@awebai/oats 0.29.3 → 0.30.0

package/lib/teams.mjs

@@ -0,0 +1,190 @@
+/**
+ * Team model v2 (docs/design/2026-09-27-team-model-v2.md, option B), pure.
+ *
+ * Where teams live:
+ *   - the committed oats-workspace.yaml `teams.<label> = { description?, team? }`: SHARED teams (edited
+ *     by PR). A shared team without `team` is declared but not yet created (unmapped);
+ *   - the deployment's oats-local.yaml `teams.<label> = { team, description? }`: LOCAL teams, plus
+ *     `defaultTeam: <label>`, `souls.teams: { "*" | <soul key>: [labels] }` and
+ *     `souls.default: { <soul key>: <label> }`.
+ * A soul key is the soul's bare name, or `<package>/<soul>` for a package soul.
+ *
+ * Resolution: labels = shared ∪ local (a label in both is `team-label-collision`; the SHARED definition
+ * wins). defaultOf(soul) = souls.default[soul] ?? defaultTeam; a soul's teams = {defaultOf} ∪
+ * souls.teams["*"] ∪ souls.teams[soul]. An undeclared label the soul reaches is E_TEAM_UNKNOWN; a
+ * souls.default outside the soul's teams is E_TEAM_NOT_ELIGIBLE.
+ *
+ * Rows (docs/desktop-cli-api.md, Team model v2): TeamRow { label, team, default, from: shared|local },
+ * the default first, then by label. Reports carry unmapped rows (team null); OATS_TEAMS and
+ * instance.json carry mapped rows only. DefaultTeam { label, team, from: deployment|soul } | null.
+ */
+import { oatsError } from "./errors.mjs";
+
+const isObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const str = (v) => (typeof v === "string" && v ? v : null);
+const labelsOf = (v) => (Array.isArray(v) ? v.filter((l) => typeof l === "string") : []);
+const byCodepoint = (a, b) => (a < b ? -1 : a > b ? 1 : 0);
+export const pointerKey = (k) => String(k).replace(/~/g, "~0").replace(/\//g, "~1");
+function fail(code, message, details) {
+  const e = oatsError(code, message, details);
+  e.details = details;
+  return e;
+}
+
+export const LOCAL_FILE = "oats-local.yaml";
+/** A provider team id, as both schemas' `teams.*.team` pattern: the kernel's SAFETY rule only (never
+ *  `-`-led, so never an option; no whitespace or control characters; bounded). The messaging provider
+ *  validates its own id shape. Keep equal to docs/oats-{local,workspace}.schema.json. */
+export const TEAM_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._:@/+-]{0,255}$/;
+/** What 0.30 removed, named by the schema problems that replace them. */
+export const TEAM_MEMBERSHIP_MOVED = "team membership is local since 0.30: `oats soul teams`";
+export const BY_TEAM_REMOVED = "byTeam was removed in 0.30: a team's provider id is teams.<label>.team (oats-workspace.yaml for a shared team, oats-local.yaml for a local one)";
+
+const UNMAPPED_FIX = "its owner runs `oats aweb setup`, then commits the id";
+
+/** The deployment's teams from the committed workspace and oats-local.yaml (either may be null). */
+export function teamModel(workspace, local, { workspaceKey = null } = {}) {
+  const shared = new Map(), localTeams = new Map();
+  for (const [label, def] of Object.entries(isObject(workspace?.teams) ? workspace.teams : {})) {
+    shared.set(label, { label, team: str(def?.team), description: str(def?.description), from: "shared",
+      at: `${workspaceKey ? `${workspaceKey}:` : ""}oats-workspace.yaml#/teams/${pointerKey(label)}` });
+  }
+  for (const [label, def] of Object.entries(isObject(local?.teams) ? local.teams : {})) {
+    localTeams.set(label, { label, team: str(def?.team), description: str(def?.description), from: "local", at: `${LOCAL_FILE}#/teams/${pointerKey(label)}` });
+  }
+  const souls = isObject(local?.souls) ? local.souls : {};
+  return {
+    shared, local: localTeams,
+    labels: new Map([...localTeams, ...shared]), // the committed definition wins a collision
+    defaultTeam: str(local?.defaultTeam),
+    souls: { teams: isObject(souls.teams) ? souls.teams : {}, default: isObject(souls.default) ? souls.default : {} },
+  };
+}
+
+/** The key a soul has in souls.teams / souls.default. */
+export function soulKeyOf(soulEntry) {
+  return typeof soulEntry?.package === "string" && typeof soulEntry.qualifiedName === "string" ? soulEntry.qualifiedName : soulEntry.name;
+}
+
+const unknown = (label, at) => fail("E_TEAM_UNKNOWN", `team ${JSON.stringify(label)} is not declared (${at}): declare it with \`oats teams add\`, or in oats-workspace.yaml teams: for a shared team`, { label, at });
+
+/**
+ * One soul's teams here (key "*": the deployment default + souls.teams["*"]).
+ * → { key, defaultTeam: DefaultTeam | null, teams: [TeamRow + via] } | throws E_TEAM_UNKNOWN / E_TEAM_NOT_ELIGIBLE.
+ * `via` ⊂ ["default", "*", "soul"], in that order: why the soul has the team.
+ */
+export function soulTeams(model, key) {
+  const known = (label, at) => { if (!model.labels.has(label)) throw unknown(label, at); };
+  if (model.defaultTeam !== null) known(model.defaultTeam, `${LOCAL_FILE}#/defaultTeam`);
+  const star = labelsOf(model.souls.teams["*"]);
+  star.forEach((l, i) => known(l, `${LOCAL_FILE}#/souls/teams/*/${i}`));
+  const own = key === "*" ? [] : labelsOf(model.souls.teams[key]);
+  own.forEach((l, i) => known(l, `${LOCAL_FILE}#/souls/teams/${pointerKey(key)}/${i}`));
+  const override = key === "*" ? null : str(model.souls.default[key]);
+  if (override !== null) {
+    const at = `${LOCAL_FILE}#/souls/default/${pointerKey(key)}`;
+    known(override, at);
+    if (override !== model.defaultTeam && !star.includes(override) && !own.includes(override)) {
+      throw fail("E_TEAM_NOT_ELIGIBLE", `souls.default.${key} is ${JSON.stringify(override)}, which is not one of ${key}'s teams here — add it first (\`oats soul teams ${key} --add ${override}\`)`, { soul: key, label: override, at });
+    }
+  }
+  const defaultLabel = override ?? model.defaultTeam;
+  const via = new Map();
+  const add = (label, why) => { const v = via.get(label) ?? []; if (!v.includes(why)) v.push(why); via.set(label, v); };
+  if (defaultLabel !== null) add(defaultLabel, "default");
+  for (const l of star) add(l, "*");
+  for (const l of own) add(l, "soul");
+  const teams = [...via].map(([label, v]) => {
+    const d = model.labels.get(label);
+    return { label, team: d.team, default: label === defaultLabel, from: d.from, via: v };
+  }).sort((a, b) => (b.default - a.default) || byCodepoint(a.label, b.label));
+  const defaultTeam = defaultLabel === null ? null : { label: defaultLabel, team: model.labels.get(defaultLabel).team, from: override !== null ? "soul" : "deployment" };
+  return { key, defaultTeam, teams };
+}
+
+/** TeamRows as the reports carry them (unmapped included, no `via`). */
+export const reportRows = (teams) => (teams || []).map(({ label, team, default: d, from }) => ({ label, team, default: d, from }));
+/** TeamRows as OATS_TEAMS and instance.json carry them: mapped only. */
+export const envRows = (teams) => reportRows(teams).filter((r) => r.team !== null);
+
+/** Every reference to `label` in oats-local.yaml, in written order (`oats teams remove` refuses on any). */
+export function teamReferences(model, label) {
+  const refs = [];
+  if (model.defaultTeam === label) refs.push("defaultTeam");
+  for (const [key, list] of Object.entries(model.souls.teams)) if (labelsOf(list).includes(label)) refs.push(`souls.teams:${key}`);
+  for (const [key, l] of Object.entries(model.souls.default)) if (l === label) refs.push(`souls.default:${key}`);
+  return refs;
+}
+
+const collisionProblem = (label, shared, local) => ({
+  code: "team-label-collision", label, severity: "warning",
+  shared: { team: shared.team, description: shared.description, at: shared.at },
+  local: { team: local.team, description: local.description, at: local.at },
+  message: `team ${label} is declared in both oats-workspace.yaml (shared) and oats-local.yaml (local); the shared definition wins`,
+  fix: "rename the local label in oats-local.yaml",
+});
+const unmappedProblem = (d, isDefault) => isDefault
+  ? { code: "team-unmapped", label: d.label, default: true, severity: "failure", at: d.at, message: `the default team ${d.label} has no provider id yet`, fix: `${UNMAPPED_FIX}; or choose another default with \`oats teams default\`` }
+  : { code: "team-unmapped", label: d.label, default: false, severity: "warning", at: d.at, message: `shared team ${d.label} has no provider id yet`, fix: UNMAPPED_FIX };
+const unconfiguredProblem = () => ({ code: "E_TEAM_UNCONFIGURED", severity: "failure", message: "no teams configured: run `oats aweb setup`", fix: "run `oats aweb setup` (it creates the teams and sets the default), or `oats teams add <label> --team <id>`" });
+const refusalProblem = (e) => ({ code: e.code, ...e.details, severity: "failure", message: e.message,
+  fix: e.code === "E_TEAM_UNKNOWN" ? "declare the team (`oats teams add`), or remove the reference" : "add the label to the soul's teams (`oats soul teams … --add`), or clear its default (`--clear-default`)" });
+
+/**
+ * Readiness problems. Without `key`: the deployment's (`oats teams`): collisions, unmapped shared
+ * teams (a failure when it is `defaultTeam`), every unknown reference, every ineligible
+ * souls.default. With `key`: only what concerns that soul (`default` marks ITS default).
+ * `messaging`: a messaging layer is active, so no default is E_TEAM_UNCONFIGURED.
+ */
+export function teamProblems(model, { key = null, messaging = false } = {}) {
+  const problems = [];
+  if (key !== null) {
+    let t;
+    try { t = soulTeams(model, key); }
+    catch (e) { if (e.code === "E_TEAM_UNKNOWN" || e.code === "E_TEAM_NOT_ELIGIBLE") return [refusalProblem(e)]; throw e; }
+    for (const r of t.teams) if (model.shared.has(r.label) && model.local.has(r.label)) problems.push(collisionProblem(r.label, model.shared.get(r.label), model.local.get(r.label)));
+    for (const r of t.teams) if (r.team === null) problems.push(unmappedProblem(model.labels.get(r.label), r.default));
+    if (messaging && t.defaultTeam === null) problems.push(unconfiguredProblem());
+    return problems;
+  }
+  const labels = [...model.labels.keys()].sort(byCodepoint);
+  for (const label of labels) if (model.shared.has(label) && model.local.has(label)) problems.push(collisionProblem(label, model.shared.get(label), model.local.get(label)));
+  for (const label of labels) { const d = model.labels.get(label); if (d.team === null) problems.push(unmappedProblem(d, label === model.defaultTeam)); }
+  const known = (label, at) => { if (!model.labels.has(label)) problems.push(refusalProblem(unknown(label, at))); };
+  if (model.defaultTeam !== null) known(model.defaultTeam, `${LOCAL_FILE}#/defaultTeam`);
+  for (const [k, list] of Object.entries(model.souls.teams)) labelsOf(list).forEach((l, i) => known(l, `${LOCAL_FILE}#/souls/teams/${pointerKey(k)}/${i}`));
+  for (const [k, l] of Object.entries(model.souls.default)) if (typeof l === "string") known(l, `${LOCAL_FILE}#/souls/default/${pointerKey(k)}`);
+  for (const [k, l] of Object.entries(model.souls.default)) {
+    if (typeof l !== "string" || !model.labels.has(l)) continue;
+    try { soulTeams(model, k); } catch (e) { if (e.code === "E_TEAM_NOT_ELIGIBLE" && e.details.soul === k) problems.push(refusalProblem(e)); else if (e.code !== "E_TEAM_UNKNOWN") throw e; }
+  }
+  if (messaging && model.defaultTeam === null) problems.push(unconfiguredProblem());
+  return problems;
+}
+
+/**
+ * The provider environment (docs/desktop-cli-api.md, The provider environment) from a soul's teams
+ * `{ defaultTeam, teams, source: "live"|"recorded" }`, or null when they are not known. A name that
+ * does not apply is `undefined`, so a child process never inherits an ambient value. The pre-0.30
+ * names are always unset.
+ */
+export function teamsEnv(t) {
+  const known = isObject(t) && Array.isArray(t.teams);
+  const d = known && isObject(t.defaultTeam) ? t.defaultTeam : null;
+  return {
+    OATS_DEFAULT_TEAM: d?.label ?? undefined,
+    OATS_DEFAULT_TEAM_ID: d?.team ?? undefined,
+    OATS_DEFAULT_TEAM_FROM: d?.from ?? undefined,
+    OATS_TEAMS: known ? JSON.stringify(envRows(t.teams)) : undefined,
+    OATS_TEAMS_SOURCE: known && (t.source === "live" || t.source === "recorded") ? t.source : undefined,
+    OATS_TEAM_LABEL: undefined, OATS_TEAM_LABELS: undefined, OATS_TEAM_ID: undefined,
+  };
+}
+
+/** A home's spawn-time teams (instance.json `teams` / `defaultTeam`) → { teams, defaultTeam }; teams null
+ *  when the home recorded none in this shape (spawned before 0.30: its teams are unknown, never guessed). */
+export function recordedTeams(meta) {
+  const rows = Array.isArray(meta?.teams) && meta.teams.every((r) => isObject(r) && typeof r.label === "string" && typeof r.default === "boolean") ? meta.teams : null;
+  const d = isObject(meta?.defaultTeam) && typeof meta.defaultTeam.label === "string" ? meta.defaultTeam : null;
+  return { teams: rows, defaultTeam: rows ? d : null };
+}

package/lib/triggers.mjs

@@ -28,8 +28,8 @@ import { spawnSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
-import { readDefinitions, writeDefinitions, stateDir, withScopeLock, childEnv, parseEnvelopeText, schedulerStatus } from "./schedule.mjs";
-import { automationError, baseRow, localEntry, localId, qualifiedId, soulOriginOf } from "./automations.mjs";
+import { readDefinitions, writeDefinitions, stateDir, withScopeLock, childEnv, parseEnvelopeText, schedulerStatus, readRegistry } from "./schedule.mjs";
+import { MODEL_RE, automationError, baseRow, localEntry, localId, parseOwner, qualifiedId, soulOriginOf } from "./automations.mjs";
 import { lockedPackageRef } from "./packages.mjs";
 
 export const TRIGGER_API = 1;
@@ -121,7 +121,7 @@ export function validateTrigger(def) {
   if (!Array.isArray(teams) || teams.some((t) => typeof t !== "string" || !LABEL_RE.test(t)) || new Set(teams).size !== teams.length) throw invalid("spawn.teams", "a list of distinct team labels");
   if (sp.launchConfig !== undefined && (typeof sp.launchConfig !== "string" || !LAUNCH_CONFIG_RE.test(sp.launchConfig))) throw invalid("spawn.launchConfig", "the name of a launch configuration on the running host (oats-local.yaml launch-configs)");
   if (sp.harness !== undefined && !HARNESSES.has(sp.harness)) throw invalid("spawn.harness", "pi, claude or codex");
-  if (sp.model !== undefined && (typeof sp.model !== "string" || !sp.model.trim())) throw invalid("spawn.model", "a model id");
+  if (sp.model !== undefined && (typeof sp.model !== "string" || !MODEL_RE.test(sp.model))) throw invalid("spawn.model", "a model id: a letter or digit, then letters, digits and . _ : / @ + - [ ] (at most 128 characters)");
   if (sp.yolo !== undefined && typeof sp.yolo !== "boolean") throw invalid("spawn.yolo", "boolean");
   if (sp.backend !== undefined && !BACKENDS.has(sp.backend)) throw invalid("spawn.backend", "tmux or herdr");
   const cc = def.concurrency === undefined ? {} : def.concurrency;
@@ -207,7 +207,12 @@ export function triggerKind({ lock = null, remote = null } = {}) {
     parseBody: parseTriggerBody,
     expand: async (a) => {
       const raw = a.source.from ? await packageTriggerTemplate(lock, a.source.from, a.source.set, { id: a.name, remote }) : { ...a.source.definition };
-      return validateTrigger({ ...raw, id: a.name, kind: "trigger", enabled: true });
+      const def = validateTrigger({ ...raw, id: a.name, kind: "trigger", enabled: true });
+      // The owner check asks gh on the OWNER's host, and the poll runs on the REPO's host: they must be
+      // one GitHub host, or polling would act as whoever is logged in there (re-review B #7).
+      const owner = parseOwner(a.owner), repo = parseRepo(def.on.repo);
+      if (owner && repo && owner.host.toLowerCase() !== repo.host) throw Object.assign(triggerError("E_TRIGGER_INVALID", `owner ${a.owner} is on ${owner.host}, but on.repo ${repo.key} is on ${repo.host}: a trigger acts as its owner on the repository's own GitHub host`), { field: "owner" });
+      return def;
     },
   };
 }
@@ -265,8 +270,28 @@ export function readTriggerState(ws) {
   let doc;
   try { doc = JSON.parse(readFileSync(file, "utf8")); } catch { doc = null; }
   if (!isObject(doc) || !isObject(doc.triggers)) return { version: 1, triggers: {} };
+  return carryUnqualifiedState(doc);
+}
+/** 0.28 kept a local trigger's state under its bare id, with event keys `<id>:…`; 0.29 qualifies
+ *  both as `local/<id>`. Carried on read (re-review B #2): without it the first 0.29 tick saw no
+ *  PR state, so every open matching PR emitted `opened` and spawned again. A bare id already
+ *  present in qualified form keeps the qualified state. */
+function carryUnqualifiedState(doc) {
+  for (const id of Object.keys(doc.triggers)) {
+    if (id.includes("/")) continue;
+    const qid = localId(id), old = doc.triggers[id];
+    delete doc.triggers[id];
+    if (doc.triggers[qid] || !isObject(old)) continue;
+    const rekey = (map) => Object.fromEntries(Object.entries(isObject(map) ? map : {}).map(([k, v]) => {
+      const key = k.startsWith(`${id}:`) ? `${qid}${k.slice(id.length)}` : k;
+      return [key, isObject(v) && "key" in v ? { ...v, key, ...(v.trigger === id ? { trigger: qid } : {}) } : v];
+    }));
+    doc.triggers[qid] = { ...old, prs: isObject(old.prs) ? old.prs : {}, fired: rekey(old.fired), pending: rekey(old.pending) };
+  }
   return doc;
 }
+/** Whether an instance's recorded trigger id is `id`: a 0.28 home records a local trigger's bare id. */
+const sameTrigger = (recorded, id) => recorded === id || (typeof recorded === "string" && !recorded.includes("/") && id === localId(recorded));
 function writeTriggerState(ws, st) {
   const file = statePath(ws);
   mkdirSync(dirname(file), { recursive: true });
@@ -290,7 +315,7 @@ export function liveTriggerInstances(ws, id) {
       if (!e.isDirectory()) continue;
       const home = join(instances, e.name);
       let meta; try { meta = JSON.parse(readFileSync(join(home, "instance.json"), "utf8")); } catch { continue; }
-      if (isObject(meta?.trigger) && meta.trigger.id === id) out.push({ instance: meta.instance ?? e.name, home, repo: meta.trigger.repo, number: meta.trigger.number, event: meta.trigger.event, key: meta.trigger.key ?? null });
+      if (isObject(meta?.trigger) && (id === null || sameTrigger(meta.trigger.id, id))) out.push({ instance: meta.instance ?? e.name, home, repo: meta.trigger.repo, number: meta.trigger.number, event: meta.trigger.event, key: meta.trigger.key ?? null });
     }
   }
   return out;
@@ -359,6 +384,9 @@ export function foldPoll(def, ts, poll, now) {
     for (const e of eventsFor(def, ts.prs[pr.number], pr)) {
       const key = eventKey(def, pr, e);
       if (ts.fired[key] || ts.pending[key]) continue;
+      // A newer push supersedes a pending `synchronize` for an older head of the same PR: only
+      // the newest head is reviewed (re-review B #6).
+      if (e.event === "synchronize") for (const [k, p] of Object.entries(ts.pending)) if (p.number === pr.number && p.event === "synchronize") delete ts.pending[k];
       ts.pending[key] = { trigger: def.qid ?? def.id, source: def.on.source, repo: def.on.repo, number: pr.number, url: pr.url, event: e.event, headSha: pr.headSha, labels: pr.labels, observedAt: now.toISOString(), key };
       added.push(key);
     }
@@ -384,7 +412,7 @@ function runOats(ws, argv, io) {
 /** What `oats spawn <soul> --preview` says about the soul: its qualified resolution and the
  *  capability filling its messaging slot. → { ok, result | error } */
 export function previewSoul(ws, def, io) {
-  const r = runOats(ws, ["spawn", def.spawn.soul, "--dir", ws, "--preview", "--json"], io);
+  const r = runOats(ws, ["spawn", def.spawn.soul, `--dir=${ws}`, "--preview", "--json"], io);
   if (!r.envelope || typeof r.envelope.ok !== "boolean") return { ok: false, error: { code: "E_SPAWN_FAILED", message: r.timedOut ? "spawn --preview timed out" : `spawn --preview answered no envelope${r.stderr ? `: ${r.stderr.trim().split("\n").pop()}` : ""}` } };
   if (!r.envelope.ok) return { ok: false, error: { code: r.envelope.error?.code ?? "E_SPAWN_FAILED", message: r.envelope.error?.message ?? "spawn --preview failed" } };
   const modules = Array.isArray(r.envelope.result?.modules) ? r.envelope.result.modules : [];
@@ -396,17 +424,18 @@ export function previewSoul(ws, def, io) {
 export function spawnForEvent(ws, def, ev, io) {
   const fields = { repo: ev.repo, number: ev.number, url: ev.url, event: ev.event, headSha: ev.headSha, trigger: def.id };
   const purpose = renderTemplate(def.spawn.purpose, fields);
-  const argv = ["spawn", def.spawn.soul, "--dir", ws, "--purpose", purpose, "--json"];
+  // Every value travels as ONE `--flag=value` token, so no value can be read as a flag of its own.
+  const argv = ["spawn", def.spawn.soul, `--dir=${ws}`, `--purpose=${purpose}`, "--json"];
   if (def.spawn.teams.length) {
     const pv = previewSoul(ws, def, io);
     if (!pv.ok) throw triggerError(pv.error.code, pv.error.message);
     if (!pv.messaging) throw triggerError("E_TRIGGER_TEAMS", `trigger ${def.id}: spawn.teams [${def.spawn.teams.join(", ")}] needs a messaging capability, and soul ${def.spawn.soul} resolves none`, { details: { soul: def.spawn.soul, teams: def.spawn.teams } });
     argv.push("--provider", pv.messaging, `join=${def.spawn.teams.join(",")}`);
   }
-  if (def.spawn.launchConfig) argv.push("--launch-config", def.spawn.launchConfig);
-  if (def.spawn.harness) argv.push("--harness", def.spawn.harness);
-  if (def.spawn.model) argv.push("--model", def.spawn.model);
-  if (def.spawn.backend) argv.push("--backend", def.spawn.backend);
+  if (def.spawn.launchConfig) argv.push(`--launch-config=${def.spawn.launchConfig}`);
+  if (def.spawn.harness) argv.push(`--harness=${def.spawn.harness}`);
+  if (def.spawn.model) argv.push(`--model=${def.spawn.model}`);
+  if (def.spawn.backend) argv.push(`--backend=${def.spawn.backend}`);
   if (def.spawn.yolo === true) argv.push("--yolo"); else if (def.spawn.yolo === false) argv.push("--no-yolo");
   if (io?.noLaunch === true) argv.push("--no-launch");
   // The task and the event travel as private files, never in argv.
@@ -416,7 +445,7 @@ export function spawnForEvent(ws, def, ev, io) {
   const taskFile = `${stem}.md`, eventFile = `${stem}.event.json`;
   writeFileSync(eventFile, JSON.stringify(ev, null, 2) + "\n", { mode: 0o600 });
   writeFileSync(taskFile, renderTemplate(def.spawn.task, fields).trimEnd() + triggerBlock(def, ev, "<home>/.oats/trigger-event.json"), { mode: 0o600 });
-  argv.push("--task-file", taskFile, "--trigger-event", eventFile);
+  argv.push(`--task-file=${taskFile}`, `--trigger-event=${eventFile}`);
   let r;
   try { r = runOats(ws, argv, io); }
   finally { for (const f of [taskFile, eventFile]) { try { rmSync(f, { force: true }); } catch { /* best effort */ } } }
@@ -438,18 +467,24 @@ function heldBy(def, ev, live) {
  *  whose poll is not due is not polled; pending events (a spawn that failed, or was held by
  *  concurrency) are retried whenever the trigger polls. `dryRun` reads only.
  *  → considered rows { workspace, trigger, action, … } */
-export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = null } = {}) {
+export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = null, reg = null, wsList = null } = {}) {
   let entries;
   try { entries = triggerEntries(ws, ctx); } catch (e) { return [{ workspace: ws, action: "error", error: e.message }]; }
   if (!entries.length) return [];
+  // The host cap (registry triggersMaxConcurrent; absent = unbounded) counts every trigger-spawned
+  // live home in the host's scopes, and nothing a schedule runs (re-review B #5).
+  let hostCap;
+  try { hostCap = (reg || readRegistry()).triggersMaxConcurrent; } catch (e) { return [{ workspace: ws, action: "error", error: e.message }]; }
+  const scopes = [...new Set([...(wsList || []), ws])];
+  let hostLive = hostCap ? scopes.reduce((n, w) => n + liveTriggerInstances(w, null).length, 0) : 0;
   const st = readTriggerState(ws);
   const considered = [];
   const rec = (id, action, extra = {}) => considered.push({ workspace: ws, trigger: id, action, ...extra });
   for (const e of entries) {
     const id = e.id;
     // A workspace trigger another host runs is not this tick's business; one NAMED for this host
-    // that it cannot run (another gh account) is reported every tick until someone fixes it.
-    if (e.placement.reason) { if (e.placement.reason === "owner-mismatch" && e.placement.enabledHere) rec(id, "not-here", { reason: e.placement.reason, detail: e.placement.detail }); continue; }
+    // that it cannot run (another gh account, or not trusted here) is reported every tick until someone fixes it.
+    if (e.placement.reason) { if (["owner-mismatch", "untrusted"].includes(e.placement.reason) && e.placement.enabledHere) rec(id, "not-here", { reason: e.placement.reason, detail: e.placement.detail }); continue; }
     if (e.invalid) { if (e.placement.enabledHere) rec(id, "invalid", { error: e.invalid.message }); continue; }
     if (!e.placement.runsHere) continue;
     const def = runDef(e);
@@ -471,15 +506,16 @@ export function tickTriggers(ws, { now = new Date(), io, dryRun = false, ctx = n
     const queue = Object.values(work.pending).sort((a, b) => a.observedAt.localeCompare(b.observedAt) || a.key.localeCompare(b.key));
     if (!queue.length) rec(id, "polled", { prs: work.lastPoll.prs, matching: work.lastPoll.matching });
     for (const ev of queue) {
-      const held = heldBy(def, ev, live);
+      const held = heldBy(def, ev, live) ?? (hostCap && hostLive >= hostCap ? `host triggersMaxConcurrent ${hostCap} reached (${hostLive} live)` : null);
       if (held) { rec(id, "held", { key: ev.key, reason: held }); continue; }
-      if (dryRun) { rec(id, "would-fire", { key: ev.key, event: ev.event, number: ev.number, url: ev.url }); live.push({ repo: ev.repo, number: ev.number }); continue; }
+      if (dryRun) { rec(id, "would-fire", { key: ev.key, event: ev.event, number: ev.number, url: ev.url }); live.push({ repo: ev.repo, number: ev.number }); hostLive++; continue; }
       try {
         const run = spawnForEvent(ws, def, ev, io);
         work.fired[ev.key] = { at: now.toISOString(), instance: run.instance ?? null, home: run.home ?? null, event: ev.event, number: ev.number };
         delete work.pending[ev.key];
         work.lastFiredAt = now.toISOString();
         live.push({ instance: run.instance, home: run.home, repo: ev.repo, number: ev.number });
+        hostLive++;
         rec(id, "fired", { key: ev.key, instance: run.instance ?? null, home: run.home ?? null });
       } catch (e) {
         work.lastError = { at: now.toISOString(), code: e.code || "E_SPAWN_FAILED", message: e.message, key: ev.key };