@dougharness/cli 1.5.0 → 1.6.0

package/node_modules/@dougharness/gates/lib/gate-lock.mjs

@@ -1,9 +1,11 @@
 // The gate.lock helpers shared by the Stop gate (scripts/stop-gate.mjs) and verify.mjs (card
 // verify-takes-gate-lock). Moved verbatim from stop-gate.mjs; the Stop gate's behaviour is unchanged.
 
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadConfig } from "./config.mjs";
 
 // Single-runner lock (card stop-gate-process-storm, goal 3): only one gate runs the verification commands
 // at a time per project, so concurrent SubagentStops share one suite instead of each starting its own (the
@@ -72,10 +74,10 @@ export function pidIsLive(pid) {
 
 // Creates gate.lock exclusively (throws EEXIST when one is already there, or any other fs error). The
 // caller decides what a failure means.
-export function writeGateLock(dir, sessionId) {
+export function writeGateLock(dir, sessionId, pid = process.pid) {
   const p = gateLockPath(dir);
   mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify({ pid: process.pid, session: sessionId, at: Date.now() }), { flag: "wx" });
+  writeFileSync(p, JSON.stringify({ pid, session: sessionId, at: Date.now() }), { flag: "wx" });
 }
 
 // Overwrites gate.lock with this gate's own pid/session, whether it was stale (a dead pid) or its holder
@@ -92,6 +94,48 @@ export function takeOverGateLock(dir, sessionId) {
   }
 }
 
+// Card gate-load-timeouts: exclusive acquisition for a waiter that saw the lock released, dead or stale. The
+// old path overwrote it, so two waiters leaving the wait loop together both ran their suites (ledger blocks 425
+// and 426). Creates with wx; a stale lock is removed only while the content judged stale is still in place, and
+// EEXIST reports "busy" so the caller keeps waiting. Returns "acquired", "busy" or "unwritable" (the lock cannot
+// be written at all: run unlocked). Never throws.
+export function acquireGateLock(dir, sessionId, hookTimeoutMs, pid = process.pid) {
+  try {
+    const p = gateLockPath(dir);
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        writeGateLock(dir, sessionId, pid);
+        return "acquired";
+      } catch (err) {
+        if (!err || err.code !== "EEXIST") return "unwritable";
+      }
+      let raw;
+      try {
+        raw = readFileSync(p, "utf8");
+      } catch {
+        continue; // released between the create and the read: try the create again
+      }
+      let lock = null;
+      try {
+        const o = JSON.parse(raw);
+        lock = o && typeof o === "object" && Number.isInteger(o.pid) && o.pid > 0 ? o : null;
+      } catch {
+        lock = null;
+      }
+      if (lock && pidIsLive(lock.pid) && !lockStaleByAge(lock, hookTimeoutMs)) return "busy";
+      try {
+        if (readFileSync(p, "utf8") !== raw) return "busy"; // someone else replaced it meanwhile
+        unlinkSync(p);
+      } catch {
+        // already gone, or not removable: the next create decides
+      }
+    }
+    return "busy";
+  } catch {
+    return "unwritable";
+  }
+}
+
 // Card stop-gate-budget-under-hook-timeout: cfg.stopGate.hookTimeoutSec must equal the platform's own
 // Stop/SubagentStop hook `timeout` (hooks.json/settings.json), but a hook reader never throws (F6), so a
 // missing, non-number, or non-positive value reads as the platform's own default, 600.
@@ -124,3 +168,130 @@ export function normalizedTimeoutMs(cfg) {
 export function lockWaitBoundMs(perCommandMs, commandCount) {
   return perCommandMs * Math.max(1, commandCount);
 }
+
+// Card gate-load-timeouts: CLI for .githooks/pre-commit, so a commit's suites queue on the same gate.lock as the
+// Stop gate and verify.mjs (ledger blocks 422, 432, 435 had a lock-free pre-commit suite next to a gate's).
+// `node gate-lock.mjs run -- <command> [args...]`, run from the repo top level: waits on a live lock up to
+// stopGate.timeoutMs (default 300000), then runs anyway; a stale lock is taken at once; a lock that cannot be
+// written runs unlocked. Leading NAME=VALUE arguments set the command's env; one remaining argument runs via `sh -c`.
+// Holds the lock while the command runs, releases it, exits with the command's status.
+function isMain() {
+  try {
+    return !!process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    return false;
+  }
+}
+if (isMain()) {
+  const args = process.argv.slice(2);
+  const dir = process.cwd();
+  const sub = args[0];
+  if (sub === "acquire" || sub === "release") {
+    // Card gate-lock-takeover-exclusive: one lock for a whole shell hook, held under the hook shell's own pid
+    // (`--pid $$`, alive for the whole hook). `acquire` waits like `run` and exits 0 whether it owns the lock,
+    // gave up waiting, or the lock is unwritable (the hook then runs unlocked); a non-zero exit is a runner
+    // failure. `release` removes the lock only when it names that pid, and never fails.
+    const pidArg = args.indexOf("--pid") === -1 ? NaN : Number(args[args.indexOf("--pid") + 1]);
+    if (!Number.isInteger(pidArg) || pidArg <= 0) {
+      process.stderr.write(`usage: gate-lock.mjs ${sub} --pid <pid>\n`);
+      process.exit(2);
+    }
+    if (sub === "release") {
+      try {
+        const lock = readGateLock(dir);
+        if (lock && lock.pid === pidArg) unlinkSync(gateLockPath(dir));
+      } catch {
+        // never fail a release
+      }
+      process.exit(0);
+    }
+    let waitMs = 300000;
+    let hookTimeoutMs = 600000;
+    try {
+      const cfg = loadConfig(dir);
+      waitMs = normalizedTimeoutMs(cfg) ?? waitMs;
+      hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
+    } catch {
+      // defaults
+    }
+    const deadline = Date.now() + waitMs;
+    const nap = new Int32Array(new SharedArrayBuffer(4));
+    while (true) {
+      const r = acquireGateLock(dir, "pre-commit", hookTimeoutMs, pidArg);
+      if (r !== "busy") break;
+      if (Date.now() >= deadline) {
+        process.stderr.write(`[doug] pre-commit: gate.lock still held after ${waitMs} ms; running anyway.\n`);
+        break;
+      }
+      Atomics.wait(nap, 0, 0, 200);
+    }
+    process.exit(0);
+  }
+  const sep = args.indexOf("--");
+  const cmd = sep === -1 ? [] : args.slice(sep + 1);
+  if (args[0] !== "run" || cmd.length === 0) {
+    process.stderr.write("usage: gate-lock.mjs run -- <command> [args...]\n");
+    process.exit(2);
+  }
+  let owned = false;
+  const release = () => {
+    try {
+      if (!owned) return;
+      owned = false;
+      const lock = readGateLock(dir);
+      if (lock && lock.pid === process.pid) unlinkSync(gateLockPath(dir));
+    } catch {
+      // never throw from a release
+    }
+  };
+  process.on("exit", release);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(sig, () => process.exit(128));
+  try {
+    let waitMs = 300000;
+    let hookTimeoutMs = 600000;
+    try {
+      const cfg = loadConfig(dir);
+      waitMs = normalizedTimeoutMs(cfg) ?? waitMs;
+      hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
+    } catch {
+      // defaults
+    }
+    const deadline = Date.now() + waitMs;
+    const nap = new Int32Array(new SharedArrayBuffer(4));
+    while (true) {
+      const r = acquireGateLock(dir, "pre-commit", hookTimeoutMs);
+      if (r === "acquired") {
+        owned = true;
+        break;
+      }
+      if (r === "unwritable") break;
+      if (Date.now() >= deadline) {
+        process.stderr.write(`[doug] pre-commit: gate.lock still held after ${waitMs} ms; running ${cmd[0]} anyway.\n`);
+        break;
+      }
+      Atomics.wait(nap, 0, 0, 200);
+    }
+  } catch {
+    // run unlocked rather than block a commit on a lock fault
+  }
+  // Card gate-lock-run-shell-forms: leading NAME=VALUE arguments go into the child's environment, a single
+  // remaining argument runs through `sh -c` (a quoted compound command), and several arguments spawn as argv
+  // unchanged. A command that cannot be spawned says so on stderr and exits 127 instead of a silent 1.
+  const env = { ...process.env };
+  let argv = cmd;
+  while (argv.length > 1 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[0])) {
+    const eq = argv[0].indexOf("=");
+    env[argv[0].slice(0, eq)] = argv[0].slice(eq + 1);
+    argv = argv.slice(1);
+  }
+  const res =
+    argv.length === 1
+      ? spawnSync("sh", ["-c", argv[0]], { stdio: "inherit", env })
+      : spawnSync(argv[0], argv.slice(1), { stdio: "inherit", env });
+  release();
+  if (res.error) {
+    process.stderr.write(`[doug] gate-lock run: cannot run ${argv[0]}: ${res.error.message}\n`);
+    process.exit(127);
+  }
+  process.exit(res.status === null ? 1 : res.status);
+}

package/node_modules/@dougharness/gates/lib/test-totals.mjs

@@ -5,7 +5,7 @@
 //   - Counts cannot see delete-one-add-one: a session that removes a test and adds an unrelated one keeps
 //     every number level and passes.
 //   - The verified-unchanged skip runs no test command, so there is no output to count there; no count check
-//     happens on it. (The pre-commit credit path is counted from the totals the hook records in last-run.json.)
+//     happens on it. (The credited path is counted from the totals the verified-tree record carries.)
 //   - The baseline is the number of `Tests` summaries a command prints plus their sum (ADR 0013): a session
 //     that adds or removes a package changes the number of summaries and blocks with no waiver until a new
 //     baseline is taken.

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",

package/node_modules/@dougharness/gates/scripts/stop-gate.mjs

@@ -91,9 +91,9 @@ import { isAppliedContent } from "../lib/proposals.mjs";
 import { gitHead, mergeSnapshot, readDecisions, readPlanSummary, readPlanSummaries, snapshotSection } from "../lib/anchor.mjs";
 import { contextReading, recordAgentContext } from "../lib/agent-context.mjs";
 import { parseTotals, readSummaries, sumTotals, compareTotals, deltaTotals, waiverCovers } from "../lib/test-totals.mjs";
-import { failingTestFilesFrom, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
+import { failingTestFilesFrom, tscErrorPaths, nonTestTscPathsFrom, classifyFinalBlock, appendBlockLine, outputTail, redactText } from "../lib/block-ledger.mjs";
 import { docsGateDecision } from "../lib/docs-gate.mjs";
-import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, acquireGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { resolveCommands, computeTree, readRecord, writeRecord as writeTreeRecord, removeRecord as removeTreeRecord, creditable, totalsUsable, exitCreditUsable } from "../lib/verified-tree.mjs";
 
 // Only the last this many characters of last_assistant_message are ever scanned for a partial claim
@@ -560,7 +560,10 @@ function treeUnchangedSinceStart(dir, cfg, sessionId, subagent, input, currentFi
 // .claude/worktrees names the main checkout, except <dir>/.doug/.state and anything under it (untracked state,
 // never project code) which names nothing; any other path names nothing. The set is the cwd's worktree plus
 // every tree its trace paths name (a worktree that no longer exists as a directory is skipped). Empty, a main
-// Stop, or any failure resolves to [dir]. Only the verification target varies per tree: state, trace,
+// Stop, or any failure resolves to [dir]. Card queen-seat-stop-gates-worktree: a Bash or Monitor line of the
+// agent (Pre or Post, whatever ok) also names a worktree by any absolute path token in its detail (a seat
+// that edits only through `cd <wt> && ...`); a shell token never names the main checkout.
+// Only the verification target varies per tree: state, trace,
 // gate.lock, the ledger, and evidence stay under `dir`. Never throws.
 function verifyDirs(dir, cfg, sessionId, input, subagent) {
   try {
@@ -598,7 +601,22 @@ function verifyDirs(dir, cfg, sessionId, input, subagent) {
       const file = tracePath(dir, sessionId);
       if (existsSync(file)) {
         for (const l of readTrace(file)) {
-          if (l.agent !== subagent.id || l.event !== "PostToolUse" || !CHANGE_TOOLS.has(l.tool) || l.ok === false) continue;
+          if (l.agent !== subagent.id) continue;
+          if (SHELL_TOOLS.has(l.tool) && (l.event === "PreToolUse" || l.event === "PostToolUse")) {
+            // card queen-seat-stop-gates-worktree: a shell command names a worktree by an absolute path token;
+            // a main-checkout path in it names nothing.
+            for (const tok of String(l.detail || "").split(/[\s;&|()<>'"`=]+/)) {
+              if (!tok.startsWith("/")) continue;
+              // the trace clips a detail at 120 chars with a trailing ellipsis; a clipped token names a worktree
+              // only when the name is followed by "/" inside it (else the cut name may be a sibling's prefix)
+              const clipped = tok.endsWith("…");
+              const t = clipped ? tok.slice(0, -1) : tok;
+              const n = wtName(t);
+              if (n && (!clipped || t.includes("/" + n + "/"))) addWt(n);
+            }
+            continue;
+          }
+          if (l.event !== "PostToolUse" || !CHANGE_TOOLS.has(l.tool) || l.ok === false) continue;
           const name = wtName(l.detail);
           if (name) addWt(name);
           else if (inMain(l.detail)) add(dir);
@@ -865,14 +883,14 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       // logging must never fail the gate
     }
   };
-  // Each entry is `{ command, stdout }` (a real run: parsed here) or `{ command, result }` (a credited pre-commit
+  // Each entry is `{ command, stdout }` (a real run: parsed here) or `{ command, result }` (a credited verified-tree
   // run: the parseTotals-shaped result the hook recorded). Both take the identical path below.
   for (const { command, stdout, result } of ran) {
     try {
       const p = result !== undefined ? result : parseTotals(stdout);
       const summaries = p.status === "ok" ? readSummaries(p) : null;
       if (!summaries) {
-        note(`count check did not run for \`${command}\`: no test summary in its output`);
+        note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: no test summary in its output`);
         continue;
       }
       const baseline = baselineFor(command);
@@ -880,11 +898,11 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       const baseList = all ? readSummaries(all[command]) : null;
       if (!baseList) {
         parsed[command] = summaries;
-        note(`count check did not run for \`${command}\`: no baseline totals for it (${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"} printed: ${summaries.map((s) => `total ${s.total}, skipped ${s.skipped}, todo ${s.todo}`).join("; ")})`);
+        note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: no baseline totals for it (${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"} printed: ${summaries.map((s) => `total ${s.total}, skipped ${s.skipped}, todo ${s.todo}`).join("; ")})`);
         continue;
       }
       if (baseList.length !== summaries.length) {
-        problems.push(`\`${command}\` printed ${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"}; the baseline has ${baseList.length}. The test count cannot be trusted. A waiver does not cover this; take a new baseline if a package was added or removed.`);
+        problems.push(`\`${redactText(command, cfg.secrets)}\` printed ${summaries.length} test summar${summaries.length === 1 ? "y" : "ies"}; the baseline has ${baseList.length}. The test count cannot be trusted. A waiver does not cover this; take a new baseline if a package was added or removed.`);
         continue;
       }
       parsed[command] = summaries;
@@ -896,10 +914,10 @@ function countCheck(dir, cfg, state, input, ran, vdir) {
       if (waiverCovers(waiverSources(dir, state.baselineHead), delta)) continue;
       const lines = found.map((f) => `${f.kind} ${f.kind === "total" ? "dropped" : "rose"} from ${f.baseline} (baseline) to ${f.now} (now)`);
       problems.push(
-        `\`${command}\` test count regressed: ${lines.join("; ")}. Deleting or skipping tests does not make a change green. Restore them, or waive it with a line \`test-count-waiver: total=${delta.total} skipped=${delta.skipped} todo=${delta.todo}; <reason>\` in the commit message or ${WAIVER_FILE_RELPATH}.`,
+        `\`${redactText(command, cfg.secrets)}\` test count regressed: ${lines.join("; ")}. Deleting or skipping tests does not make a change green. Restore them, or waive it with a line \`test-count-waiver: total=${delta.total} skipped=${delta.skipped} todo=${delta.todo}; <reason>\` in the commit message or ${WAIVER_FILE_RELPATH}.`,
       );
     } catch {
-      note(`count check did not run for \`${command}\`: error while checking`);
+      note(`count check did not run for \`${redactText(command, cfg.secrets)}\`: error while checking`);
     }
   }
   return { problems, parsed };
@@ -923,19 +941,6 @@ function writeLastGreen(dir, parsed) {
   }
 }
 
-// card stop-gate-credits-pre-commit: `git rev-parse HEAD^{tree}`, the tree sha of the current commit — what
-// the pre-commit hook's own record (.doug/.state/pre-commit/last-run.json) compares its `tree` field against.
-// Null on any failure (no git, no HEAD yet, ...): a reader must never throw.
-function headTreeSha(dir) {
-  try {
-    const out = execFileSync("git", ["rev-parse", "HEAD^{tree}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 });
-    const sha = out.trim();
-    return /^[0-9a-f]{40}$/.test(sha) ? sha : null;
-  } catch {
-    return null;
-  }
-}
-
 // card ratchet-pre-commit-credit: a recorded parseTotals result, normalised, or null when it is not readable.
 function readableRecordedTotals(t) {
   try {
@@ -948,10 +953,10 @@ function readableRecordedTotals(t) {
 }
 
 // card verified-tree-record: a verified-tree record (lib/verified-tree.mjs) of `tree` (the working tree now), same
-// Node and command set, credits the commands instead of re-running them. Same return shape as preCommitCredit:
+// Node and command set, credits the commands instead of re-running them. Returns
 // one `{ name, command, ok: true, credited: "verified-tree", recorded? }` per resolveCommands entry in config
 // order. A command with a baseline in state.testTotals and no readable recorded totals returns null (the commands
-// run), the same rule as preCommitCredit. Never throws: any failure is null, and null runs the commands.
+// run). Never throws: any failure is null, and null runs the commands.
 function treeCredit(dir, cfg, state, tree, mainDir) {
   try {
     if (!tree) return null;
@@ -977,59 +982,6 @@ function treeCredit(dir, cfg, state, tree, mainDir) {
   }
 }
 
-// card stop-gate-credits-pre-commit: the pre-commit hook (.githooks/pre-commit) writes a machine-readable
-// record of its own run to .doug/.state/pre-commit/last-run.json (version, tree, ok, at, commands: [{ name,
-// command, exit, durationMs, totals? }], totals being the hook's parseTotals result for that command; a command with a baseline in state.testTotals is credited only if its totals are readable (a list of summaries, or an old ok or conflict shape), else the commands run). When the working tree has no changes beyond HEAD (nothing left in `changed`
-// once stopGate.ignoreChangedPaths paths are removed) and that record is a passing run, against HEAD's own
-// tree, of exactly today's configured commands in order, the Stop gate credits it instead of re-running the
-// same commands a second time — returning `{ name, command, ok: true, credited: "pre-commit" }` per command,
-// same length and order as resolveCommands(cfg). Returns null (run as today) on a missing, unparsable,
-// wrong-shape, failing, stale-tree, or mismatched-commands record, or a dirty tree — fail closed to running,
-// never to passing. A reader must never throw: every path here is wrapped, so a corrupt record never crashes
-// the hook (`runHook` fails open on a throw, which here would mean passing without running — forbidden).
-function preCommitCredit(dir, cfg, changed, state, mainDir) {
-  try {
-    if (!Array.isArray(changed)) return null;
-    const ignore = cfg.stopGate.ignoreChangedPaths || [];
-    const remaining = changed.filter((f) => !matchAny(ignore, f));
-    if (remaining.length > 0) return null;
-    const raw = readFileSync(join(dir, ".doug/.state/pre-commit/last-run.json"), "utf8");
-    const record = JSON.parse(raw);
-    if (!record || typeof record !== "object") return null;
-    if (record.version !== 1) return null;
-    if (record.ok !== true) return null;
-    if (typeof record.tree !== "string") return null;
-    if (!Array.isArray(record.commands)) return null;
-    const head = headTreeSha(dir);
-    if (!head || record.tree !== head) return null;
-    for (const c of record.commands) {
-      if (!c || typeof c !== "object" || c.exit !== 0) return null;
-    }
-    const configured = resolveCommands(cfg);
-    if (record.commands.length !== configured.length) return null;
-    for (let i = 0; i < configured.length; i++) {
-      if (!record.commands[i] || record.commands[i].command !== configured[i].command) return null;
-    }
-    // card ratchet-pre-commit-credit: a command with a baseline in state.testTotals is credited only when the
-    // record carries readable totals for it (a list of valid summaries, or an old ok or conflict shape);
-    // otherwise null and the commands really run. `recorded` is the parseTotals-shaped result for the count check.
-    // dir is the verify dir (a worktree for a worktree agent); mainDir the main checkout, as countCheck's dir.
-    const baselineFor = countBaselineFor(mainDir ?? dir, state, dir);
-    const out = [];
-    for (let i = 0; i < configured.length; i++) {
-      const { name, command } = configured[i];
-      const recorded = readableRecordedTotals(record.commands[i].totals);
-      const base = baselineFor(command);
-      const hasBaseline = base ? readSummaries(base[command]) !== null : false;
-      if (hasBaseline && (!recorded || recorded.status === "none")) return null;
-      out.push({ name, command, ok: true, credited: "pre-commit", ...(recorded ? { recorded } : {}) });
-    }
-    return out;
-  } catch {
-    return null;
-  }
-}
-
 // card stop-gate-process-storm, case 2 (second tester pass, reviewer-found gap): a verified-unchanged skip
 // is a green gate in every way that matters, not a bare allow — it resets the same counters an ordinary
 // green gate resets, and on the main Stop it still surfaces the context-window notice, exactly like the
@@ -1735,7 +1687,6 @@ runHook("stop-gate", async (input) => {
         currentFingerprint &&
         (sameTree(rec.fingerprint, currentFingerprint) || (rec.scope === scopeNow && (redViaNoTestPaths = onlyNoTestPathsChanged(vdir, cfg, rec.fingerprint, vchanged)))) &&
         !(subagent && (redByDesignClaim(input.last_assistant_message) ?? redByDesignClaim(lastHandbackMessage(input.agent_transcript_path)))) &&
-        !preCommitCredit(vdir, cfg, vchanged, state, dir) &&
         !treeCredit(vdir, cfg, state, computeTree(vdir), dir)
       ) {
         lastRed = rec;
@@ -1779,6 +1730,7 @@ runHook("stop-gate", async (input) => {
         failures: Array.isArray(lastRed.failures) ? lastRed.failures : [],
         cwd: typeof lastRed.cwd === "string" ? lastRed.cwd : null,
         tree: typeof lastRed.tree === "string" ? lastRed.tree : null,
+        files: Array.isArray(lastRed.files) ? lastRed.files : [],
       };
       logBlock(reason, reuseClass, reuseRecord);
       traceMainBlock(reuseRecord);
@@ -1818,13 +1770,17 @@ runHook("stop-gate", async (input) => {
         lockOwned = false;
       } else {
         const lock = readGateLock(dir);
-        if (!lock || !pidIsLive(lock.pid) || lockStaleByAge(lock, hookTimeoutMs)) {
+        // Card gate-lock-takeover-exclusive: a stale-on-arrival lock is acquired exclusively; "busy" (a rival just
+        // took it) enters the wait branch below like a live holder, "unwritable" runs unlocked.
+        let arrivalWait = !(!lock || !pidIsLive(lock.pid) || lockStaleByAge(lock, hookTimeoutMs));
+        if (!arrivalWait) {
           // Stale (a dead pid, a lock file that fails to parse, or one older than the hook-timeout budget —
-          // card stop-gate-budget-under-hook-timeout: no legitimate holder can still be running that long):
-          // take it over at once, no wait.
-          takeOverGateLock(dir, input.session_id);
-          lockOwned = true;
-        } else {
+          // card stop-gate-budget-under-hook-timeout: no legitimate holder can still be running that long).
+          const got = acquireGateLock(dir, input.session_id, hookTimeoutMs);
+          if (got === "acquired") lockOwned = true;
+          else if (got === "busy") arrivalWait = true;
+        }
+        if (arrivalWait) {
           // The bound scales with the number of configured commands (reviewer-found gap): a holder legitimately
           // runs each of resolveCommands(cfg) with its own timeoutMs budget, one after another, so a flat
           // timeoutMs would give up on — and duplicate — a holder still legitimately partway through its own
@@ -1839,11 +1795,22 @@ runHook("stop-gate", async (input) => {
           // taking the lock over, since taking over and running past the platform's own timeout would just get
           // this gate killed mid-command too (an ungated stop, its block message discarded).
           let refusedLock = null;
+          let acquired = false;
           while (true) {
             const live = readGateLock(dir);
-            if (!live || !pidIsLive(live.pid) || lockStaleByAge(live, hookTimeoutMs)) break; // released, died, or stale by age
+            if (!live || !pidIsLive(live.pid) || lockStaleByAge(live, hookTimeoutMs)) {
+              // Released, died, or stale by age. Card gate-load-timeouts: take it exclusively, so two waiters
+              // leaving this loop together do not both run their suites (ledger blocks 425 and 426). A lost race
+              // goes back to waiting, still bounded by the two deadlines below.
+              const got = acquireGateLock(dir, input.session_id, hookTimeoutMs);
+              if (got !== "busy") {
+                acquired = got === "acquired";
+                lockOwned = acquired;
+                break;
+              }
+            }
             if (Date.now() >= budgetDeadline) {
-              refusedLock = live;
+              refusedLock = readGateLock(dir) || live || {};
               break;
             }
             if (Date.now() >= waitDeadline) break; // bounded: never hang the gate on someone else's lock
@@ -1891,8 +1858,10 @@ runHook("stop-gate", async (input) => {
             return verifiedUnchangedAllow(dir, cfg, state, input, subagent, deferralCapNote);
           }
           // Still different, or the wait hit its bound with the lock still held: take it over and run.
-          takeOverGateLock(dir, input.session_id);
-          lockOwned = true;
+          if (!acquired) {
+            takeOverGateLock(dir, input.session_id);
+            lockOwned = true;
+          }
         }
       }
     }
@@ -1971,20 +1940,21 @@ runHook("stop-gate", async (input) => {
         const r = failedRuns[i] || {};
         return { command: redactText(cf.command, cfg.secrets), exit: typeof r.status === "number" ? r.status : null, timedOut: !!r.timedOut, tail: outputTail(cf.output, cfg.secrets) };
       });
-      return { failures, cwd: vdir, tree: treeBefore ?? null };
+      // card memory-failures-wiring: the sorted, unique, repo-relative paths the failed commands' output names.
+      const files = [...new Set(commandFailures.flatMap((cf) => [...failingTestFilesFrom(cf.output, vdir), ...tscErrorPaths(cf.output, vdir)]))].sort();
+      return { failures, cwd: vdir, tree: treeBefore ?? null, files };
     } catch {
-      return { failures: [], cwd: vdir, tree: null }; // the line is written without the failures; the decision is unchanged
+      return { failures: [], cwd: vdir, tree: null, files: [] }; // the line is written without the failures; the decision is unchanged
     }
   };
   const failedRuns = []; // parallel to commandFailures: { status, timedOut } of each failed run (card block-ledger-failing-output)
-  const ranGreen = []; // count check input: { command, stdout } of each command that really ran and exited 0, plus { command, result } of each credited pre-commit command whose recorded totals are readable
-  // card stop-gate-credits-pre-commit: a passing pre-commit record for this exact tree and command set
-  // stands in for actually running them — see preCommitCredit above. Every other check below (evidence,
-  // red-by-design, state.verified, the block ledger) runs exactly as it would after a real run.
+  const ranGreen = []; // count check input: { command, stdout } of each command that really ran and exited 0, plus { command, result } of each credited verified-tree command whose recorded totals are readable
   // card verified-tree-record: treeBefore is the working tree immediately before the first command; a record of
-  // it (any writer: Stop, verify.mjs, land, pre-commit) is tried before preCommitCredit's last-run.json.
+  // it (any writer: Stop, verify.mjs, land, pre-commit) for this exact tree and command set stands in for
+  // actually running them. Every other check below (evidence, red-by-design, state.verified, the block ledger)
+  // runs exactly as it would after a real run.
   const treeBefore = skipVerification ? null : computeTree(vdir);
-  const credited = skipVerification ? null : (treeCredit(vdir, cfg, state, treeBefore, dir) ?? preCommitCredit(vdir, cfg, vchanged, state, dir));
+  const credited = skipVerification ? null : treeCredit(vdir, cfg, state, treeBefore, dir);
   // card gate-docs-skip-unless-named: a targeted run is never a full run (no record, no ratchet, no state.verified).
   const targeted = !credited && targetedFiles ? targetedFiles : null;
   if (!skipVerification && credited) {
@@ -2004,7 +1974,7 @@ runHook("stop-gate", async (input) => {
       if (remaining <= 0) {
         results.push({ name, command, ok: false, skipped: "budget" });
         problems.push(
-          `\`${command}\` not run: the stop gate's budget (hook timeout ${hookTimeoutSec} s) was used up before it could start.`,
+          `\`${redactText(command, cfg.secrets)}\` not run: the stop gate's budget (hook timeout ${hookTimeoutSec} s) was used up before it could start.`,
         );
         continue;
       }
@@ -2073,7 +2043,7 @@ runHook("stop-gate", async (input) => {
   let evidence = null;
   if (!skipVerification && cfg.stopGate.requireEvidence !== false && sessionMadeChanges) {
     evidence = verificationEvidence(state.commands || [], cfg);
-    if (evidence.ran.length === 0) problems.push(describeMissingEvidence(evidence.looked, results.every((r) => r.ok)));
+    if (evidence.ran.length === 0) problems.push(describeMissingEvidence(evidence.looked.map((c) => redactText(c, cfg.secrets)), results.every((r) => r.ok)));
   }
   const evidenceProblemAdded = problems.length > postCommandProblems;
 

package/node_modules/@dougharness/gates/scripts/verify.mjs

@@ -10,7 +10,7 @@ import { spawnSync } from "node:child_process";
 import { unlinkSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { loadConfig } from "../lib/config.mjs";
-import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
+import { gateLockPath, readGateLock, pidIsLive, writeGateLock, takeOverGateLock, acquireGateLock, resolveHookTimeoutSec, lockStaleByAge, normalizedTimeoutMs, lockWaitBoundMs } from "../lib/gate-lock.mjs";
 import { runCommand, tail } from "../lib/run.mjs";
 import { parseTotals, readSummaries, sumTotals } from "../lib/test-totals.mjs";
 import { computeTree, readRecord, writeRecord, removeRecord, creditable, exitCreditUsable, resolveCommands } from "../lib/verified-tree.mjs";
@@ -155,17 +155,33 @@ function main() {
       const hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
       const stale = (l) => !l || !pidIsLive(l.pid) || lockStaleByAge(l, hookTimeoutMs);
       const held = readGateLock(dir);
-      if (stale(held)) {
-        takeOverGateLock(dir, o.by || "verify");
-        lockOwned = true;
-      } else {
+      // Card gate-lock-takeover-exclusive: a lock read as stale on arrival is acquired exclusively; "busy" (a rival
+      // just took it) is waited on like a live holder, never overwritten; "unwritable" runs unlocked.
+      let needWait = !stale(held);
+      if (!needWait) {
+        const got = acquireGateLock(dir, o.by || "verify", hookTimeoutMs);
+        if (got === "acquired") lockOwned = true;
+        else if (got === "busy") needWait = true;
+      }
+      if (needWait) {
         const waitStart = Date.now();
         const deadline = waitStart + waitBoundMs;
         let live = held;
+        let acquired = false;
         const nap = new Int32Array(new SharedArrayBuffer(4));
         while (true) {
           live = readGateLock(dir);
-          if (stale(live) || Date.now() >= deadline) break;
+          if (stale(live)) {
+            // Card gate-load-timeouts: take a released or stale lock exclusively (two waiters must not both run);
+            // a lost race goes back to waiting, bounded by the deadline.
+            const got = acquireGateLock(dir, o.by || "verify", hookTimeoutMs);
+            if (got !== "busy") {
+              acquired = got === "acquired";
+              lockOwned = acquired;
+              break;
+            }
+          }
+          if (Date.now() >= deadline) break;
           Atomics.wait(nap, 0, 0, 200);
         }
         lockWaitMs = Date.now() - waitStart;
@@ -173,9 +189,11 @@ function main() {
         treeBefore = computeTree(cwd);
         const again = tryCredit();
         if (again !== null) return again;
-        if (!stale(live)) process.stderr.write(`[doug] verify: gate.lock still held by pid ${live.pid} after ${waitBoundMs} ms; running the commands anyway.\n`);
-        takeOverGateLock(dir, o.by || "verify");
-        lockOwned = true;
+        if (!acquired) {
+          if (!stale(live)) process.stderr.write(`[doug] verify: gate.lock still held by pid ${live.pid} after ${waitBoundMs} ms; running the commands anyway.\n`);
+          takeOverGateLock(dir, o.by || "verify");
+          lockOwned = true;
+        }
       }
     }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/cli",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "doug: tailored, approval-gated harness install for Claude Code.",
   "type": "module",
   "license": "MIT",
@@ -23,8 +23,8 @@
     "node": ">=22.16"
   },
   "dependencies": {
-    "@dougharness/flow": "1.5.0",
-    "@dougharness/gates": "1.5.0"
+    "@dougharness/flow": "1.6.0",
+    "@dougharness/gates": "1.6.0"
   },
   "bundleDependencies": [
     "@dougharness/flow",