@dougharness/cli 1.1.1 → 1.3.0

package/node_modules/@dougharness/gates/lib/proposals.mjs

@@ -37,6 +37,11 @@ const MAX_VERIFIED_ROWS = 20;
 // Every spawned git call gets a hard ceiling (ms) so a hung or adversarially slow git invocation cannot itself
 // become the way to blow the Stop-gate timeout (review MINOR 7).
 const GIT_TIMEOUT_MS = 5000;
+// Most commits (newest first) that touched a target since the session baseline whose parent is tried as a
+// re-derivation ref (card ledger-two-committed-applies): a bound, so a long session cannot make the walk costly.
+const MAX_PARENT_REFS = 10;
+// A git commit sha, abbreviated or full (same shape lib/baseline.mjs accepts for baselineHead).
+const GIT_SHA_RE = /^[0-9a-f]{7,64}$/;
 
 // Every well-formed line, tolerant of a missing file or a torn line (a crashed process mid-write) - never fatal.
 export function readAppliedLedger(dir) {
@@ -139,18 +144,48 @@ function diffAppliesAtRef(dir, relPath, diffAbsPath, currentSha, ref) {
   }
 }
 
+// The parents of the commits since `base` that touched relPath, newest first, capped at MAX_PARENT_REFS: each
+// `<commit>^` holds relPath as it was just before that commit, which is where an in-session apply's preimage
+// lives once a later apply is also committed (card ledger-two-committed-applies). Empty when `base` is not a
+// usable sha, or the git call fails or times out (GIT_TIMEOUT_MS); never throws.
+function parentRefsSince(dir, relPath, base) {
+  try {
+    const listed = spawnSync("git", ["rev-list", `--max-count=${MAX_PARENT_REFS}`, `${base}..HEAD`, "--", relPath], {
+      cwd: dir,
+      timeout: GIT_TIMEOUT_MS,
+      encoding: "utf8",
+    });
+    if (listed.status !== 0 || typeof listed.stdout !== "string") return [];
+    return listed.stdout
+      .split("\n")
+      .map((line) => line.trim())
+      .filter((line) => /^[0-9a-f]{7,64}$/.test(line))
+      .map((sha) => `${sha}^`);
+  } catch {
+    return [];
+  }
+}
+
 // `base` (card stop-scan-committed-changes) is the session's baseline HEAD when known, tried first: a diff
 // that created `relPath` after that baseline still applies onto "absent" even once the session has since
 // committed `relPath` itself (HEAD would otherwise already equal the current bytes, and git apply refuses to
 // create a file that already exists there). M1 fix: when the base attempt fails, HEAD is also tried before
 // giving up, not only when `base` is null/omitted - a second approved apply on the same target, committed
 // in-session after the first (so its preimage is the first version, not the pre-session base), re-derives
-// correctly onto HEAD even though it cannot re-derive onto the pre-session base at all. Every other check
+// correctly onto HEAD even though it cannot re-derive onto the pre-session base at all. Card
+// ledger-two-committed-applies: once two or more applies on one target are committed in-session, the earlier
+// ones' preimage is neither the base nor HEAD; when both fail and `base` is known, the parent of each commit
+// since `base` that touched `relPath` (parentRefsSince, newest first, capped) is tried too. Every other check
 // (row shape, containment, diffSha256, diffNamesOnly) is unchanged; this only widens which ref the content
 // re-derivation itself is allowed to succeed against.
 function diffReproducesCurrentContent(dir, relPath, diffAbsPath, currentSha, base) {
-  const refs = typeof base === "string" && base && base !== "HEAD" ? [base, "HEAD"] : ["HEAD"];
-  return refs.some((ref) => diffAppliesAtRef(dir, relPath, diffAbsPath, currentSha, ref));
+  // `base` is agent-writable state (state.baselineHead): only a hex sha ever reaches git, so a value such as
+  // "--output=<path>" is dropped here and can neither be read as an option nor name a revision.
+  const hasBase = typeof base === "string" && GIT_SHA_RE.test(base);
+  const refs = hasBase ? [base, "HEAD"] : ["HEAD"];
+  if (refs.some((ref) => diffAppliesAtRef(dir, relPath, diffAbsPath, currentSha, ref))) return true;
+  if (!hasBase) return false;
+  return parentRefsSince(dir, relPath, base).some((ref) => diffAppliesAtRef(dir, relPath, diffAbsPath, currentSha, ref));
 }
 
 // One row's full verification, wrapped so that no exception - a malformed field of any type, an unreadable
@@ -182,8 +217,9 @@ function rowIsGenuine(dir, relPath, sha, learnDirAbs, row, base) {
 // before the session started, not only against HEAD (which, once the target is committed, already equals the
 // current bytes and would make a new-file diff fail to apply there). HEAD is always tried too (M1 review
 // fix) - a second approved apply on the same target, committed in-session after the first, has the first
-// version as its preimage and can only re-derive onto HEAD, not onto the pre-session base. With `base` null
-// or omitted, only HEAD is tried, exactly as before this card.
+// version as its preimage and can only re-derive onto HEAD, not onto the pre-session base. With several applies
+// committed in-session (card ledger-two-committed-applies), the parent of each commit since `base` that touched
+// the target is tried as well. With `base` null or omitted, only HEAD is tried, exactly as before this card.
 export function isAppliedContent(dir, relPath, { base = null } = {}) {
   const sha = currentSha256(dir, relPath);
   const learnDirAbs = resolve(dir, LEARN_STATE_RELPATH);

package/node_modules/@dougharness/gates/lib/scope.mjs

@@ -2,7 +2,7 @@
 // the files its tasks own is the only thing a session may change.
 // Pure functions plus one reader; the stop gate decides, this file only computes.
 
-import { readFileSync, existsSync } from "node:fs";
+import { readFileSync, existsSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { globToRegExp, matchAny, normalizePath } from "./glob.mjs";
 
@@ -10,18 +10,56 @@ export const PLAN_RELPATH = ".doug/plan.json";
 export const ENFORCED_STATUSES = ["approved", "done"];
 // The flow's own files change during a run and are never out of scope. Per-session hook state too.
 // board.json moves uncommitted with the live board server; it lands in the card's landing commit.
-export const ALWAYS_ALLOWED = [".doug/plan.json", ".doug/anchor.md", ".doug/.state/**", ".doug/board.json"];
+export const ALWAYS_ALLOWED = [".doug/plan.json", ".doug/plans/**", ".doug/anchor.md", ".doug/.state/**", ".doug/board.json"];
 
 // Returns { plan, reason }. plan is set only when the file exists, parses, has tasks, and is in an
 // enforced status; reason says why not otherwise ("no-plan", "unreadable", "status:draft", "invalid").
 export function loadScopePlan(dir) {
+  const single = loadSinglePlan(dir);
+  if (single.plan) return single;
+  // card parallel-card-queens: with no enforced .doug/plan.json, the enforced, not-landed per-card plans
+  // under .doug/plans/ hold scope together.
+  const cards = loadCardPlans(dir);
+  if (cards.plan || cards.reason === "unreadable") return cards;
+  return single;
+}
+
+// Union of every approved/done, not-landed .doug/plans/*.json. Never throws: an unreadable file is skipped,
+// and reported as reason "unreadable" only when it leaves no plan holding scope.
+function loadCardPlans(dir) {
+  let names = [];
+  try {
+    names = readdirSync(join(dir, ".doug/plans")).filter((f) => f.endsWith(".json")).sort();
+  } catch {
+    return { plan: null, reason: "no-plan" };
+  }
+  const plans = [];
+  for (const name of names) {
+    try {
+      const p = JSON.parse(readFileSync(join(dir, ".doug/plans", name), "utf8"));
+      if (!p || typeof p !== "object" || !Array.isArray(p.tasks)) continue;
+      if (!ENFORCED_STATUSES.includes(p.status) || p.landed) continue;
+      plans.push(p);
+    } catch (err) {
+      // fail open: any unreadable per-card file means the union is unknown, so scope is not checked
+      return { plan: null, reason: "unreadable", error: String(err && err.message), file: `.doug/plans/${name}` };
+    }
+  }
+  if (!plans.length) return { plan: null, reason: "no-plan" };
+  const status = plans.some((p) => p.status === "approved") ? "approved" : "done";
+  const cards = plans.map((p) => p.card || p.title || "?");
+  const title = `per-card plans (${cards.join(", ")})`;
+  return { plan: { version: 1, title, status, perCard: cards, tasks: plans.flatMap((p) => p.tasks) }, reason: null };
+}
+
+function loadSinglePlan(dir) {
   const file = join(dir, PLAN_RELPATH);
   if (!existsSync(file)) return { plan: null, reason: "no-plan" };
   let plan;
   try {
     plan = JSON.parse(readFileSync(file, "utf8"));
   } catch (err) {
-    return { plan: null, reason: "unreadable", error: String(err.message) };
+    return { plan: null, reason: "unreadable", error: String(err.message), file: PLAN_RELPATH };
   }
   if (!plan || typeof plan !== "object" || !Array.isArray(plan.tasks)) return { plan: null, reason: "invalid" };
   if (!ENFORCED_STATUSES.includes(plan.status)) return { plan: null, reason: `status:${plan.status}` };
@@ -104,7 +142,8 @@ export function scopeViolations(changed, plan, { ignore = [] } = {}) {
 }
 
 export function describeViolations(violations, plan) {
-  const lines = [`Files changed outside the ${plan.status} plan "${plan.title}" (${PLAN_RELPATH}):`];
+  const source = Array.isArray(plan.perCard) ? `per-card plans ${plan.perCard.join(", ")} (.doug/plans/)` : `plan "${plan.title}" (${PLAN_RELPATH})`;
+  const lines = [`Files changed outside the ${plan.status} ${source}:`];
   for (const v of violations) {
     const near = v.nearest.length ? `nearest task${v.nearest.length > 1 ? "s" : ""}: ${v.nearest.map((n) => `${n.id} (owns ${n.via})`).join(", ")}` : "no task owns anything near it";
     lines.push(`  ${v.file}  ${near}`);

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.1.1",
+  "version": "1.3.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",

package/node_modules/@dougharness/gates/scripts/reanchor.mjs

@@ -19,7 +19,7 @@ import { join } from "node:path";
 import { runHook, allow, addContext, systemMessage } from "../lib/io.mjs";
 import { loadConfig, projectDir } from "../lib/config.mjs";
 import { loadState, saveState } from "../lib/state.mjs";
-import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, snapshotSection, splitSnapshot } from "../lib/anchor.mjs";
+import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, readPlanSummaries, snapshotSection, splitSnapshot } from "../lib/anchor.mjs";
 
 runHook("reanchor", async (input) => {
   const dir = projectDir(input);
@@ -30,6 +30,7 @@ runHook("reanchor", async (input) => {
     const state = loadState(dir, input.session_id);
     const section = snapshotSection({
       plan: readPlanSummary(dir),
+      plans: readPlanSummaries(dir),
       decisions: readDecisions(dir),
       state,
       now: new Date(),

package/node_modules/@dougharness/gates/scripts/research-cap.mjs

@@ -27,9 +27,11 @@
 // Loopback exemption (card research-cap-localhost, whole-command grammar, fix pass 5): a local model probe is not
 // web research, so it is neither counted nor denied. The exemption applies only when the entire raw command
 // string, before any splitting, is ONE simple fetch (isLoopbackFetch):
-//   1. Trimmed, it tokenizes into words. Single quotes are literal; double quotes may not hold $, a backtick, a
-//      backslash or !; an unterminated quote is not exempt. Outside quotes only space, tab, [A-Za-z0-9._:/=@%+,-]
-//      and a redirect's > are allowed, so & | ; ( ) { } [ ] * ? ~ # $ ` \ ! < and a newline are never exempt.
+//   1. Trimmed, it tokenizes into words. Single quotes are literal; double quotes may not hold $, a backtick or !,
+//      and a backslash only as \" or \\ (a literal char; any other backslash is not exempt); an unterminated quote
+//      is not exempt. Outside quotes only space, tab, [A-Za-z0-9._:/=@%+,-], a redirect's >, the exact word 2>&1
+//      and a backslash-newline continuation (removed, no word break) are allowed, so & | ; ( ) { } [ ] * ? ~ # $
+//      ` \ ! < and a bare newline are otherwise never exempt (2>&1>x, a&b, 2>&1; are not the exact word).
 //   2. The first word is exactly curl or wget: no path, wrapper, assignment or other case.
 //   3. Every other word is an allowlisted option (value-less -s -S -f -L -i -v -g or --silent and similar,
 //      combinable in one short token; value-taking -o -H -d -X -w -m for curl, -O -T and --header for wget,
@@ -41,11 +43,18 @@
 //      exactly /dev/null or does not start with /dev/ (bash opens /dev/tcp and /dev/udp as sockets).
 // A command outside the grammar is not an error: it is counted by bashFetchVerbs exactly as at HEAD, one count
 // per split command whose first resolved fetch form is curl or wget. Only Bash curl/wget is affected; WebFetch
-// and WebSearch always count. Anything doubtful counts: a compound line, a pipe, a wrapper, a mixed local and
-// remote command, no URL such as curl --version, other 127.x addresses, 0.0.0.0, host.docker.internal.
+// and WebSearch always count.
 // Accepted limits of the exemption: an env proxy (https_proxy=http://evil.com in the environment, not on the
 // command) routes the request out; -L, and wget by default, follow a redirect a local server can point at a
 // remote host; a ~/.curlrc or ~/.wgetrc can add a URL or a proxy.
+// Anything doubtful counts: a compound line, a pipe that is not a safe pipe consumer (below), a wrapper, a mixed
+// local and remote command, no URL such as curl --version, other 127.x addresses, 0.0.0.0, host.docker.internal.
+//
+// Pipe consumers (card research-cap-loopback-post): the same exemption holds for a pipeline of unquoted single "|"
+// (never ||, |& or an empty segment) whose first segment is a loopback fetch unchanged and whose every later
+// segment is, with no redirect, head/tail with only a count (-c N, -n N, -cN, -nN, -N) or exactly
+// python3|python -m json.tool. Anything else (jq, sh, curl, python -c) counts as at HEAD. Each counted Bash
+// counter line also carries hosts, the URL hosts of that split command, so a miss is diagnosable.
 //
 // Known limit: several calls issued in one message can each read the same count before any of them appends, so
 // a single burst can push an agent's count past the cap by the number of calls it issues at once.
@@ -305,14 +314,29 @@ function tokenize(text) {
     gt = false;
     open = false;
   };
-  for (const ch of text) {
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
     if (quote) {
+      if (quote === '"' && ch === "\\") {
+        // Only \" and \\ are escapes inside double quotes; both give a literal char. Any other backslash
+        // (\$, \`, \!, backslash-newline) leaves the grammar.
+        const next = text[i + 1];
+        if (next !== '"' && next !== "\\") return null;
+        raw += ch + next;
+        val += next;
+        i += 1;
+        continue;
+      }
       raw += ch;
       if (ch === quote) quote = "";
-      else if (quote === '"' && "$`\\!".includes(ch)) return null;
+      else if (quote === '"' && "$`!".includes(ch)) return null;
       else val += ch;
     } else if (ch === " " || ch === "\t") end();
-    else {
+    else if (ch === "\\" && text[i + 1] === "\n") i += 1; // a line continuation: removed, no word break
+    else if (!open && text.startsWith("2>&1", i) && (i + 4 === text.length || " \t".includes(text[i + 4]))) {
+      words.push({ raw: "2>&1", val: "2>&1", gt: false, dup: true }); // the exact word only, never a prefix
+      i += 3;
+    } else {
       open = true;
       raw += ch;
       if (ch === "'" || ch === '"') quote = ch;
@@ -337,7 +361,8 @@ function isLoopbackFetch(command) {
   let urls = 0;
   let wantValue = false;
   for (let k = 1; k < words.length; k += 1) {
-    const { raw, val, gt } = words[k];
+    const { raw, val, gt, dup } = words[k];
+    if (dup) continue;
     if (gt) {
       const m = REDIRECT.exec(raw);
       if (!m) return false;
@@ -368,19 +393,98 @@ function isLoopbackFetch(command) {
   return urls > 0;
 }
 
-// Returns one verb ("curl" or "wget") per split command of a Bash command line that resolves to a fetch;
-// non-fetch split commands contribute nothing. A non-string command (missing, or e.g. a number) is zero
+// Splits a raw command on unquoted single "|" (card research-cap-loopback-post). Null when the text has a "||", a
+// "|&", an empty segment, or no pipe at all, so only a plain pipeline is ever split.
+function splitPipeline(command) {
+  const text = String(command);
+  const segs = [];
+  let quote = "";
+  let cur = "";
+  for (let i = 0; i < text.length; i += 1) {
+    const ch = text[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < text.length) {
+        cur += ch + text[i + 1];
+        i += 1;
+        continue;
+      }
+      if (ch === quote) quote = "";
+      cur += ch;
+    } else if (ch === "'" || ch === '"') {
+      quote = ch;
+      cur += ch;
+    } else if (ch === "|") {
+      if (text[i + 1] === "|" || text[i + 1] === "&" || cur.trim() === "") return null;
+      segs.push(cur);
+      cur = "";
+    } else cur += ch;
+  }
+  if (quote || cur.trim() === "" || segs.length === 0) return null;
+  segs.push(cur);
+  return segs;
+}
+
+// One pipe consumer that cannot fetch: head or tail with only a count, or python[3] -m json.tool. No redirect.
+function isSafeConsumer(segment) {
+  const words = tokenize(segment.trim());
+  if (!words || words.length === 0 || words.some((w) => w.gt || w.raw !== w.val)) return false;
+  const v = words.map((w) => w.val);
+  if (v[0] === "head" || v[0] === "tail") {
+    const rest = v.slice(1);
+    if (rest.length === 0) return false;
+    if (rest.length === 1) return /^-(?:[cn]?\d+)$/.test(rest[0]);
+    return rest.length === 2 && /^-[cn]$/.test(rest[0]) && /^\d+$/.test(rest[1]);
+  }
+  return (v[0] === "python3" || v[0] === "python") && v.length === 3 && v[1] === "-m" && v[2] === "json.tool";
+}
+
+// True when the whole command is one loopback fetch, or one followed by safe consumers (see the header).
+function isLoopbackCommand(command) {
+  if (isLoopbackFetch(command)) return true;
+  const segs = splitPipeline(command);
+  return !!segs && isLoopbackFetch(segs[0]) && segs.slice(1).every(isSafeConsumer);
+}
+
+// URL hosts of one split command, lower-cased, unique, in order (card research-cap-loopback-post). Diagnostic
+// only: never throws and never returns the command text.
+function urlHosts(cmd) {
+  const hosts = [];
+  try {
+    for (const w of String(cmd).match(/(?:[^\s"']+|"[^"]*"|'[^']*')+/g) || []) {
+      const word = w.replace(/["']/g, "");
+      if (word === "" || word.startsWith("-")) continue;
+      let host = "";
+      const scheme = /^[a-z][a-z0-9+.-]*:\/\/([^/?#]*)/i.exec(word);
+      if (scheme) {
+        const auth = scheme[1].slice(scheme[1].lastIndexOf("@") + 1);
+        const m = /^(\[[^\]]*\]|[^:]*)/.exec(auth);
+        host = m ? m[1] : "";
+      } else {
+        const m = /^(\[::1\]|[a-z0-9.-]+)(:\d+)?([/?#]|$)/i.exec(word);
+        if (m && (/^(?:localhost|127\.0\.0\.1|\[::1\])$/i.test(m[1]) || m[2] || m[3])) host = m[1];
+      }
+      host = host.toLowerCase();
+      if (host && !hosts.includes(host)) hosts.push(host);
+    }
+  } catch {
+    // diagnostic only
+  }
+  return hosts;
+}
+
+// Returns one {verb, hosts} per split command of a Bash command line that resolves to a fetch (verb "curl" or
+// "wget"); non-fetch split commands contribute nothing. A non-string command (missing, or e.g. a number) is zero
 // fetches. commandForms runs on each split command's original text with its quotes intact (it does its own
 // quote parsing for a shell -c script), never on stripped or reconstructed text. A command that is one simple
-// loopback fetch (isLoopbackFetch) is not a fetch to count.
+// loopback fetch, alone or piped to a safe consumer (isLoopbackCommand), is not a fetch to count.
 function bashFetchVerbs(command) {
-  if (isLoopbackFetch(command)) return [];
+  if (isLoopbackCommand(command)) return [];
   const verbs = [];
   for (const cmd of splitTopLevel(command)) {
     for (const form of commandForms(cmd)) {
       const verb = firstWordBasename(form);
       if (FETCH_VERBS.has(verb)) {
-        verbs.push(verb);
+        verbs.push({ verb, hosts: urlHosts(cmd) });
         break;
       }
     }
@@ -401,7 +505,7 @@ runHook("research-cap", async (input) => {
   if (input.tool_name === "Bash") {
     const verbs = bashFetchVerbs(input.tool_input && input.tool_input.command);
     if (verbs.length === 0) return allow(); // an ordinary Bash command is never counted or denied here
-    entries = verbs.map((verb) => ({ tool: "Bash", verb }));
+    entries = verbs.map(({ verb, hosts }) => ({ tool: "Bash", verb, hosts }));
   } else {
     entries = [{ tool: input.tool_name }];
   }

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -73,11 +73,11 @@
 // Fails closed exactly like subagentsInFlight: with trace.enabled false, or the trace file missing or
 // unreadable, there is no evidence either way, so the gate runs as today.
 
-import { existsSync, mkdirSync, readFileSync, realpathSync, statSync, writeFileSync, unlinkSync, openSync, closeSync, readSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync, unlinkSync, openSync, closeSync, readSync } from "node:fs";
 import { execFileSync, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { join, dirname, isAbsolute, relative, resolve, sep } from "node:path";
-import { runHook, allow, blockStop, systemMessage } from "../lib/io.mjs";
+import { runHook, allow as allowRaw, blockStop, systemMessage as systemMessageRaw } from "../lib/io.mjs";
 import { loadConfig, projectDir } from "../lib/config.mjs";
 import { loadState, saveState } from "../lib/state.mjs";
 import { matchAny } from "../lib/glob.mjs";
@@ -88,7 +88,7 @@ import { verificationEvidence, describeMissingEvidence } from "../lib/evidence.m
 import { changedFiles, captureBaseline, sinceBaseline, headAt, committedSince, walkProposalPathFiles, fileIdentity, treeFingerprint, sameTree, readAgentStart, readTurnStart, turnTreeStatus, onlyNoTestPathsChanged, movedSinceVerified } from "../lib/baseline.mjs";
 import { tracePath, readTrace, traceLine, appendTrace, agentLabel } from "../lib/trace.mjs";
 import { isAppliedContent } from "../lib/proposals.mjs";
-import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, snapshotSection } from "../lib/anchor.mjs";
+import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, readPlanSummaries, snapshotSection } from "../lib/anchor.mjs";
 import { contextReading, recordAgentContext } from "../lib/agent-context.mjs";
 import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiverCovers } from "../lib/test-totals.mjs";
 import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine } from "../lib/block-ledger.mjs";
@@ -492,7 +492,24 @@ function agentMadeNoChanges(dir, cfg, sessionId, subagent) {
 // readAgentStart) and it equals the current one (same HEAD, same dirty set, same identities), and the agent's
 // final message carries no tests_red_by_design claim, and its trace shows no successful Edit-type call. Catches read-only agents that run Bash, which
 // agentMadeNoChanges counts as a change. No record, no git, any failure -> false (run the gate).
-function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFingerprint) {
+// card stop-gate-worktree-agent-fingerprint: the start record is a fingerprint of the main checkout (the trace
+// hook runs there), so for a worktree verification dir it is compared like with like instead: unchanged only if
+// the record exists, every verification dir has no changed files, and every one's HEAD carries no commit of its
+// own: it equals or is an ancestor of the record's HEAD, or of the main checkout's refs/remotes/origin/HEAD (Claude
+// Code branches a fresh isolation worktree from the remote default branch, which local main may be ahead of or
+// behind). Any git failure reads as changed. A verification set that mixes a worktree with `dir` reads as
+// changed. A main-checkout agent keeps the fingerprint comparison.
+function isAncestorIn(dir, a, b) {
+  try {
+    if (!/^[0-9a-f]{7,64}$/.test(String(a)) || !/^[0-9a-f]{7,64}$/.test(String(b))) return false;
+    execFileSync("git", ["merge-base", "--is-ancestor", a, b], { cwd: dir, stdio: "ignore", timeout: 5000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFingerprint, vdir = dir, forced = null) {
   try {
     if (!subagent || !currentFingerprint) return false;
     if (redByDesignClaim(input.last_assistant_message) ?? redByDesignClaim(lastHandbackMessage(input.agent_transcript_path))) return false;
@@ -503,6 +520,24 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
       if (existsSync(file) && readTrace(file).some((l) => l.agent === subagent.id && l.event === "PostToolUse" && CHANGE_TOOLS.has(l.tool) && l.ok !== false)) return false;
     }
     const start = readAgentStart(dir, sessionId, subagent.id);
+    if (vdir !== dir) {
+      if (!start || typeof start !== "object" || !start.head) return false;
+      const dirs = forced ? [vdir] : verifyDirs(dir, cfg, sessionId, input, subagent);
+      if (!dirs.includes(vdir) || dirs.includes(dir)) return false;
+      let remoteHead;
+      try {
+        remoteHead = execFileSync("git", ["rev-parse", "--verify", "-q", "refs/remotes/origin/HEAD^{commit}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim() || null;
+      } catch {
+        remoteHead = null;
+      }
+      return dirs.every((d) => {
+        const h = headAt(d);
+        if (!h) return false;
+        if (!isAncestorIn(dir, h, start.head) && !(remoteHead && isAncestorIn(dir, h, remoteHead))) return false;
+        const c = changedFiles(d);
+        return Array.isArray(c) && c.length === 0;
+      });
+    }
     return sameTree(start, currentFingerprint);
   } catch {
     return false;
@@ -721,6 +756,7 @@ function contextNotice(dir, cfg, state, sessionId, boundary) {
     const anchorFile = join(dir, ".doug/anchor.md");
     const section = snapshotSection({
       plan: readPlanSummary(dir),
+      plans: readPlanSummaries(dir),
       decisions: readDecisions(dir),
       state,
       now: new Date(),
@@ -766,10 +802,24 @@ function waiverSources(dir, baselineHead) {
   return sources;
 }
 
+// A tree's own last-green record, read live; null when absent or unreadable (card worktree-count-baseline).
+function readLastGreen(dir) {
+  try {
+    const parsed = JSON.parse(readFileSync(join(dir, LAST_GREEN_RELPATH), "utf8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 // The count check for the commands that ran green by exit code. Returns { problems, parsed }: `problems` are
 // block reasons, `parsed` the per-command summary lists of every run that was counted (for the last-green
 // record). A missing or unparseable summary, or no baseline, is a trace line and no check.
-function countCheck(dir, cfg, state, input, ran) {
+function countCheck(dir, cfg, state, input, ran, vdir) {
+  // card worktree-count-baseline: a worktree run compares against its own earlier green runs, never main's record
+  // (a worktree can lack the dist build main has, so its skipped count differs). No record yet means no check.
+  const inWorktree = typeof vdir === "string" && vdir !== dir;
+  const baseline = inWorktree ? readLastGreen(vdir) : state.testTotals;
   const problems = [];
   const parsed = {};
   // The note carries its own event name, never the stop event's: a decision-less SubagentStop line would read to
@@ -793,7 +843,7 @@ function countCheck(dir, cfg, state, input, ran) {
         note(`count check did not run for \`${command}\`: no test summary in its output`);
         continue;
       }
-      const all = state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+      const all = baseline && typeof baseline === "object" ? baseline : null;
       const baseList = all ? readSummaries(all[command]) : null;
       if (!baseList) {
         parsed[command] = summaries;
@@ -1008,10 +1058,99 @@ function normalizedDeferrals(state) {
   return typeof d === "number" && Number.isFinite(d) && d >= 0 ? Math.floor(d) : 0;
 }
 
+// Card landing-block-enforced: board.mjs record/summary leave .doug/.state/reports/<id>/landing-block.txt and an
+// empty landing-block.pending (move <id> done re-arms it). A main Stop that would otherwise allow checks each
+// pending block against the lead's final message and blocks, once, until every line of it is there verbatim. The
+// marker is deleted the first time it is checked, so the block happens at most once per landing. Every exit that
+// lets a main Stop end plainly goes through allow() below. The systemMessage exits (the block-cap and turn-budget
+// stand-downs, the deferral notice, the repeat-deferral exit) return their text unchanged and never block (card
+// landing-block-shown-on-deferral): systemMessage() below first sweeps quietly, deleting a marker whose lines are
+// all in the final message and leaving any other, so a block printed on a deferral stop is not demanded again at
+// a later plain stop. A red gate (blockStop) keeps its own reason. A marker holds the session that landed (empty =
+// any); another session's marker is left untouched. Fails open: any throw, an unreadable block
+// file, or a final message that is not a string allows with one stderr line.
+let landingInput = null;
+// The pending markers this session owns, as [id, root] pairs; null when there is no reports directory.
+function ownedLandingMarkers(input) {
+  const root = join(projectDir(input), ".doug/.state/reports");
+  if (!existsSync(root)) return { root, pending: [] };
+  const mine = (id) => {
+    try {
+      const owner = readFileSync(join(root, id, "landing-block.pending"), "utf8").trim();
+      return owner === "" || owner === input.session_id;
+    } catch {
+      return false;
+    }
+  };
+  return { root, pending: readdirSync(root).filter((id) => existsSync(join(root, id, "landing-block.pending")) && mine(id)).sort() };
+}
+function landingBlockLines(root, id) {
+  return readFileSync(join(root, id, "landing-block.txt"), "utf8").split("\n").map((l) => l.trim()).filter(Boolean);
+}
+function landingBlockReason(input) {
+  try {
+    const { root, pending } = ownedLandingMarkers(input);
+    if (!pending.length) return null;
+    const message = input.last_assistant_message;
+    if (typeof message !== "string") {
+      // The markers stay, so a later Stop with a readable final message still checks them.
+      process.stderr.write("[doug] landing-block check skipped: the final message is unreadable\n");
+      return null;
+    }
+    const missing = [];
+    for (const id of pending) {
+      const marker = join(root, id, "landing-block.pending");
+      try {
+        const lines = landingBlockLines(root, id);
+        if (lines.length && !lines.every((l) => message.includes(l))) missing.push({ id, lines });
+      } catch (e) {
+        process.stderr.write(`[doug] landing-block check skipped: ${id}: ${e && e.message ? e.message : String(e)}\n`);
+      }
+      try {
+        unlinkSync(marker);
+      } catch {}
+    }
+    if (!missing.length) return null;
+    return missing.map((m) => `Landing block missing from your final message for ${m.id}. Paste these lines verbatim:\n${m.lines.join("\n")}`).join("\n\n");
+  } catch (e) {
+    process.stderr.write(`[doug] landing-block check skipped: ${e && e.message ? e.message : String(e)}\n`);
+    return null;
+  }
+}
+// Quiet sweep for the systemMessage exits: delete each owned marker whose lines are all in the final message,
+// keep the rest. Never blocks, never changes the exit's text.
+function sweepLandingMarkers(input) {
+  try {
+    const message = input.last_assistant_message;
+    if (typeof message !== "string") return;
+    const { root, pending } = ownedLandingMarkers(input);
+    for (const id of pending) {
+      try {
+        const lines = landingBlockLines(root, id);
+        if (lines.length && lines.every((l) => message.includes(l))) unlinkSync(join(root, id, "landing-block.pending"));
+      } catch (e) {
+        process.stderr.write(`[doug] landing-block check skipped: ${id}: ${e && e.message ? e.message : String(e)}\n`);
+      }
+    }
+  } catch (e) {
+    process.stderr.write(`[doug] landing-block check skipped: ${e && e.message ? e.message : String(e)}\n`);
+  }
+}
+function systemMessage(message) {
+  if (landingInput) sweepLandingMarkers(landingInput);
+  return systemMessageRaw(message);
+}
+function allow() {
+  const reason = landingInput ? landingBlockReason(landingInput) : null;
+  if (reason) return blockStop(reason);
+  return allowRaw();
+}
+
 const READ_ONLY_LINE = "[doug] Read-only turn: verification skipped; the working tree holds unverified changes from other agents.";
 
 runHook("stop-gate", async (input) => {
-  if (input.stop_hook_active) return allow();
+  if (input.stop_hook_active) return allowRaw();
+  if (input.hook_event_name !== "SubagentStop") landingInput = input;
   const dir = projectDir(input);
   const cfg = loadConfig(dir);
   let state = loadState(dir, input.session_id);
@@ -1394,8 +1533,8 @@ runHook("stop-gate", async (input) => {
     // Draft and rejected plans are not contracts yet, so they are ignored.
     let scope = null;
     if (Array.isArray(changed) && cfg.stopGate.planScope !== false) {
-      const { plan, reason, error } = loadScopePlan(dir);
-      if (reason === "unreadable") process.stderr.write(`[doug] ${PLAN_RELPATH} is unreadable (${error}); scope not checked\n`);
+      const { plan, reason, error, file } = loadScopePlan(dir);
+      if (reason === "unreadable") process.stderr.write(`[doug] ${file || PLAN_RELPATH} is unreadable (${error}); scope not checked\n`);
       if (plan) {
         const violations = scopeViolations(changed, plan, { ignore: cfg.stopGate.ignoreChangedPaths || [] });
         scope = { plan: plan.title, status: plan.status, outOfScope: violations.map((v) => v.file) };
@@ -1449,7 +1588,10 @@ runHook("stop-gate", async (input) => {
         state.deferrals = n;
         state.lastDeferral = { ids, fingerprint: currentFingerprint };
         saveState(dir, input.session_id, state);
-        if (repeat) return allow();
+        if (repeat) {
+          if (landingInput) sweepLandingMarkers(landingInput);
+          return allowRaw();
+        }
         return systemMessage(
           `[doug] Verification deferred: waits for ${names} to stop; the full gate runs at the first Stop after they stop.`,
         );
@@ -1498,7 +1640,7 @@ runHook("stop-gate", async (input) => {
   };
   const skipReason = subagent && agentMadeNoChanges(dir, cfg, input.session_id, subagent)
     ? "no-agent-changes"
-    : subagent && treeUnchangedSinceStart(dir, cfg, input.session_id, subagent, input, currentFingerprint)
+    : subagent && treeUnchangedSinceStart(dir, cfg, input.session_id, subagent, input, currentFingerprint, vdir, forced)
       ? "tree-unchanged"
       : readOnlyTurn
         ? "read-only-turn"
@@ -1588,7 +1730,7 @@ runHook("stop-gate", async (input) => {
 
   // card stop-gate-process-storm, case 3: only one gate runs the verification commands at a time per
   // project (the 2026-09-16 process storm: four concurrent SubagentStops each ran the full suite, each
-  // 300s timeout orphaning ten vitest workers). A gate holds .doug/.state/gate.lock while its commands run;
+  // 300s timeout orphaning ten vitest workers). A gate holds gate.lock (gateLockPath: under the git common dir) while its commands run;
   // a second gate that finds a live lock waits for it, bounded by stopGate.timeoutMs, then reloads state and
   // reapplies the skip above — the holder's own green run may have just recorded the very `verified` tree
   // this gate needs, letting it skip instead of also running the full suite.
@@ -1863,7 +2005,7 @@ runHook("stop-gate", async (input) => {
   const evidenceProblemAdded = problems.length > postCommandProblems;
 
   // 3c. Test-count ratchet (card test-count-ratchet): its own kind of problem, not a failed command.
-  const counted = countCheck(dir, cfg, state, input, ranGreen);
+  const counted = countCheck(dir, cfg, state, input, ranGreen, vdir);
   problems.push(...counted.problems);
   const countProblemAdded = counted.problems.length > 0;
 
@@ -1884,7 +2026,7 @@ runHook("stop-gate", async (input) => {
   // A read-only-turn skip verified nothing: it leaves lastRed (and stopBlocks, below) as they were.
   if (skipReason !== "read-only-turn") state.lastRed = null; // card stop-gate-no-change-restop: re-set at the final block below when it qualifies
   if (problems.length === 0 && !skipVerification && !targeted) state.verified = verifiedCandidate;
-  if (problems.length === 0 && !skipVerification) writeLastGreen(dir, counted.parsed); // empty when nothing really ran
+  if (problems.length === 0 && !skipVerification) writeLastGreen(vdir || dir, counted.parsed); // empty when nothing really ran
   if (problems.length === 0 && subagent) {
     // A subagent's green gate: its counter resets; the checkpoint, if any, belongs to the session's own Stop.
     state.agentBlocks = { ...(state.agentBlocks || {}), [subagent.id]: 0 };