@dougharness/cli 1.4.0 → 1.6.0

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -91,10 +91,10 @@ import { isAppliedContent } from "../lib/proposals.mjs";
 import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, readPlanSummaries, snapshotSection } from "../lib/anchor.mjs";
 import { contextReading, recordAgentContext } from "../lib/agent-context.mjs";
 import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiverCovers } from "../lib/test-totals.mjs";
-import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
+import { failingTestFilesFrom, tscErrorPaths, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
 import { docsGateDecision } from "../lib/docs-gate.mjs";
-import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
-import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable } from "../lib/verified-tree.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, acquireGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
+import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable, totalsUsable, exitCreditUsable } from "../lib/verified-tree.mjs";
 
 // Only the last this many characters of last_assistant_message are ever scanned for a partial claim
 // (review, scan cost): a structured result lives at the end of a worker's message, and the balanced-span
@@ -311,14 +311,14 @@ function stripLeadingDotSlash(f) {
 // failed command's output names at least one test file, every named file is in the claim, and every
 // claimed file is changed or untracked in the working tree (`changed`, from changedFiles(dir) above);
 // otherwise `{ covered: false, reasonLine }` — one line, no newline, saying why.
-function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
+function redByDesignCoverage(claimFiles, commandFailures, changed, dir, secrets) {
   const changedSet = new Set(Array.isArray(changed) ? changed : []);
   for (const cf of commandFailures) {
     const bad = nonTestTscPathsFrom(cf.output, dir);
     if (bad.length > 0) {
       return {
         covered: false,
-        reasonLine: `The tests_red_by_design claim does not cover this: \`${cf.command}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
+        reasonLine: `The tests_red_by_design claim does not cover this: \`${redactText(cf.command, secrets)}\` reported a type error in ${bad.join(", ")}, which is not a test file.`,
       };
     }
   }
@@ -327,7 +327,7 @@ function redByDesignCoverage(claimFiles, commandFailures, changed, dir) {
   if (noFile.length > 0) {
     return {
       covered: false,
-      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${c.command}\``).join(", ")} named no test file in its output.`,
+      reasonLine: `The tests_red_by_design claim does not cover this: ${noFile.map((c) => `\`${redactText(c.command, secrets)}\``).join(", ")} named no test file in its output.`,
     };
   }
   const allNamed = [...new Set(namedByCommand.flatMap((c) => c.files))];
@@ -510,7 +510,7 @@ function agentMadeNoChanges(dir, cfg, sessionId, subagent) {
 // card stop-gate-worktree-agent-fingerprint: the start record is a fingerprint of the main checkout (the trace
 // hook runs there), so for a worktree verification dir it is compared like with like instead: unchanged only if
 // the record exists, every verification dir has no changed files, and every one's HEAD carries no commit of its
-// own: it equals or is an ancestor of the record's HEAD, or of the main checkout's refs/remotes/origin/HEAD (Claude
+// own: it equals or is an ancestor of the record's HEAD, or of the origin/HEAD sha the record holds, taken at start, never the live ref (Claude
 // Code branches a fresh isolation worktree from the remote default branch, which local main may be ahead of or
 // behind). Any git failure reads as changed. A verification set that mixes a worktree with `dir` reads as
 // changed. A main-checkout agent keeps the fingerprint comparison.
@@ -539,12 +539,7 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
       if (!start || typeof start !== "object" || !start.head) return false;
       const dirs = forced ? [vdir] : verifyDirs(dir, cfg, sessionId, input, subagent);
       if (!dirs.includes(vdir) || dirs.includes(dir)) return false;
-      let remoteHead;
-      try {
-        remoteHead = execFileSync("git", ["rev-parse", "--verify", "-q", "refs/remotes/origin/HEAD^{commit}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim() || null;
-      } catch {
-        remoteHead = null;
-      }
+      const remoteHead = typeof start.originHead === "string" && start.originHead ? start.originHead : null;
       return dirs.every((d) => {
         const h = headAt(d);
         if (!h) return false;
@@ -565,7 +560,10 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
 // .claude/worktrees names the main checkout, except <dir>/.doug/.state and anything under it (untracked state,
 // never project code) which names nothing; any other path names nothing. The set is the cwd's worktree plus
 // every tree its trace paths name (a worktree that no longer exists as a directory is skipped). Empty, a main
-// Stop, or any failure resolves to [dir]. Only the verification target varies per tree: state, trace,
+// Stop, or any failure resolves to [dir]. Card queen-seat-stop-gates-worktree: a Bash or Monitor line of the
+// agent (Pre or Post, whatever ok) also names a worktree by any absolute path token in its detail (a seat
+// that edits only through `cd <wt> && ...`); a shell token never names the main checkout.
+// Only the verification target varies per tree: state, trace,
 // gate.lock, the ledger, and evidence stay under `dir`. Never throws.
 function verifyDirs(dir, cfg, sessionId, input, subagent) {
   try {
@@ -603,7 +601,22 @@ function verifyDirs(dir, cfg, sessionId, input, subagent) {
       const file = tracePath(dir, sessionId);
       if (existsSync(file)) {
         for (const l of readTrace(file)) {
-          if (l.agent !== subagent.id || l.event !== "PostToolUse" || !CHANGE_TOOLS.has(l.tool) || l.ok === false) continue;
+          if (l.agent !== subagent.id) continue;
+          if (SHELL_TOOLS.has(l.tool) && (l.event === "PreToolUse" || l.event === "PostToolUse")) {
+            // card queen-seat-stop-gates-worktree: a shell command names a worktree by an absolute path token;
+            // a main-checkout path in it names nothing.
+            for (const tok of String(l.detail || "").split(/[\s;&|()<>'"`=]+/)) {
+              if (!tok.startsWith("/")) continue;
+              // the trace clips a detail at 120 chars with a trailing ellipsis; a clipped token names a worktree
+              // only when the name is followed by "/" inside it (else the cut name may be a sibling's prefix)
+              const clipped = tok.endsWith("…");
+              const t = clipped ? tok.slice(0, -1) : tok;
+              const n = wtName(t);
+              if (n && (!clipped || t.includes("/" + n + "/"))) addWt(n);
+            }
+            continue;
+          }
+          if (l.event !== "PostToolUse" || !CHANGE_TOOLS.has(l.tool) || l.ok === false) continue;
           const name = wtName(l.detail);
           if (name) addWt(name);
           else if (inMain(l.detail)) add(dir);
@@ -827,22 +840,36 @@ function readLastGreen(dir) {
   }
 }
 
+// card ratchet-credit-reads-record: one baseline for the count check and both credit paths. In a worktree
+// (vdir !== dir) it is the worktree's own last-green record. On the main checkout (card
+// ratchet-stale-session-baseline) it is the main last-green record when that has a readable entry for the
+// command, else the session-start copy state.testTotals. Returns (command) => baseline object or null. Never throws.
+function countBaselineFor(dir, state, vdir) {
+  try {
+    const inWorktree = typeof vdir === "string" && vdir !== dir;
+    const worktreeBaseline = inWorktree ? readLastGreen(vdir) : null;
+    const mainRecord = inWorktree ? null : readLastGreen(dir);
+    const fallback = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    return (command) => {
+      try {
+        if (inWorktree) return worktreeBaseline;
+        return mainRecord && readSummaries(mainRecord[command]) ? mainRecord : fallback;
+      } catch {
+        return null;
+      }
+    };
+  } catch {
+    return () => null;
+  }
+}
+
 // The count check for the commands that ran green by exit code. Returns { problems, parsed }: `problems` are
 // block reasons, `parsed` the per-command summary lists of every run that was counted (for the last-green
 // record). A missing or unparseable summary, or no baseline, is a trace line and no check.
 function countCheck(dir, cfg, state, input, ran, vdir) {
   // card worktree-count-baseline: a worktree run compares against its own earlier green runs, never main's record
   // (a worktree can lack the dist build main has, so its skipped count differs). No record yet means no check.
-  const inWorktree = typeof vdir === "string" && vdir !== dir;
-  // card ratchet-stale-session-baseline: a main-checkout run compares against the main tree's live last-green
-  // record too (per command), not the session-start copy; the copy is the fallback when the record has no
-  // readable entry for the command, so a deleted record does not remove the check.
-  const worktreeBaseline = inWorktree ? readLastGreen(vdir) : null;
-  const mainRecord = inWorktree ? null : readLastGreen(dir);
-  const baselineFor = (command) => {
-    if (inWorktree) return worktreeBaseline;
-    return mainRecord && readSummaries(mainRecord[command]) ? mainRecord : state.testTotals;
-  };
+  const baselineFor = countBaselineFor(dir, state, vdir);
   const problems = [];
   const parsed = {};
   // The note carries its own event name, never the stop event's: a decision-less SubagentStop line would read to
@@ -856,14 +883,14 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       // logging must never fail the gate
     }
   };
-  // Each entry is `{ command, stdout }` (a real run: parsed here) or `{ command, result }` (a credited pre-commit
+  // Each entry is `{ command, stdout }` (a real run: parsed here) or `{ command, result }` (a credited verified-tree
   // run: the parseTotals-shaped result the hook recorded). Both take the identical path below.
   for (const { command, stdout, result } of ran) {
     try {
       const p = result !== undefined ? result : parseTotals(stdout);
       const summaries = p.status === "ok" ? readSummaries(p) : null;
       if (!summaries) {
-        note(`count check did not run for \`${command}\`: no test summary in its output`);
+        note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: no test summary in its output`);
         continue;
       }
       const baseline = baselineFor(command);
@@ -871,11 +898,11 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       const baseList = all ? readSummaries(all[command]) : null;
       if (!baseList) {
         parsed[command] = summaries;
-        note(`count check did not run for \`${command}\`: no baseline totals for it (${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"} printed: ${summaries.map((s) => `total ${s.total}, skipped ${s.skipped}, todo ${s.todo}`).join("; ")})`);
+        note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: no baseline totals for it (${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"} printed: ${summaries.map((s) => `total ${s.total}, skipped ${s.skipped}, todo ${s.todo}`).join("; ")})`);
         continue;
       }
       if (baseList.length !== summaries.length) {
-        problems.push(`\`${command}\` printed ${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"}; the baseline has ${baseList.length}. The test count cannot be trusted. A waiver does not cover this; take a new baseline if a package was added or removed.`);
+        problems.push(`\`${redactText(command, cfg.secrets)}\` printed ${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"}; the baseline has ${baseList.length}. The test count cannot be trusted. A waiver does not cover this; take a new baseline if a package was added or removed.`);
         continue;
       }
       parsed[command] = summaries;
@@ -887,10 +914,10 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       if (waiverCovers(waiverSources(dir, state.baselineHead), delta)) continue;
       const lines = found.map((f) => `${f.kind} ${f.kind === "total" ? "dropped" : "rose"} from ${f.baseline} (baseline) to ${f.now} (now)`);
       problems.push(
-        `\`${command}\` test count regressed: ${lines.join("; ")}. Deleting or skipping tests does not make a change green. Restore them, or waive it with a line \`test-count-waiver: total=${delta.total} skipped=${delta.skipped} todo=${delta.todo}; <reason>\` in the commit message or ${WAIVER_FILE_RELPATH}.`,
+        `\`${redactText(command, cfg.secrets)}\` test count regressed: ${lines.join("; ")}. Deleting or skipping tests does not make a change green. Restore them, or waive it with a line \`test-count-waiver: total=${delta.total} skipped=${delta.skipped} todo=${delta.todo}; <reason>\` in the commit message or ${WAIVER_FILE_RELPATH}.`,
       );
     } catch {
-      note(`count check did not run for \`${command}\`: error while checking`);
+      note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: error while checking`);
     }
   }
   return { problems, parsed };
@@ -914,19 +941,6 @@ function writeLastGreen(dir, parsed) {
   }
 }
 
-// card stop-gate-credits-pre-commit: `git rev-parse HEAD^{tree}`, the tree sha of the current commit — what
-// the pre-commit hook's own record (.doug/.state/pre-commit/last-run.json) compares its `tree` field against.
-// Null on any failure (no git, no HEAD yet, ...): a reader must never throw.
-function headTreeSha(dir) {
-  try {
-    const out = execFileSync("git", ["rev-parse", "HEAD^{tree}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
-    const sha = out.trim();
-    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
-  } catch {
-    return null;
-  }
-}
-
 // card ratchet-pre-commit-credit: a recorded parseTotals result, normalised, or null when it is not readable.
 function readableRecordedTotals(t) {
   try {
@@ -939,11 +953,11 @@ function readableRecordedTotals(t) {
 }
 
 // card verified-tree-record: a verified-tree record (lib/verified-tree.mjs) of `tree` (the working tree now), same
-// Node and command set, credits the commands instead of re-running them. Same return shape as preCommitCredit:
+// Node and command set, credits the commands instead of re-running them. Returns
 // one `{ name, command, ok: true, credited: "verified-tree", recorded? }` per resolveCommands entry in config
 // order. A command with a baseline in state.testTotals and no readable recorded totals returns null (the commands
-// run), the same rule as preCommitCredit. Never throws: any failure is null, and null runs the commands.
-function treeCredit(dir, cfg, state, tree) {
+// run). Never throws: any failure is null, and null runs the commands.
+function treeCredit(dir, cfg, state, tree, mainDir) {
   try {
     if (!tree) return null;
     const record = readRecord(dir);
@@ -951,11 +965,14 @@ function treeCredit(dir, cfg, state, tree) {
     const configured = resolveCommands(cfg);
     if (configured.length === 0) return null;
     if (!creditable(dir, cfg, record, tree, configured.map((c) => c.command)).ok) return null;
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
+    if (!exitCreditUsable(record, dir)) return null;
+    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
+    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
     const out = [];
     for (const { name, command } of configured) {
-      const recorded = readableRecordedTotals(record.totals[command]);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
+      const recorded = totalsUsable(record, dir) ? readableRecordedTotals(record.totals[command]) : null;
+      const base = baselineFor(command);
+      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
       if (hasBaseline && (!recorded || recorded.status === "none")) return null;
       out.push({ name, command, ok: true, credited: "verified-tree", ...(recorded ? { recorded } : {}) });
     }
@@ -965,57 +982,6 @@ function treeCredit(dir, cfg, state, tree) {
   }
 }
 
-// card stop-gate-credits-pre-commit: the pre-commit hook (.githooks/pre-commit) writes a machine-readable
-// record of its own run to .doug/.state/pre-commit/last-run.json (version, tree, ok, at, commands: [{ name,
-// command, exit, durationMs, totals? }], totals being the hook's parseTotals result for that command; a command with a baseline in state.testTotals is credited only if its totals are readable (a list of summaries, or an old ok or conflict shape), else the commands run). When the working tree has no changes beyond HEAD (nothing left in `changed`
-// once stopGate.ignoreChangedPaths paths are removed) and that record is a passing run, against HEAD's own
-// tree, of exactly today's configured commands in order, the Stop gate credits it instead of re-running the
-// same commands a second time — returning `{ name, command, ok: true, credited: "pre-commit" }` per command,
-// same length and order as resolveCommands(cfg). Returns null (run as today) on a missing, unparsable,
-// wrong-shape, failing, stale-tree, or mismatched-commands record, or a dirty tree — fail closed to running,
-// never to passing. A reader must never throw: every path here is wrapped, so a corrupt record never crashes
-// the hook (`runHook` fails open on a throw, which here would mean passing without running — forbidden).
-function preCommitCredit(dir, cfg, changed, state) {
-  try {
-    if (!Array.isArray(changed)) return null;
-    const ignore = cfg.stopGate.ignoreChangedPaths || [];
-    const remaining = changed.filter((f) => !matchAny(ignore, f));
-    if (remaining.length > 0) return null;
-    const raw = readFileSync(join(dir, ".doug/.state/pre-commit/last-run.json"), "utf8");
-    const record = JSON.parse(raw);
-    if (!record || typeof record !== "object") return null;
-    if (record.version !== 1) return null;
-    if (record.ok !== true) return null;
-    if (typeof record.tree !== "string") return null;
-    if (!Array.isArray(record.commands)) return null;
-    const head = headTreeSha(dir);
-    if (!head || record.tree !== head) return null;
-    for (const c of record.commands) {
-      if (!c || typeof c !== "object" || c.exit !== 0) return null;
-    }
-    const configured = resolveCommands(cfg);
-    if (record.commands.length !== configured.length) return null;
-    for (let i = 0; i < configured.length; i++) {
-      if (!record.commands[i] || record.commands[i].command !== configured[i].command) return null;
-    }
-    // card ratchet-pre-commit-credit: a command with a baseline in state.testTotals is credited only when the
-    // record carries readable totals for it (a list of valid summaries, or an old ok or conflict shape);
-    // otherwise null and the commands really run. `recorded` is the parseTotals-shaped result for the count check.
-    const all = state && state.testTotals && typeof state.testTotals === "object" ? state.testTotals : null;
-    const out = [];
-    for (let i = 0; i < configured.length; i++) {
-      const { name, command } = configured[i];
-      const recorded = readableRecordedTotals(record.commands[i].totals);
-      const hasBaseline = all ? readSummaries(all[command]) !== null : false;
-      if (hasBaseline && (!recorded || recorded.status === "none")) return null;
-      out.push({ name, command, ok: true, credited: "pre-commit", ...(recorded ? { recorded } : {}) });
-    }
-    return out;
-  } catch {
-    return null;
-  }
-}
-
 // card stop-gate-process-storm, case 2 (second tester pass, reviewer-found gap): a verified-unchanged skip
 // is a green gate in every way that matters, not a bare allow — it resets the same counters an ordinary
 // green gate resets, and on the main Stop it still surfaces the context-window notice, exactly like the
@@ -1721,8 +1687,7 @@ runHook("stop-gate", async (input) => {
         currentFingerprint &&
         (sameTree(rec.fingerprint, currentFingerprint) || (rec.scope === scopeNow && (redViaNoTestPaths = onlyNoTestPathsChanged(vdir, cfg, rec.fingerprint, vchanged)))) &&
         !(subagent && (redByDesignClaim(input.last_assistant_message) ?? redByDesignClaim(lastHandbackMessage(input.agent_transcript_path)))) &&
-        !preCommitCredit(vdir, cfg, vchanged, state) &&
-        !treeCredit(vdir, cfg, state, computeTree(vdir))
+        !treeCredit(vdir, cfg, state, computeTree(vdir), dir)
       ) {
         lastRed = rec;
       }
@@ -1765,6 +1730,7 @@ runHook("stop-gate", async (input) => {
         failures: Array.isArray(lastRed.failures) ? lastRed.failures : [],
         cwd: typeof lastRed.cwd === "string" ? lastRed.cwd : null,
         tree: typeof lastRed.tree === "string" ? lastRed.tree : null,
+        files: Array.isArray(lastRed.files) ? lastRed.files : [],
       };
       logBlock(reason, reuseClass, reuseRecord);
       traceMainBlock(reuseRecord);
@@ -1804,13 +1770,17 @@ runHook("stop-gate", async (input) => {
         lockOwned = false;
       } else {
         const lock = readGateLock(dir);
-        if (!lock || !pidIsLive(lock.pid) || lockStaleByAge(lock, hookTimeoutMs)) {
+        // Card gate-lock-takeover-exclusive: a stale-on-arrival lock is acquired exclusively; "busy" (a rival just
+        // took it) enters the wait branch below like a live holder, "unwritable" runs unlocked.
+        let arrivalWait = !(!lock || !pidIsLive(lock.pid) || lockStaleByAge(lock, hookTimeoutMs));
+        if (!arrivalWait) {
           // Stale (a dead pid, a lock file that fails to parse, or one older than the hook-timeout budget —
-          // card stop-gate-budget-under-hook-timeout: no legitimate holder can still be running that long):
-          // take it over at once, no wait.
-          takeOverGateLock(dir, input.session_id);
-          lockOwned = true;
-        } else {
+          // card stop-gate-budget-under-hook-timeout: no legitimate holder can still be running that long).
+          const got = acquireGateLock(dir, input.session_id, hookTimeoutMs);
+          if (got === "acquired") lockOwned = true;
+          else if (got === "busy") arrivalWait = true;
+        }
+        if (arrivalWait) {
           // The bound scales with the number of configured commands (reviewer-found gap): a holder legitimately
           // runs each of resolveCommands(cfg) with its own timeoutMs budget, one after another, so a flat
           // timeoutMs would give up on — and duplicate — a holder still legitimately partway through its own
@@ -1825,11 +1795,22 @@ runHook("stop-gate", async (input) => {
           // taking the lock over, since taking over and running past the platform's own timeout would just get
           // this gate killed mid-command too (an ungated stop, its block message discarded).
           let refusedLock = null;
+          let acquired = false;
           while (true) {
             const live = readGateLock(dir);
-            if (!live || !pidIsLive(live.pid) || lockStaleByAge(live, hookTimeoutMs)) break; // released, died, or stale by age
+            if (!live || !pidIsLive(live.pid) || lockStaleByAge(live, hookTimeoutMs)) {
+              // Released, died, or stale by age. Card gate-load-timeouts: take it exclusively, so two waiters
+              // leaving this loop together do not both run their suites (ledger blocks 425 and 426). A lost race
+              // goes back to waiting, still bounded by the two deadlines below.
+              const got = acquireGateLock(dir, input.session_id, hookTimeoutMs);
+              if (got !== "busy") {
+                acquired = got === "acquired";
+                lockOwned = acquired;
+                break;
+              }
+            }
             if (Date.now() >= budgetDeadline) {
-              refusedLock = live;
+              refusedLock = readGateLock(dir) || live || {};
               break;
             }
             if (Date.now() >= waitDeadline) break; // bounded: never hang the gate on someone else's lock
@@ -1877,8 +1858,10 @@ runHook("stop-gate", async (input) => {
             return verifiedUnchangedAllow(dir, cfg, state, input, subagent, deferralCapNote);
           }
           // Still different, or the wait hit its bound with the lock still held: take it over and run.
-          takeOverGateLock(dir, input.session_id);
-          lockOwned = true;
+          if (!acquired) {
+            takeOverGateLock(dir, input.session_id);
+            lockOwned = true;
+          }
         }
       }
     }
@@ -1957,20 +1940,21 @@ runHook("stop-gate", async (input) => {
         const r = failedRuns[i] || {};
         return { command: redactText(cf.command, cfg.secrets), exit: typeof r.status === "number" ? r.status : null, timedOut: !!r.timedOut, tail: outputTail(cf.output, cfg.secrets) };
       });
-      return { failures, cwd: vdir, tree: treeBefore ?? null };
+      // card memory-failures-wiring: the sorted, unique, repo-relative paths the failed commands' output names.
+      const files = [...new Set(commandFailures.flatMap((cf) => [...failingTestFilesFrom(cf.output, vdir), ...tscErrorPaths(cf.output, vdir)]))].sort();
+      return { failures, cwd: vdir, tree: treeBefore ?? null, files };
     } catch {
-      return { failures: [], cwd: vdir, tree: null }; // the line is written without the failures; the decision is unchanged
+      return { failures: [], cwd: vdir, tree: null, files: [] }; // the line is written without the failures; the decision is unchanged
     }
   };
   const failedRuns = []; // parallel to commandFailures: { status, timedOut } of each failed run (card block-ledger-failing-output)
-  const ranGreen = []; // count check input: { command, stdout } of each command that really ran and exited 0, plus { command, result } of each credited pre-commit command whose recorded totals are readable
-  // card stop-gate-credits-pre-commit: a passing pre-commit record for this exact tree and command set
-  // stands in for actually running them — see preCommitCredit above. Every other check below (evidence,
-  // red-by-design, state.verified, the block ledger) runs exactly as it would after a real run.
+  const ranGreen = []; // count check input: { command, stdout } of each command that really ran and exited 0, plus { command, result } of each credited verified-tree command whose recorded totals are readable
   // card verified-tree-record: treeBefore is the working tree immediately before the first command; a record of
-  // it (any writer: Stop, verify.mjs, land, pre-commit) is tried before preCommitCredit's last-run.json.
+  // it (any writer: Stop, verify.mjs, land, pre-commit) for this exact tree and command set stands in for
+  // actually running them. Every other check below (evidence, red-by-design, state.verified, the block ledger)
+  // runs exactly as it would after a real run.
   const treeBefore = skipVerification ? null : computeTree(vdir);
-  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore) ?? preCommitCredit(vdir, cfg, vchanged, state));
+  const credited = skipVerification ? null : treeCredit(vdir, cfg, state, treeBefore, dir);
   // card gate-docs-skip-unless-named: a targeted run is never a full run (no record, no ratchet, no state.verified).
   const targeted = !credited && targetedFiles ? targetedFiles : null;
   if (!skipVerification && credited) {
@@ -1990,7 +1974,7 @@ runHook("stop-gate", async (input) => {
       if (remaining <= 0) {
         results.push({ name, command, ok: false, skipped: "budget" });
         problems.push(
-          `\`${command}\` not run: the stop gate's budget (hook timeout ${hookTimeoutSec} s) was used up before it could start.`,
+          `\`${redactText(command, cfg.secrets)}\` not run: the stop gate's budget (hook timeout ${hookTimeoutSec} s) was used up before it could start.`,
         );
         continue;
       }
@@ -2008,7 +1992,7 @@ runHook("stop-gate", async (input) => {
         const output = r.stderr + "\n" + r.stdout;
         // card gate-output-names-failures: the block reason leads with the failing test names (R1/R2);
         // commandFailures below keeps the untruncated output for the tests_red_by_design coverage check.
-        problems.push(`\`${command}\` failed (${why}):\n${failureSummary(output, 40)}`);
+        problems.push(`\`${redactText(command, cfg.secrets)}\` failed (${why}):\n${redactText(failureSummary(output, 40), cfg.secrets)}`);
         commandFailures.push({ command, output });
         failedRuns.push({ status: r.status, timedOut: r.timedOut });
       }
@@ -2035,6 +2019,7 @@ runHook("stop-gate", async (input) => {
             node: process.version,
             at: new Date().toISOString(),
             by: subagent ? "subagent-stop" : "stop",
+            ranIn: realpathSync(vdir),
             commands: results.map((r) => ({ name: r.name, command: r.command, exit: 0, durationMs: typeof r.durationMs === "number" ? r.durationMs : 0 })),
             totals,
           });
@@ -2058,7 +2043,7 @@ runHook("stop-gate", async (input) => {
   let evidence = null;
   if (!skipVerification && cfg.stopGate.requireEvidence !== false && sessionMadeChanges) {
     evidence = verificationEvidence(state.commands || [], cfg);
-    if (evidence.ran.length === 0) problems.push(describeMissingEvidence(evidence.looked, results.every((r) => r.ok)));
+    if (evidence.ran.length === 0) problems.push(describeMissingEvidence(evidence.looked.map((c) => redactText(c, cfg.secrets)), results.every((r) => r.ok)));
   }
   const evidenceProblemAdded = problems.length > postCommandProblems;
 
@@ -2150,7 +2135,7 @@ runHook("stop-gate", async (input) => {
           // (none of them a dropped command) closes that gap.
           postCommandProblems - preVerificationProblems === commandFailures.length
         ) {
-          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir);
+          const coverage = redByDesignCoverage(claimFiles, commandFailures, changed, dir, cfg.secrets);
           if (coverage.covered) {
             // Same as a subagent's green gate: counter resets, no checkpoint, no turn.
             state.agentBlocks = { ...(state.agentBlocks || {}), [subagent.id]: 0 };

package/node_modules/@dougharness/gates/scripts/verify.mjs

@@ -7,13 +7,13 @@
 // No count ratchet and no scans here (no session baseline); the Stop gate does those. Takes the Stop gate's gate.lock (under the git common dir, shared by every worktree) around the commands (card verify-takes-gate-lock).
 
 import { spawnSync } from "node:child_process";
-import { unlinkSync } from "node:fs";
+import { unlinkSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadConfig } from "../lib/config.mjs";
-import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, acquireGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { runCommand, tail } from "../lib/run.mjs";
 import { parseTotals, readSummaries, sumTotals } from "../lib/test-totals.mjs";
-import { computeTree, readRecord, writeRecord, removeRecord, creditable, resolveCommands } from "../lib/verified-tree.mjs";
+import { computeTree, readRecord, writeRecord, removeRecord, creditable, exitCreditUsable, resolveCommands } from "../lib/verified-tree.mjs";
 
 function parseArgs(argv) {
   const o = { noCredit: false, json: false, commands: [], creditDirs: [] };
@@ -51,6 +51,20 @@ function toplevel() {
   return process.cwd();
 }
 
+// True when dir is a main checkout (git dir equals the common dir), or when that cannot be told (fail closed). Never throws.
+function isMainCheckout(dir) {
+  try {
+    const env = {};
+    for (const [k, v] of Object.entries(process.env)) if (!k.startsWith("GIT_")) env[k] = v;
+    const r = spawnSync("git", ["rev-parse", "--git-dir", "--git-common-dir"], { cwd: dir, encoding: "utf8", env, timeout: 10000 });
+    const [a, b] = r.status === 0 ? r.stdout.trim().split("\n") : [];
+    if (!a || !b) return true;
+    return realpathSync(resolve(dir, a)) === realpathSync(resolve(dir, b));
+  } catch {
+    return true;
+  }
+}
+
 function passed(totals) {
   const s = totals && totals.status === "ok" ? readSummaries(totals) : null;
   if (!s) return null;
@@ -86,9 +100,11 @@ function main() {
     const wanted = commands.map((c) => c.command);
     let record = null;
     let fromOther = false;
+    // Card verify-credit-foreign-skipped: in a main checkout a record from another checkout that skipped tests is not evidence.
+    const mainCwd = isMainCheckout(cwd);
     for (const [i, d] of [recordDir, ...o.creditDirs.map((c) => resolve(c))].entries()) {
       const rec = readRecord(d);
-      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok) {
+      if (rec && creditable(cwd, cfg, rec, treeBefore, wanted).ok && (!mainCwd || exitCreditUsable(rec, cwd))) {
         record = rec;
         fromOther = i > 0;
         break;
@@ -139,17 +155,33 @@ function main() {
       const hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
       const stale = (l) => !l || !pidIsLive(l.pid) || lockStaleByAge(l, hookTimeoutMs);
       const held = readGateLock(dir);
-      if (stale(held)) {
-        takeOverGateLock(dir, o.by || "verify");
-        lockOwned = true;
-      } else {
+      // Card gate-lock-takeover-exclusive: a lock read as stale on arrival is acquired exclusively; "busy" (a rival
+      // just took it) is waited on like a live holder, never overwritten; "unwritable" runs unlocked.
+      let needWait = !stale(held);
+      if (!needWait) {
+        const got = acquireGateLock(dir, o.by || "verify", hookTimeoutMs);
+        if (got === "acquired") lockOwned = true;
+        else if (got === "busy") needWait = true;
+      }
+      if (needWait) {
         const waitStart = Date.now();
         const deadline = waitStart + waitBoundMs;
         let live = held;
+        let acquired = false;
         const nap = new Int32Array(new SharedArrayBuffer(4));
         while (true) {
           live = readGateLock(dir);
-          if (stale(live) || Date.now() >= deadline) break;
+          if (stale(live)) {
+            // Card gate-load-timeouts: take a released or stale lock exclusively (two waiters must not both run);
+            // a lost race goes back to waiting, bounded by the deadline.
+            const got = acquireGateLock(dir, o.by || "verify", hookTimeoutMs);
+            if (got !== "busy") {
+              acquired = got === "acquired";
+              lockOwned = acquired;
+              break;
+            }
+          }
+          if (Date.now() >= deadline) break;
           Atomics.wait(nap, 0, 0, 200);
         }
         lockWaitMs = Date.now() - waitStart;
@@ -157,9 +189,11 @@ function main() {
         treeBefore = computeTree(cwd);
         const again = tryCredit();
         if (again !== null) return again;
-        if (!stale(live)) process.stderr.write(`[doug] verify: gate.lock still held by pid ${live.pid} after ${waitBoundMs} ms; running the commands anyway.\n`);
-        takeOverGateLock(dir, o.by || "verify");
-        lockOwned = true;
+        if (!acquired) {
+          if (!stale(live)) process.stderr.write(`[doug] verify: gate.lock still held by pid ${live.pid} after ${waitBoundMs} ms; running the commands anyway.\n`);
+          takeOverGateLock(dir, o.by || "verify");
+          lockOwned = true;
+        }
       }
     }
   }
@@ -185,7 +219,7 @@ function main() {
   if (ok) {
     const treeAfter = computeTree(cwd);
     if (treeBefore && treeAfter && treeBefore === treeAfter) {
-      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", commands: recCommands, totals });
+      writeRecord(recordDir, { version: 1, tree: treeAfter, node: process.version, at: new Date().toISOString(), by: o.by || "verify", ranIn: realpathSync(cwd), commands: recCommands, totals });
     }
   } else {
     removeRecord(recordDir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/cli",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "doug: tailored, approval-gated harness install for Claude Code.",
   "type": "module",
   "license": "MIT",
@@ -23,8 +23,8 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@dougharness/flow": "1.4.0",
-    "@dougharness/gates": "1.4.0"
+    "@dougharness/flow": "1.6.0",
+    "@dougharness/gates": "1.6.0"
   },
   "bundleDependencies": [
     "@dougharness/flow",