@feigi/fleet-ctl 3.100.3 → 3.101.0

package/commands/review-and-fix.md

@@ -12,6 +12,7 @@ argument-hint: [pr-number]
    See **Specialists** — those constraints are not optional.
 2. Plan the actions. Split explicitly into **apply now** / **defer**. A finding is deferred, never dropped. **Every `suggestion` — the review's `severity`, the plugin's *Suggestions* bucket — arrives unchecked: the review budgets that band 0 refuters, so nothing has looked at it yet.** Checking it is now your job, not nobody's. So split it by SCOPE first, and check it in either scope. Out of the PR's ticket scope → defer and file, but **the claim bar runs first:** a suggestion whose claim is about shape — step 5's worth-a-claim bar, recorded `claimKind: shape` — gets no refuter and goes to the `PR #<pr> review: the suggestion band, checked` record, and every other out-of-scope suggestion gets the same refuter an in-scope one does, dispatched the same way, before it is filed. In scope → dispatch one refuter against it, biased to refuse, and hand it this instruction verbatim with one substitution: resolve `<scratch>/pr<N>/<finding>/` in it to an absolute path under your own run root — `mktemp -d` once per round for `<scratch>/pr<N>/fix-XXXXXXXX/`, never bare `pr<N>`, since finding ids restart at 1 each round too — and write that absolute path into the refuter's prompt in its place; a refuter never derives its own path, and tell it your step-3 `testCmd`, which its rules call `<testCmd>`: *Try to REFUTE this finding. Default to refuted=true if uncertain. Verify by RUNNING something — compile it, run the test, apply the mutation. Do not reason your way to agreement. Observe that run synchronously — run the command, wait for it, read its exit code. Never poll a log file for a completion marker: prefer ONE blocking run to a poll loop, and treat its return as permission to look, never as the answer. Reading a log the run has already finished writing is fine; waiting on one is not. If you match a test reporter's own output, accepting both `ℹ` and `#` is necessary but NOT sufficient — strip SGR escapes first as well. node's prefix moves with the node version and with whether stdout is a TTY, and color wraps the whole line so it begins with ESC and no prefix anchor matches at all, which returns empty at exit 0 — indistinguishable from a hung run and from a run of zero tests. For an uncolored baseline use `env -u FORCE_COLOR`; `FORCE_COLOR=` empty still enables color, so it is not a control. State your search scope AND what your pattern would have missed. A grep over one ref does not support a claim about history; a pattern built from the token a diff removed does not support a claim that the category is empty. When your check scores a mutant killed or a test red, run only in your own copy of the tree, and these rules decide it and nothing else: Valid red: a run that completed — the command returned on its own, with no signal and no timeout, deadline or kill having fired — in which the test the claim names is reported failing. An exit ≠ 0 with no failing test is not red, and a different test failing is not red for this claim. A red in the full suite only triggers a narrowed run; it is never evidence on its own. Narrowed run: the Test entrypoint with arguments appended, `<testCmd> <args>`. That appended arguments reach the Test entrypoint is all that is promised about them, so a narrowed run counts only if it reports `tests` > 0 and its output names the claimed test. If no narrowing can be proven, run the full `<testCmd>` and read the named test's own result from its output. Kill: the mutant produced a valid red in a narrowed run, and the same narrowed command, in the same tree with the mutant reverted, ran a valid green with the named test passing — completed, exit 0, `tests` > 0, `cancelled` 0. A completed exit ≠ 0 with the named test not failing is not a kill, and no kill stands without that green run on the unmutated tree. The result is inconclusive, never a kill, when the red does not reproduce in the narrowed run, when the unmutated tree is red too, or when no usable run exists. Evidence line: every kill and every valid red you claim carries one line in the claim's own free-text field: `red: <cmd> → exit N, fail K incl <test>; baseline: <cmd> → exit 0, <test> pass`. A failing-test finding filed off the review's shared run carries the `red:` half alone. This refuter has no abstain: a run that could not decide — neither a valid red nor a valid green — is no kill and no refutation, so name the runs in `reason`, each with its evidence line, and leave `refuted` true, so the suggestion defers on the record instead of applying on a check that decided nothing. A failure injection with no positive control has produced NO result, never a negative one. Before you read an injected fault — an env var, an argv word, a mutant — as having had no effect, prove the injection reached the child: one run whose output differs with it present versus absent, or the child echoing the injected value back. Uncontrolled, the cell is unrun — say so in your verdict instead of reporting a no-effect result. Build such an invocation as an array expanded braced and quoted — `cfg=(SETB=1 BADJ=1); env "${cfg[@]}" sh ./probe.sh` — or inline the assignments literally — `env SETB=1 BADJ=1 sh ./probe.sh`; NEVER from an unquoted scalar — `cfg="SETB=1 BADJ=1"; env $cfg sh ./probe.sh` — which under zsh passes ONE argument, sets a variable literally named `SETB` to `1 BADJ=1`, never sets `BADJ` at all, and still exits 0. `env $cfg[@]` is not the portable spelling either: measured, bash word-splits it into `SETB=1` and `BADJ=1[@]`, so the injection variable is set to a corrupted value, while zsh behaves exactly as with the bare `$cfg` — `BADJ` never set, exit 0. Everything you write — mutants, fixtures, scratch repos — goes under `<scratch>/pr<N>/<finding>/` and nowhere else; the checkout and any worktree are never write targets, though `git show`/`git archive` at a pinned ref read fine anywhere. Chain the directory change into the command, `cd "$D" && git …`, never `cd "$D"; git …`, so a failed `cd` cannot leave a `git` command running in the checkout — and bracket a fixture's own git with `git rev-parse --show-toplevel`: before `git init` it must NOT resolve to the host repository, and `fatal: not a git repository` (exit 128) is the usual pass, not a failure — an outer repository whose ignore rules cover your scratch dir is a pass too; before any `git commit` it must resolve to your scratch path, which catches a forgotten `git init` under any enclosing repository — compare resolved forms (`realpath`), since `--show-toplevel` can report a symlinked parent such as `/tmp` or a symlinked `$HOME` under its resolved name.* That last clause is the whole mechanism — a refuter left to reason its way to agreement rubber-stamps, and "apply only what survives" silently degrades into "apply everything in scope". Apply only what survives; a refuted one defers with the refutation in its body. **Out of scope the refuter decides only where the suggestion is filed — it defers either way, never applied.** Refuted → the `PR #<pr> review: the suggestion band, checked` record, never an open issue. Survived, or its refuter crashed or abstained → its own open issue labelled `needs-triage`, citing the verdict, or the run that crashed, in the body. There is no cap on these refuters; your final verdict (step 4) says how many you dispatched against out-of-scope suggestions. "In scope" means the ticket's scope, not merely the same files — and applying one still never licenses editing a file the ticket has no business in. **A finding in `unverified` whose refuters ran and crashed or abstained always defers, whatever its severity** — and which it is, you read off the finding's **`refutersDispatched`** and **`refutersInconclusive`**, never off severity and never off an empty vote list: `refutersDispatched` above zero with nothing decided means every refuter dispatched against it died or abstained, and `refutersInconclusive` counts the ones that abstained. Only a `survived` finding has been checked; severity says how much a finding would matter if true, never whether anything looked. **Deferring a crash is your move, and re-running it is not** — the review already re-dispatched every crashed refuter pair once, in-run, so a crash that reaches you crashed twice, and the result's `resume` field names the one move left, which is not yours: nothing replays a review that ran in a runner's kernel — it is reported, not acted on. So say *in the deferral* that its refuters crashed rather than that it went unchecked, and re-run nothing for it. **An abstention is not a crash** — a refuter that abstained ran and could not decide: defer and file the finding, citing the inconclusive runs each abstaining refuter named in its `reason`, and never describe its refuters as crashed. **A `suggestion` is also in `unverified`, for a different reason — `refutersDispatched` of zero, the 0-refuter budget the workflow gives that band by policy, so nothing looked *there* — and the scope split above, not this rule, covers it.**
    **Write every ruling to `<scratch>/dispositions-<your name>.json`, `<your name>` the `fix-pr-<pr>[-x]` you were dispatched as (standalone, `fix-pr-<pr>`) — the disposition record `dispositions-check.mjs` judges against the review result file before any finisher is dispatched.** It is `{"head": "<the review file's head>", "run": "<the run root's name in the review path>", "entries": [ … ]}` — `run` the `<run>` of the review path your prompt names, which the check holds against the one the PR's latest `reviewed=` names, so a record written against an earlier review of the same PR, a same-head one included, is a mismatch (standalone, with no ledger naming a run, leave it out): one entry per `survived` finding and per `unverified` finding, plus one per `refuted` finding you reverse. Each entry carries `bucket` (`survived|unverified|refuted`), `index` (its position in that bucket of the review file — stable, since a round's file never changes), `scope` (`in|out`), `claimKind` (`behavior|shape`) and `disposition` (`apply|defer`), and where they apply `reason`, `issue` (the number you filed it to or commented on), `verdictPath` (a suggestion's refuter verdict file, in scope and, above the claim bar, out of scope) and `remedyFiles` (the files its remedy names). A `refuted` entry carries `scope`, `claimKind` and `disposition` like every other entry, and a non-empty `reason` holding the evidence that reverses it; a missing or blank `reason` is a mismatch. The check reads scope off the diff before it reads your entry: a finding with no `line`, or on a line `git diff` touches from the PR's merge-base with `origin/main` to the review's `head`, is in scope whatever `scope` says, and only otherwise does the declared one stand. An in-scope `survived` finding deferred passes only with `reason` `false-rationale`, `mutual-exclusion`, `remedy-worse` or `remedy-outside-diff`. `remedy-outside-diff` — the remedy would edit a file the PR's diff does not touch — also needs `remedyFiles` to name at least one file absent from `git diff` from that merge-base to the review's `head`: none named, or every one in that diff, is a mismatch. A `critical` or `important` finding deferred for it goes to a human instead of passing: the script exits 1 with verdict `escalate`, `ledger.mjs dispatch` refuses the PR's finisher, and nothing retries it; a `suggestion` deferred for it passes. Any other reason, none, or a `survived` or `unverified` finding with no entry is a mismatch: the script exits 1 naming each violating entry's bucket, index and rule, and `ledger.mjs dispatch` refuses the PR's finisher. `disposition` has no `dismiss`: an in-scope `survived` finding verified correct, needing no change, is deferred with `reason` `false-rationale` and filed on the suggestion-band record — step 5's `PR #<pr> review: the suggestion band, checked`.
+   **Give every entry whose finding stands a Charge:** `charge` — `false-claim`, `unmet`, `both` or `none` — and, with `none` only, a `chargeReason`: `defect-outside-acceptance` (a defect outside the ticket's acceptance criteria, which no text the implementer wrote claims is otherwise), `not-the-implementers-text` (the false text predates the PR, or comes from the ticket) or `claim-about-untouched-code` (a claim about code the change does not touch). A `survived` finding not deferred `false-rationale` stands, and so does every `refuted` one you reverse; an `unverified` one never does. Charge the work as submitted — a finding you apply is charged as if it were still there — by the definitions of `closed_own_ticket` and `minted_false_claim` in the header of `docs/metrics/tier-outcomes.tsv`, against the ticket as its implementer was dispatched with it; an entry scoped `out` is charged `none`. The check requires a Charge on every standing entry of the record answering the PR's first review — the first that counted no survived and no unverified finding, or else the first a fix-applier answered — and a record answering a later review, or one checked with no ledger, needs none. Wherever a `charge` or `chargeReason` appears it is judged: an unknown value, `none` with no `chargeReason`, a `chargeReason` with any other `charge` or with none, and an out-of-scope entry charged anything but `none` are each a mismatch.
 3. **Run `checkCmd` and `testCmd` before you commit**, from the worktree, each copied verbatim — not a runner you picked. `checkCmd` is the Recipe's Check step and `testCmd` is the command your dispatcher handed you; **standalone, with no dispatcher to hand you them, they are the repo's own Check step and Test entrypoint**, read off the repo's Recipe cache (`derive-testcmd.sh <repo> check` prints the first, `derive-testcmd.sh <repo> test` the second). Read them off the repo, never invent one: "not a runner you picked" is what this step forbids, and on the standalone path nothing else defines the referent. With no usable Recipe cache (`derive-testcmd.sh` refuses), run the Recipe derivation step first — dispatch a `task` member, agent `fleet-recipe-deriver`, its prompt naming the main checkout's absolute path as `<repo>` and a scratch directory of its own; it proves all three commands in a throwaway worktree and writes the cache only on proof, and its `RECIPE NOT PROVEN` is a stop, reported with its reason. Never fall back to a runner of your own choosing. `tests 0` is a FAILED run, not a pass: a glob matching nothing still exits 0. **Zero is not the only no-work count.** A run reporting **0 passes with no failures** skipped everything it collected, and a count **materially below the whole suite** means you ran a partial tree — this suite reported `tests 937` when this line was written, so compare what you get against a full run rather than against zero. The number drifts; that is the safe direction, because a stale one produces a loud false red while its absence produces a silent false green. Red, zero-test, or either no-work count → fix it or move the finding to defer; never commit over it. Then commit and push — `~/.fleet/bin/fleet-run push-sync.mjs --branch <branch>`, which pushes the explicit refspec `HEAD:refs/heads/<branch>` and then moves the worktree holding `<branch>` to the pushed SHA, or names why it did not and exits 3 with the push landed: this step also runs from a `--detach` worktree (`run-team/SKILL.md`'s worktree-recreation form), where a bare `git push` exits 128 (`fatal: You are not currently on a branch`), any push whose destination is `HEAD` rather than a full or branch refname (`-u` or not, forced or not) exits 1 (`error: The destination you provided is not a full refname`), and a refspec push alone leaves the claim worktree's `refs/heads/<branch>` at its old tip — and report the test result alongside the SHA. **Then reconcile the PR body with what you actually did.** It merges into the permanent record and nothing downstream re-derives it: your commit messages are yours to fix and usually get fixed, the body is neither. Removing a change, or reversing one, leaves the body asserting work the diff no longer contains. Measured twice in one run — one body kept asserting a calibration its own fix had just deleted as false, another kept claiming a hunk the fix had removed as "this diff owns it" — both caught by a finisher's reading rather than by any rule, and both would otherwise have merged intact. `gh pr edit <pr> --body-file <path>`, and re-read the body against the final diff rather than against your memory of it. **Never `--no-verify` on a commit you push, or on the push itself.** The fleet runs in repos it knows nothing about: it must not assume a pre-commit hook exists, and must never bypass one that does on what reaches the branch — a hook that fails is a finding to report, not an obstacle. Nothing re-reviews what you commit here, so this run is the only gate between your edit and a merge.
    **Under the fleet, run the two through `recipe-check.mjs`, not one by one:** from the worktree, after `git add` and before the commit, `~/.fleet/bin/fleet-run recipe-check.mjs --member <your name> --testCmd "<testCmd>" --reports <scratch>/reports` — `<your name>` the `fix-pr-<pr>[-x]` you were dispatched as, and `<testCmd>` the whole command you were handed, one quoted argument. It runs the Recipe's Check step, which is `checkCmd`, then `<testCmd>` exactly as handed, against the staged tree, and records both results beside your report. The record is keyed to the tree, so run it again after any content change or rebase — a message-only amend keeps it valid — and the controller refuses an `applied` report whose head's tree has no green record. After the commit, and before you push or report, compare `git rev-parse 'HEAD^{tree}'` with the `tree` field of your record, `<scratch>/reports/<your name>.check.json`. A commit hook that rewrote and re-staged files after the record was written makes the two differ. When they do, list the paths it changed, `git diff --name-only "$(jq -r .tree <scratch>/reports/<your name>.check.json)" HEAD`. If the PR changes every listed path anyway, run `recipe-check.mjs` again with the same arguments: right after the commit the index holds the committed tree, so the re-run runs both commands on that tree and records it, leaving the head's sha as it is. A listed path the PR does not otherwise change is a stale base the hook staged rather than left unstaged, and a re-run would record it green: `git fetch origin && git rebase origin/main`, take the commit back with `git reset --soft HEAD^`, put each such path alone back with `git restore --source=HEAD --staged --worktree -- <that path>`, run `recipe-check.mjs`, then `git commit -C ORIG_HEAD` and compare again. A hook that stages such a path again on the rebased base → push nothing and report that cause. Equal trees need no re-run. A non-zero exit is red, save two that are no test result: exit 75 — no slot was free and nothing ran — so run it again, and exit 143, 130 or 129 — a SIGTERM, SIGINT or SIGHUP stopped it and nothing was recorded — so run it again with `timeout: 0` on the call. **Standalone, with no report to settle against,** run `checkCmd` and `testCmd` yourself, each copied verbatim.
 4. **Under the fleet, do not hold this wait.** The controller owns a persistent CI Monitor and dispatches a finisher once your report has arrived and CI is green — so push, then report to the controller a **final verdict** (every specialist you dispatched + its outcome + your apply/defer adjudication + how many refuters you dispatched against out-of-scope suggestions + the pushed SHA) and stop. A specialist that has not reported to you is not a verdict line — `hub send` it by name for its report, then ask the controller, before ruling; see **Specialists**. The controller keys "review complete" on that verdict, **never on you merely going idle** — a slow specialist can still be running when your turn ends, and finishing off idle-alone ships a premature label (observed: a PR labelled while its contract-test specialist was still running and about to surface a vacuous pin). A turn-based reviewer re-reading `gh pr checks` each idle cycle rebuilds its whole context for nothing the Monitor lacks. **Standalone (no controller): watch** the run until the diff-validating jobs are green (bind via `ci-state.mjs` below); fix a **genuine** failure and repeat from 3. **Staleness is not a failure:** a `rebase-check` red or heavy jobs `skipped` **solely from a non-zero behind-count** never clears by waiting and must not be rebased away here — see **`skipped` is not `passed`** and **Do NOT rebase to label** below for what it looks like and why. Stop watching and go to 6. A turn-based reviewer that "waits for green" on a behind PR stalls forever and ends its turn without labelling. **`ci-state.mjs` returns `verdict: "no-ci"`** → there is no run to watch, so don't: go straight to 6 and let that step's `--declare-no-ci` branch decide.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.100.3",
+  "version": "3.101.0",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/dispatch-prompt.mjs

@@ -22,7 +22,8 @@
 // EXIT. 0 rendered. 2 refused, with the reason on stderr and nothing on
 // stdout: a missing, unknown or relative argument, a template that carries a
 // placeholder it never declared or no text at all for the kind, a leftover
-// declared placeholder in the output, or instruments.sh answering anything
+// declared placeholder in the output, a ticket the ledger names whose saved
+// issue file is missing or unreadable, or instruments.sh answering anything
 // but 0.
 //
 // INSTRUMENTS. After the command line has parsed and before anything is
@@ -40,12 +41,15 @@
 //     arg <flag> <placeholder>   the argument `--<flag>` fills `<placeholder>`
 //     path <flag>                that argument must be an absolute path
 //     literal <text>             `<text>` is carried to the member as written
+//     ticket <placeholder>       the renderer fills `<placeholder>` with the
+//                                ticket of the PR `--pr` names (THE TICKET)
 //   A placeholder is `<` + a letter + anything but `<`, `>` and a newline +
 //   `>`, matched by its inner text exactly; it may hold spaces. No flag and
 //   no placeholder is declared twice, and --member, --json and --kind are
 //   reserved.
-// - Every placeholder the selected text carries must be declared by `arg` or
-//   `literal`; an undeclared one is a template defect and refuses, naming it.
+// - Every placeholder the selected text carries must be declared by `arg`,
+//   `literal` or `ticket`; an undeclared one is a template defect and
+//   refuses, naming it.
 // - An argument is required exactly when its placeholder occurs in the text
 //   selected for the kind. A flag the selected text never uses is refused.
 // - The body is plain text. Lines `## kind: <k>[, <k>…]` open a section that
@@ -59,6 +63,20 @@
 //   only a caller passing a value like `<branch>` can cause — refuses, naming
 //   it.
 //
+// THE TICKET. A `ticket` placeholder in the selected text is filled with the
+// ticket the PR's implementer was dispatched with, which the renderer finds
+// itself: the ledger's settled `impl-<N>=PR#<pr>` token names ticket N, `<pr>`
+// the `--pr` value, and the Pull's `<scratch>/impl-<N>/issue.json` holds it,
+// `<scratch>` the `--scratch` value — so a template declaring `ticket`
+// declares `--pr` and `--scratch` too, and a kind carrying the placeholder
+// carries theirs. It is composed by ticket-text.mjs's ticketText(), as the
+// implementer's was, and defanged as the implementer's was, by the
+// implementer template's argument placeholders and this template's own. Two
+// tickets naming one PR are each rendered, in row order. An issue file that
+// is missing or unreadable refuses, naming its path; nothing asks the tracker
+// in its place. No ledger, or no settled token naming the PR, fills it with a
+// line saying no ticket is on hand.
+//
 // The text every member of a role shares lives in that role's agent body; a
 // template carries only what varies between dispatches of the role.
 
@@ -70,7 +88,9 @@ import { fileURLToPath } from "node:url";
 import { makeDie, defineFlags, writeAll } from "./arg.mjs";
 import { FleetDirUnresolvable, fleetFile } from "./fleet-dir.mjs";
 import { gitEnv } from "./git-env.mjs";
+import { ROWS, ledgerSection, memberTokens } from "./ledger-grammar.mjs";
 import { runnerScratchRefusal } from "./review-core.mjs";
+import { defang, ticketText } from "./ticket-text.mjs";
 
 const NAME = "dispatch-prompt";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
@@ -96,13 +116,17 @@ function parseTemplate(role, text) {
   const args = [];
   const paths = new Set();
   const literals = new Set();
+  let ticket = null;
   for (const line of lines.slice(1, close)) {
-    const m = /^(arg|path|literal) (.+)$/.exec(line);
+    const m = /^(arg|path|literal|ticket) (.+)$/.exec(line);
     if (m === null) refuse(`has a frontmatter line that is no directive: ${line}`);
     if (m[1] === "literal") {
       literals.add(m[2]);
     } else if (m[1] === "path") {
       paths.add(m[2]);
+    } else if (m[1] === "ticket") {
+      if (ticket !== null) refuse(`declares a ticket placeholder twice: <${ticket}> and <${m[2]}>`);
+      ticket = m[2];
     } else {
       const split = /^(\S+) (.+)$/.exec(m[2]);
       if (split === null) refuse(`has an arg line without a placeholder: ${line}`);
@@ -114,6 +138,9 @@ function parseTemplate(role, text) {
   }
   for (const flag of paths) if (!args.some((a) => a.flag === flag)) refuse(`marks --${flag} as a path but never declares it`);
   for (const a of args) if (literals.has(a.placeholder)) refuse(`declares <${a.placeholder}> as both an argument and a literal`);
+  if (ticket !== null && (literals.has(ticket) || args.some((a) => a.placeholder === ticket))) {
+    refuse(`declares <${ticket}> as the ticket and as an argument or a literal`);
+  }
 
   const sections = [];
   let current = { kinds: null, lines: [] };
@@ -130,8 +157,9 @@ function parseTemplate(role, text) {
   const kinds = [...new Set(sections.flatMap((s) => s.kinds ?? []))];
 
   const whole = sections.flatMap((s) => s.lines).join("\n");
-  for (const a of args) if (!whole.includes(`<${a.placeholder}>`)) refuse(`declares <${a.placeholder}> but never carries it`);
-  return { args, paths, literals, sections, kinds };
+  for (const p of [...args.map((a) => a.placeholder), ...(ticket === null ? [] : [ticket])]) if (!whole.includes(`<${p}>`)) refuse(`declares <${p}> but never carries it`);
+  if (ticket !== null) for (const flag of TICKET_FLAGS) if (!args.some((a) => a.flag === flag)) refuse(`declares the ticket <${ticket}> but no --${flag} to find it by`);
+  return { args, paths, literals, ticket, sections, kinds };
 }
 
 function loadTemplate(role) {
@@ -144,6 +172,52 @@ function loadTemplate(role) {
   return parseTemplate(role, text);
 }
 
+// --- the ticket --------------------------------------------------------------
+
+// The arguments THE TICKET is found by: the PR, and the scratch root the Pull
+// saved the ticket under.
+const TICKET_FLAGS = ["pr", "scratch"];
+
+// The text a `ticket` placeholder is filled with, for PR `pr` under scratch
+// root `scratch` (THE TICKET above): each ticket a settled `impl-<N>=PR#<pr>`
+// token on the ledger's rows names, once, in row order, composed by
+// ticketText() and defanged by `names`.
+function ticketFor(pr, scratch, names) {
+  let ledger;
+  try {
+    ledger = fleetFile("ledger.md");
+  } catch (err) {
+    if (err instanceof FleetDirUnresolvable) die(`cannot find the ledger naming PR #${pr}'s ticket: ${err.message}`);
+    throw err;
+  }
+  let text = "";
+  try {
+    text = readFileSync(ledger, "utf8");
+  } catch (err) {
+    if (err.code !== "ENOENT") die(`cannot read the ledger ${ledger} for PR #${pr}'s ticket: ${err.message}`);
+  }
+  const tickets = [];
+  for (const row of ledgerSection(text, ROWS)) {
+    for (const t of memberTokens(row)) {
+      if (t.family === "impl" && t.error === null && t.outcome === `PR#${pr}` && !tickets.includes(t.number)) tickets.push(t.number);
+    }
+  }
+  if (tickets.length === 0) return `No settled impl-<N>=PR#${pr} token is on this run's ledger, so no ticket is on hand for PR #${pr}.`;
+  return tickets.map((n) => {
+    const path = join(scratch, `impl-${n}`, "issue.json");
+    let issue;
+    try {
+      issue = JSON.parse(readFileSync(path, "utf8"));
+    } catch (err) {
+      return die(`cannot read ticket #${n}, the ticket PR #${pr}'s implementer was dispatched with, from ${path}: ${err.message}`);
+    }
+    if (typeof issue?.title !== "string") {
+      return die(`cannot read ticket #${n}, the ticket PR #${pr}'s implementer was dispatched with, from ${path}: it holds no issue with a title`);
+    }
+    return defang(ticketText(issue), names);
+  }).join("\n\n");
+}
+
 // --- the instrument check ---------------------------------------------------
 
 function runInstruments() {
@@ -199,7 +273,7 @@ const selected = template.sections.filter((s) => s.kinds === null || s.kinds.inc
 const body = selected.join("\n");
 if (body.trim() === "") die(`template ${role}.md carries no text for ${kind === null ? "the role" : `kind ${kind}`}`);
 
-const declared = new Set(template.args.map((a) => a.placeholder));
+const declared = new Set([...template.args.map((a) => a.placeholder), ...(template.ticket === null ? [] : [template.ticket])]);
 for (const [, inner] of body.matchAll(PLACEHOLDER)) {
   if (!declared.has(inner) && !template.literals.has(inner)) die(`template ${role}.md carries the undeclared placeholder <${inner}>`);
 }
@@ -223,9 +297,23 @@ for (const a of required) {
   values.set(a.placeholder, value);
 }
 
+// THE TICKET, once every argument has passed: only for a kind whose text
+// carries the placeholder, found by that kind's own --pr and --scratch.
+const carriesTicket = template.ticket !== null && body.includes(`<${template.ticket}>`);
+if (carriesTicket) {
+  const by = TICKET_FLAGS.map((flag) => required.find((a) => a.flag === flag));
+  if (by.includes(undefined)) {
+    die(`template ${role}.md carries the ticket <${template.ticket}> in kind ${kind} without ${TICKET_FLAGS.map((f) => `--${f}`).join(" and ")} to find it by`);
+  }
+  const [pr, scratch] = by.map((a) => values.get(a.placeholder));
+  const names = [...loadTemplate("implementer").args, ...template.args].map((a) => a.placeholder).concat(template.ticket);
+  values.set(template.ticket, ticketFor(pr, scratch, names));
+}
+
 const brief = `${body.replace(PLACEHOLDER, (whole, inner) => (values.has(inner) ? values.get(inner) : whole))}\n`;
-for (const a of required) {
-  if (brief.includes(`<${a.placeholder}>`)) die(`the rendered brief still carries <${a.placeholder}> — an argument value spells it`);
+const filled = [...required.map((a) => a.placeholder), ...(carriesTicket ? [template.ticket] : [])];
+for (const p of filled) {
+  if (brief.includes(`<${p}>`)) die(`the rendered brief still carries <${p}> — an argument value spells it`);
 }
 
 const payload = {

package/scripts/dispositions-check.mjs

@@ -35,7 +35,12 @@
 //                    "reason": "<string>",          required, non-empty, on a `refuted` entry; else optional
 //                    "issue": <number>,             optional: filed or commented to
 //                    "verdictPath": "<path>",       optional: a suggestion's refuter verdict
-//                    "remedyFiles": ["<path>", …]   optional: files the remedy names
+//                    "remedyFiles": ["<path>", …],  optional: files the remedy names
+//                    "charge": "false-claim" | "unmet" | "both" | "none",
+//                                                   the Charge, on an entry whose finding stands
+//                    "chargeReason": "defect-outside-acceptance" | "not-the-implementers-text"
+//                                  | "claim-about-untouched-code"
+//                                                   required with charge none, and only with it
 //                  }, … ] }
 //
 // One entry per `survived` finding and per `unverified` finding, plus one per
@@ -63,6 +68,18 @@
 //     here. A finding whose `file` and `line` sit on a touched line is in
 //     scope whatever the entry declares, and a finding with no `line` (or no
 //     `file`) is in scope. Otherwise the declared `scope` stands.
+//   - Charge: a finding stands when it is `survived` and not deferred with
+//     `reason` `false-rationale`, or `refuted` — an entry there is a reversal.
+//     An `unverified` finding never stands. On the record answering the PR's
+//     first review — firstReview() in ledger-grammar.mjs, this record's run
+//     counted as answered — every entry whose finding stands carries a
+//     `charge`; a record answering a later review, or one checked with no
+//     ledger, needs none. A `charge` or `chargeReason` an entry carries is
+//     judged wherever it appears: a value outside the ones above, a `charge`
+//     of `none` with no `chargeReason`, a `chargeReason` with any other
+//     `charge` or with no `charge`, and an entry declared `out` that the
+//     presumption above leaves out of scope charged anything but `none` are
+//     each a mismatch.
 //   - An in-scope `survived` finding deferred passes only with `reason` one
 //     of ALLOWED_DEFER. Any other reason, or none, is a mismatch.
 //     `disposition` has no `dismiss`: an in-scope `survived` finding verified
@@ -165,8 +182,8 @@ import { makeDie, defineFlags } from "./arg.mjs";
 import { isCLI } from "./is-cli.mjs";
 import { gitEnv } from "./git-env.mjs";
 import { fleetFile, FleetDirUnresolvable } from "./fleet-dir.mjs";
-import { parseMember, memberTokens, rowNums } from "./ledger-grammar.mjs";
-import { deriveRun, dispositionsToken, LedgerError } from "./fleet-tick.mjs";
+import { parseMember, memberTokens, rowNums, dispositionsToken, firstReview, prTokens } from "./ledger-grammar.mjs";
+import { deriveRun, LedgerError } from "./fleet-tick.mjs";
 import { VERDICT_SCHEMA } from "./review-core.mjs";
 
 const NAME = "dispositions-check";
@@ -187,6 +204,11 @@ const COVERED = ["survived", "unverified"];
 const BUCKETS = [...COVERED, "refuted"];
 const ENUMS = { scope: ["in", "out"], claimKind: ["behavior", "shape"], disposition: ["apply", "defer"] };
 
+// A Charge: what a finding that stands on a PR's first review says about the
+// work as submitted. `none` names one of CHARGE_REASONS; no other Charge does.
+export const CHARGES = Object.freeze(["false-claim", "unmet", "both", "none"]);
+export const CHARGE_REASONS = Object.freeze(["defect-outside-acceptance", "not-the-implementers-text", "claim-about-untouched-code"]);
+
 // The filing table: a deferral's home by its finding's state. `record` is the
 // suggestion-band record; `open` the weakest triage label an open home may carry.
 export const FILING_ROWS = Object.freeze({
@@ -393,9 +415,39 @@ function shapeErrors(e) {
   if (e.remedyFiles !== undefined && !(Array.isArray(e.remedyFiles) && e.remedyFiles.every((f) => typeof f === "string"))) {
     errors.push("remedyFiles is not an array of paths");
   }
+  if (e.charge !== undefined && !CHARGES.includes(e.charge)) errors.push(`charge ${JSON.stringify(e.charge)} is not one of ${CHARGES.join("|")}`);
+  if (e.chargeReason !== undefined && !CHARGE_REASONS.includes(e.chargeReason)) {
+    errors.push(`chargeReason ${JSON.stringify(e.chargeReason)} is not one of ${CHARGE_REASONS.join("|")}`);
+  }
   return errors;
 }
 
+// Whether an entry's finding stands: a survived finding not deferred
+// false-rationale, or a refuted one — an entry in that bucket exists only for
+// a refutation the fix-applier reversed. An unverified finding never stands.
+const stands = (bucket, e) => bucket === "refuted"
+  || (bucket === "survived" && !(e.disposition === "defer" && e.reason === "false-rationale"));
+
+// Why an entry's Charge breaks a rule, or null when it holds. `required`: the
+// record answers the PR's first review and the entry's finding stands, so the
+// entry carries a Charge. Anywhere else a Charge is optional, and judged only
+// when present.
+function chargeProblem(e, { inScope, required }) {
+  if (e.charge === undefined) {
+    if (e.chargeReason !== undefined) return "chargeReason gives the reason for a Charge of none, and this entry carries no charge";
+    if (required) {
+      return `a finding that stands on the PR's first review carries a Charge, and this entry carries none — charge it ${CHARGES.filter((c) => c !== "none").join(", ")}, or none with a chargeReason`;
+    }
+    return null;
+  }
+  if (e.charge === "none") {
+    return e.chargeReason === undefined ? `a Charge of none names its chargeReason, one of ${CHARGE_REASONS.join(", ")}, and this one names none` : null;
+  }
+  if (e.chargeReason !== undefined) return `chargeReason gives the reason for a Charge of none, and this entry is charged ${e.charge}`;
+  if (!inScope) return `an out-of-scope finding counts for nothing, so it is charged none, and this one is charged ${e.charge}`;
+  return null;
+}
+
 /**
  * Every rule the record breaks against the review, as `violations` of
  * `{bucket, index, rule}` — `bucket`/`index` null for a rule about the record
@@ -415,10 +467,13 @@ function shapeErrors(e) {
  * `{problem}` when the tracker cannot say; `verdict` answers `{refuted}` for
  * a refuter verdict path or `{problem}` when it is no usable evidence, with
  * `undecided: true` when the path is a refuter's own location holding no decision.
+ * `charges` is whether the record answers the PR's first review (firstReview()
+ * in ledger-grammar.mjs), where every entry whose finding stands carries a
+ * Charge; a Charge an entry carries anywhere is judged all the same.
  * `review` must pass reviewProblem() — a bucket missing or holding a
  * non-object is a TypeError here, not a violation.
  */
-export function checkDispositions({ review, record, recordProblem = null, run = null, touched, diffFiles = null, roots = [], filing = null }) {
+export function checkDispositions({ review, record, recordProblem = null, run = null, touched, diffFiles = null, roots = [], filing = null, charges = false }) {
   const violations = [];
   const escalations = [];
   const unchecked = [];
@@ -471,14 +526,16 @@ export function checkDispositions({ review, record, recordProblem = null, run =
       at(bucket, index, `malformed entry — ${errors.join("; ")}`);
       return;
     }
+    const finding = review[bucket][index];
+    const presumed = presumedInScope(finding, touched, roots);
+    const inScope = presumed !== null || e.scope === "in";
+    const charge = chargeProblem(e, { inScope, required: charges && stands(bucket, e) });
+    if (charge !== null) at(bucket, index, charge);
     if (bucket === "refuted" && !e.reason?.trim()) {
       at(bucket, index, "a reversed refutation names its evidence in reason, and this one names none");
       return;
     }
     if (bucket !== "unverified" && e.disposition !== "defer") return;
-    const finding = review[bucket][index];
-    const presumed = presumedInScope(finding, touched, roots);
-    const inScope = presumed !== null || e.scope === "in";
     const why = presumed === null ? "its entry declares scope in" : `${presumed}, so it is in scope whatever its entry declares`;
     const crashed = bucket === "unverified" && finding.refutersDispatched > 0;
     const shape = e.claimKind === "shape";
@@ -776,7 +833,7 @@ function main() {
   // same per-PR fold `ledger.mjs dispatch` gates the finisher by, so the check
   // and the gate never judge two different reviews. Without one nothing names
   // it, so `--review` must.
-  let data = null, row = null, run = null, reviewPath;
+  let data = null, row = null, run = null, charges = false, reviewPath;
   if (ledgerFile === null) {
     reviewPath = arg("review");
     if (reviewPath === null) die(`no ledger names PR #${pr}'s review — pass --review <path> for the review file ${member.name}'s record answers`);
@@ -797,6 +854,9 @@ function main() {
     }
     if (latest === undefined) die(`PR #${pr} has no reviewed= on the ledger — no review for ${member.name}'s record to answer`);
     run = latest.run;
+    // Charges are required only on the record answering the PR's first
+    // review; this record answers `run`, so `run` counts as answered.
+    charges = firstReview(prTokens(data.rows, pr), [run])?.run === run;
     reviewPath = join(scratch, `pr${pr}`, run, "review.json");
   }
   let review;
@@ -843,7 +903,7 @@ function main() {
     `list the files of ${base}..${head}`).split("\0").filter(Boolean);
 
   const { violations, escalations, unchecked } = checkDispositions({
-    review, record, recordProblem, run, touched: touchedLines(diff), diffFiles, roots: [review.snapshot, top],
+    review, record, recordProblem, run, touched: touchedLines(diff), diffFiles, roots: [review.snapshot, top], charges,
     filing: { pr, issue: issueReader(repo), verdict: verdictReader(scratch, pr) },
   });
   // No ledger, no row: the exit status below is the verdict, and with no

package/scripts/fleet-event.mjs

@@ -194,8 +194,8 @@ import { makeDie, defineFlags, isDigits, writeAll } from "./arg.mjs";
 import { FleetDirUnresolvable, fleetFile } from "./fleet-dir.mjs";
 import { gitEnv } from "./git-env.mjs";
 import { isCLI } from "./is-cli.mjs";
-import { BRIEFS, REVIEW, REVIEWED, REVIEWER, memberTokens, nextReviewerName, parseDispatchedEntry, parseMember, parseToken, readRetired, rowNums } from "./ledger-grammar.mjs";
-import { NO_TRANSCRIPT_AFTER_DEFAULT, PARKS, controllerState, dispositionsToken, foldLedger, parkedToken } from "./fleet-tick.mjs";
+import { BRIEFS, REVIEW, REVIEWED, REVIEWER, dispositionsToken, memberTokens, nextReviewerName, parseDispatchedEntry, parseMember, parseToken, readRetired, rowNums } from "./ledger-grammar.mjs";
+import { NO_TRANSCRIPT_AFTER_DEFAULT, PARKS, controllerState, foldLedger, parkedToken } from "./fleet-tick.mjs";
 import { phase0Gate, readRunReceipt, tickCaps } from "./phase0-receipt.mjs";
 import { defaultScratch, readReportIn, reportsDir } from "./report-files.mjs";
 import { readState, statePath } from "./fleet-state.mjs";

package/scripts/fleet-tick.mjs

@@ -146,7 +146,7 @@
 // the ledger; main() does the I/O. Split so the guard table and the reading are
 // both unit-testable without a network.
 
-import { parseMember, parseToken, premisesOf, rowNums, nextRetry, readRetired, pullEnded, REVIEW, REVIEWED } from "./ledger-grammar.mjs";
+import { parseMember, parseToken, premisesOf, rowNums, nextRetry, readRetired, pullEnded, dispositionsToken, REVIEW, REVIEWED } from "./ledger-grammar.mjs";
 
 // The implementer and reviewer rows' TARGET is the In-flight bound; the merge
 // bot's is 1. Availability of work belongs in the ACTION, not the target: a
@@ -616,26 +616,6 @@ function parkedReason(encoded) {
 // or `tier-mismatch=<member>:<def>` — or `tier-unverifiable=<member>:no-transcript`
 // for a settled member whose transcript was never written.
 const TIER_VERDICT = /^tier-(ok|mismatch|unverifiable)=([^:\s]+):\S+$/;
-// dispositions-check.mjs's verdict on a review fix-applier's disposition
-// record: `dispositions-ok=fix-pr-<M>[-x]:<run>`,
-// `dispositions-mismatch=…`, `dispositions-escalate=…` (a critical or
-// important deferral, or a second mismatch on one review, that a human rules
-// on) or `dispositions-unchecked=…` (no rule broke, but where a deferral was
-// filed could not be read), `<run>` the run of the review the record
-// answers, as its `reviewed=` names it. `ledger.mjs dispatch` refuses a
-// finisher on anything but an ok. A
-// mismatch returns the PR to fixDue for one retry; an escalate is a hold only
-// a human answers, so the tick never re-offers the PR for it; an unchecked is
-// answered by running the check again, so the tick never offers a
-// fix-applier for it either. A token outside this shape is no verdict at all,
-// which the gate reads as unchecked: fail closed.
-export function dispositionsToken(tok) {
-  const m = /^dispositions-(ok|mismatch|escalate|unchecked)=([^:\s]+):(run-[A-Za-z0-9]{8})$/i.exec(tok);
-  if (!m) return null;
-  const member = parseMember(m[2]);
-  if (member === null || member.family !== "fix-pr") return null;
-  return { verdict: m[1].toLowerCase(), member, run: m[3] };
-}
 
 // Which verdict outranks which when one fix-applier carries more than one for
 // a review: the stricter reading wins.

package/scripts/ledger-grammar.mjs

@@ -221,6 +221,56 @@ function streams(rows) {
   return out;
 }
 
+/** Every token of PR `pr`'s stream, in ledger row order: the tokens firstReview() reads. */
+export const prTokens = (rows, pr) => streams(rows).get(pr) ?? [];
+
+// dispositions-check.mjs's verdict on a review fix-applier's disposition
+// record: `dispositions-ok=fix-pr-<M>[-x]:<run>`,
+// `dispositions-mismatch=…`, `dispositions-escalate=…` (a critical or
+// important deferral, or a second mismatch on one review, that a human rules
+// on) or `dispositions-unchecked=…` (no rule broke, but where a deferral was
+// filed could not be read), `<run>` the run of the review the record
+// answers, as its `reviewed=` names it. `ledger.mjs dispatch` refuses a
+// finisher on anything but an ok. A
+// mismatch returns the PR to fixDue for one retry; an escalate is a hold only
+// a human answers, so the tick never re-offers the PR for it; an unchecked is
+// answered by running the check again, so the tick never offers a
+// fix-applier for it either. A token outside this shape is no verdict at all,
+// which the gate reads as unchecked: fail closed.
+export function dispositionsToken(tok) {
+  const m = /^dispositions-(ok|mismatch|escalate|unchecked)=([^:\s]+):(run-[A-Za-z0-9]{8})$/i.exec(tok);
+  if (!m) return null;
+  const member = parseMember(m[2]);
+  if (member === null || member.family !== "fix-pr") return null;
+  return { verdict: m[1].toLowerCase(), member, run: m[3] };
+}
+
+/**
+ * A PR's first review, read off its `tokens` (prTokens()): walking its
+ * `reviewed=` tokens in ledger order, the first that counted no survived and
+ * no unverified finding, or that a fix-applier answered — a `dispositions-*`
+ * verdict anywhere on the stream names its run. A review with findings no
+ * fix-applier answered was superseded, and is skipped; a failed review wrote
+ * no `reviewed=`, and is no review. `answered` names runs answered on top of
+ * the ledger's: dispositions-check.mjs passes the run of the record it is
+ * checking, whose verdict is not written yet. `{head, survived, refuted,
+ * unverified, run}`, or null when no review qualifies.
+ */
+export function firstReview(tokens, answered = []) {
+  const runs = new Set(answered);
+  for (const tok of tokens) {
+    const d = dispositionsToken(tok);
+    if (d !== null) runs.add(d.run);
+  }
+  for (const tok of tokens) {
+    const m = REVIEWED.exec(tok);
+    if (m === null) continue;
+    const review = { head: m[1].toLowerCase(), survived: Number(m[2]), refuted: Number(m[3]), unverified: Number(m[4]), run: m[5] };
+    if ((review.survived === 0 && review.unverified === 0) || runs.has(review.run)) return review;
+  }
+  return null;
+}
+
 const isOpen = (launch) => !launch.failed && !launch.answered;
 
 // One stream's review record, read in order. A `reviewed=` answers the
@@ -672,6 +722,21 @@ export function unescapeText(s) {
   return s.replace(/\\(\\|n)/g, (_, c) => (c === "n" ? "\n" : "\\"));
 }
 
+// A section's entries, unescaped, in file order — none when the header is
+// absent. Lenient by design: it refuses nothing, so ledger.mjs's rotate reads
+// a ledger its load() refuses through the same slicing, and
+// dispatch-prompt.mjs reads `## Rows` without loading the ledger whole.
+export function ledgerSection(text, name) {
+  const m = headerRe(name).exec(text);
+  if (!m) return [];
+  const start = m.index + m[1].length + name.length;
+  const after = text.slice(start);
+  const end = after.search(/\n## /);
+  return (end === -1 ? after : after.slice(0, end))
+    .split("\n").map((l) => l.trim()).filter((l) => l.startsWith("- "))
+    .map((l) => unescapeText(l.slice(2)));
+}
+
 /** The name the next merge bot takes: 1 + the highest `merge-bot-<n>` in
  * `## Dispatched`, settled ones included, or among `names` — the other names
  * the session holds, a retired bot's and a settled token on a row — the

package/scripts/ledger.mjs

@@ -56,7 +56,7 @@ import { fileURLToPath } from "node:url";
 import { spawnSync, execFileSync } from "node:child_process";
 import { makeDie, isFlagLike, hasEqualsForm, isDigits, writeAll } from "./arg.mjs";
 import { fleetFile, FleetDirUnresolvable } from "./fleet-dir.mjs";
-import { parseMember, parseToken, memberTokens, nextMergeBot, nextRetry, liveOnLedger, settledOnLedger, retiredOnLedger, retiredName, readRetired, agentDefinition, expectedDefinition, CELL, POLICY_CELL, tierValues, rowPr, rowWriteRefusal, isReviewToken, addedReviewToken, newSplitRow, splitRowClause, added, premisesOf, MEMBER_FAMILIES, HALT_CAUSES, ROWS, DISPATCHED, FILED, RULED, DRAIN, RETIRED, RECEIPT, archiveStamp, receiptArchiveName, CLOSEOUT_RECEIPT, closeoutArchiveName, BRIEFS, briefsArchiveName, memberRole, parseDispatchedEntry, dispatchedEntry, headerRe, escapeText, unescapeText, nextReviewerName } from "./ledger-grammar.mjs";
+import { parseMember, parseToken, memberTokens, nextMergeBot, nextRetry, liveOnLedger, settledOnLedger, retiredOnLedger, retiredName, readRetired, agentDefinition, expectedDefinition, CELL, POLICY_CELL, tierValues, rowPr, rowWriteRefusal, isReviewToken, addedReviewToken, newSplitRow, splitRowClause, added, premisesOf, MEMBER_FAMILIES, HALT_CAUSES, ROWS, DISPATCHED, FILED, RULED, DRAIN, RETIRED, RECEIPT, archiveStamp, receiptArchiveName, CLOSEOUT_RECEIPT, closeoutArchiveName, BRIEFS, briefsArchiveName, memberRole, parseDispatchedEntry, dispatchedEntry, headerRe, escapeText, ledgerSection, nextReviewerName } from "./ledger-grammar.mjs";
 import { deriveRun, LedgerError, labelOffMember, HELD, CONFLICT_HOLD, PARKED } from "./fleet-tick.mjs";
 import { stateFileIn, readState, writeState, assessBeat, stallsAt } from "./fleet-state.mjs";
 import { processSource, ancestry, controllerOf, judgeController, ProcUnreadable } from "./proc.mjs";
@@ -486,20 +486,6 @@ function refuseStrayInId(value, what) {
 // report what the parse saw rather than what a later stat() guesses.
 let ledgerParsed = false;
 
-// A section's entries, unescaped, in file order — none when the header is
-// absent. Lenient by design: it refuses nothing, so rotate reads a ledger
-// load() refuses through the same slicing.
-function sectionOf(text, name) {
-  const m = headerRe(name).exec(text);
-  if (!m) return [];
-  const start = m.index + m[1].length + name.length;
-  const after = text.slice(start);
-  const end = after.search(/\n## /);
-  return (end === -1 ? after : after.slice(0, end))
-    .split("\n").map((l) => l.trim()).filter((l) => l.startsWith("- "))
-    .map((l) => unescapeText(l.slice(2)));
-}
-
 function load() {
   if (!existsSync(file)) return { rows: [], filed: [], ruled: [], dispatched: [], briefs: {}, queued: {}, drain: null, retired: [] };
   let text;
@@ -508,7 +494,7 @@ function load() {
   } catch (e) {
     die(`cannot read ${file}: ${e.message}`);
   }
-  const section = (name) => sectionOf(text, name);
+  const section = (name) => ledgerSection(text, name);
   // Set here, past the read and the early return, so it can only be true of a
   // file this function actually opened and recognised as a ledger.
   ledgerParsed = headerRe(FILED).test(text);
@@ -1756,7 +1742,7 @@ function runRotate() {
 function carryOf(text) {
   const skipped = [];
   const skippedRows = [];
-  const rows = sectionOf(text, ROWS).filter((r) => {
+  const rows = ledgerSection(text, ROWS).filter((r) => {
     try {
       deriveRun({ rows: [r], dispatched: [], drain: null }, []);
       return true;
@@ -1771,7 +1757,7 @@ function carryOf(text) {
   // beside the token it writes, so a carried member's record still names the
   // brief it was dispatched with — and a carried merge bot the queue it is
   // judged against — and a dropped member's does not.
-  const { dispatched: allDispatched, briefs: allBriefs, queued: allQueued } = dispatchedOf(sectionOf(text, DISPATCHED));
+  const { dispatched: allDispatched, briefs: allBriefs, queued: allQueued } = dispatchedOf(ledgerSection(text, DISPATCHED));
   const dispatched = allDispatched.filter((e) => {
     const t = parseToken(e);
     if (t !== null && t.error === null) return true;
@@ -1783,7 +1769,7 @@ function carryOf(text) {
   // bare — but its name retires, and one naming no member or reviewer is
   // skipped and retires nothing.
   const archivedRetired = [];
-  for (const line of sectionOf(text, RETIRED)) {
+  for (const line of ledgerSection(text, RETIRED)) {
     const name = retiredName(line);
     if (name === null) skipped.push({ line, why: "names no member or reviewer" });
     else {

package/scripts/pull.mjs

@@ -137,7 +137,7 @@ import { gitEnv } from "./git-env.mjs";
 import { isCLI } from "./is-cli.mjs";
 import { EXCLUDED_REASON, memberTokens, premisesOf, pullEnded, tierValues } from "./ledger-grammar.mjs";
 import { sessionFromReceipt } from "./phase0-receipt.mjs";
-import { briefPaths, briefText, outOfScope, strandedRuling } from "./ticket-router.mjs";
+import { briefPaths, briefText, defang, outOfScope, strandedRuling, ticketText } from "./ticket-text.mjs";
 
 const NAME = "pull";
 const SCRIPTS = dirname(fileURLToPath(import.meta.url));
@@ -399,11 +399,6 @@ function declaredPlaceholders() {
   return names;
 }
 
-/** `text` with each declared placeholder's spelling `<name>` written `‹name›`, which the renderer does not read. */
-export function defang(text, names) {
-  return names.reduce((t, n) => t.split(`<${n}>`).join(`‹${n}›`), text);
-}
-
 // ── children ─────────────────────────────────────────────────────────────────
 
 const trimmed = (s) => String(s ?? "").trim();
@@ -686,15 +681,6 @@ class Pull {
     ];
   }
 
-  // What the dispatched member is told the ticket is: its title, its brief,
-  // and the Out of scope section when that sits outside the brief.
-  dispatchBrief() {
-    const issue = this.issue();
-    const text = briefText(issue).trim();
-    const outside = outOfScope(text) === null ? outOfScope(String(issue.body ?? "")) : null;
-    return [`Title: ${issue.title}`, text, ...(outside === null ? [] : [outside])].join("\n\n");
-  }
-
   // ── the question standing, printed in full: what a Pull picked up again re-reads ──
   describe() {
     const { qid } = this.st.pending;
@@ -998,7 +984,7 @@ class Pull {
     const r = this.script("render", "dispatch-prompt.mjs", [
       "render", "implementer", "--member", st.member, "--ticket", String(st.ticket), "--worktree", worktree,
       "--branch", `implementer/${st.ticket}-${st.member}`, "--scratch", this.p.scratch,
-      "--brief", defang(this.dispatchBrief(), names), "--staleness", defang(staleness, names),
+      "--brief", defang(ticketText(this.issue()), names), "--staleness", defang(staleness, names),
     ]);
     if (r.status !== 0) return this.stop(withText(`dispatch-prompt.mjs render refused (${r.how}) — the claim stands`, r));
     st.stage = "dispatch";

package/scripts/ticket-router.mjs

@@ -55,6 +55,7 @@ import {
   AttributionError, FEATURE_COLUMNS, TRIP_POINTS, attribute, bootUnit, bootstrapDiffCI, generations, parseFeatures, tally, underFloor,
 } from "./pull-attribution.mjs";
 import { RulingError, parseTierOutcomes } from "./tier-outcomes.mjs";
+import { briefPaths, briefText } from "./ticket-text.mjs";
 
 const NAME = "ticket-router";
 const SCRIPT_DIR = dirname(fileURLToPath(import.meta.url));
@@ -80,76 +81,6 @@ const DAY_MS = 86_400_000;
 // metrics — every one free, deterministic and known before dispatch
 // ---------------------------------------------------------------------------
 
-/** An `## Agent Brief` heading line: what marks the comment the brief is taken from. */
-const AGENT_BRIEF = /^## Agent Brief/m;
-
-/** The brief: the last comment carrying an `## Agent Brief` heading line, else the body. */
-export function briefText(issue) {
-  const comments = Array.isArray(issue.comments) ? issue.comments : [];
-  for (let i = comments.length - 1; i >= 0; i--) {
-    const body = String(comments[i]?.body ?? "");
-    if (AGENT_BRIEF.test(body)) return body;
-  }
-  return String(issue.body ?? "");
-}
-
-/** A ruling or triage heading line: what a decision posted outside an `## Agent Brief` comment is headed with. */
-const RULING_HEADING = /^## (?:Ruling|Triage).*$/m;
-
-/**
- * The newest comment with a ruling or triage heading line and no `## Agent
- * Brief` heading line that comes after the last comment `briefText` takes the
- * brief from, or after none when there is no such comment, as its first ruling
- * or triage heading line and its `url`; null when none is.
- */
-export function strandedRuling(issue) {
-  const comments = Array.isArray(issue.comments) ? issue.comments : [];
-  for (let i = comments.length - 1; i >= 0; i--) {
-    const body = String(comments[i]?.body ?? "");
-    if (AGENT_BRIEF.test(body)) return null;
-    const heading = RULING_HEADING.exec(body);
-    if (heading !== null) return { heading: heading[0], url: comments[i].url };
-  }
-  return null;
-}
-
-/** The line span `[at, end)` of `lines`' `Out of scope` section, heading to the next heading of its level or above; null when there is none. */
-function outOfScopeSpan(lines) {
-  const at = lines.findIndex((l) => /^#{1,6}\s*out of scope\b/i.test(l));
-  if (at === -1) return null;
-  const level = /^#+/.exec(lines[at])[0].length;
-  for (let i = at + 1; i < lines.length; i++) {
-    const h = /^(#{1,6})\s/.exec(lines[i]);
-    if (h !== null && h[1].length <= level) return { at, end: i };
-  }
-  return { at, end: lines.length };
-}
-
-/** The `Out of scope` section of `text`, heading to the next heading of its level or above; null when there is none. */
-export function outOfScope(text) {
-  const all = text.split("\n");
-  const span = outOfScopeSpan(all);
-  return span === null ? null : all.slice(span.at, span.end).join("\n").trim();
-}
-
-/**
- * The file paths a brief names: every backticked token without whitespace that
- * holds a `/` or ends in an extension, in first-seen order, each once. The
- * brief's `Out of scope` section names no target, so its tokens are skipped.
- */
-export function briefPaths(brief) {
-  const all = brief.split("\n");
-  const span = outOfScopeSpan(all);
-  const kept = span === null ? brief : [...all.slice(0, span.at), ...all.slice(span.end)].join("\n");
-  const paths = new Set();
-  for (const m of kept.matchAll(/`([^`\n]+)`/g)) {
-    const tok = m[1];
-    if (/\s/.test(tok)) continue;
-    if (tok.includes("/") || /\.[A-Za-z][A-Za-z0-9]*$/.test(tok)) paths.add(tok);
-  }
-  return [...paths];
-}
-
 /** The metric columns for a parsed `gh issue view --json title,body,comments,labels,createdAt`, or null when it is not one. */
 export function issueMetrics(issue, now = Date.now()) {
   if (issue === null || typeof issue !== "object" || Array.isArray(issue) || typeof issue.body !== "string") return null;

package/scripts/ticket-text.mjs

@@ -0,0 +1,94 @@
+// A ticket's text as the fleet reads it off a saved `gh issue view --json
+// title,body,comments,…`: its brief, its `Out of scope` section, the paths it
+// names, a ruling posted outside its brief, and the text a member is
+// dispatched with. A module of its own, importing nothing, because
+// ticket-router.mjs, pull.mjs and dispatch-prompt.mjs each read a ticket this
+// way, and the renderer has no use for the router's fit or anything it
+// imports.
+
+/** An `## Agent Brief` heading line: what marks the comment the brief is taken from. */
+const AGENT_BRIEF = /^## Agent Brief/m;
+
+/** The brief: the last comment carrying an `## Agent Brief` heading line, else the body. */
+export function briefText(issue) {
+  const comments = Array.isArray(issue.comments) ? issue.comments : [];
+  for (let i = comments.length - 1; i >= 0; i--) {
+    const body = String(comments[i]?.body ?? "");
+    if (AGENT_BRIEF.test(body)) return body;
+  }
+  return String(issue.body ?? "");
+}
+
+/** A ruling or triage heading line: what a decision posted outside an `## Agent Brief` comment is headed with. */
+const RULING_HEADING = /^## (?:Ruling|Triage).*$/m;
+
+/**
+ * The newest comment with a ruling or triage heading line and no `## Agent
+ * Brief` heading line that comes after the last comment `briefText` takes the
+ * brief from, or after none when there is no such comment, as its first ruling
+ * or triage heading line and its `url`; null when none is.
+ */
+export function strandedRuling(issue) {
+  const comments = Array.isArray(issue.comments) ? issue.comments : [];
+  for (let i = comments.length - 1; i >= 0; i--) {
+    const body = String(comments[i]?.body ?? "");
+    if (AGENT_BRIEF.test(body)) return null;
+    const heading = RULING_HEADING.exec(body);
+    if (heading !== null) return { heading: heading[0], url: comments[i].url };
+  }
+  return null;
+}
+
+/** The line span `[at, end)` of `lines`' `Out of scope` section, heading to the next heading of its level or above; null when there is none. */
+function outOfScopeSpan(lines) {
+  const at = lines.findIndex((l) => /^#{1,6}\s*out of scope\b/i.test(l));
+  if (at === -1) return null;
+  const level = /^#+/.exec(lines[at])[0].length;
+  for (let i = at + 1; i < lines.length; i++) {
+    const h = /^(#{1,6})\s/.exec(lines[i]);
+    if (h !== null && h[1].length <= level) return { at, end: i };
+  }
+  return { at, end: lines.length };
+}
+
+/** The `Out of scope` section of `text`, heading to the next heading of its level or above; null when there is none. */
+export function outOfScope(text) {
+  const all = text.split("\n");
+  const span = outOfScopeSpan(all);
+  return span === null ? null : all.slice(span.at, span.end).join("\n").trim();
+}
+
+/**
+ * The ticket as a member is told it: its title, its brief (briefText), and the
+ * body's `Out of scope` section when the brief carries none. An implementer's
+ * dispatch carries it, and a review fix-applier's brief carries the same text
+ * for the PR that implementer opened.
+ */
+export function ticketText(issue) {
+  const text = briefText(issue).trim();
+  const outside = outOfScope(text) === null ? outOfScope(String(issue.body ?? "")) : null;
+  return [`Title: ${issue.title}`, text, ...(outside === null ? [] : [outside])].join("\n\n");
+}
+
+/** `text` with each declared placeholder's spelling `<name>` written `‹name›`, which dispatch-prompt.mjs does not read. */
+export function defang(text, names) {
+  return names.reduce((t, n) => t.split(`<${n}>`).join(`‹${n}›`), text);
+}
+
+/**
+ * The file paths a brief names: every backticked token without whitespace that
+ * holds a `/` or ends in an extension, in first-seen order, each once. The
+ * brief's `Out of scope` section names no target, so its tokens are skipped.
+ */
+export function briefPaths(brief) {
+  const all = brief.split("\n");
+  const span = outOfScopeSpan(all);
+  const kept = span === null ? brief : [...all.slice(0, span.at), ...all.slice(span.end)].join("\n");
+  const paths = new Set();
+  for (const m of kept.matchAll(/`([^`\n]+)`/g)) {
+    const tok = m[1];
+    if (/\s/.test(tok)) continue;
+    if (tok.includes("/") || /\.[A-Za-z][A-Za-z0-9]*$/.test(tok)) paths.add(tok);
+  }
+  return [...paths];
+}

package/skills/run-team/briefs/fix-applier.md

@@ -11,6 +11,7 @@ arg violations violations
 path worktree
 path scratch
 path mismatched-record
+ticket ticket
 literal your name
 literal outcome
 literal that path
@@ -64,6 +65,16 @@ claim, never your patch.
 **Before you report, write every ruling to `<scratch>/dispositions-<your name>.json`**,
 `<your name>` the `fix-pr-<pr>[-x]` you were dispatched as — the record the controller checks with
 `dispositions-check.mjs` before it dispatches any finisher.
+
+**Charge every standing entry of that record:** which entries stand, and the
+`charge` and `chargeReason` fields, are in `review-and-fix.md`'s step 2. Read
+the definitions of `closed_own_ticket` and `minted_false_claim` in the header
+of `docs/metrics/tier-outcomes.tsv`, and charge each standing entry by them,
+against the ticket below as its implementer was dispatched with it.
+
+The ticket:
+
+<ticket>
 ## kind: conflict
 Bring `<branch>` current with `origin/main`, resolving every conflict by the
 **No-undo audit** in `$(~/.fleet/bin/fleet-run --root)/commands/run-merge-bot.md`.