@feigi/fleet-ctl 3.22.9 → 3.23.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feigi/fleet-ctl",
-  "version": "3.22.9",
+  "version": "3.23.1",
   "description": "Agent fleet: run-team controller, merge bot, PR reviewer, and the ticket pipeline they share",
   "license": "Apache-2.0",
   "repository": {

package/scripts/cell-readout.mjs

@@ -37,6 +37,16 @@
 // `below the gate` count on stderr. Nothing on either stream names a session,
 // ticket or member: the gate forbids reading a comparison early.
 //
+// STOPPING RULE (exported as `stoppingRule`, not printed by this CLI). For a
+// cell X other than slow-high whose definition is live, a VERDICT is a ticket
+// with an admissible Pull at X dated on or after the day X's
+// `fleet-implementer-<cell>` definition was most recently added, ruled by its
+// last tier-outcomes.tsv row (a `+`-joined `ticket` field rules each ticket
+// it names); a ticket counts once however many Pulls it took. A verdict FAILS
+// the quality floor on `minted_false_claim=yes` or `closed_own_ticket=no`.
+// X is to be withdrawn once it has at least STOP.verdicts verdicts and
+// floor failures ÷ verdicts is at least STOP.failRate.
+//
 // Exit 0 whatever the counts; 2 on a usage error or an unreadable or
 // malformed input, with nothing on stdout.
 
@@ -49,6 +59,7 @@ import { parseFeatures } from "./pr-cost.mjs";
 
 const NAME = "cell-readout";
 export const GATE = Object.freeze({ comparisons: 10, runDates: 5 });
+export const STOP = Object.freeze({ verdicts: 10, failRate: 0.8 });
 
 const key = (session, agent) => `${session}\0${agent}`;
 const levelOf = (cell) => CELL.exec(cell)?.[2] ?? null;
@@ -104,6 +115,37 @@ export function readout({ features, members }) {
   return { cells: out, unjoined };
 }
 
+/**
+ * One entry per cell named in `added` (cell → the `YYYY-MM-DD` its definition
+ * was most recently added) other than the policy cell, sorted by cell:
+ * `{ cell, since, verdicts, failures, stop }`. `verdicts` is
+ * `[{ ticket, pr, run_date, closed_own_ticket, minted_false_claim, failed }]`
+ * sorted by ticket, `run_date` the ruling's; `stop` is whether the stopping
+ * rule withdraws the cell. `verdicts` are parsed tier-outcomes.tsv rows.
+ */
+export function stoppingRule({ features, members, verdicts, added }) {
+  const byKey = new Map(members.map((m) => [key(m.session, m.agent), m]));
+  const ruling = new Map();
+  for (const v of verdicts) for (const t of String(v.ticket).split("+")) ruling.set(t, v);
+  const judged = new Map(Object.keys(added).filter((c) => c !== POLICY_CELL).map((c) => [c, new Map()]));
+  for (const p of features) {
+    const tickets = judged.get(p.chosen_cell);
+    if (!tickets || p.run_date < added[p.chosen_cell] || !ruling.has(p.ticket) || !admissibleMember(p, byKey)) continue;
+    const v = ruling.get(p.ticket);
+    const failed = v.minted_false_claim === "yes" || v.closed_own_ticket === "no";
+    tickets.set(p.ticket, {
+      ticket: p.ticket, pr: v.pr, run_date: v.run_date,
+      closed_own_ticket: v.closed_own_ticket, minted_false_claim: v.minted_false_claim, failed,
+    });
+  }
+  return [...judged].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([cell, tickets]) => {
+    const list = [...tickets.values()].sort((a, b) => Number(a.ticket) - Number(b.ticket));
+    const failures = list.filter((v) => v.failed).length;
+    const stop = list.length >= STOP.verdicts && failures / list.length >= STOP.failRate;
+    return { cell, since: added[cell], verdicts: list, failures, stop };
+  });
+}
+
 // Only a gated cell is formatted, and a comparison needs an admissible row at
 // the cell, so `models` is never empty here.
 function formatModels(models) {

package/scripts/cell-readout.test.mjs

@@ -10,7 +10,7 @@ import { tempDir } from "./temp-dir.mjs";
 import { paragraph, phrase, unemphasized } from "./prose-pin.mjs";
 import { formatTsv } from "./member-outcomes.mjs";
 import { FEATURE_COLUMNS } from "./pr-cost.mjs";
-import { readout, GATE } from "./cell-readout.mjs";
+import { readout, stoppingRule, GATE, STOP } from "./cell-readout.mjs";
 
 const SCRIPT = fileURLToPath(new URL("./cell-readout.mjs", import.meta.url));
 
@@ -339,3 +339,105 @@ function parsed(w) {
     members: w.members.map((r) => ({ ...r })),
   };
 }
+
+// ---------------------------------------------------------------------------
+// The per-cell stopping rule: admissible Pulls at a cell, joined to their
+// ticket's last tier-outcomes row.
+
+const verdict = (o) => ({
+  run_date: "2026-10-03", pr: "", ticket: "", class: "", tier: "", closed_own_ticket: "yes",
+  minted_false_claim: "no", note: "n", sizing: "", profile: "", loc: "", files: "", ...o,
+});
+// `n` admissible Pulls at `cell` on `date`, each ruled; the first `failures` fail the floor,
+// alternating between its two halves.
+function addVerdicts(w, cell, n, failures, { date = "2026-10-02", ...rowOpts } = {}) {
+  w.verdicts ??= [];
+  for (let i = 0; i < n; i++) {
+    addRow(w, { session: `2026-10-02T00-00-00-000Z_v${nextSession++}`, date, cell, ...rowOpts });
+    const p = w.features.at(-1);
+    p.run_date = date;
+    const fail = i < failures;
+    w.verdicts.push(verdict({
+      ticket: p.ticket, pr: String(Number(p.ticket) + 5000),
+      minted_false_claim: fail && i % 2 === 0 ? "yes" : "no", closed_own_ticket: fail && i % 2 === 1 ? "no" : "yes",
+    }));
+  }
+}
+const stop = (w, added) => stoppingRule({ ...parsed(w), verdicts: (w.verdicts ?? []).map((r) => ({ ...r })), added });
+const judged = (w, added, cell) => stop(w, added).find((c) => c.cell === cell);
+
+test("stopping rule: ten verdicts with eight floor failures stop the cell; seven, or nine verdicts all failing, do not", () => {
+  const added = { "smol-high": "2026-09-01" };
+  const eight = world();
+  addVerdicts(eight, "smol-high", 10, 8);
+  const at = judged(eight, added, "smol-high");
+  assert.equal(at.verdicts.length, STOP.verdicts);
+  assert.equal(at.failures, 8, "both floor halves count: minted_false_claim=yes and closed_own_ticket=no");
+  assert.equal(at.stop, true);
+  assert.equal(at.since, "2026-09-01");
+  assert.deepEqual(Object.keys(at.verdicts[0]).sort(), ["closed_own_ticket", "failed", "minted_false_claim", "pr", "run_date", "ticket"]);
+
+  const seven = world();
+  addVerdicts(seven, "smol-high", 10, 7);
+  assert.equal(judged(seven, added, "smol-high").stop, false, "70% is under the 80% floor-failure rate");
+
+  const nine = world();
+  addVerdicts(nine, "smol-high", 9, 9);
+  assert.equal(judged(nine, added, "smol-high").stop, false, "nine verdicts are under the ten the rule needs");
+
+  // Past ten verdicts the rate alone decides: 28 of 35 is 80%, 27 of 35 under it.
+  const exact = world();
+  addVerdicts(exact, "smol-high", 35, 28);
+  assert.equal(judged(exact, added, "smol-high").stop, true);
+  const under = world();
+  addVerdicts(under, "smol-high", 35, 27);
+  assert.equal(judged(under, added, "smol-high").stop, false);
+});
+
+test("stopping rule: a cell's verdicts are listed by ascending ticket number however the corpus orders them", () => {
+  const w = world();
+  w.ticket = 95; // 95..104 crosses a digit boundary: a string sort would put 100 before 95
+  addVerdicts(w, "smol-high", 10, 0);
+  w.features.reverse();
+  w.verdicts.reverse();
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.deepEqual(at.verdicts.map((v) => v.ticket), ["95", "96", "97", "98", "99", "100", "101", "102", "103", "104"]);
+});
+
+test("stopping rule: only admissible Pulls on or after the definition was last added count, at a cell with a live definition other than the policy cell", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 10, 10, { date: "2026-10-02" });
+  addVerdicts(w, "task-high", 10, 10, { effort: "medium" });
+  addVerdicts(w, "task-high", 2, 2, { subagentType: "task" });
+  addVerdicts(w, "slow-high", 10, 10);
+  addVerdicts(w, "task-max", 10, 10);
+  const out = stop(w, { "smol-high": "2026-10-03", "task-high": "2026-09-01", "slow-high": "2026-09-01" });
+  assert.deepEqual(out.map((c) => c.cell), ["smol-high", "task-high"], "slow-high is the policy cell; task-max has no definition");
+  assert.equal(out[0].verdicts.length, 0, "every Pull predates the definition's re-add");
+  assert.equal(out[1].verdicts.length, 0, "a clamped effort or a generic dispatch is not admissible");
+  assert.equal(out[0].stop, false);
+
+  const reAdded = stop(w, { "smol-high": "2026-10-02" });
+  assert.equal(reAdded[0].verdicts.length, 10, "a Pull dated the day the definition was added counts");
+  assert.equal(reAdded[0].stop, true);
+});
+
+test("stopping rule: a ticket counts once, judged by its last tier-outcomes row, and a `+`-joined ticket field rules each ticket", () => {
+  const w = world();
+  addVerdicts(w, "smol-high", 10, 10);
+  const [first, second] = w.features;
+  // A re-dispatch of the first ticket in its own session: same ticket, same cell.
+  addRow(w, { session: first.session, date: "2026-10-02", cell: "smol-high" });
+  Object.assign(w.features.at(-1), { ticket: first.ticket, agent: `impl-${first.ticket}-2`, run_date: "2026-10-02" });
+  Object.assign(w.members.at(-1), { ticket: first.ticket, agent: `impl-${first.ticket}-2`, member: `impl-${first.ticket}-2` });
+  // A later ruling of the first ticket passes the floor, and the second ticket's
+  // only ruling now shares a row with another ticket.
+  w.verdicts.push(verdict({ ticket: first.ticket, pr: "9001" }));
+  w.verdicts.find((v) => v.ticket === second.ticket).ticket = `77+${second.ticket}`;
+  const at = judged(w, { "smol-high": "2026-09-01" }, "smol-high");
+  assert.equal(at.verdicts.length, 10, "the re-dispatch adds no second verdict");
+  assert.equal(at.failures, 9, "the first ticket's last ruling passed");
+  assert.equal(at.verdicts.find((v) => v.ticket === first.ticket).pr, "9001");
+  assert.equal(at.verdicts.find((v) => v.ticket === second.ticket).failed, true);
+  assert.equal(at.stop, true);
+});

package/scripts/fleet-tick.mjs

@@ -912,6 +912,22 @@ const PR_LIMIT = 200;
 const CLAIMED_LIMIT = 200;
 const MAX_BUFFER = 64 * 1024 * 1024;
 const GIT_TIMEOUT_MS = 10_000;
+// Every gh spawn below is killed at this bound, so a gh that never answers is
+// a failed read on that call's own failure path — the open-PR read refuses the
+// tick, a probe leaves standing what it could not confirm, the claimed count
+// reads unknown — never a tick that does not return. The bound is per gh call,
+// not per tick: the probes run one after another, so a tick whose probes all
+// hang waits one bound for each of them. 20 s, shortlist.mjs's own gh bound.
+// FLEET_TICK_GH_TIMEOUT overrides it, in seconds, and can only ever
+// SHORTEN it — ledger.mjs's LEDGER_GIT_TIMEOUT rule: a value that is not a
+// positive whole number below the default leaves the default standing, in
+// silence. Exported for its own test; it touches nothing.
+export function ghBudget(defaultSeconds, override) {
+  const seconds = isDigits(String(override)) ? Number(override) : 0;
+  return (seconds > 0 && seconds < defaultSeconds ? seconds : defaultSeconds) * 1000;
+}
+const GH_TIMEOUT_MS = ghBudget(20, process.env.FLEET_TICK_GH_TIMEOUT);
+const TIMED_OUT = `timed out after ${GH_TIMEOUT_MS / 1000}s`;
 
 // die() shared with the other fleet scripts (writeSync-based, pipe-safe —
 // see arg.mjs for the #176/#328/#363 rationale). This file parses its own
@@ -979,12 +995,12 @@ function openPrs() {
   let out;
   try {
     out = execFileSync("gh", ["pr", "list", "--state", "open", "--limit", String(PR_LIMIT),
-      "--json", "number,labels,closingIssuesReferences,headRefOid"], { encoding: "utf8" });
+      "--json", "number,labels,closingIssuesReferences,headRefOid"], { encoding: "utf8", timeout: GH_TIMEOUT_MS });
   } catch (e) {
     // Never interpolates e.stderr or e.message: execFileSync already forwarded
     // the child's stderr to ours, and Node builds e.message out of it, so
     // either one emits every byte a second time (#176).
-    die(`gh pr list failed: ${e.code ?? (e.signal ? `killed by ${e.signal}` : `exit ${e.status}`)} — a failed read is not an empty queue`);
+    die(`gh pr list failed: ${e.code === "ETIMEDOUT" ? TIMED_OUT : e.code ?? (e.signal ? `killed by ${e.signal}` : `exit ${e.status}`)} — a failed read is not an empty queue`);
   }
   let prs;
   try {
@@ -1006,8 +1022,10 @@ function openPrs() {
   return prs;
 }
 
-// A child that did not exit 0, named with the last line it printed.
+// A child that did not exit 0, named with the last line it printed. A gh
+// killed at GH_TIMEOUT_MS ran and overran: "did not run" would misstate it.
 function failure(r, what) {
+  if (r.error?.code === "ETIMEDOUT") return `${what} ${TIMED_OUT}`;
   if (r.error) return `${what} did not run: ${r.error.code ?? r.error.message}`;
   const last = String(r.stderr ?? "").trim().split("\n").at(-1);
   return `${what} ${r.signal ? `killed by ${r.signal}` : `exited ${r.status}`}${last ? `: ${last}` : ""}`;
@@ -1077,7 +1095,7 @@ function liftedPremise(excluded, entries, prs) {
       if (kind === "issue") {
         // Scrubbed as shortlist.mjs's probeState() is: gh's remote resolution
         // follows GIT_DIR/GIT_WORK_TREE, and GH_REPO outranks both.
-        const r = spawnSync("gh", ["issue", "view", target, "--json", "state"], { encoding: "utf8", env: gitEnv({ GH_REPO: "" }) });
+        const r = spawnSync("gh", ["issue", "view", target, "--json", "state"], { encoding: "utf8", timeout: GH_TIMEOUT_MS, env: gitEnv({ GH_REPO: "" }) });
         if (r.error || r.status !== 0) {
           // Disclosed, not dropped: every other gh call in this file either
           // dies or logs its failure — a bare empty catch here would be the
@@ -1104,7 +1122,7 @@ function liftedPremise(excluded, entries, prs) {
 function closedTickets(mismatched) {
   const closed = new Set();
   for (const { number } of mismatched.map(parseMember)) {
-    const r = spawnSync("gh", ["issue", "view", String(number), "--json", "state"], { encoding: "utf8", env: gitEnv({ GH_REPO: "" }) });
+    const r = spawnSync("gh", ["issue", "view", String(number), "--json", "state"], { encoding: "utf8", timeout: GH_TIMEOUT_MS, env: gitEnv({ GH_REPO: "" }) });
     if (r.error || r.status !== 0) {
       console.error(`${NAME}: ${failure(r, `gh issue view ${number}`)} — tier mismatch on #${number} unconfirmed closed, hold stands`);
       continue;
@@ -1131,7 +1149,7 @@ function closedTickets(mismatched) {
 function finishedReviewPrs(offList) {
   const finished = new Set();
   for (const number of offList) {
-    const r = spawnSync("gh", ["pr", "view", String(number), "--json", "state"], { encoding: "utf8", env: gitEnv({ GH_REPO: "" }) });
+    const r = spawnSync("gh", ["pr", "view", String(number), "--json", "state"], { encoding: "utf8", timeout: GH_TIMEOUT_MS, env: gitEnv({ GH_REPO: "" }) });
     if (r.error || r.status !== 0) {
       console.error(`${NAME}: ${failure(r, `gh pr view ${number}`)} — review on PR#${number} unconfirmed finished, its slot stands`);
       continue;
@@ -1166,12 +1184,12 @@ function refresh() {
 // reporting "0 claimed" says the dead run stranded nothing.
 function claimed() {
   const r = spawnSync("gh", ["issue", "list", "--label", "in-progress", "--state", "open",
-    "--limit", String(CLAIMED_LIMIT), "--json", "number", "--jq", "length"], { encoding: "utf8" });
+    "--limit", String(CLAIMED_LIMIT), "--json", "number", "--jq", "length"], { encoding: "utf8", timeout: GH_TIMEOUT_MS });
   if (r.error || r.status !== 0) {
     // Disclosed, not dropped: a real gh failure must be distinguishable from
     // the deliberately-undiagnosed case.
-    const why = r.error
-      ? `gh did not run: ${r.error.code ?? r.error.message}`
+    const why = r.error?.code === "ETIMEDOUT" ? `gh ${TIMED_OUT}`
+      : r.error ? `gh did not run: ${r.error.code ?? r.error.message}`
       : `gh ${r.signal ? `killed by ${r.signal}` : `exited ${r.status}`}`;
     const tail = (r.stderr ?? "").trim().split("\n").slice(-5).join("\n");
     console.error(`${NAME}: ${why} — claimed ticket count unknown${tail ? `\n${tail}` : ""}`);

package/scripts/fleet-tick.test.mjs

@@ -1307,8 +1307,13 @@ test("CLI: every synchronous spawn in this file goes through spawnBounded (#2320
 // `pr list` for the open PRs, `issue view` for a behind-issue premise's state,
 // `pr view` for the state of a PR an in-flight review names that is no longer
 // on the open list, `issue list --label in-progress` for the stall report's
-// claimed count.
+// claimed count. `GH_HANG` names one of those (`pr list`, `issue view`, …) to
+// stall for `GH_HANG_S` seconds before answering as usual, so a tick that waits
+// a hang out still reads a normal reply. The sleep holds none of the stub's
+// pipes: killed at the tick's bound, the stub leaves no child keeping the
+// tick's read open.
 const GH_STUB = `#!/bin/sh
+[ -n "$GH_HANG" ] && [ "$1 $2" = "$GH_HANG" ] && sleep "$GH_HANG_S" </dev/null >/dev/null 2>&1
 case "$1 $2" in
   "pr list") [ -n "$PR_FAIL" ] && { echo "boom" >&2; exit 1; }; cat "$FIXTURE_PRS" ;;
   "issue view")
@@ -2329,3 +2334,111 @@ test("CLI: a busy, fully-staffed fleet is not reported STALLED just because the
   assert.doesNotMatch(r.stdout, /STALLED/);
   assert.match(r.stdout, /^implementers 2\/2 → AT CAP/m);
 });
+
+// Every gh spawn in the tick carries a bound: a gh that never answers is a
+// failed read on that call's own failure path, never a tick that hangs. Each
+// case stalls one gh call for 30s under a 1s override, so a spawn that lost its
+// bound waits the stall out, reads the stub's normal reply, and fails the
+// assertions on the disclosed timeout — inside spawnBounded's own backstop.
+import { ghBudget } from "./fleet-tick.mjs";
+
+const hang = (call, seconds = "30", budget = "1") => ({ GH_HANG: call, GH_HANG_S: seconds, FLEET_TICK_GH_TIMEOUT: budget });
+
+test("CLI: a hung gh pr list refuses the tick at the bound — a read that timed out is not an empty queue", () => {
+  const r = runCli([], { shortlist: shortlistText([]), env: hang("pr list") });
+  assert.equal(r.status, 2, r.stderr);
+  assert.equal(r.stdout.trim(), "");
+  assert.match(r.stderr, /gh pr list failed: timed out after 1s — a failed read is not an empty queue/);
+});
+
+test("CLI: a hung probe of a mismatched ticket is disclosed at the bound and the hold stands", () => {
+  const r = runCli([], {
+    shortlist: shortlistText([1, 2, 3]), ledger: { rows: ["#7 impl-7=tier-mismatch"], dispatched: ["impl-7=tier-mismatch"] },
+    issueStates: { 7: "CLOSED" }, env: hang("issue view"),
+  });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /^implementers 0\/2 → HOLD \(tier mismatch impl-7\)/m);
+  assert.match(r.stderr, /fleet-tick: gh issue view 7 timed out after 1s — tier mismatch on #7 unconfirmed closed, hold stands/);
+});
+
+test("CLI: a hung behind-issue probe is disclosed at the bound and the exclusion stands", () => {
+  const r = runCli([], {
+    shortlist: shortlistText([1, 2, 3]), refresh: shortlistText([1, 2, 3, 50]),
+    ledger: { rows: ["#50 excluded · behind-issue:#9"] }, issueStates: { 9: "CLOSED" }, env: hang("issue view"),
+  });
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(r.refreshed, 0, "a probe that timed out cannot confirm the lift");
+  assert.match(r.stderr, /fleet-tick: gh issue view 9 timed out after 1s — behind-issue:#9 premise unconfirmed, exclusion stands/);
+});
+
+test("CLI: a hung probe of a PR off the open list is disclosed at the bound and its review keeps the slot", () => {
+  const r = runCli(["--reviewer-cap", "1", "--max-reviews", "1"], {
+    shortlist: shortlistText([]), prs: [REVIEW_DUE], ledger: { rows: zombieRows([101]) }, prStates: { 101: "MERGED" },
+    env: hang("pr view"),
+  });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stderr, /fleet-tick: gh pr view 101 timed out after 1s — review on PR#101 unconfirmed finished, its slot stands/);
+  assert.match(r.stdout, /^reviewers +1\/1 → AT CAP/m);
+});
+
+test("CLI: a hung claimed-count read makes the stall report's count unknown at the bound", (t) => {
+  const dir = realpathSync(mkdtempSync(join(tmpdir(), "fleet-tick-stall-hung-")));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+  const path = join(dir, "heartbeat.json");
+  writeFileSync(path, beat(90 * 60_000, 1200));
+  const r = runCli(["--state", path], { ...IDLE, claimed: [{ number: 41 }], env: hang("issue list") });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /unknown ticket\(s\) claimed and in flight/);
+  assert.match(r.stderr, /fleet-tick: gh timed out after 1s — claimed ticket count unknown/);
+});
+
+// The one case that proves the DEFAULT is a bound, and pays it in full: an
+// override past the default is refused, so the hang is cut at 20s rather than
+// waited out at 40s.
+test("CLI: FLEET_TICK_GH_TIMEOUT cannot lengthen the default bound", () => {
+  const r = runCli([], { shortlist: shortlistText([]), env: hang("pr list", "40", "600") });
+  assert.equal(r.status, 2, r.stderr);
+  assert.match(r.stderr, /gh pr list failed: timed out after 20s/);
+});
+
+// What the bound must ACCEPT: a gh that answers slowly, inside the bound, is a
+// normal read, not a failure.
+test("CLI: a slow gh that answers inside the bound is read as usual", () => {
+  const r = runCli([], {
+    shortlist: shortlistText([1, 2, 3]), ledger: { rows: ["#7 impl-7=tier-mismatch"], dispatched: ["impl-7=tier-mismatch"] },
+    issueStates: { 7: "CLOSED" }, env: hang("issue view", "2", "10"),
+  });
+  assert.equal(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stderr, /timed out/);
+  assert.deepEqual(r.issueViews, ["7"]);
+  assert.match(r.stdout, /^implementers 0\/2 → PULL #1 #2 /m, "the slow CLOSED answer was read and lifted the hold");
+});
+
+// The cases above pin the gh spawns the tick has today; this pins the next
+// one, on the script's code with its comments blanked. Every call through
+// spawnSync or execFileSync that does not name process.execPath or git must
+// pass the shared bound — as `timeout: GH_TIMEOUT_MS` closed by a comma or a
+// brace, never a longer expression — before its call closes. A gh spawned
+// through any other function must name child_process again, and the import pin
+// fails on every line that does.
+test("CLI: every gh spawn in fleet-tick.mjs passes the shared bound", () => {
+  const code = readFileSync(SCRIPT, "utf8").replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/g, (c) => c.replace(/[^\n]/g, " "));
+  assert.deepEqual(code.split("\n").map((l) => l.trimEnd()).filter((l) => l.includes("child_process")),
+    ['import { execFileSync, spawnSync } from "node:child_process";'],
+    "the script spawns through something new — extend this sweep to it");
+  const lineOf = (i) => code.slice(0, i).split("\n").length;
+  const calls = [...code.matchAll(/\b(?:spawnSync|execFileSync)\(\s*(?=\S)(?!process\.execPath\b|["']git["'])/g)];
+  assert.ok(calls.length > 0, "no gh spawn found; this sweep has nothing to measure");
+  const unbounded = calls
+    .filter((m) => !/\btimeout:\s*GH_TIMEOUT_MS\s*[,}]/.test(code.slice(m.index, code.indexOf(");", m.index))))
+    .map((m) => `line ${lineOf(m.index)}`);
+  assert.deepEqual(unbounded, []);
+});
+
+test("ghBudget: the override only ever shortens, and anything but digits leaves the default", () => {
+  const cases = [
+    [undefined, 20_000], ["", 20_000], ["5", 5_000], ["1", 1_000], ["19", 19_000],
+    ["20", 20_000], ["600", 20_000], ["0", 20_000], ["-1", 20_000], ["3.5", 20_000], ["1e1", 20_000], [" 5", 20_000], ["abc", 20_000],
+  ];
+  for (const [override, ms] of cases) assert.equal(ghBudget(20, override), ms, JSON.stringify(override));
+});

package/scripts/run-team-local-hook.test.mjs

@@ -0,0 +1,432 @@
+// The repo-local run-team hook, .omp/skills/run-team-local/hook.mjs, run as
+// the CLI against a fixture workspace: a clone of a bare origin whose main
+// carries the metrics corpus, the router table and the cell definitions, and
+// a stub `gh` that answers from a fixture file and logs every call it gets.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { tempDir } from "./temp-dir.mjs";
+import { writeExecStub } from "./exec-stub.mjs";
+import { COLUMNS as MEMBER_COLUMNS, formatTsv } from "./member-outcomes.mjs";
+import { COLUMNS as TIER_COLUMNS, formatRow } from "./tier-outcomes.mjs";
+import { FEATURE_COLUMNS, WINDOW_START, MIN_N } from "./pr-cost.mjs";
+import { FIT_EVERY_MERGED } from "./ticket-router.mjs";
+import { STOP } from "./cell-readout.mjs";
+
+const HOOK = fileURLToPath(new URL("../../.omp/skills/run-team-local/hook.mjs", import.meta.url));
+const DAY = WINDOW_START;
+const SESSION = "2026-10-03T10-00-00-000Z_01a00000-0000-7000-8000-000000000000";
+const STAGE1 = ["slow-high", "task-high", "smol-high"];
+const PENDING = join(".fleet", "ticket-features.pending.tsv");
+const FEATURES = join("docs", "metrics", "ticket-features.tsv");
+const GUARD = join(".fleet", "cost-guard.json");
+const TABLE = join("plugin", "scripts", "router-table.json");
+
+// Pinned identity, no developer config, no inherited repo pointers.
+const ENV = {
+  ...process.env,
+  GIT_DIR: undefined, GIT_WORK_TREE: undefined, GIT_INDEX_FILE: undefined, GIT_TEMPLATE_DIR: undefined,
+  GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@example.com", GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@example.com",
+  GIT_CONFIG_GLOBAL: "/dev/null", GIT_CONFIG_SYSTEM: "/dev/null",
+};
+const git = (cwd, args, env = {}) => execFileSync("git", ["-C", cwd, ...args], { env: { ...ENV, ...env }, encoding: "utf8" }).trim();
+
+const MODEL_ROLES = { slow: "anthropic/claude-opus-5", task: "anthropic/claude-sonnet-5", smol: "anthropic/claude-haiku-4-5" };
+const CATALOG = {
+  models: [
+    { selector: "anthropic/claude-opus-5", thinking: ["low", "medium", "high", "xhigh", "max"] },
+    { selector: "anthropic/claude-sonnet-5", thinking: ["low", "medium", "high", "xhigh", "max"] },
+    { selector: "anthropic/claude-haiku-4-5", thinking: ["minimal", "low", "medium", "high", "xhigh"] },
+  ],
+};
+const MODEL_OF = { slow: "claude-opus-5", task: "claude-sonnet-5", smol: "claude-haiku-4-5" };
+
+const pull = (o) => ({
+  run_date: DAY, session: SESSION, policy_cell: "slow-high", chosen_cell: "slow-high", exploration_draw: "",
+  sizing_src: "rule", sizing_pre: "", router_usd: "", brief_chars: "100", criteria: "1", comments: "0",
+  age_days: "0", paths: "0", test_paths: "0", xrefs: "0", kind: "enhancement", ...o,
+});
+const member = (o) => ({
+  session: SESSION, run_date: DAY, role: "implementer", member: o.agent, model: "claude-opus-5", effort: "high",
+  ticket: "", pr: "", tokensCacheCreate: 0, tokensOut: 0, wallS: 0, turns: 1, harness: "omp", subagentType: "",
+  tokensIn: 0, tokensCacheRead: 0, tokensCacheWrite1h: 0, cost: 0, ...o,
+});
+const tier = (o) => ({
+  run_date: DAY, class: "", tier: "", closed_own_ticket: "yes", minted_false_claim: "no", note: "n",
+  sizing: "light", profile: "small", loc: "10", files: "1", ...o,
+});
+const corpus = () => ({ features: [], members: [], tiers: [] });
+// One ruled Pull at `cell`: its features row, its admissible member row, its verdict.
+function ruled(rows, { ticket, cell = "slow-high", fail = false, date = DAY }) {
+  const [role, level] = cell.split("-");
+  const agent = `impl-${ticket}`;
+  rows.features.push(pull({ ticket: String(ticket), agent, chosen_cell: cell, run_date: date }));
+  rows.members.push(member({ agent, ticket: String(ticket), run_date: date, effort: level, model: MODEL_OF[role], subagentType: `fleet-implementer-${cell}` }));
+  rows.tiers.push(tier({ ticket: String(ticket), pr: String(ticket + 5000), run_date: date, minted_false_claim: fail ? "yes" : "no" }));
+}
+
+const featuresTsv = (rows, cols = FEATURE_COLUMNS) => [cols.join("\t"), ...rows.map((r) => cols.map((c) => r[c] ?? "").join("\t"))].join("\n") + "\n";
+const membersTsv = (rows) => `# ${MEMBER_COLUMNS.join("\t")}\n${rows.length ? formatTsv(rows) : ""}`;
+const tiersTsv = (rows) => `# ${TIER_COLUMNS.join("\t")}\n${rows.map((r) => `${formatRow(r)}\n`).join("")}`;
+const routerTable = (over = {}) => ({
+  window_start: null, fitted_through: "2026-10-01", n_rows: 0, stage: 1, cells: [...STAGE1], burn_in: true,
+  rows: { "*": "slow-high" }, classifier: { b: null, tau: null }, estimates: {}, guard: { tripped: [], n: {} }, ...over,
+});
+const agentMd = (cell) => {
+  const [role, level] = cell.split("-");
+  return `---\nname: fleet-implementer-${cell}\ndescription: fixture\nmodel: "@${role}:${level}"\n---\n\nbody\n`;
+};
+
+// Answers `pr list` (pr-cost's merged-state read, or the open re-fit PR read),
+// `issue list` (raw text instead of JSON when the fixture has `issuesRaw`),
+// and the two writes, from GH_FIXTURE; logs each argv to GH_LOG.
+const GH_STUB = `#!/usr/bin/env node
+const fs = require("node:fs");
+const args = process.argv.slice(2);
+fs.appendFileSync(process.env.GH_LOG, JSON.stringify(args) + "\\n");
+const fx = JSON.parse(fs.readFileSync(process.env.GH_FIXTURE, "utf8"));
+const json = args[args.indexOf("--json") + 1];
+const out = (v) => process.stdout.write(JSON.stringify(v));
+const cmd = args.slice(0, 2).join(" ");
+if (cmd === "pr list") out(json === "number,headRefName" ? fx.openPrs : fx.prs);
+else if (cmd === "issue list") { if (fx.issuesRaw !== undefined) process.stdout.write(fx.issuesRaw); else out(fx.issues); }
+else if (cmd === "issue create") console.log("https://github.com/o/r/issues/901");
+else if (cmd === "pr create") console.log("https://github.com/o/r/pull/902");
+else { process.stderr.write("gh stub: unexpected " + args.join(" ")); process.exit(9); }
+`;
+
+function write(root, rel, text) {
+  mkdirSync(dirname(join(root, rel)), { recursive: true });
+  writeFileSync(join(root, rel), text);
+}
+
+// `readded`: cell → the date its definition is deleted and added back on main.
+function fixture({ rows = corpus(), table = routerTable(), cells = STAGE1, readded = {}, pending = null, guardBefore = null, gh = {} } = {}) {
+  const root = tempDir("run-team-local-");
+  const origin = join(root, "origin.git");
+  const seed = join(root, "seed");
+  git(root, ["init", "--quiet", "--bare", "-b", "main", origin]);
+  git(root, ["init", "--quiet", "-b", "main", seed]);
+  const commit = (msg, at) => git(seed, ["commit", "--quiet", "-m", msg], { GIT_AUTHOR_DATE: at, GIT_COMMITTER_DATE: at });
+  write(seed, ".gitignore", ".fleet/\n");
+  for (const cell of cells) write(seed, `plugin/agents/fleet-implementer-${cell}.agent.md`, agentMd(cell));
+  git(seed, ["add", "-A"]);
+  commit("cells", "2026-09-01T00:00:00Z");
+  for (const [cell, at] of Object.entries(readded)) {
+    git(seed, ["rm", "--quiet", `plugin/agents/fleet-implementer-${cell}.agent.md`]);
+    commit(`withdraw ${cell}`, at);
+    write(seed, `plugin/agents/fleet-implementer-${cell}.agent.md`, agentMd(cell));
+    git(seed, ["add", "-A"]);
+    commit(`reinstate ${cell}`, at);
+  }
+  write(seed, FEATURES, featuresTsv(rows.features));
+  write(seed, "docs/metrics/member-outcomes.tsv", membersTsv(rows.members));
+  write(seed, "docs/metrics/tier-outcomes.tsv", tiersTsv(rows.tiers));
+  write(seed, TABLE, `${JSON.stringify(table, null, 2)}\n`);
+  git(seed, ["add", "-A"]);
+  commit("corpus", "2026-10-03T12:00:00Z");
+  git(seed, ["push", "--quiet", origin, "main"]);
+  const repo = join(root, "repo");
+  git(root, ["clone", "--quiet", origin, repo]);
+  if (pending !== null) write(repo, PENDING, pending);
+  if (guardBefore !== null) write(repo, GUARD, JSON.stringify(guardBefore));
+  mkdirSync(join(root, "bin"));
+  writeExecStub(join(root, "bin", "gh"), GH_STUB);
+  writeFileSync(join(root, "gh.json"), JSON.stringify({ prs: [], openPrs: [], issues: [], ...gh }));
+  writeFileSync(join(root, "model-roles.json"), JSON.stringify(MODEL_ROLES));
+  writeFileSync(join(root, "catalog.json"), JSON.stringify(CATALOG));
+  const log = join(root, "gh.log");
+  return {
+    root, origin, repo,
+    run(phase, extra = [], { cwd = repo, repoFlag = true } = {}) {
+      const args = [HOOK, phase, ...(repoFlag ? ["--repo", repo] : []),
+        "--model-roles", join(root, "model-roles.json"), "--catalog", join(root, "catalog.json"), ...extra];
+      return spawnSync(process.execPath, args, {
+        cwd, encoding: "utf8",
+        env: { ...ENV, PATH: `${join(root, "bin")}:${process.env.PATH}`, GH_FIXTURE: join(root, "gh.json"), GH_LOG: log },
+      });
+    },
+    ghCalls: () => (existsSync(log) ? readFileSync(log, "utf8").trim().split("\n").map((l) => JSON.parse(l)) : []),
+  };
+}
+const calls = (f, cmd) => f.ghCalls().filter((c) => c.slice(0, 2).join(" ") === cmd);
+const worktrees = (repo) => git(repo, ["worktree", "list", "--porcelain"]).split("\n").filter((l) => l.startsWith("worktree ")).length;
+const escape = (s) => s.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&");
+
+// ---------------------------------------------------------------------------
+// phase-0
+
+test("phase-0: drains the pending TSV into ticket-features.tsv, deduped on session + agent, and writes a fresh cost-guard.json", () => {
+  const rows = corpus();
+  ruled(rows, { ticket: 1 });
+  const fresh = [pull({ ticket: "2", agent: "impl-2" }), pull({ ticket: "3", agent: "impl-3", chosen_cell: "task-high", exploration_draw: "2/3" })];
+  // Read by column name: a pending header in another order drains the same rows.
+  const pending = featuresTsv([rows.features[0], fresh[0], ...fresh], [...FEATURE_COLUMNS].reverse());
+  const f = fixture({ rows, pending, guardBefore: { computed_at: "2000-01-01T00:00:00.000Z", verdict: "ok", tripped: [], cells: [] } });
+  const started = Date.now();
+  const r = f.run("phase-0");
+  assert.equal(r.status, 0, r.stderr);
+  assert.equal(readFileSync(join(f.repo, FEATURES), "utf8"), featuresTsv([rows.features[0], ...fresh]));
+  assert.equal(existsSync(join(f.repo, PENDING)), false, "the drained pending file is gone");
+  assert.match(r.stdout, /drain: 2 rows from \.fleet\/ticket-features\.pending\.tsv into docs\/metrics\/ticket-features\.tsv \(2 already there\)/);
+  const guard = JSON.parse(readFileSync(join(f.repo, GUARD), "utf8"));
+  assert.ok(Date.parse(guard.computed_at) >= started - 1000, `a fresh guard, not the stale one: ${guard.computed_at}`);
+  assert.equal(guard.verdict, "none");
+  assert.match(r.stdout, /cost guard: verdict none, pr-cost\.mjs exit 4/, "no verdict yet is a verdict, not a failure");
+  assert.match(r.stdout, /drift notice: every cell's last admissible row ran its role's current target/);
+  assert.deepEqual(f.ghCalls().map((c) => c.slice(0, 2).join(" ")), ["pr list"], "phase 0 writes nothing to GitHub");
+});
+
+test("phase-0: with no --repo it works on the main checkout of the cwd's repository; a second run finds nothing pending and changes nothing", () => {
+  const rows = corpus();
+  ruled(rows, { ticket: 1 });
+  const fresh = pull({ ticket: "2", agent: "impl-2" });
+  const f = fixture({ rows, pending: featuresTsv([fresh]) });
+  const wt = join(f.root, "wt");
+  git(f.repo, ["worktree", "add", "--quiet", wt]);
+  const r = f.run("phase-0", [], { cwd: wt, repoFlag: false });
+  assert.equal(r.status, 0, r.stderr);
+  const drained = readFileSync(join(f.repo, FEATURES), "utf8");
+  assert.equal(drained, featuresTsv([rows.features[0], fresh]));
+  assert.equal(existsSync(join(f.repo, GUARD)), true);
+  assert.equal(existsSync(join(wt, ".fleet")), false, "nothing is written under the linked worktree");
+
+  const again = f.run("phase-0", [], { cwd: wt, repoFlag: false });
+  assert.equal(again.status, 0, again.stderr);
+  assert.match(again.stdout, /drain: nothing pending in \.fleet\/ticket-features\.pending\.tsv/);
+  assert.equal(readFileSync(join(f.repo, FEATURES), "utf8"), drained);
+});
+
+test("phase-0: a tripped guard is a verdict and the hook goes on; a guard that cannot be computed fails the hook there", () => {
+  const rows = corpus();
+  const prs = [];
+  for (let i = 0; i < MIN_N; i++) {
+    ruled(rows, { ticket: 1000 + i, cell: "slow-high", fail: i < 6 });
+    ruled(rows, { ticket: 2000 + i, cell: "task-high", fail: i < 9 });
+    prs.push({ number: 6000 + i, state: "MERGED", mergedAt: `${DAY}T12:00:00Z` }, { number: 7000 + i, state: "MERGED", mergedAt: `${DAY}T12:00:00Z` });
+  }
+  const tripped = fixture({ rows, gh: { prs } });
+  const t = tripped.run("phase-0");
+  assert.equal(t.status, 0, t.stderr);
+  assert.match(t.stdout, /cost guard: verdict tripped \(tripped: task-high\), pr-cost\.mjs exit 3/);
+  assert.match(t.stdout, /drift notice:/, "the duty after the guard ran");
+
+  const broken = fixture({ rows: corpus() });
+  writeFileSync(join(broken.repo, "docs", "metrics", "member-outcomes.tsv"), "short\trow\n");
+  const b = broken.run("phase-0");
+  assert.equal(b.status, 1);
+  assert.match(b.stderr, /run-team-local: cost guard failed: pr-cost\.mjs --guard exited 2/);
+  assert.doesNotMatch(b.stdout, /drift notice/, "the duties after a failed one do not run");
+});
+
+test("phase-0: the drift notice names a cell whose last admissible row ran another model than its role now resolves, and a cell whose level that target does not run", () => {
+  const rows = corpus();
+  rows.members.push(
+    member({ agent: "impl-1", run_date: "2026-10-01", session: "s1", model: "claude-sonnet-5", effort: "high", subagentType: "fleet-implementer-task-high" }),
+    member({ agent: "impl-2", run_date: "2026-10-02", session: "s2", model: "claude-sonnet-4-5", effort: "high", subagentType: "fleet-implementer-task-high" }),
+    // Newer, but clamped to another effort: never admissible, so never the last admissible row.
+    member({ agent: "impl-3", run_date: "2026-10-05", session: "s3", model: "claude-sonnet-5", effort: "medium", subagentType: "fleet-implementer-task-high" }),
+    // The role's target spelled with its provider prefix is the same model.
+    member({ agent: "impl-4", run_date: "2026-10-02", session: "s4", model: "claude-opus-5", effort: "high", subagentType: "fleet-implementer-slow-high" }),
+    member({ agent: "impl-5", run_date: "2026-10-01", session: "s5", model: "claude-haiku-4-5", effort: "high", subagentType: "fleet-implementer-smol-high" }),
+    member({ agent: "impl-6", run_date: "2026-10-09", session: "s6", model: "claude-haiku-3", effort: "high", subagentType: "task" }),
+  );
+  const f = fixture({ rows, cells: [...STAGE1, "smol-max"] });
+  const r = f.run("phase-0");
+  assert.equal(r.status, 0, r.stderr);
+  assert.deepEqual(r.stdout.split("\n").filter((l) => l.startsWith("tier-roles: notice: ")), [
+    "tier-roles: notice: fleet-implementer-smol-max runs at max; modelRoles.smol now resolves anthropic/claude-haiku-4-5, which does not run at max (thinking: minimal, low, medium, high, xhigh)",
+    "tier-roles: notice: fleet-implementer-task-high last ran claude-sonnet-4-5; modelRoles.task now resolves anthropic/claude-sonnet-5 — cell history spans two models",
+  ]);
+});
+
+test("phase-0: a role with no target in modelRoles raises no notice for its cells, and the cells whose role resolves are still checked", () => {
+  const rows = corpus();
+  rows.members.push(
+    member({ agent: "impl-1", run_date: "2026-10-01", session: "s1", model: "claude-haiku-3", effort: "high", subagentType: "fleet-implementer-smol-high" }),
+    member({ agent: "impl-2", run_date: "2026-10-01", session: "s2", model: "claude-sonnet-4-5", effort: "high", subagentType: "fleet-implementer-task-high" }),
+  );
+  const f = fixture({ rows });
+  const { smol, ...withoutSmol } = MODEL_ROLES;
+  writeFileSync(join(f.root, "model-roles.json"), JSON.stringify(withoutSmol));
+  const r = f.run("phase-0");
+  assert.equal(r.status, 0, r.stderr);
+  assert.deepEqual(r.stdout.split("\n").filter((l) => l.startsWith("tier-roles: notice: ")), [
+    "tier-roles: notice: fleet-implementer-task-high last ran claude-sonnet-4-5; modelRoles.task now resolves anthropic/claude-sonnet-5 — cell history spans two models",
+  ]);
+});
+
+test("phase-0: of the rows dated the same day the drift notice follows the higher session, in whichever order the rows come", () => {
+  const rows = corpus();
+  const sameDay = (agent, session, model, cell) => member({ agent, run_date: "2026-10-02", session, model, effort: "high", subagentType: `fleet-implementer-${cell}` });
+  rows.members.push(
+    // The lower session ran another model and comes first.
+    sameDay("impl-1", "s1", "claude-haiku-3", "smol-high"),
+    sameDay("impl-2", "s2", "claude-haiku-4-5", "smol-high"),
+    // The higher session comes first.
+    sameDay("impl-3", "s4", "claude-sonnet-5", "task-high"),
+    sameDay("impl-4", "s3", "claude-sonnet-4-5", "task-high"),
+  );
+  const r = fixture({ rows }).run("phase-0");
+  assert.equal(r.status, 0, r.stderr);
+  assert.doesNotMatch(r.stdout, /tier-roles: notice:/);
+  assert.match(r.stdout, /drift notice: every cell's last admissible row ran its role's current target/);
+});
+
+// ---------------------------------------------------------------------------
+// close-out: the stopping rule
+
+// smol-high at ten verdicts, eight failing the floor; task-high at three, all failing.
+function floorFailing() {
+  const rows = corpus();
+  for (let i = 0; i < STOP.verdicts; i++) ruled(rows, { ticket: 100 + i, cell: "smol-high", fail: i < 8 });
+  for (let i = 0; i < 3; i++) ruled(rows, { ticket: 200 + i, cell: "task-high", fail: true });
+  return rows;
+}
+const TITLE = "Withdraw exploration cell smol-high: 8/10 floor failures";
+
+test("close-out --dry-run: a cell at ten verdicts and eight floor failures would file its withdrawal issue; a cell under the rule continues", () => {
+  const f = fixture({ rows: floorFailing() });
+  const r = f.run("close-out", ["--dry-run"]);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, new RegExp(`stopping rule: smol-high 8/10 floor failures since 2026-09-01 — would file "${escape(TITLE)}" \\(ready-for-human\\)`));
+  assert.match(r.stdout, /stopping rule: task-high 3\/3 floor failures since 2026-09-01 — continues/);
+  const lists = calls(f, "issue list");
+  assert.equal(lists.length, 1, "only the stopping cell is looked up");
+  assert.deepEqual(lists[0].slice(2, 6), ["--state", "open", "--search", `"${TITLE}" in:title`]);
+  assert.deepEqual(calls(f, "issue create"), [], "a dry run files nothing");
+});
+
+test("close-out: an open issue with the same title dedupes the withdrawal; an open one with other counts does not, and the issue is filed", () => {
+  const decoy = { number: 78, title: "Withdraw exploration cell smol-high: 7/9 floor failures" };
+  const open = { number: 77, title: TITLE };
+  const dup = fixture({ rows: floorFailing(), gh: { issues: [decoy, open] } });
+  const d = dup.run("close-out");
+  assert.equal(d.status, 0, d.stderr);
+  assert.match(d.stdout, new RegExp(`stopping rule: smol-high 8/10 floor failures since 2026-09-01 — withdrawal issue already open, #${open.number}$`, "m"));
+  assert.deepEqual(calls(dup, "issue create"), []);
+
+  const fresh = fixture({ rows: floorFailing(), gh: { issues: [decoy] } });
+  const r = fresh.run("close-out");
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /stopping rule: smol-high 8\/10 floor failures since 2026-09-01 — filed https:\/\/github\.com\/o\/r\/issues\/901/);
+  const [create] = calls(fresh, "issue create");
+  const flag = (name) => create[create.indexOf(name) + 1];
+  assert.equal(flag("--title"), TITLE);
+  assert.equal(flag("--label"), "ready-for-human");
+  // One verdict-table row per ticket: ticket and PR as references, the ruling's date and both floor fields.
+  const row = (ticket, minted, floor) => `| #${ticket} | #${ticket + 5000} | 2026-10-03 | yes | ${minted} | ${floor} |`;
+  const body = flag("--body").split("\n");
+  assert.ok(body.includes(row(100, "yes", "fail")), flag("--body"));
+  assert.ok(body.includes(row(109, "no", "pass")), flag("--body"));
+  const tickets = body.filter((l) => l.startsWith("| #")).map((l) => Number(l.match(/^\| #(\d+) /)[1]));
+  assert.deepEqual(tickets, [100, 101, 102, 103, 104, 105, 106, 107, 108, 109], "rows run in ascending ticket order");
+});
+
+test("close-out: the count restarts on the day a cell's definition was most recently added", () => {
+  const f = fixture({ rows: floorFailing(), readded: { "smol-high": "2026-10-04T00:00:00Z" } });
+  const r = f.run("close-out", ["--dry-run"]);
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /stopping rule: smol-high 0\/0 floor failures since 2026-10-04 — continues/);
+  assert.deepEqual(calls(f, "issue list"), []);
+});
+
+test("close-out: a definition no commit adds fails the stopping rule naming it, after the cells that can be judged are reported, and the re-fit does not run", () => {
+  const f = fixture({ rows: floorFailing() });
+  // On disk beside the committed definitions, never committed.
+  writeFileSync(join(f.repo, "plugin", "agents", "fleet-implementer-smol-max.agent.md"), agentMd("smol-max"));
+  const r = f.run("close-out", ["--dry-run"]);
+  assert.equal(r.status, 1, r.stdout);
+  assert.match(r.stdout, new RegExp(`stopping rule: smol-high 8/10 floor failures since 2026-09-01 — would file "${escape(TITLE)}"`));
+  assert.match(r.stderr, /run-team-local: stopping rule failed: not judged — no commit adds fleet-implementer-smol-max\.agent\.md$/m);
+  assert.doesNotMatch(r.stdout, /router fit/);
+});
+
+test("close-out: a gh that prints something other than JSON fails the duty naming the gh command and what it printed", () => {
+  const f = fixture({ rows: floorFailing(), gh: { issuesRaw: "<html>rate limited</html>" } });
+  const r = f.run("close-out", ["--dry-run"]);
+  assert.equal(r.status, 1, r.stdout);
+  assert.match(r.stderr, /stopping rule failed: gh issue list printed non-JSON \(.*\): "<html>rate limited<\/html>"$/m);
+});
+
+// ---------------------------------------------------------------------------
+// close-out: the router re-fit cadence
+
+// FIT_EVERY_MERGED Pulls on main dated after the table's fitted_through, `n` of them ruled.
+function merged(n) {
+  const rows = corpus();
+  for (let i = 1; i <= FIT_EVERY_MERGED; i++) {
+    rows.features.push(pull({ ticket: String(i), agent: `impl-${i}`, run_date: "2026-10-05" }));
+    if (i <= n) rows.tiers.push(tier({ ticket: String(i), pr: String(500 + i), run_date: "2026-10-05" }));
+  }
+  return rows;
+}
+
+test("close-out --dry-run: fifty merged PRs since fitted_through run ticket-router.mjs fit in a throwaway checkout; forty-nine do not", () => {
+  const below = fixture({ rows: merged(FIT_EVERY_MERGED - 1) });
+  const b = below.run("close-out", ["--dry-run"]);
+  assert.equal(b.status, 0, b.stderr);
+  assert.match(b.stdout, /router fit: DUE=no MERGED=49\/50 — not due/);
+  assert.doesNotMatch(b.stdout, /ticket-router: fitted/);
+
+  const at = fixture({ rows: merged(FIT_EVERY_MERGED) });
+  const before = readFileSync(join(at.repo, TABLE), "utf8");
+  const a = at.run("close-out", ["--dry-run"]);
+  assert.equal(a.status, 0, a.stderr);
+  assert.match(a.stdout, /^run-team-local: router fit: DUE=yes MERGED=50\/50 — ticket-router: fitted \d+ tickets through 2026-10-05; .*; would open a chore PR from chore\/router-fit-\d{4}-\d{2}-\d{2}$/m);
+  assert.equal(readFileSync(join(at.repo, TABLE), "utf8"), before, "the checkout's own table is untouched");
+  assert.equal(worktrees(at.repo), 1, "the throwaway checkout is gone");
+  assert.equal(git(at.origin, ["branch", "--list", "chore/*"]), "", "a dry run pushes nothing");
+  assert.deepEqual(calls(at, "pr create"), []);
+});
+
+test("close-out: a relative --repo reaches the re-fit as the absolute one does", () => {
+  const f = fixture({ rows: merged(FIT_EVERY_MERGED) });
+  const r = f.run("close-out", ["--repo", ".", "--dry-run"], { cwd: f.repo, repoFlag: false });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /router fit: DUE=yes MERGED=50\/50 — .*; would open a chore PR from chore\/router-fit-/);
+});
+
+test("close-out: a due re-fit is pushed to its own chore branch and opened as a PR labelled patch, never onto main — and not while an earlier re-fit PR is open", () => {
+  const f = fixture({ rows: merged(FIT_EVERY_MERGED) });
+  const r = f.run("close-out");
+  assert.equal(r.status, 0, r.stderr);
+  const branch = /opened https:\/\/github\.com\/o\/r\/pull\/902 from (chore\/router-fit-\S+)$/m.exec(r.stdout)?.[1];
+  assert.ok(branch, r.stdout);
+  assert.equal(JSON.parse(git(f.origin, ["show", `${branch}:${TABLE}`])).fitted_through, "2026-10-05");
+  assert.equal(JSON.parse(git(f.origin, ["show", `main:${TABLE}`])).fitted_through, "2026-10-01", "main itself is untouched");
+  const [create] = calls(f, "pr create");
+  assert.equal(create[create.indexOf("--base") + 1], "main");
+  assert.equal(create[create.indexOf("--head") + 1], branch);
+  assert.equal(create[create.indexOf("--label") + 1], "patch", "labelled by the create itself, not by an edit that can fail after it");
+  assert.deepEqual(calls(f, "pr edit"), []);
+  assert.equal(git(f.repo, ["branch", "--list", "chore/*"]), "", "the checkout's repository keeps no local branch of the PR's");
+  assert.doesNotMatch(git(f.repo, ["config", "--local", "--list"]), /^branch\.chore/m, "and no upstream config for it");
+  assert.equal(worktrees(f.repo), 1);
+
+  const earlier = { number: 55, headRefName: "chore/router-fit-2026-10-01" };
+  const held = fixture({ rows: merged(FIT_EVERY_MERGED), gh: { openPrs: [earlier] } });
+  const h = held.run("close-out");
+  assert.equal(h.status, 0, h.stderr);
+  assert.match(h.stdout, new RegExp(`router fit: DUE=yes MERGED=50/50 — re-fit PR #${earlier.number} \\(${escape(earlier.headRefName)}\\) is still open$`, "m"));
+  assert.deepEqual(calls(held, "pr create"), []);
+  assert.equal(git(held.origin, ["branch", "--list", "chore/*"]), "");
+});
+
+// ---------------------------------------------------------------------------
+// usage
+
+test("usage: exactly one phase, and only the declared flags, else exit 2", () => {
+  const f = fixture();
+  for (const extra of [[], ["phase-0", "close-out"], ["phase-0", "--bogus"]]) {
+    const r = spawnSync(process.execPath, [HOOK, ...extra, "--repo", f.repo], { encoding: "utf8", env: ENV });
+    assert.equal(r.status, 2, `${extra.join(" ")}: ${r.stderr}`);
+  }
+  // A flag's value that spells a phase is not the phase.
+  const value = spawnSync(process.execPath, [HOOK, "--repo", "phase-0", "--dry-run"], { encoding: "utf8", env: ENV, cwd: f.repo });
+  assert.equal(value.status, 2, value.stderr);
+  assert.match(value.stderr, /usage: hook\.mjs phase-0\|close-out/);
+});