@bluewombat/runtime 0.9.0 → 0.11.0

package/README.md

@@ -53,19 +53,21 @@ package's README — Host does not grow a `--repo` flag for it.
 | --------------- | -------------------------------------------------------------------------------------- |
 | `mason run`     | Drain the TicketTracker, run Conductor, report                                        |
 | `mason watch`   | Snapshot the ledger and follow the journal. Ctrl-C leaves the worker running           |
-| `mason status`  | Snapshot the ledger, then exit. `--json` for scripts                                   |
+| `mason status`  | Snapshot the ledger as a Feature / Ticket tree, then exit. `--json` for scripts        |
 | `mason log`     | Replay the journal, with the reason a phase stopped. `--problems` for just those       |
 | `mason init`    | Set this directory up: asks, writes the config and the Builder stub, then runs `setup` |
 | `mason setup`   | Prepare the tracker. A plan by default; `--apply` writes. Exit 1 on a blocked step     |
 | `mason doctor`  | Check the config, the slots, and the manager. Exit 1 on any failure                    |
+| `mason incident` | Gather what is known about one stop (ledger, journal, streams, transcripts) into one page, for a person to read or hand on. Without a key, list what waits. `--json`, `--out DIR`, `--with-config`. Read-only |
 | `mason explain` | Say what an agent role starts with: prompt, plugins, skills, the project's profile. Read-only, offline. Exit 1 on a setup every attempt would fail on |
 | `mason cancel`  | Abandon a Ticket by key, when the tracker cannot say it is gone                       |
+| `mason restart` | Resume an escalated Feature with a fresh workspace, made again from its line. Offline: the tracker is not told |
 | `mason release` | Drop a held unit without waiting for the bail clock                                    |
 
 ### What an agent role starts with
 
 ```bash
-mason explain builder.producer      # one role; no role names all of them
+mason explain ticket.build.producer      # one role; no role names all of them
 mason explain --json                # the same facts for a script
 ```
 
@@ -128,7 +130,9 @@ mason watch
 That is the operator surface: the durable state of every Ticket, then the film
 of the current step (`submitted` included). It does not talk to the tracker, and
 it cannot `resume` or claim. `status` is the same snapshot without the
-follow. `--json` prints that snapshot as JSON.
+follow: a header with the counts, each Feature with its Tickets under it
+(escalated Features first, finished ones last, keys in numeric order), then the
+Tickets of no Feature. `--json` prints that tree as JSON.
 
 When a run only printed `unavailable:<key>`, the reason is already in the
 journal and `log` is how you read it:
@@ -144,6 +148,24 @@ distinct failure. If a slot was started with `--transcript-dir`, the newest
 transcript files are named underneath, with the agent exit and duration read
 from the start of each file.
 
+When a Ticket or a Feature is waiting for a person, `incident` gathers what the
+run knows of it:
+
+```bash
+mason incident                  # what waits for a person
+mason incident 106              # one stop: the key, or the tracker's number
+mason incident 106 --out ./inc  # incident.md and incident.json, to hand on
+mason incident 106 --with-config  # also the config file, secret-looking values blanked
+```
+
+The page says what the run was made of (versions, what the configuration switched
+on), who refused the work and what they said, the Tickets of the
+Feature with their pull requests, the Gate's configuration, the journal's events
+of the last round and where the streams and transcripts are. What it could not
+find is listed under "Not found". Streams exist only if the Project turned them
+on (`--streams-dir`); without them the page has the Gate's report but not what
+the Gate printed.
+
 To abandon a Ticket the tracker can no longer mention (a deleted issue, a
 manager with no `probe`), stop `run` if it holds the ledger lock, then:
 
@@ -151,13 +173,29 @@ manager with no `probe`), stop `run` if it holds the ledger lock, then:
 mason cancel github:owner/name#19
 ```
 
-After a crash left a unit `running` with nobody on it, stop `run` if it
-holds the lock, then:
+A unit that was stopped (Ctrl-C, a crash) is picked up where it was by the next
+`mason run`: its workspace is kept, the Attempts it finished still count and the
+numbering goes on. To start a unit over instead (the line moved on, the work took
+a wrong turn), stop `run` if it holds the lock, then:
 
 ```bash
 mason release github:owner/name#19
 ```
 
+`release` destroys the workspace and forgets it; the next `run` isolates a fresh one.
+
+A Feature that escalated keeps its work. When a person then changes its line and resumes it,
+the work takes in what the line gained, merged into it, before it is judged again; a conflict
+escalates the Feature again, naming it. To throw the work away instead, stop `run` if it holds
+the lock, then:
+
+```bash
+mason restart github:owner/name#106    # or just 106
+```
+
+The Feature must be escalated. Its workspace is removed and it is resumed; the next `run`
+cuts the work again from the line. The tracker is not told.
+
 The film is `<ledger>/events.jsonl`, next to `cursor`. It is not truth after a
 crash — the ledger is. The file can grow; there is no rotation yet.
 
@@ -174,45 +212,50 @@ value that starts with `@`, like every `@bluewombat/...` package name, needs
 quotes: `@` is a reserved YAML indicator at the start of a plain scalar.
 
 ```yaml
-featureTracker:
-  package: "@bluewombat/manager-fake"
-  options:
-    source: ./.mason/source
-    target: ./.mason/threads
-ticketTracker:
-  package: "@bluewombat/manager-fake"
-  options:
-    source: ./.mason/source
-    target: ./.mason/threads
 workLine:
   stable: ./work-line-stable
   isolation: "@bluewombat/isolation-copy"
   warm:
     cmd: [pnpm, install, --frozen-lockfile]
     timeoutMs: 600000
-builder:
-  producer:
-    cmd: [node, ./mason-builder.mjs]
-    timeoutMs: 600000
-    gates: { defaultTimeoutMs: 120000, gates: [] }
-  repair:
-    cmd: [node, ./mason-repair.mjs]
-    timeoutMs: 600000
+ticket:
+  tracker:
+    package: "@bluewombat/manager-fake"
+    options:
+      source: ./.mason/source
+      target: ./.mason/threads
+  build:
+    producer:
+      cmd: [node, ./mason-builder.mjs]
+      timeoutMs: 600000
+    repair:
+      cmd: [node, ./mason-repair.mjs]
+      timeoutMs: 600000
     gates: { defaultTimeoutMs: 120000, gates: [] }
-  maxAttempts: 3
-assembly:
+    maxAttempts: 3
+  validate: { agent: false }
   gates: { defaultTimeoutMs: 900000, gates: [] }
+feature:
+  tracker:
+    package: "@bluewombat/manager-fake"
+    options:
+      source: ./.mason/source
+      target: ./.mason/threads
 authority:
   enabled: false
 timeoutMs: 600000
 pollIntervalMs: 10000
 ```
 
+The file reads by level, and each level in the order it is used: `ticket` and `feature` both hold
+`tracker`, then what makes the work (`build` for a Ticket, `test` for a Feature), `validate`, `gates`, `fix`.
+
 | Field                       | Meaning                                                                                                                                                                                                                                                                                                                                                                      |
 | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `featureTracker`            | `package` (a name or path that exports `createManager`) and `options`: where Features are written and signalled                                                                                                                                                                                                                                                                                                                            |
-| `ticketTracker`             | Same shape: where the Tickets of a Feature are, and the Authority that holds the lines. May name the same package as `featureTracker`, or another                                                                                                                                                                                                                                                                                                             |
+| `feature.tracker`          | `package` (a name or path that exports `createManager`) and `options`: where Features are written and signalled                                                                                                                                                                                                                                                                                                                            |
+| `ticket.tracker`           | Same shape: where the Tickets of a Feature are, and the Authority that holds the lines. May name the same package as `feature.tracker`, or another                                                                                                                                                                                                                                                                                                             |
 | `workLine.stable`           | Existing directory the work folds into. Optional when the manager names a reference work line: Host then keeps its own copy at `<home>/work-line`                                                                                                                                                                                                                            |
+| `workLine.targetStable`     | A second copy of the work line, on the branch a Feature is folded into: what is merged into the Feature when it is brought up to date. Host keeps its own at `<home>/target-line` when the manager names a reference; required with an Authority otherwise |
 | `workLine.isolation`        | Package name or path exporting `strategy` — required. Host loads it like a manager; Isolator/Integrator do not sniff                                                                                                                                                                                                                                                         |
 | `workLine.isolationOptions` | What that strategy is told, unread by Host — like a manager's `options`. `isolation-git` reads `exclude`, the paths a Child never gets (default `.env`, `.env.*`). A strategy without `createStrategy` refuses any                                                                                                                                                                |
 | `workLine.warm`             | Optional `cmd` / `timeoutMs`. Runs in the workspace after Isolation, before the Builder — typically `pnpm install --frozen-lockfile`. Absent: the Builder gets a cold tree                                                                                                                                                                 |
@@ -223,26 +266,30 @@ pollIntervalMs: 10000
 | `ledger`                    | WorkLedger root (created). The Cursor is a file inside it. Default `<home>/ledger`                                                                                                                                                                                                                                                                                           |
 | `persist`                   | Package name or path exporting `openPersist({ ledgerRoot })`: how the ledger is stored under that root. Default `@bluewombat/persist-fs`; `@bluewombat/persist-sqlite` ships too. `watch` reads through the same backend                                                                                                                                                     |
 | `agents`                    | Agents a pass names instead of writing `cmd` (§ Agent passes written short)                                                                                                                                                                                                                                                                                                 |
-| `builder.producer`          | `cmd` / `timeoutMs` / `gates`. Spawned in the workspace. Exit 0 runs its own `gates`                                                                                                                                                                                                                                                                                 |
-| `builder.repair`            | The same, for a pass a Gate refused. **Required**, and never inherited — including its `gates`: a repair with none of its own runs ungated, even when `builder.producer.gates` is not empty                                                                                                                                                                               |
-| `builder.maxAttempts`       | Attempts one Task may start. Default 3                                                                                                                                                                                                                                                                                                                                       |
-| `assembly.fix`              | `cmd` / `timeoutMs` / `gates`. Spawned when a judgement of the whole refused it — by an Authority, by `assembly.validate`, or by both. Judged by its own `gates`                                                                                                                                                                                                            |
-| `assembly.validate`         | `cmd` / `timeoutMs` / `gates`. Optional. A local, read-only judge of the assembled ticket, run after align, with or without an Authority. A refusal is repaired by `assembly.fix` the same as an Authority's. Judged by its own `gates`, never `builder`'s or `assembly.fix`'s                                                                                            |
-| `assembly.maxAttempts`      | Attempts that one fix may start. Default 3                                                                                                                                                                                                                                                                                                                                   |
-| `assembly.gates`            | `defaultTimeoutMs` and `gates`: the produce:false judgement-only pass — no producer of its own, re-checking the assembled ticket. Empty: the Authority judges alone. Independent of `assembly.fix.gates` / `assembly.validate.gates` — never shared with either                                                                                                          |
+| `feature.test`               | Optional. Declares the feature-test acceptance check (see § The feature-test acceptance check): the pass that makes the Ticket holding the suite, `{ agent, prompt, homePlugins, appDeckProfile, timeoutMs, gates }` or `{ cmd, timeoutMs, gates }`. One command for the first pass and for a pass a Gate refused; its own `gates` (they check the form: compiles, one test per manifest id, no application file touched). Nothing is borrowed from `ticket.build.producer`, `ticket.build.repair` or `ticket.build.gates`. Needs a Feature Gate with `skipWhen: skip-feature-test`, and the other way round |
+| `ticket.build.producer`          | `cmd` / `timeoutMs`. Spawned in the workspace. Exit 0 runs `ticket.build.gates`                                                                                                                                                                                                                                                                                 |
+| `ticket.build.repair`            | The same, for a pass a Gate refused. **Required**, and never inherited: it names its own command. It is judged by the same `ticket.build.gates` as the producer                                                                                                                                                                               |
+| `ticket.build.gates`             | `defaultTimeoutMs` and `gates`: the one Gate list for `ticket.build.producer` and `ticket.build.repair`. `gates` written on either pass is refused, naming this key. Empty: the unit runs ungated |
+| `ticket.build.maxAttempts`       | Attempts one Task may start. Default 3                                                                                                                                                                                                                                                                                                                                       |
+| `ticket.fix`              | `cmd` / `timeoutMs` / `gates`. Spawned when a judgement of the whole refused it — by an Authority, by `ticket.validate`, or by both. Judged by its own `gates`                                                                                                                                                                                                            |
+| `ticket.validate`         | `cmd` / `timeoutMs` / `gates`. A local, read-only judge of the assembled ticket, run after align, with or without an Authority. A refusal is repaired by `ticket.fix` the same as an Authority's. Judged by its own `gates`, never `ticket.build`'s or `ticket.fix`'s. `validate` is required when a `ticket` block is written, and so is `feature.validate`: `{ agent: false, gates }` turns the agent off and keeps the gates, and `{ agent: false }` with no gates turns the review off — a bare `gates:` counts as none. |
+| `ticket.maxAttempts`      | Attempts that one fix may start. Default 3                                                                                                                                                                                                                                                                                                                                   |
+| `ticket.gates`            | `defaultTimeoutMs` and `gates`: the produce:false judgement-only pass — no producer of its own, re-checking the assembled ticket. Empty: the Authority judges alone. Independent of `ticket.fix.gates` / `ticket.validate.gates` — never shared with either                                                                                                          |
 | `timeoutMs`                 | How long a child **outside** a Task may run: manager, isolations                                                                                                                                                                                                                                                                                                             |
-| `maxRefusals`               | Times the work may be sent back before it escalates, by an Authority, by `assembly.validate`, or by both — one shared budget. Default 3                                                                                                                                                                                                                                      |
+| `ticket.maxRefusals`               | Times the work may be sent back before it escalates, by an Authority, by `ticket.validate`, or by both — one shared budget. Default 3                                                                                                                                                                                                                                      |
+| `ticket.maxParallel`        | How many Tickets of a Project are worked on at once. Default 1: one after the other. Above 1 needs `authority.enabled`; a Ticket waiting on a check or a person holds a place, the others go on. Tickets that wait on another (*Blocked by*) still start only once it is `done` |
+| `feature`                   | Required with `authority.enabled`. How a Feature's line is delivered to the line it is folded into, by the same steps as a Ticket: the final line is merged into the Feature's work (`workLine.targetStable`, or Host's own copy of the reference), `validate` (same shape as `ticket.validate`) reviews the whole against the Feature's request and its `gates` (at least one) are where the project's checks on the whole line run, a refusal goes to `fix`, the line is published, and `gates` (at least one, the CI) judge it. `maxAttempts` and `maxRefusals` (default 3, same rule as a Ticket's) are its own. Nothing falls back to `ticket`. The merge itself is automatic only with `merge-when-ready`; the delivery to the Authority is for every Feature |
 | `pollIntervalMs`            | Set it and the process keeps draining until SIGINT. Absent: one tick. Pick it with § Choosing `pollIntervalMs` — 10000 is the floor worth having                                                                                                                                                                                                                             |
 | `observability.streams`     | `enabled`, `dir`, `keep`. Films what every child says, as it says it — one file per child under `<dir>/<ticket>/`, named in the journal by a `stream-opened` line. `dir` resolves against the config file; default `<home>/streams`. `keep` is `stdout` / `stderr`, default both. Off unless `enabled` is true: a stream is the Project's own code and prompts in the clear |
 
 Every `cmd` is named where it is used, and nothing falls back to a neighbour: a
 `repair` with no command of its own is refused rather than quietly running the
-first-pass agent again. `builder` makes the unit of work. `assembly` judges the whole
-and, when that judgement refuses it, runs `assembly.fix` — not a second first-pass.
-`assembly.validate`, when declared, is a second, local judge of the whole: it
+first-pass agent again. `ticket.build` makes the unit of work. `ticket` judges the whole
+and, when that judgement refuses it, runs `ticket.fix` — not a second first-pass.
+`ticket.validate`, when declared, is a second, local judge of the whole: it
 runs after align, before the Authority sees the work (or before the final
-fold, with none). Its refusal is repaired by `assembly.fix` exactly as an
-Authority's is, and shares the same `maxRefusals` budget.
+fold, with none). Its refusal is repaired by `ticket.fix` exactly as an
+Authority's is, and shares the same `ticket.maxRefusals` budget.
 
 Paths a slot **writes** — `--transcript-dir`, `--agent-home` and
 `--plugins-out` — always resolve against the config file's directory, even
@@ -266,36 +313,39 @@ agents:
     denyShell: []                   # commands refused to the agent, e.g. [gh, vercel]; ssh and scp always are
     transcripts: ./.mason/transcripts
     pluginsOut: ./.mason/plugins    # where deck profiles are built
-builder:
-  producer:
-    agent: cursor
-    prompt: ./prompts/builder.md
-    plugins: [./ai-plugins/core/builder]
-    profile: builder
-    args: [--mode, agent]           # the vendor CLI's own flags
-    timeoutMs: 1200000
-    gates: { defaultTimeoutMs: 120000, gates: [] }
+ticket:
+  build:
+    producer:
+      agent: cursor
+      prompt: ./prompts/builder.md
+      homePlugins: [./ai-plugins/core/builder]
+      appDeckProfile: .ai/profiles/builder
+      args: [--mode, agent]         # the vendor CLI's own flags
+      timeoutMs: 1200000
 ```
 
 Host writes the `cmd` it stands for — `node <slots>/<role>.mjs --prompt-file …
--- node <slots>/agents/cursor.mjs --transcript-dir … --plugin-dir … --profile
+-- node <slots>/agents/cursor.mjs --transcript-dir … --plugin-dir … --app-deck-profile
 … --plugins-out … --agent-arg …` — with `<slots>` the
 `node_modules/@bluewombat/slots` next to the config. Nothing past the config
-knows a pass was written short. The roles: `builder.producer`,
-`builder.repair`, `assembly.fix`, `assembly.validate`, and `authority.describe`
-(an argv, or `{ agent, prompt?, plugins?, profile?, args? }`).
+knows a pass was written short. The roles: `ticket.build.producer`,
+`ticket.build.repair`, `ticket.fix`, `ticket.validate`, and `authority.describe`
+(an argv, or `{ agent, prompt?, homePlugins?, appDeckProfile?, args? }`).
 
 | Key       | Meaning                                                                                                   |
 | --------- | --------------------------------------------------------------------------------------------------------- |
 | `agent`   | A name `agents` declares. With `cmd` beside it, the pass is refused                                       |
 | `prompt`  | `--prompt-file` of the role slot. Absent: the role's built-in template                                    |
 | `rules`   | `--rules-file` of the role slot                                                                           |
-| `plugins` | Plugin folders of the Mason home, each a `--plugin-dir`                                                   |
-| `profile` | The project's deck profile for this role. Needs the agent's `pluginsOut`. See the slots' § Agents/Plugins |
+| `homePlugins` | Plugin folders of the Mason home, each a `--plugin-dir`                                               |
+| `appDeckProfile` | The app's deck profile for this role, as a path: `[<app dir>/].ai/profiles/<name>`. Needs the agent's `pluginsOut`. See the slots' § Agents/Plugins |
 | `args`    | Appended to the agent's own `args`, each an `--agent-arg`                                                 |
 
-A `profile` is read in the project, not in the Mason home: the role gets the
-base plugins and that profile, as the project's committed deck locks pin them.
+An `appDeckProfile` is read in the app, not in the Mason home: the role gets the
+app's base plugins, that profile's plugins and its `prompt.md`, as the app's
+committed deck locks pin them. deck keeps profiles in `<app>/.ai/profiles/<name>`,
+so the path has that shape; `<app dir>` is where the app's `.ai/` is in the
+checkout (`.` by default, `apps/web` in a monorepo). It stays inside the checkout.
 `mason doctor` checks those locks in the work line without the network.
 
 Every tracker field lives in the `options` of its side. Host does not read them.
@@ -375,20 +425,20 @@ Examples ship in [`@bluewombat/slots`](../../plugins/slots/README.md), installed
 the shipped roles and agents (Cursor CLI, Claude Code), the shipped Gates, and
 their options. What follows is what Host guarantees them.
 
-```json
-"builder": {
-  "producer": {
-    "cmd": [
-      "node", "./node_modules/@bluewombat/slots/builders/producer.mjs",
-      "--",
-      "node", "./node_modules/@bluewombat/slots/agents/claude.mjs"
-    ],
-    "timeoutMs": 600000
-  }
-}
+```yaml
+ticket:
+  build:
+    producer:
+      cmd:
+        - node
+        - ./node_modules/@bluewombat/slots/builders/producer.mjs
+        - --
+        - node
+        - ./node_modules/@bluewombat/slots/agents/claude.mjs
+      timeoutMs: 600000
 ```
 
-`builder.repair` is required too, with its own `cmd` and `timeoutMs`. The
+`ticket.build.repair` is required too, with its own `cmd` and `timeoutMs`. The
 composition with `--` is the same.
 
 ### Builder
@@ -406,15 +456,15 @@ The config always names a producer (and a repair). Implementer can still run a
 Task as its Gate sequence alone — that is the first judgement of the assembled
 ticket, which makes nothing.
 
-### Assembly fix
+### Ticket fix
 
 Spawned in the ticket workspace when a judgement of the whole refused it
 (`--report`, `--report-from`). Same argv as a Builder otherwise. Host hands
-Implementer `assembly.fix` as that pass's only agent: there is no first-pass
+Implementer `ticket.fix` as that pass's only agent: there is no first-pass
 producer at this moment. The refusal it repairs may have come from an
-Authority or from `assembly.validate`.
+Authority or from `ticket.validate`.
 
-### Assembly validate
+### Ticket validate
 
 Spawned in the ticket workspace after align, with or without an Authority —
 `--intention`, `--id`, `--attempt`, `--context`. No `--report`: it is a
@@ -425,23 +475,24 @@ that completes cleanly but finds a problem is still a refusal.
 
 ### Gates
 
-Four independent sequences, one per role — `builder.producer`,
-`builder.repair`, `assembly.fix`, `assembly.validate` — plus `assembly.gates`
-for the one judgement-only pass with no producer of its own (re-checking the
-assembled ticket; `ci-green` reads the checks the work line ran on what the
-Publisher placed, so it belongs there). No sharing, no dispatch choosing
-between two buckets: a check right for one pass is not necessarily right for
-another, even within the same stage. `builder.repair` is the sharpest edge —
-it does not inherit `builder.producer.gates`, so a repair Attempt with no
-Gate of its own runs ungated.
-
-Implementer's Gates are told `--stage unit` or `--stage assembly` alongside
+Four sequences: `ticket.build.gates`, shared by `ticket.build.producer` and
+`ticket.build.repair` (a repair is judged by exactly what judged the first try),
+then one per assembly role — `ticket.fix`, `ticket.validate` — plus
+`ticket.gates` for the one judgement-only pass with no producer of its own
+(re-checking the assembled ticket; `ci-green` reads the checks the work line
+ran on what the Publisher placed, so it belongs there). The assembly lists are
+not shared with each other or with the builder, and no dispatch chooses between
+two buckets: a check right for one pass is not necessarily right for another,
+even within the same stage. `gates` written on `ticket.build.producer` or
+`ticket.build.repair` is refused, and the message names `ticket.build.gates`.
+
+Implementer's Gates are told `--stage unit` or `--stage ticket` alongside
 `--id`, `--attempt`, `--gate-id` and `--intention`.
 Most have no use for it. `workspace-changed` does: "nothing changed" means
 nothing was done in a unit, and is the correct outcome for an assembly that
 needed nothing.
 
-`init` writes an empty list on `builder.producer` and `builder.repair`; add a
+`init` writes an empty list on `ticket.build.producer` and `ticket.build.repair`; add a
 Gate when the Project has a check.
 
 Every child carries its own ceiling and no other. A Gate entry may name a
@@ -451,11 +502,11 @@ from what another child left behind, so a slow producer cannot leave its
 Gates a millisecond to answer in.
 
 What bounds the unit is therefore what you wrote:
-`builder.maxAttempts × (builder.producer.timeoutMs + Σ builder.producer.gates timeouts)`
+`ticket.build.maxAttempts × (ticket.build.producer.timeoutMs + Σ ticket.build.gates timeouts)`
 for a first pass, and the same shape with `repair` in place of `producer` once
 a Gate has refused one.
 A repair and an assembly fix each carry their own `timeoutMs`. An assembly fix
-is bounded the same way from `assembly.maxAttempts` and `assembly.fix`.
+is bounded the same way from `ticket.maxAttempts` and `ticket.fix`.
 
 ```json
 {
@@ -471,6 +522,53 @@ is bounded the same way from `assembly.maxAttempts` and `assembly.fix`.
 }
 ```
 
+### The feature-test acceptance check
+
+A Project proves each Feature by its own tests, run once on the assembled Feature
+line, when its config says so, by a pair:
+
+```yaml
+feature:
+  test:                              # makes the Ticket that holds the suite (label `feature-test` on the tracker)
+    agent: claude
+    prompt: ./prompts/feature-test.md # {{task}} is the scenarios; {{report}}, {{refused_by}}, {{refusal}} on a refused pass
+    timeoutMs: 1800000
+    gates:                   # form only: it compiles, one test per manifest id, no application file touched
+      gates:
+        - { id: feature-tests-form, argv: [...], timeoutMs: 120000 }
+  validate:
+    agent: false
+    gates:
+      defaultTimeoutMs: 120000
+      gates:
+        - id: feature-tests
+          skipWhen: skip-feature-test      # Host does not run this Gate for a Feature that carries the label
+          timeoutMs: 720000
+          argv:
+            - node
+            - ./node_modules/@bluewombat/slots/gates/feature-tests.mjs
+            - --run
+            - pnpm test --grep "{ids}" --reporter=junit --outputFile={junit}
+```
+
+`skipWhen` is the one condition Host reads for a Gate, on a Feature's Gates only
+(`feature.validate`, `feature.gates`, `feature.fix`); its one value today is
+`skip-feature-test`, whatever the tracker calls that label. A Gate left out is not a Gate that
+passed: the journal gets `gate-skipped` and the trace says "`feature-test` not run: the Feature carries
+skip-feature-test". The Gate knows nothing of the skip and no environment variable carries it.
+
+The tracker side: a Ticket carrying the feature-test label (`featureTestLabel` of the TicketTracker manager) is
+made by `feature.test`; a Feature carrying the skip label
+(`skipFeatureTestLabel` of the FeatureTracker manager) has that Ticket cancelled, with a line in
+the trace. The label is read again until the Feature is submitted. A Project that declares the
+check refuses a Feature that holds neither a feature-test Ticket nor the skip label, or whose feature-test
+Ticket is not blocked by every other Ticket, as `invalid`, with the reason as a comment.
+
+What the Gate proves is a red/green verdict; what the operator reads is its text in the
+journal (`gate-finished`) — a red suite is also in the reason of the refusal the fix is
+given and in the escalation. A passing suite's text is not shown on the pull request: see
+RESERVATIONS I17.
+
 ### Describer
 
 How a delivered ticket describes itself — the words the manager puts on the
@@ -543,31 +641,34 @@ it each stop `mason run` at boot, and `mason doctor` reports the same offline
 and is the operator's directory.
 
 ```
-assembled → align → assembly.validate (optional, local)
-              refused  → assembly.fix, then align again, then validate again
+assembled → align → recheck (ticket.build.gates again, on the aligned work)
+              conflict or failed → ticket.fix, then align again
+          → ticket.validate (optional, local)
+              refused  → ticket.fix, then align again, recheck, validate again
               accepted → Publisher places the work → manager opens the Submission
           → submitted, and the run comes back to it on each poll
-              assembly.gates judge what was published
-              refused  → assembly.fix, then the same Submission is offered again
-              accepted → the Authority folds it → done
+              ticket.gates judge what was published
+              refused  → ticket.fix, then the same Submission is offered again
+              accepted → has the line moved on since the align? yes: align again
+                         no: the Authority folds it → done (a refused fold also aligns again)
 ```
 
-Neither half judges: that is what `assembly.gates` are for. The Authority places
-and folds; a Gate says whether the fold may happen. `assembly.validate`, when
+Neither half judges: that is what `ticket.gates` are for. The Authority places
+and folds; a Gate says whether the fold may happen. `ticket.validate`, when
 declared, judges before either half — the same verdict has the same fate
 whether or not there is an Authority to offer the work to afterwards. After the
 Authority folds, Host brings its copy of the work line up to date with a
 fast-forward — the work line moved where the Authority is, and the next
 Isolation must start from that version, not from a copy left behind.
 
-A refusal is not a second failure path: its report reaches `assembly.fix`
-exactly as a Gate's report reaches `builder.repair`. After `maxRefusals`
+A refusal is not a second failure path: its report reaches `ticket.fix`
+exactly as a Gate's report reaches `ticket.build.repair`. After `ticket.maxRefusals`
 refusals the ticket escalates with that report as its Trace, and `done` names
 the Submission rather than a directory on the machine that ran.
 
 ## Write another manager
 
-Host loads whatever `featureTracker.package` and `ticketTracker.package` name, as long as it exports `createManager`. The
+Host loads whatever `feature.tracker.package` and `ticket.tracker.package` name, as long as it exports `createManager`. The
 contract and a worked example are in
 [`@bluewombat/manager-kit`](../manager-kit/README.md). Nothing in Host changes.
 
@@ -636,7 +737,7 @@ change that breaks it does not merge.
 | `config/`            | What a Project wrote: argv, `mason.config.yaml`, discovery, `HostOptions`. Pure: YAML in, options out                                                     | A runtime value (a Journal, a Port, a process handle)            | Node, `manager-kit` types                     |
 | `plugins/`           | Load a package by name and check its shape: a manager, an isolation strategy                                                                              | What to do with the loaded thing                                 | `config`                                      |
 | `loop/`              | The process: listen → probe → adapt → admit → run → report; composition (`open-host`, `transformers`, Authority, work line, lock, Cursor, journal, trace) | A command a human types; a string a human reads about the config | `plugins`, `config`, the kernel, Transformers |
-| `operator/`          | Tools for a human: `init`, `setup`, `doctor`, `watch` / `status`, `log`, `cancel`, `release`, `board`, the terminal prompt                                | Anything the loop needs — the loop cannot see this layer         | everything below                              |
+| `operator/`          | Tools for a human: `init`, `setup`, `doctor`, `watch` / `status`, `log`, `incident`, `cancel`, `restart`, `release`, `board`, the terminal prompt                                | Anything the loop needs — the loop cannot see this layer         | everything below                              |
 | `index.ts`, `cli.ts` | The package surface and the dispatch. Nothing else sits at the top of `src/`                                                                              | Logic                                                            | everything                                    |
 
 Host's code names no plugin. A manager, an isolation strategy, a persistence
@@ -691,6 +792,6 @@ src/
   config/                argv, JSON config, config discovery → HostOptions; defaults: the plugin names Host ships with
   plugins/               load: the one loader; manager, isolation, persist: one shape each; discover
   loop/                  open-host (composition), tick (the loop), deliveries, drive, probe, report, authority, work-line, cursor, lock, journal (the film), streams (what a child said), trace, transformers
-  operator/              run, init, setup, doctor, explain, live (watch / status), log, film, cancel, release, board, prompt, git-remote
+  operator/              run, init, setup, doctor, explain, live (watch / status), log, incident, film, cancel, release, board, prompt, git-remote
 fixtures/                stand-in slots for the loop's tests
 ```