
+                seen["n"] += 1
+                return stale if seen["n"] == 1 else real(r)
+
+            safety._next_free = scanned_earlier
+            safety.cmd_id_new({"host": "quality", "title": "the second one"})
+        finally:
+            safety._next_free = real
+            os.environ.pop("WORK_DIR", None)
+
+        text = (root / "quality" / "README.md").read_text()
+        claimed = [m.group(1) for m in ids.titled_heading(3).finditer(text)]
+        assert len(claimed) == 2, claimed
+        assert len(set(claimed)) == 2, f"two rules claimed the same id: {claimed}"
+        assert not list((root.parent / ".work" / "ids").glob("*")), \
+            "a lock file leaked — the number is lost forever"
+
+
+def test_every_event_the_harness_records_is_one_the_record_knows():
+    # The closed list of kinds is the point — a typo'd kind is a line that never
+    # shows up in a digest — and `append` used to enforce it by RAISING, in front of
+    # a user, after the tree had already changed, on a function whose first sentence
+    # promises it never raises. So the check lives here, where a typo is caught by a
+    # run rather than by whoever hit it.
+    called = set()
+    for module in sorted((Path(__file__).parent / "harness").glob("*.py")):
+        called |= set(re.findall(r"""events\.append\(\s*[^,]+,\s*["']([^"']+)["']""",
+                                 module.read_text()))
+    assert called, "fixture: found no call sites to check"
+    assert not called - set(events.KINDS), \
+        f"recorded but not in KINDS, so it never reaches a digest: {sorted(called - set(events.KINDS))}"
+
+
+def test_a_claim_nobody_can_read_reads_as_absent_rather_than_raising():
+    # `read_claim` promises an unreadable claim reads as absent, and the comparison
+    # threw rather than the parse: a `.claim` written without a timezone parsed
+    # fine and then could not be compared against an aware now. One malformed file
+    # took down every command that asks who is holding an item.
+    with tempfile.TemporaryDirectory() as tmp:
+        folder = Path(tmp) / "a-task"
+        folder.mkdir()
+        (folder / shift.CLAIM).write_text(json.dumps(
+            {"instance": "someone", "expires": "2099-01-01T00:00:00"}))
+        assert shift.read_claim(folder) is None
+
+
+def test_the_lowest_tier_the_vocabulary_defines_can_actually_be_set():
+    # `TIERS` and `TIER_MEANING` both define tier 0 and the method's own table
+    # documents it — reversible and local, a typo, a comment, a test name — and it
+    # was refused every time, because the DEFAULT for an ordinary change was being
+    # used as the FLOOR nobody may go under. Two numbers, not one.
+    assert 0 in tree.TIERS and 0 in tree.TIER_MEANING
+    assert autonomy.derive_tier("lesson-authoring", [], "0")[0] == 0
+    # Nothing about autonomy moved: the ceiling is 2, so 0 sits under it as 1 did.
+    assert autonomy.derive_tier("lesson-authoring", [])[0] == 1, \
+        "a task nobody tiered is still an ordinary change"
+    # And the rule this must not weaken: an owner that floors a task at 3 still
+    # refuses every number under it, 0 included.
+    for want in ("0", "1", "2"):
+        try:
+            autonomy.derive_tier("security", [], want)
+            assert False, f"--tier {want} on a security task should refuse"
+        except SystemExit:
+            pass
+
+
+def test_two_events_of_one_kind_in_a_commit_keep_their_own_detail():
+    # `verify` records one `verified` per gate, so two in a commit is the ordinary
+    # case rather than an exotic one. The payload was keyed on the KIND, so the
+    # second line was dropped and both events came back wearing the first's fields:
+    # a digest reporting one gate's result twice and the other never.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=False)
+            (repo / "work" / "note.md").write_text("something changed\n")
+            committed, _, note = _board_write(repo, "alpha", [
+                {"event": "verified", "name": "alpha", "gate": "tests", "exit": 0},
+                {"event": "verified", "name": "alpha", "gate": "lint", "exit": 1},
+            ])
+            assert committed, note
+
+            back = [e for e in git.read(repo, name="alpha") if e["event"] == "verified"]
+            assert [e.get("gate") for e in back] == ["tests", "lint"], back
+            assert [e.get("exit") for e in back] == ["0", "1"], back
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_repo_that_moves_its_coverage_shard_is_actually_read_there():
+    # `coverage.shard` is defaulted and documented and nothing read it: the reader
+    # hardcoded `.work/coverage`. So a repo that pointed its runners elsewhere got no
+    # error and no effect, and then `coverage` reported "no evidence" for every
+    # criterion a run had just proved.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            root = Path(tmp) / "work"
+            (root / "product").mkdir(parents=True)
+            (root / "product" / "viewer.md").write_text(
+                "---\ntype: feature\nstate: building\n---\n\n"
+                "## Acceptance criteria\n- [x] AC-01 (unit): a thing a test proves\n")
+            src = root.parent / "pkg" / "x.test.ts"
+            src.parent.mkdir(parents=True)
+            src.write_text("//\n")
+            elsewhere = root.parent / "build" / "evidence"
+            elsewhere.mkdir(parents=True)
+            (elsewhere / "vitest.json").write_text(json.dumps(
+                {"source": "pkg/x.test.ts", "runner": "vitest",
+                 "covered": {"viewer/AC-01": {"status": "passed"}}}))
+
+            config.apply({**config.DEFAULTS,
+                          "coverage": {"shard": "build/evidence"}})
+            out = _coverage_report(root)
+            assert "no run found" not in out, out
+            assert "BUILT COVERAGE  1/1" in out, out
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_a_coverage_shard_path_may_not_escape_the_repo():
+    # It is joined onto the repo root, so an absolute one silently becomes the whole
+    # answer — and the session-state root is derived from its parent.
+    for bad in ("/tmp/evidence", "../outside", ""):
+        with tempfile.TemporaryDirectory() as tmp:
+            repo = _repo_with_config(tmp, {"coverage": {"shard": bad}})
+            try:
+                config.load(repo)
+                assert False, f"{bad!r} should be refused"
+            except config.ConfigError as e:
+                assert "coverage.shard" in str(e)
+
+
+def test_a_task_with_an_open_question_can_be_put_back_into_blocked():
+    # The rule is right — a blocked task nobody can unblock is a dead end — and the
+    # test was the wrong one: it asked whether you had just called `ask`, not whether
+    # the item has an unanswered question. So a task showing in `needs` that moment,
+    # carrying its question in its own frontmatter, could not be returned to
+    # `blocked/` once somebody had moved it out. Which is precisely what a session
+    # does when it picks one up and finds the question still unanswered.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha",
+              fm="priority: P1\nasked:\n  - 2026-09-01  founder  which way?\n")
+        with _work_dir(tmp) as root:
+            assert task.cmd_move({"name": "alpha", "status": "blocked"}) == 0
+            assert (e / "blocked" / "alpha").is_dir()
+            assert model.locate(root, "alpha").status == "blocked"
+
+
+def test_a_task_with_nothing_to_unblock_it_still_cannot_be_blocked():
+    # The half that must not weaken: no open question means nobody can ever take it
+    # out again, and the refusal says which command to reach for instead.
+    with tempfile.TemporaryDirectory() as tmp:
+        v = _tree(tmp)
+        e = _epic(v, "an-epic")
+        _task(e / "in-progress", "alpha")
+        _task(e / "in-progress", "beta",
+              fm=("priority: P1\nasked:\n  - 2026-09-01  founder  which way?\n"
+                  "  - answered 2026-09-02  that way\n"))
+        with _work_dir(tmp):
+            for name in ("alpha", "beta"):
+                try:
+                    task.cmd_move({"name": name, "status": "blocked"})
+                    assert False, f"blocking '{name}' should refuse"
+                except SystemExit:
+                    pass
+                assert (e / "in-progress" / name).is_dir()
+
+
+def test_a_push_that_could_not_rebase_says_what_git_actually_complained_about():
+    # End to end, against a real conflict — the strings below are whatever this git
+    # really produces. The reason used to be read off the FIRST line, which is a
+    # fetch banner, and git glues its `error:` onto the end of the progress counter
+    # with no newline. Measured with four board writes racing: three refusals
+    # explaining themselves as "From /tmp/…/origin", "warning: fetch updated the
+    # current branch head.." and "Rebasing (1/4)." — three non-answers.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=True)
+            config.apply({**config.DEFAULTS,
+                          "git": {"commit": True, "push": True, "remote": "origin",
+                                  "paths": ["work"]}})
+            shared = repo / "work" / "shared.md"
+            shared.write_text("one\n")
+            _git(repo, "add", "-A"); _git(repo, "commit", "-qm", "seed")
+            _git(repo, "push", "-q", "origin", "HEAD:main")
+
+            # Somebody else changes the same board file and lands it first.
+            other = repo.parent / "other"
+            import subprocess
+            subprocess.run(["git", "clone", "-q", str(repo.parent / "origin.git"),
+                            str(other)], check=True, capture_output=True)
+            for k, v in (("user.email", "t@t"), ("user.name", "T")):
+                _git(other, "config", k, v)
+            (other / "work" / "shared.md").write_text("theirs\n")
+            _git(other, "add", "-A"); _git(other, "commit", "-qm", "theirs")
+            _git(other, "push", "-q", "origin", "HEAD:main")
+
+            # ...and this clone changes it too, so the rebase has a real conflict.
+            shared.write_text("ours\n")
+            committed, pushed, note = _board_write(
+                repo, "an-item", [{"event": "moved", "name": "an-item"}])
+
+            assert committed and not pushed, note
+            assert "could not apply" in note, note
+            for noise in ("From ", "Rebasing (", "fetch updated"):
+                assert noise not in note, f"the reason is git progress output: {note}"
+            assert "sync" in note, "a push that waited must say how to send it"
+            # And nothing is left half-applied for the session to clean up.
+            assert not [p for p in (repo / ".git").iterdir()
+                        if "rebase" in p.name.lower()], "a rebase was left in progress"
+            assert shared.read_text() == "ours\n"
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_four_board_writes_racing_a_rejected_push_lose_nothing():
+    # `_hold` serialises the COMMIT and deliberately not the push: some commands run
+    # a test suite, and a lock held across `verify` would stall every other agent in
+    # the repo for the length of a build. So the recovery a rejected push runs —
+    # `pull --rebase`, `rebase --abort` — happens outside it, and two writers can
+    # interleave.
+    #
+    # What makes that survivable is that nothing in the recovery MOVES anything: the
+    # autostash and the `reset --hard` that used to sit here went on 2026-09-08, and
+    # git declines rather than rebases over a tree that is not clean. So the answer
+    # to interleaving is that the loser waits — measured across four writers, a
+    # moved origin and a real conflict, and repeated: every item lands, the working
+    # tree is as it was, and no rebase is left half-applied.
+    import threading
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo(tmp, push=True)
+            config.apply({**config.DEFAULTS,
+                          "git": {"commit": True, "push": True, "remote": "origin",
+                                  "paths": ["work"]}})
+            # THE ORIGIN MOVES, so every push below is rejected and every writer
+            # enters the recovery path that runs outside the lock.
+            import subprocess
+            other = repo.parent / "other"
+            subprocess.run(["git", "clone", "-q", str(repo.parent / "origin.git"),
+                            str(other)], check=True, capture_output=True)
+            for k, v in (("user.email", "t@t"), ("user.name", "T")):
+                _git(other, "config", k, v)
+            (other / "work" / "theirs.md").write_text("somebody else\n")
+            _git(other, "add", "-A"); _git(other, "commit", "-qm", "their work")
+            _git(other, "push", "-q", "origin", "HEAD:main")
+
+            # …and the session has its own half-written code open the whole time.
+            (repo / "src").mkdir()
+            (repo / "src" / "app.ts").write_text("half-written\n")
+
+            queue = repo / "work" / "versions" / "v" / "e" / "queue"
+            start = threading.Barrier(4)
+
+            def write(n):
+                folder = queue / f"item-{n}"
+                folder.mkdir(parents=True, exist_ok=True)
+                (folder / "task.md").write_text(f"---\npriority: P0\n---\n\n# {n}\n")
+                start.wait()
+                git.land(repo, f"item-{n}", [{"event": "created", "name": f"item-{n}"}])
+
+            threads = [threading.Thread(target=write, args=(n,)) for n in range(4)]
+            [t.start() for t in threads]
+            [t.join() for t in threads]
+
+            listed = _git(repo, "ls-tree", "-r", "--name-only", "HEAD").stdout
+            for n in range(4):
+                assert f"queue/item-{n}/task.md" in listed, \
+                    f"item-{n} was written and never committed:\n{listed}"
+            assert "work/theirs.md" in listed, "another writer's file was lost"
+            assert (repo / "src" / "app.ts").read_text() == "half-written\n", \
+                "the session's own edits were moved"
+            assert not [p for p in (repo / ".git").iterdir()
+                        if "rebase" in p.name.lower()], "a rebase was left in progress"
+            assert _git(repo, "status", "--porcelain").stdout.strip() == "?? src/", \
+                _git(repo, "status", "--porcelain").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
+def test_config_unset_with_no_key_says_so_rather_than_throwing():
+    # The repair branch — `unset` may remove a key the schema does not know — took
+    # the empty key for one of those, because `_present` answers True for a path of
+    # no segments. It then indexed the last of zero parts, so the command an
+    # installer shells out to answered with an IndexError traceback.
+    with tempfile.TemporaryDirectory() as tmp:
+        repo = _repo_with_config(tmp, {"ids": {"prefix": "G"}})
+        for key in ("", ".", "  "):
+            try:
+                _cli(repo, "config", "unset", key)
+                assert False, f"unset {key!r} should refuse"
+            except SystemExit as e:
+                assert e.code, f"unset {key!r} exited 0"
+        assert json.loads((repo / ".claude" / "work.config.json").read_text()) == \
+            {"ids": {"prefix": "G"}}, "a refused unset changed the file"
+
+
+def test_asking_where_the_gates_stand_never_commits_the_board():
+    # `verify` writes the result of a run it EXECUTES, and two of its four doors
+    # execute nothing: `--async` starts a detached child that commits its own
+    # result, `--status` only reports. Both were driving a commit that swept up
+    # whatever the person had open in work/, as "docs(work): board edits" under no
+    # item — seen twice on this repo's own board in one session, while polling for a
+    # gate to finish, which is exactly the call a session repeats.
+    with tempfile.TemporaryDirectory() as tmp:
+        try:
+            repo = _git_repo_cli(tmp)
+            (repo / ".claude" / "work.config.json").write_text(json.dumps(
+                {"git": {"commit": True, "push": False, "remote": "origin",
+                         "paths": ["work"]},
+                 "verify": {"tests": "true"}}))
+            _git(repo, "add", "-A"); _git(repo, "commit", "-qm", "gates configured")
+            (repo / "work" / "product" / "README.md").write_text("a hand edit\n")
+            before = _git(repo, "rev-parse", "HEAD").stdout.strip()
+
+            _entry(repo, "verify", "--task", "alpha", "--status")
+            assert _git(repo, "rev-parse", "HEAD").stdout.strip() == before, \
+                "asking where the gates stand committed the board"
+            assert "work/product/README.md" in _git(repo, "status", "--porcelain").stdout
+        finally:
+            config.apply(config.DEFAULTS)
+
+
 if __name__ == "__main__":
     tests = [v for k, v in sorted(globals().items())
              if k.startswith("test_") and callable(v)]
@@ -6233,4 +6967,4 @@ if __name__ == "__main__":
         fn()
         print(f"ok  {fn.__name__}")
     shutil.rmtree(_TMP, ignore_errors=True)
-    print(f"\n{len(tests)} passed")
+    print(f"\n{len(tests)} passed")