@plot-pm/board 0.16.1 → 0.16.3

package/plot-fleet-scan.sh

@@ -471,8 +471,13 @@ fi
 # seam, not a knob: nothing in Plot sets it, and lowering it in real use buys
 # nothing but the silent misses described above.
 MERGE_SCAN_LIMIT=${PLOT_MERGE_SCAN_LIMIT:-2000}
+# `%H %s` RATHER THAN `%s`, because the age rule needs the merge COMMIT and not
+# only its sentence: a subject proves a branch for a plan only when its merge is
+# not contained in the commit that added the plan file, and that is an ancestry
+# question about this hash. One walk still, and the hash costs nothing — the
+# same `git log`, one more format placeholder.
 MERGE_SUBJECTS=$(git log "origin/$MAIN" --merges \
-  --max-count="$MERGE_SCAN_LIMIT" --pretty=%s </dev/null 2>/dev/null || true)
+  --max-count="$MERGE_SCAN_LIMIT" --pretty='%H %s' </dev/null 2>/dev/null || true)
 MERGE_SCAN_TRUNCATED=0
 if [ -n "$MERGE_SUBJECTS" ] \
    && [ "$(printf '%s\n' "$MERGE_SUBJECTS" | grep -c .)" -ge "$MERGE_SCAN_LIMIT" ]; then
@@ -489,11 +494,22 @@ fi
 #               capped walk detected, but not exhaustively.
 #   none      — the default branch carries no conforming merge commits at all
 #               (a squash/rebase repo), so `open` says nothing about merging.
-if printf '%s\n' "$MERGE_SUBJECTS" | grep -qE '^Merge pull request #[0-9]+ from [^/]+/.+$'; then
-  MERGE_DETECT=$([ "$MERGE_SCAN_TRUNCATED" = 1 ] && echo truncated || echo pr-merge)
-else
-  MERGE_DETECT=none
-fi
+#   unaskable — the rule could not be asked at all, so NO branch got a subject
+#               reading and every refless branch went to the host. A missing or
+#               silent bundle is the case; it is not the same answer as `none`,
+#               which is a measurement of this estate's history.
+#
+# THE WORD IS THE BUNDLE'S, and this is why no regex decides it here. The regex
+# that stood on this line read GitHub's form only, so a Bitbucket estate — whose
+# every merge carries `Merged in <branch> (pull request #N)` — reported
+# `merge_detect=none` and said its own 1723 proofs did not exist. The forms are
+# data in the host adapter now, and a second copy in shell is exactly what
+# `a-merge-subject-proves-a-landing-the-host-cannot` removes.
+#
+# SET AFTER THE PLANS ARE PARSED, because the bundle is asked then — the plan
+# branches and their adding commits are known only then. Until that point the
+# word is `unaskable`, which is the honest answer for a scan that has not asked.
+MERGE_DETECT=unaskable
 
 # ---------------------------------------------------------------------------
 # Squash merges: the case where no local evidence survives at all
@@ -648,7 +664,32 @@ cache_key() { # $1=branch → a filename that is injective in the branch name
 # them. OPEN outranks MERGED outranks CLOSED, matching the walk `pr-state`
 # already performs on Bitbucket, so the join and the per-branch lookup cannot
 # disagree about the same branch.
-PR_LIST_LIMIT="${PLOT_PR_LIST_LIMIT:-1000}"
+# GENEROUS MEANS ABOVE THE REPOSITORY'S PR COUNT, and 1000 stopped being that.
+# It was set when this repo held 221 PRs. Measured 2026-10-02 it holds 1064, so
+# `--state all --limit 1000` returned exactly 1000 rows — a page AT its limit,
+# which proves only "at least 1000" and can never license completeness. The
+# marker was withheld, and the 26 branches the join could not name each cost one
+# `pr-state` call at 3.8 s: 54-61% of the scan's wall time (#1017).
+#
+# THE NUMBER IS A BUDGET, NOT AN ASSUMPTION, and that distinction is what makes
+# raising it a fix rather than a deferral. A page short of this limit is now read
+# as PROOF of completeness — `plot-host.sh` states it and `prefill_pr_states`
+# reads the sentence — so the limit's only job is to be reachable. A repository
+# that outgrows it gets a capped page, the adapter says `possibly truncated`,
+# the marker is withheld, and the scan degrades to the per-branch asking it did
+# before: slower, and still correct. The failure is loud in the adapter's own
+# stderr and costs cost, never an answer.
+#
+# COST SCALES WITH ROWS RETURNED, NOT ROWS REQUESTED, so the headroom is nearly
+# free. Measured 2026-10-02 through `plot-host.sh pr-list --state all`:
+# `--limit 1000` → 1000 rows in 7.0 s; `--limit 3000` → 1065 rows in 9.2 s;
+# `--limit 5000` → the same 1065 rows in 11.1 s. GitHub pages internally and
+# stops at what exists, so asking for 3000 of 1064 fetches 1064. Two seconds
+# more on one call against ~100 s of per-branch calls removed.
+#
+# `PLOT_PR_LIST_LIMIT` still overrides it, and lowering it is how a repository
+# with a tighter quota trades the join back for per-branch asking.
+PR_LIST_LIMIT="${PLOT_PR_LIST_LIMIT:-3000}"
 
 # WHETHER THE HOST ANSWERED, as a fact of its own — the thing this scan
 # computed and threw away until 2026-08-30.
@@ -823,9 +864,129 @@ pr_list_verdict_rank() {
   esac
 }
 
+# The listing a previous pulse made, handed in rather than spent again.
+#
+# THE BOARD DECIDES, NOT THIS SCRIPT. `listingSpend` in the domain answers
+# whether the account can afford a listing now, and the board — the only
+# long-lived process here — holds the previous one and hands it back. This scan
+# is spawned fresh per pulse and can span none, which is `PLOT_TERMINAL_CACHE`'s
+# reason (`fleet.ts:3380`) applied to the listing rather than to merge facts.
+#
+# Measured 2026-10-02 on the Bitbucket workspace `quatico`: this scan spent 2949
+# of one account's 3150 calls in an hour, 93.6%, because the open listing sweeps
+# one REST request per tracked branch per state and the pulse is 5 s. Cutting the
+# number of runs does not fix that; cutting the listings a run makes does.
+#
+# A CARRIED LISTING IS A FULL ANSWER OR IT IS NOT USED. It carries the same
+# per-branch lines `prefill_pr_states` would have written plus the markers that
+# license `NONE`, so every reader below is unchanged and none of them can tell a
+# carried listing from a fetched one. That is deliberate: the AGE is the board's
+# to report, because the board is what knows how old its own listing is.
+# An empty value means nothing was carried and the listing is spent as before.
+PLOT_PR_LISTING="${PLOT_PR_LISTING:-}"
+
+# Fill the cache from a carried listing. Prints nothing; returns 1 when there was
+# nothing to carry, so the caller spends the listing instead.
+#
+# ABSENT IS NOT EMPTY. A carried listing with no rows would license `NONE` for
+# every branch — the 2026-08-27 failure that refused four fully-merged plans —
+# so a value carrying no arrival marker is refused here and the host is asked.
+carried_listing() {
+  [ -n "$PLOT_PR_LISTING" ] || return 1
+  local key st chk dft arrived=0 complete=0
+  while IFS="	" read -r key st chk dft; do
+    case "$key" in
+      '') continue ;;
+      # The markers travel as lines rather than as files, because the board holds
+      # one string and not a directory.
+      .list-arrived) arrived=1; continue ;;
+      .list-complete) complete=1; continue ;;
+      # Every other dotted key is a note for the board and not a branch. Skipped
+      # rather than written: `git check-ref-format` rejects a branch name starting
+      # with a dot and the key encoding maps only `_` and `/`, so no branch key can
+      # begin with one and a dotted key is never a missed answer.
+      .*) continue ;;
+    esac
+    [ -n "$st" ] || continue
+    # The `-` sentinel back to empty, exactly as the host payload's plain rows are
+    # translated: an empty `checks` reads as `unknown` in `pr_ready` and degrades
+    # `--loose` to strict, which is the safe direction.
+    [ "$chk" = "-" ] && chk=""
+    [ "$dft" = "-" ] && dft=""
+    printf '%s\t%s\t%s' "$st" "$chk" "$dft" > "$HOST_STATE_CACHE/$key" 2>/dev/null || true
+  done <<EOF
+$PLOT_PR_LISTING
+EOF
+  # A listing that arrived with no rows is a real answer — a repository with no
+  # PRs — but it is indistinguishable here from a value truncated in transit, and
+  # the direction that errs costs a fabricated `NONE`. The MARKER carries the
+  # claim, so arrival decides and the row count does not.
+  [ "$arrived" = 1 ] || return 1
+  printf '1' > "$HOST_STATE_CACHE/.list-arrived" 2>/dev/null || true
+  [ "$complete" = 1 ] && { printf '1' > "$HOST_STATE_CACHE/.list-complete" 2>/dev/null || true; }
+  # `ok`, AND A NEW WORD HERE WOULD STOP THE FLEET. `reachFrom`
+  # (`entry/branch-state.ts:113`) maps any word it does not know to `failed`, so
+  # an invented `reused` would read as *the host could not be reached*: every
+  # branch with no ref would answer `unknown`, `--next` offers only `open`, and
+  # nothing would be handed out while the listing was being reused.
+  #
+  # `ok` IS ALSO THE TRUE ANSWER TO THE QUESTION THIS WORD ASKS. The verdict says
+  # how much evidence the scan holds about a branch, not how old the evidence is:
+  # a carried listing arrived and was whole, so it licenses exactly what a fetched
+  # one licenses. The AGE is the board's to report, because the board is what
+  # knows when it listed — this scan is spawned fresh and cannot know.
+  HOST_VERDICT=ok
+  return 0
+}
+
+# Report the listing this run fetched, for the next pulse to carry.
+#
+# ON STDERR AND TAGGED, exactly as the terminal map is reported: stdout is the
+# scan's document and a reader of it must not have to know this exists. The board
+# reads the tag; every other caller discards it with the scan's ordinary prose.
+#
+# REPORTED ONLY WHERE THE LISTING ARRIVED. A failed or throttled call writes no
+# `.list-arrived`, and carrying its empty cache forward would turn one refusal
+# into a listing the next pulse trusts.
+report_listing() {
+  [ -n "$HOST_STATE_CACHE" ] || return 0
+  [ -f "$HOST_STATE_CACHE/.list-arrived" ] || return 0
+  printf 'listing: %s\t%s\t%s\t%s\n' .list-arrived 1 - - >&2
+  [ -f "$HOST_STATE_CACHE/.list-complete" ] \
+    && printf 'listing: %s\t%s\t%s\t%s\n' .list-complete 1 - - >&2
+  # WHAT THE LISTING COST, MEASURED RATHER THAN MODELLED. The Bitbucket arm sweeps
+  # one request per tracked branch per state, and this scan is the only thing that
+  # knows how many branches it tracked. A board predicting the number from the
+  # plans would under-count: a plan names a subset of the remote refs, and the
+  # sweep asks about every one of them.
+  printf 'listing: %s\t%s\t%s\t%s\n' .branches \
+    "$(printf '%s' "$TRACKED_BRANCHES" | wc -w | tr -d ' ')" - - >&2
+  # One line per branch the listing answered for, in the cache's own key encoding
+  # and its own `STATE<TAB>checks<TAB>draft` shape, so what is carried back is what
+  # this run wrote and the carry path parses no JSON.
+  local f key rec _st _chk _dft
+  for f in "$HOST_STATE_CACHE"/*; do
+    [ -f "$f" ] || continue
+    key=${f##*/}
+    case "$key" in .*) continue ;; esac
+    rec=$(cat "$f" 2>/dev/null) || continue
+    IFS="	" read -r _st _chk _dft <<EOF
+$rec
+EOF
+    [ -n "$_st" ] || continue
+    # Empty fields are refilled with `-` so every field stays occupied: TAB is an
+    # IFS whitespace character, and `read` would otherwise slide the branch key
+    # along by one. The carry path translates them back, which is the same `-`
+    # sentinel the host payload's plain rows already use.
+    printf 'listing: %s\t%s\t%s\t%s\n' "$key" "$_st" "${_chk:--}" "${_dft:--}" >&2
+  done
+}
+
 prefill_pr_states() {
   [ "$HOST_LOOKUP_OK" = 1 ] || return 0
   [ -n "$HOST_STATE_CACHE" ] || return 0
+  # ASKED BEFORE THE HOST, and the only reason this function can cost nothing.
+  carried_listing && return 0
   local js br st key rc
   # Exit code first: non-zero is a transport failure and its stdout is not an
   # answer. A failed list leaves the cache EMPTY, so every branch falls through
@@ -1070,19 +1231,44 @@ EOF
   # were dropped above, so an `open` answer that is short — exit 7, or a sweep
   # that did not state its completeness — leaves open PRs with no row at all,
   # and completeness would turn those misses into `NONE`.
+  # A STATED CLAIM OUTRANKS A RE-DERIVED ONE, and that is why this reads two
+  # sentences before it counts anything. Either sentence is the adapter saying
+  # the page was whole — `sweep complete` because every tracked branch was asked
+  # and answered, `page complete` because the page came back short of a limit the
+  # host honours. The row count below can only ever GUESS at the second, and on
+  # this repository it guessed wrong: measured 2026-10-02, `--state all --limit
+  # 1000` returned exactly 1000 rows of 1064 PRs, so `_pr_rows < PR_LIST_LIMIT`
+  # was false, the marker was withheld, and 26 branches each cost one `pr-state`
+  # call at 3.8 s — 54-61% of the scan's wall time across slice 1's five runs
+  # (#1017). The adapter knew the page was capped and said so; nothing read it.
+  #
+  # BOTH PAGES MUST CLAIM IT, as the header above requires: the `all` payload's
+  # OPEN rows were dropped, so a short `open` page is what keeps an open PR from
+  # having no row at all, and completeness would turn those misses into `NONE`.
+  # The two claims may arrive by different routes — a sweep for one state and a
+  # short page for the other — and either pair licenses the marker, because each
+  # sentence is the same assertion about its own page.
+  #
+  # THE ROW COUNT STAYS AS THE FALLBACK and is reached only when neither page
+  # stated anything. An adapter that makes no claim is the case it was written
+  # for, and it is still the weaker evidence: a count equal to the limit is
+  # evidence of AT LEAST that many PRs, never of exactly that many. Withholding
+  # the marker costs calls and never correctness, which is why every failure path
+  # here does exactly that.
   [ "$_v_open" = ok ] || return 0
-  case "$host_err" in
-    *"pr-list sweep complete"*)
-      case "$open_err" in
-        *"pr-list sweep complete"*)
-          printf '1' > "$HOST_STATE_CACHE/.list-complete" 2>/dev/null || true ;;
-      esac ;;
-    *)
-      if [ "$_pr_rows" -gt 0 ] && [ "$_pr_rows" -lt "$PR_LIST_LIMIT" ] \
-         && [ "$_pr_open_rows" -lt "$PR_LIST_LIMIT" ] 2>/dev/null; then
-        printf '1' > "$HOST_STATE_CACHE/.list-complete" 2>/dev/null || true
-      fi ;;
-  esac
+  _list_whole() { # $1=the stderr text of one pr-list call
+    case "$1" in
+      *"pr-list sweep complete"*|*"pr-list state="*" page complete "*) return 0 ;;
+    esac
+    return 1
+  }
+  if _list_whole "$host_err" && _list_whole "$open_err"; then
+    printf '1' > "$HOST_STATE_CACHE/.list-complete" 2>/dev/null || true
+  elif [ "$_pr_rows" -gt 0 ] && [ "$_pr_rows" -lt "$PR_LIST_LIMIT" ] \
+       && [ "$_pr_open_rows" -lt "$PR_LIST_LIMIT" ] 2>/dev/null; then
+    printf '1' > "$HOST_STATE_CACHE/.list-complete" 2>/dev/null || true
+  fi
+  report_listing
 }
 prefill_pr_states
 
@@ -1807,7 +1993,7 @@ while IFS=$'\t' read -r wt_branch wt_path; do
     # questions this block answers — *is anyone editing* and *when did the work
     # last change* — then read one list, which is what stopped them drifting
     # apart the last time.
-    if [ -n "$(plot_worker_dirty_filter "$wt_status")" ]; then wt_dirty=true; else wt_dirty=false; fi
+    if [ -n "$(plot_worker_dirty_filter "$wt_status" "$wt_path")" ]; then wt_dirty=true; else wt_dirty=false; fi
   elif [ "$wt_locked" = true ]; then
     # Status could not answer, but the lock says WHY, and that is an answer
     # rather than the absence of one: a write is in progress in this worktree at
@@ -1843,7 +2029,7 @@ while IFS=$'\t' read -r wt_branch wt_path; do
   # row after the first path with a tab in it. An integer cannot.
   wt_changed=""
   if [ -n "${wt_status:-}" ]; then
-    wt_dirty_paths=$(plot_worker_dirty_filter "$wt_status")
+    wt_dirty_paths=$(plot_worker_dirty_filter "$wt_status" "$wt_path")
     if [ -n "$wt_dirty_paths" ]; then
       wt_mtime_args=()
       wt_n=0
@@ -2170,19 +2356,42 @@ changed_paths_of() { # $1=branch → changed paths, one per line (may be empty)
     | head -n "$CHANGED_PATHS_LIMIT"
 }
 
-# Did this branch land on the default branch? Positive evidence only — absence
-# keeps today's answer.
-#
-# The branch name is INTERPOLATED INTO AN ERE, so every metacharacter it may
-# legally contain is escaped first. Git allows `+`, `(`, `)`, `?`, `{`, `}` and
-# `.` in ref names, and unescaped each one changes what the pattern means —
-# `feature/v.1` would match `feature/vX1`, and `bug/a+b` would fail to match
-# its OWN merge subject. Both directions are wrong, and the second is the
-# quieter one: a branch that silently never matches simply keeps reading
-# `open`, which is this plan's own bug wearing a different hat.
-merged_by_subject() { # $1=branch → 0 when a conforming merge names it
-  printf '%s\n' "$MERGE_SUBJECTS" \
-    | grep -qE "^Merge pull request #[0-9]+ from [^/]+/$(printf '%s' "$1" | sed 's/[][\.*^$+?(){}|\/]/\\&/g')\$"
+# Did this branch land on the default branch, for THIS plan? A lookup in what
+# the rule already proved — positive evidence only, and absence keeps today's
+# answer.
+#
+# A LOOKUP, NOT A MATCH. The matching is `mergedBySubject`'s, asked once per
+# scan through `plot-merge-subject.mjs`; this reads the answer. The regex that
+# stood here read GitHub's form only and was one of three copies of it on the
+# estate — and being a regex it carried its own fault: a branch name may
+# legally hold `+`, `(` or `.`, and unescaped each one changes what the pattern
+# means, so `feature/v.1` matched `feature/vX1` while `bug/a+b` failed to match
+# its own subject. The rule matches the branch as literal text and cannot have
+# that fault at all.
+#
+# KEYED BY PLAN AND BRANCH, which the regex could not be. A later plan may
+# reuse a merged branch name — a reopened ticket does it, and one measured
+# estate holds 87 reused names — so one plan's proof must never settle
+# another's. `$SUBJECT_PROVEN` holds `<plan>\t<branch>` lines and this tests the
+# pair.
+merged_by_subject() { # $1=plan-base $2=branch → 0 when the rule proved the pair
+  case "$SUBJECT_PROVEN" in
+    *$'\n'"$1"$'\t'"$2"$'\n'*) return 0 ;;
+  esac
+  return 1
+}
+
+# Was a subject naming this branch REFUSED because its merge predates the plan?
+#
+# A SEPARATE QUESTION FROM THE ONE ABOVE, and the footer and the branch JSON
+# both report it: a slice with no subject and a slice whose subject was refused
+# for age both read `unknown` under a refused host, and only the second has an
+# explanation a reader can act on.
+subject_predates_plan() { # $1=plan-base $2=branch → 0 when a subject was refused
+  case "$SUBJECT_IGNORED" in
+    *$'\n'"$1"$'\t'"$2"$'\n'*) return 0 ;;
+  esac
+  return 1
 }
 
 # Is this branch's PR ready to merge — open, not draft, AND checks green?
@@ -2847,6 +3056,36 @@ plan_meta_phases=()
 plan_meta_types=()
 plan_meta_waves=()
 
+# WHERE THE LAST LOOKUP LANDED, so the next one starts there instead of at 0.
+#
+# THE CALLERS ASK IN THE ORDER THE ESTATE WAS PARSED. `parse_plan_estate` is
+# handed `cand_reads` and the candidate loop at `:3415` then walks the SAME
+# array in the SAME order, so consecutive asks are consecutive entries and a
+# search that resumes finds its answer in one step. The scan's other two
+# callers walk `plans`, which is built from that same enumeration.
+#
+# IT IS A CURSOR AND NOT A CACHE. Nothing is remembered about any key; the
+# lookup still compares strings and still searches the whole array before it
+# answers "not parsed". Resuming changes WHERE the search starts, never what it
+# finds — a wrap brings it back to every entry it skipped.
+#
+# NO ASSOCIATIVE ARRAY, for the reason the header above gives: `/bin/bash` on
+# macOS is 3.2. A keyed map is the obvious index and `declare -A` would narrow
+# where Plot runs. Measured 2026-10-02 on this estate, the bash-3.2 string
+# idioms are all WORSE than the walk at this size: a `case` over a
+# newline-delimited index answers membership in 1 ms but `${s#*"$k"$'\t'}`
+# takes 2.9-22.8 s per call to recover the value, because a leading `*` makes
+# bash re-test the pattern at every offset of a 52 KB string. The cursor needs
+# no second structure at all.
+plan_meta_cursor=0
+
+# Whether any path was parsed twice. A cursor that starts mid-array would return
+# the LATER copy of a duplicated path, and the walk this replaces always
+# returned the first — so a duplicate turns the cursor off and the walk runs
+# from 0, exactly as it did before. Computed ONCE per parse, three forks, 177 ms
+# at 416 entries; a per-lookup check would cost the walk it is meant to avoid.
+plan_meta_dup=0
+
 # Parses every plan file given, filling the four arrays above. Called ONCE.
 parse_plan_estate() { # $@=files to parse
   [ $# -gt 0 ] || return 0
@@ -2889,15 +3128,23 @@ for line in sys.stdin:
             # run of tabs collapses to one separator and only the LAST field
             # may be optional. "-" stands in for empty everywhere, so no run
             # can form.
-            # THE PREREQUISITE, from the `waits_on` key the parser emits —
-            # never re-parsed from the annotation. The key is ABSENT on a branch that
-            # declares nothing (`plot-plan-meta.sh` promises "a branch name or
-            # nothing — never a blank string"), and "-" stands in here for the
-            # same tab-collapse reason every other middle column does.
+            # THE PREREQUISITES, from the `waits_on` key the parser emits —
+            # never re-parsed from the annotation. The key is a LIST, ABSENT on
+            # a branch that declares nothing (`plot-plan-meta.sh` promises "a
+            # list of one or more names or no key at all — never []"), joined
+            # with commas into this one column: `entry/branch-state.ts` reads
+            # field 9 as a comma-separated name list, the shape it already
+            # expects for the parallel PR-state list in field 10. "-" stands in
+            # for absence here for the same tab-collapse reason every other
+            # middle column does. A plan parsed by an OLD parser still emits a
+            # bare string for this key, which ",".join would shred into
+            # letters -- isinstance guards it, so that shape still passes
+            # through as one name.
+            waits_on = b.get("waits_on")
             print("\t".join(clean(x) for x in [
                 "W", f, str(i), ref, str(b.get("deferred")).lower(),
                 (b.get("deferred_reason") or "-"),
-                (b.get("waits_on") or "-"),
+                (",".join(waits_on) if isinstance(waits_on, list) else waits_on) or "-",
                 name or "-", b.get("claimed") or "-"]))
 ' 2>/dev/null) || records=""
 
@@ -2926,18 +3173,99 @@ for line in sys.stdin:
         ;;
     esac
   done <<< "$records"
+
+  # ONCE PER PARSE, over the whole array — a second `parse_plan_estate` call
+  # EXTENDS the arrays, so a path it adds may duplicate one the first call
+  # stored and the question has to be re-asked of everything.
+  #
+  # A duplicate is not expected: the enumeration lists each file once. It is
+  # possible — a slug reachable both through the active index and through the
+  # plan directory resolves to one file by two paths — and the walk's answer
+  # for it was the FIRST index, which `:3598` and `:4149` then use to read
+  # `plan_meta_waves`. Guessing here would hand a caller another plan's waves.
+  plan_meta_dup=0
+  if [ ${#plan_meta_files[@]} -gt 1 ]; then
+    if printf '%s\n' "${plan_meta_files[@]}" | sort | uniq -d | grep -q .; then
+      plan_meta_dup=1
+    fi
+  fi
+  plan_meta_cursor=0
 }
 
 # The index of a parsed file in the arrays above, or "" when it was not parsed
-# (an unreadable file, or one the helper could not decode). Linear, over an
-# array the size of the plan directory — the estate is parsed once, so this
-# replaces a SUBPROCESS per lookup with a string compare per lookup.
-plan_meta_index_of() { # $1=file → index on stdout, or ""
-  local i
-  for i in "${!plan_meta_files[@]}"; do
-    if [ "${plan_meta_files[$i]}" = "$1" ]; then printf '%s' "$i"; return 0; fi
+# (an unreadable file, or one the helper could not decode).
+#
+# THE SEARCH RESUMES WHERE THE LAST ONE STOPPED. It was a walk from 0 on every
+# call, and `add_plan_by_phase` asks it once per CANDIDATE file under the plan
+# directory — 416 here — so the cost was quadratic in the estate. Measured
+# 2026-10-02 under `--offline` on this estate: 1248 calls walking 260,208
+# entries between them, 208.5 per call, which is half the array and exactly
+# what a from-0 walk costs when the answers are spread through it. Slice 1's
+# `PS4` trace put the line at 294.4 s over ~345,000 gaps, the largest single
+# shell cost in the scan.
+#
+# **1245 of those 1248 calls were HITS**, not misses: in ref mode the estate
+# parse covers every candidate, so almost every ask finds its file. That is why
+# the hit path is what had to get cheaper, and why a membership test alone
+# would not have helped.
+#
+# ONE STEP PER ASK IN THE COMMON CASE. The callers ask in parse order, so the
+# entry after the last answer is usually the next answer. Measured over all 416
+# candidates in order: 0.31 s against 5.17 s for the from-0 walk, 16.5x.
+#
+# IT STILL SEARCHES EVERYTHING BEFORE ANSWERING "NO". The loop runs for the
+# array's whole length and wraps, so an ask out of order costs what it always
+# did and an unparsed file is still reported absent. Only the STARTING POINT
+# changed.
+#
+# ABSENT IS NOT FALSE. A file that was not parsed yields "", which every caller
+# already reads as "not a plan" (`:3547`, `:4096`). It must never be `0` — that
+# is the FIRST plan's index — and the function keeps exiting 0 on a miss, since
+# the callers test the string and not the status.
+#
+# THE KEY IS THE STORED STRING, compared with `[ = ]`. A `P` row's file passed
+# through `clean()`, which turns tabs and newlines into spaces, and
+# `plan_meta_files` holds that cleaned form; a caller's raw path that the clean
+# would have changed was never findable and stays unfindable. The compare is
+# literal, so a path holding `[`, `*` or `?` matches itself and never a glob.
+# THE SEARCH ITSELF, assigning to `plan_meta_index_reply`. Run it in the shell
+# whose cursor should advance; `plan_meta_index_of` below is the stdout wrapper
+# for callers that are already inside a `$(…)`.
+plan_meta_index_reply=""
+plan_meta_index_into() { # $1=file → sets plan_meta_index_reply
+  plan_meta_index_reply=""
+  local n=${#plan_meta_files[@]}
+  [ "$n" -gt 0 ] || return 0
+  local i k=0
+  # A DUPLICATED PATH TURNS THE CURSOR OFF. The walk returned the lowest index
+  # that equalled the file; resuming mid-array could return a later copy, so
+  # this falls back to the from-0 walk and keeps the old answer.
+  if [ "$plan_meta_dup" = 1 ]; then
+    for i in "${!plan_meta_files[@]}"; do
+      if [ "${plan_meta_files[$i]}" = "$1" ]; then plan_meta_index_reply="$i"; return 0; fi
+    done
+    return 0
+  fi
+  i=$plan_meta_cursor
+  while [ "$k" -lt "$n" ]; do
+    if [ "${plan_meta_files[$i]}" = "$1" ]; then
+      # The NEXT entry, because the next ask is usually the next candidate.
+      plan_meta_cursor=$(( (i + 1) % n ))
+      plan_meta_index_reply="$i"
+      return 0
+    fi
+    i=$(( (i + 1) % n ))
+    k=$((k + 1))
   done
-  printf ''
+}
+
+# The stdout form, for the two callers that read it inside a command
+# substitution. The cursor it advances belongs to that subshell and dies with
+# it, which costs those callers nothing: both ask once per live plan, and the
+# weight was never there.
+plan_meta_index_of() { # $1=file → index on stdout, or ""
+  plan_meta_index_into "$1"
+  printf '%s' "$plan_meta_index_reply"
 }
 
 # The phase a file declares, or "" when it is not a plan. Read from the single
@@ -2949,6 +3277,29 @@ plan_phase_of() { # $1=file to parse → normalized phase on stdout
   printf '%s' "${plan_meta_phases[$i]}"
 }
 
+# The same answer, ASSIGNED to `plan_phase_reply` instead of printed.
+#
+# THE CURSOR ONLY ADVANCES IN THE PARENT SHELL. `plan_phase_of` is read as
+# `$(plan_phase_of …)` and `plan_meta_index_of` as `$(plan_meta_index_of …)`,
+# and a subshell's write to `plan_meta_cursor` is discarded when it exits — so
+# the resumable search would restart from 0 on every call and the quadratic
+# shape would survive the fix. This form runs in the caller's own shell, which
+# is where `add_plan_by_phase` runs and where the 416 asks come from.
+#
+# A SECOND FUNCTION RATHER THAN A CHANGED CONTRACT. `plan_phase_of` keeps its
+# stdout form for the slug path at `:3308`, which asks once and whose answer is
+# interpolated into an array append. Rewriting that caller to read a global
+# would trade a one-off subshell for a less obvious assignment.
+plan_phase_reply=""
+plan_phase_into() { # $1=file to parse → sets plan_phase_reply
+  plan_phase_reply=""
+  local i
+  plan_meta_index_into "$1"
+  i="$plan_meta_index_reply"
+  [ -n "$i" ] || return 0
+  plan_phase_reply="${plan_meta_phases[$i]}"
+}
+
 # A terminal phase belongs to the delivered group: the plan is finished, and it
 # appears only while its `Delivered:` record is inside the rolling window.
 #
@@ -3058,7 +3409,11 @@ else
   # result, so no path below asks the format contract the same question twice.
   add_plan_by_phase() { # $1=identity path, $2=file to parse
     local id="$1" src="$2" ph
-    ph=$(plan_phase_of "$src")
+    # NO COMMAND SUBSTITUTION. This runs once per candidate file — 416 on this
+    # estate — and `$(…)` would both fork a subshell per call and discard the
+    # lookup cursor's advance, which is the whole saving.
+    plan_phase_into "$src"
+    ph="$plan_phase_reply"
     is_plan_phase "$ph" || return 0
     if is_terminal_phase "$ph"; then
       [ "$next_only" = 1 ] && return 0
@@ -3195,6 +3550,208 @@ if [ ${#plans[@]} -eq 0 ]; then
   fi
 fi
 
+# ---------------------------------------------------------------------------
+# The merge subjects, asked of the rule once the plans are known
+# ---------------------------------------------------------------------------
+#
+# WHY HERE AND NOT WITH THE WALK ABOVE. The rule is asked per plan, with that
+# plan's own refless branches and the commit that added its file — and neither
+# is known until the estate is parsed. The walk itself still happens once, up
+# at `MERGE_SUBJECTS`; this is where its lines are USED.
+#
+# THREE READINGS PER SCAN, NONE PER PLAN. The per-plan lookup this replaces
+# cost 6 to 37 ms per plan, 5.23 s for 140 plans here; the batched walk below
+# costs 0.10 s for 392 plan files, 0.02 s on the estate that reported #1139.
+#
+#   1. one `git log --diff-filter=AR --name-status` for every plan file's
+#      adding commit (here)
+#   2. the merges walk, already run above with `%H %s`
+#   3. one `git merge-base --is-ancestor` per MATCHED PAIR, which is a few calls
+#      per scan rather than one per plan
+#
+# THE BUNDLE IS ASKED TWICE, with reading 3 between the calls: the age rule
+# needs an ancestry answer and the domain may not run git, so the first call
+# names the pairs needing a test and the second applies the rule to the
+# answers. The decision stays in the bundle; this shell only reads git.
+SUBJECT_PROVEN=$'\n'
+SUBJECT_IGNORED=$'\n'
+SUBJECT_PREDATES_PLAN=0
+
+# The commit that first added each plan file, as `<path>\t<sha>` lines.
+#
+# `--diff-filter=AR` AND THE RENAME FOLLOW. With git's default rename
+# detection a renamed dated file is listed `R` and never `A`, so an `A`-only
+# walk leaves the current path out of the answer and the plan gets no subjects
+# — measured on `origin/main`, 4 of 392 dated plans have no `A` entry for their
+# current path, all renamed while Draft. Each `R` is followed back to the old
+# path's `A` in the SAME call, at no extra cost, so a retitled plan keeps the
+# commit that first added it.
+#
+# ON `origin/<main>`, NEVER `HEAD`. This runs in desks and on feature branches,
+# where `HEAD` holds another history — and the merges walk reads the same ref,
+# so a mismatch would compare an age from one history with a merge from
+# another.
+#
+# THE DATED FILE, NEVER THE SYMLINK under `active/` or `delivered/`. A delivery
+# moves the symlink as a git rename, so the symlink's adding commit is the
+# delivery commit: measured on the estate that reported #1139, one delivered
+# plan keeps 4 of 4 subjects through its target and 0 of 4 through its symlink,
+# because one bulk move re-added 13 symlinks at once.
+plan_adding_commits() { # → <path>\t<sha> per plan file
+  git log "origin/$MAIN" --diff-filter=AR --name-status --format=@%H \
+    -- "$PLAN_DIR" </dev/null 2>/dev/null \
+    | awk '
+      /^@/ { commit = substr($0, 2); next }
+      # An A line gives a path and the commit that added it. The walk runs
+      # newest-first, so the LAST A seen for a path is the oldest — which is the
+      # first add, and the age the rule wants.
+      /^A\t/ { add[$2] = commit; next }
+      # An R line maps an old path (field 2) to a new one (field 3). Recorded as
+      # a chain and resolved after the walk: a rename may be seen before the add
+      # of the path it renames from.
+      /^R/ { from[$3] = $2; next }
+      END {
+        for (path in add) resolved[path] = add[path]
+        # Follow each chain to a path with an A line. Bounded by the chain
+        # length, and a cycle cannot form — a rename always names an earlier
+        # path, and `seen` stops one anyway.
+        for (path in from) {
+          cur = path
+          delete seen
+          while (cur in from && !(cur in seen)) { seen[cur] = 1; cur = from[cur] }
+          if (cur in add) resolved[path] = add[cur]
+          # A chain ending in no A line inside this walk leaves the path
+          # unresolved, so its plan gets no subjects and its branches go to the
+          # host — stated in the plan as the limit it is.
+        }
+        for (path in resolved) printf "%s\t%s\n", path, resolved[path]
+      }'
+}
+
+# What the rule was asked, assembled once and reused for both calls.
+subject_readings() {
+  printf '@backend %s\n' "$HOST_BACKEND"
+  printf '@origin %s\n' "$ORIGIN_URL"
+  printf '@merges\n'
+  [ -n "$MERGE_SUBJECTS" ] && printf '%s\n' "$MERGE_SUBJECTS"
+  printf '%s' "$SUBJECT_PLAN_SECTIONS"
+}
+
+ask_merge_subject() { # $1=verb; stdin=readings → the rule's answer
+  node "$script_dir/board/plot-merge-subject.mjs" "$1" 2>/dev/null
+}
+
+# AN EMPTY WALK IS A MEASUREMENT, AND IT ANSWERS `none`.
+#
+# A squash or rebase estate leaves no merge commit at all, so `$MERGE_SUBJECTS`
+# is empty — and that is the walk having run and found nothing, which is exactly
+# what `none` says. `unaskable` must mean only *the rule could not be asked*, or
+# the footer stops telling a reader the two apart; the asking side of that
+# distinction is this script's and the found/not-found side is the bundle's.
+#
+# Measured by CI on the first run of this slice: the guard below read
+# `[ -n "$MERGE_SUBJECTS" ]` and a fixture with no merges reported
+# `merge_detect=unaskable`, which claims the question was never put about an
+# estate the walk had just examined.
+if [ -z "$MERGE_SUBJECTS" ]; then
+  MERGE_DETECT=none
+fi
+
+# Only where there is something for the rule to match. `--offline` and `--no-pr`
+# do not gate this: the walks are LOCAL, they cost no host call, and a subject is
+# the one proof an offline scan can still have.
+if [ ${#plans[@]} -gt 0 ] && [ -n "$MERGE_SUBJECTS" ]; then
+  # The origin URL, read once. The rule parses it — this script never does, so
+  # the owner is read one way by the scan and the supervisor alike.
+  ORIGIN_URL=$(git config --get remote.origin.url 2>/dev/null || echo "")
+  HOST_BACKEND=$("$script_dir/plot-host.sh" backend 2>/dev/null || echo "")
+
+  SUBJECT_ADDING=$'\n'"$(plan_adding_commits)"$'\n'
+
+  # One section per plan: its dated file, its adding commit, and its refless
+  # branches. A branch WITH a ref is never offered — the ref check stays in
+  # front, and a recreated branch carrying new work must not be settled by the
+  # first attempt's subject.
+  SUBJECT_PLAN_SECTIONS=""
+  for _sp_i in "${!plans[@]}"; do
+    _sp_plan="${plans[$_sp_i]}"
+    _sp_base=$(basename "$(readlink "$_sp_plan" 2>/dev/null || echo "$_sp_plan")")
+    _sp_path="$PLAN_DIR$_sp_base"
+    _sp_added=""
+    case "$SUBJECT_ADDING" in
+      *$'\n'"$_sp_path"$'\t'*)
+        _sp_added=$(printf '%s' "$SUBJECT_ADDING" \
+          | awk -F'\t' -v p="$_sp_path" '$1 == p { print $2; exit }') ;;
+    esac
+    # KEYED ON THE FILE THAT WAS PARSED, which is what `plan_meta_files` holds
+    # — `$plan_reads[i]`, the same key the row loop uses at pass 1a. In ref mode
+    # that is a materialized blob under a temp path and not `$PLAN_DIR` at all,
+    # so a reconstructed path finds nothing.
+    _sp_meta_i=$(plan_meta_index_of "${plan_reads[$_sp_i]}" 2>/dev/null || echo "")
+    [ -n "$_sp_meta_i" ] || continue
+    _sp_branches=""
+    while IFS=$'\t' read -r _sp_idx _sp_br _sp_rest; do
+      [ -n "$_sp_br" ] || continue
+      remote_ref_exists "$_sp_br" && continue
+      _sp_branches+="$_sp_br"$'\n'
+    done <<< "${plan_meta_waves[$_sp_meta_i]}"
+    [ -n "$_sp_branches" ] || continue
+    # THE BASENAME IS THE KEY, because that is what the row loop holds as
+    # `$plan_base` and what the lookup tests. The adding-commit walk keys on
+    # the full path, which is what git reports — the two are joined here, once,
+    # rather than at every lookup.
+    SUBJECT_PLAN_SECTIONS+="@plan $_sp_base"$'\n'
+    SUBJECT_PLAN_SECTIONS+="@added ${_sp_added:--}"$'\n'
+    SUBJECT_PLAN_SECTIONS+="$_sp_branches"
+  done
+
+  if [ -n "$SUBJECT_PLAN_SECTIONS" ]; then
+    # CALL 1: which pairs need an ancestry test.
+    _sp_pairs=$(subject_readings | ask_merge_subject pairs || echo "")
+    # THE READING, one per matched pair. The age rule in
+    # plot-merge-subject.mjs is what decides what it means.
+    _sp_answers=""
+    while IFS=$'\t' read -r _sp_pplan _sp_pbr _sp_merge _sp_added2; do
+      [ -n "$_sp_merge" ] || continue
+      # A wrong "contained" sends the branch to the host; a wrong "not
+      # contained" is the reused-name case this narrows.
+      #
+      # plot-ancestry: evidence  — handed to `proofOf` in
+      #                            plot-merge-subject.mjs, which decides and
+      #                            reads `unknown` as proving nothing.
+      if git merge-base --is-ancestor "$_sp_merge" "$_sp_added2" </dev/null 2>/dev/null; then
+        _sp_answers+="@ancestry $_sp_merge $_sp_added2 yes"$'\n'
+      elif git cat-file -e "$_sp_merge^{commit}" </dev/null 2>/dev/null \
+           && git cat-file -e "$_sp_added2^{commit}" </dev/null 2>/dev/null; then
+        _sp_answers+="@ancestry $_sp_merge $_sp_added2 no"$'\n'
+      else
+        # A commit this checkout cannot read answers neither way, and the rule
+        # reads `unknown` as proving nothing.
+        _sp_answers+="@ancestry $_sp_merge $_sp_added2 unknown"$'\n'
+      fi
+    done <<< "$_sp_pairs"
+
+    # CALL 2: the proof, given the answers.
+    while IFS=$'\t' read -r _sp_word _sp_a _sp_b _sp_c; do
+      case "$_sp_word" in
+        proven)  SUBJECT_PROVEN+="$_sp_a"$'\t'"$_sp_b"$'\n' ;;
+        ignored)
+          SUBJECT_IGNORED+="$_sp_a"$'\t'"$_sp_b"$'\n'
+          SUBJECT_PREDATES_PLAN=$((SUBJECT_PREDATES_PLAN + 1)) ;;
+        detect)
+          # `truncated` is THIS script's reading and outranks `pr-merge`: the
+          # bundle cannot see the cap, and a capped walk detected but did not
+          # examine exhaustively.
+          if [ "$_sp_a" = "pr-merge" ] && [ "$MERGE_SCAN_TRUNCATED" = 1 ]; then
+            MERGE_DETECT=truncated
+          else
+            MERGE_DETECT="$_sp_a"
+          fi ;;
+      esac
+    done <<< "$(printf '%s\n%s' "$(subject_readings)" "$_sp_answers" | ask_merge_subject proven || echo "")"
+  fi
+fi
+
 # A branch is merged when its remote ref is an ancestor of origin/<main>, or —
 # once the ref is gone — when the default branch carries a conforming PR-merge
 # commit naming it (see "the evidence that survives the ref" above). An absent
@@ -3316,8 +3873,9 @@ EOF
 MAIN_TIP=$(remote_ref_oid "$MAIN")
 [ -n "$MAIN_TIP" ] || MAIN_TIP="-"
 
-branch_readings() { # $1=branch $2=deferred → eight tab-separated readings
-  local br="$1" _bs_deferred="$2" _bs_subject=false _bs_ahead=0 _bs_real=0 _bs_tip
+branch_readings() { # $1=branch $2=deferred $3=plan-base → readings
+  local br="$1" _bs_deferred="$2" _bs_plan="${3:-}" _bs_subject=false
+  local _bs_ahead=0 _bs_real=0 _bs_tip
   local _bs_main="$MAIN_TIP"
   # THE REF CHECK STAYS IN FRONT. DO NOT HOIST THE MERGE LOOKUP ABOVE IT.
   #
@@ -3350,7 +3908,17 @@ branch_readings() { # $1=branch $2=deferred → eight tab-separated readings
     # exists — squash merges, a hand-rewritten subject, a branch genuinely
     # never started — today's `open` stands. The evidence may only move a branch
     # from `open` to `merged`, and only when it is positive.
-    merged_by_subject "$br" && _bs_subject=true
+    # THE PAIR, not the branch alone. `$_bs_plan` is what stops one plan's
+    # proof settling another plan's reused name — the case round 1 executed,
+    # where an unstarted reused name read `merged`, its slice read complete,
+    # the next slice opened, and the reused slice was never offered.
+    merged_by_subject "$_bs_plan" "$br" && _bs_subject=true
+    # A subject the age rule refused is reported apart from one that never
+    # existed: both read `unknown` under a refused host, and only this one has
+    # an explanation.
+    _bs_predates=false
+    [ "$_bs_subject" = false ] && subject_predates_plan "$_bs_plan" "$br" \
+      && _bs_predates=true
     # No merge commit names it — which is the ordinary case under a squash
     # merge, not an exotic one. The local walk is now out of evidence, so the
     # host is asked. It may only ever move this branch from `open` to `merged`:
@@ -3375,7 +3943,20 @@ branch_readings() { # $1=branch $2=deferred → eight tab-separated readings
     # what travels: the rule tells `CLOSED` from `NONE` from `-`, and a boolean
     # cannot. `|| true` because a not-merged answer is an ordinary reading and
     # `set -e` must not read it as a failure.
-    merged_by_host "$br" || true
+    #
+    # NOT ASKED FOR A BRANCH THE SUBJECT ALREADY PROVED. For the wave gate the
+    # subject IS enough — settling a slice and opening the next is reversible
+    # work — and asking anyway is the spend #1139 reports: a host refusing
+    # every question, asked again on a 5-second pulse about a branch already
+    # proven.
+    #
+    # THE ONE EXCEPTION IS A DELIVERY CANDIDATE, and it is asked in PASS 1e of
+    # the plan loop rather than here. Candidacy needs every branch's DECIDED
+    # state, which exists only after the rule has answered for the whole plan,
+    # and this function runs per branch in a subshell before that.
+    if [ "$_bs_subject" = false ]; then
+      merged_by_host "$br" || true
+    fi
     # `open` IS A CLAIM ABOUT A PR: that one was looked for and none was found.
     # With no ref, the host is the only remaining source, so when it could not
     # be asked that claim was never earned — and the branch measured on
@@ -3765,6 +4346,13 @@ for plan in "${plans[@]}"; do
   # deciding it — see pass 1c.
   readings=""
   order=""
+  # WHICH BRANCHES THE HOST ITSELF CALLED MERGED, recorded here because
+  # `_merged_by_host_state` is a single variable that pass 1a overwrites per
+  # branch — by the time the JSON emitter runs it holds the LAST branch's
+  # answer. The `evidence` field needs to know, per branch, whether the host
+  # confirmed the landing, so the answer is kept while it is still the right
+  # one.
+  host_merged_branches=$'\n'
   # THE ELEVENTH FIELD: whether the PR list held every PR (`.list-complete`,
   # written by `prefill_pr_states`). The rule reads a `NONE` for a ref behind
   # main as `open` only when it is true; a capped list may omit a merged PR.
@@ -3775,7 +4363,15 @@ for plan in "${plans[@]}"; do
     # "-" is the absent marker the shim writes, for the tab-collapse reason
     # above. Normalized here so everything downstream tests emptiness.
     [ "$waits" = "-" ] && waits=""
-    readings+="$(branch_readings "$br" "$deferred")	${waits:--}	?	$list_complete"$'\n'
+    readings+="$(branch_readings "$br" "$deferred" "$plan_base")	${waits:--}	?	$list_complete"$'\n'
+    # Read from the readings line just built rather than from the variable: the
+    # subshell `branch_readings` runs in cannot export it back.
+    # FIELD 6 is the host's own word, in both arms of `branch_readings`:
+    # `$_merged_by_host_state` for a refless branch and `host_pr_state` for one
+    # with a ref. Field 9 is `waits`, appended by this loop.
+    case "$(printf '%s' "$readings" | tail -n1 | cut -f6)" in
+      MERGED) host_merged_branches+="$br"$'\n' ;;
+    esac
     order+="$idx	$br	$deferred	$why	${waits:--}	$wname	$claim"$'\n'
   done <<< "$wave_lines"
 
@@ -3830,8 +4426,17 @@ for plan in "${plans[@]}"; do
       # list may legitimately omit: its plan may be delivered and its ref gone.
       # `host_pr_state`'s run cache keeps this at one call per prerequisite per
       # run, never one per pass.
-      # Field 10 is replaced; field 11 is carried.
-      refill+="$(printf '%s' "$rd_line" | cut -f1-9)	$(waits_pr_state "$waits_br")	$(printf '%s' "$rd_line" | cut -f11)"$'\n'
+      #
+      # FIELD 9 IS A LIST, comma-joined, so field 10 answers each prerequisite
+      # IN THE SAME ORDER — one `waits_pr_state` call per name, joined the same
+      # way. `entry/branch-state.ts` reads the two columns as parallel lists of
+      # equal length and throws otherwise, so a single answer for several names
+      # would desync them. Field 11 is carried, unreplaced.
+      waits_state=""
+      for _wn in ${waits_br//,/ }; do
+        waits_state+="${waits_state:+,}$(waits_pr_state "$_wn")"
+      done
+      refill+="$(printf '%s' "$rd_line" | cut -f1-9)	$waits_state	$(printf '%s' "$rd_line" | cut -f11)"$'\n'
     else
       refill+="$rd_line"$'\n'
     fi
@@ -3858,6 +4463,46 @@ for plan in "${plans[@]}"; do
     states+="$idx	$br	$st	$deferred	$why	$waits	$wname	$claim"$'\n'
   done <<< "$order"
 
+  # PASS 1e: A DELIVERY CANDIDATE ASKS THE HOST about its subject-proven branches.
+  #
+  # A candidate is an Approved plan whose every non-deferred branch reads
+  # `merged`. Its next step is a delivery, and `allSlicesConfirmed` refuses a
+  # delivery while any branch carries `evidence: subject`. So for a candidate,
+  # and only under `HOST_VERDICT` `ok` or `partial`, `merged_by_host` is asked
+  # about each branch the subject alone proved. A refused host is not asked:
+  # that spend is the condition #1139 reports, and the branch keeps
+  # `evidence: subject`.
+  #
+  # IN THE MAIN SHELL, not in `branch_readings`. That function runs per branch
+  # in a subshell before any state is decided, so it cannot know whether the
+  # plan is a candidate. Measured 2026-10-02: its `$4` was never passed, 32 of
+  # 39 merged branches on this estate read `evidence: subject`, and auto-deliver
+  # held every plan whose branch refs were deleted at merge.
+  #
+  # The terminal cache bounds the cost: a MERGED answer is kept per tip of
+  # `origin/<main>`, so a candidate is asked once per tip, not once per pulse.
+  if [ "$plan_phase" = approved ]; then
+    case "$HOST_VERDICT" in
+      ok|partial)
+        cand=true
+        cand_proven=""
+        while IFS=$'\t' read -r _ c_br c_st c_deferred _; do
+          [ -n "$c_br" ] || continue
+          if [ "$c_deferred" = true ]; then continue; fi
+          [ "$c_st" = merged ] || { cand=false; break; }
+          case "$host_merged_branches" in *$'\n'"$c_br"$'\n'*) continue ;; esac
+          if merged_by_subject "$plan_base" "$c_br"; then cand_proven+="$c_br"$'\n'; fi
+        done <<< "$states"
+        if [ "$cand" = true ]; then
+          while IFS= read -r c_br; do
+            [ -n "$c_br" ] || continue
+            if merged_by_host "$c_br"; then host_merged_branches+="$c_br"$'\n'; fi
+          done <<< "$cand_proven"
+        fi
+        ;;
+    esac
+  fi
+
   # Pass 2a: what each wave HOLDS — how many of its non-deferred branches have
   # not settled. A reading, and the whole of what this script contributes to the
   # verdict: which branches count as settled depends on `--loose` and on a host
@@ -3979,18 +4624,24 @@ for plan in "${plans[@]}"; do
       [ "$claim" = "-" ] && claim=""
       [ "$why" = "-" ] && why=""
       [ "$waits" = "-" ] && waits=""
+      # THE NOTE NAMES EVERY PREREQUISITE, not just one: `$waits` is comma-joined
+      # with no space (the shim's separator), and the sentence reads "a, b" —
+      # with one name both forms are byte-identical. The scan has the VERDICT
+      # and not the per-prerequisite answer here, so `blocked`'s sentence names
+      # every prerequisite rather than which one lacks a PR.
+      waits_prose="${waits//,/, }"
       n_branches=$((n_branches + 1))
       case "$st" in
         # WHAT IT WAITS ON, NAMED. A bare `waiting` tells a reader to come back
         # later without saying what would have to happen first, which is the
         # whole of what this state adds over `open`.
         waiting)  n_waiting=$((n_waiting + 1))
-                  note="waiting on $waits" ;;
+                  note="waiting on $waits_prose" ;;
         # A PREREQUISITE NOBODY DECLARED. The sentence says the host was asked
         # and answered, because that is what separates this from `waiting`: a
         # host that could not be asked holds the branch at `waiting` instead.
         blocked)  n_prereq_missing=$((n_prereq_missing + 1))
-                  note="blocked — no PR found for $waits" ;;
+                  note="blocked — no PR found for $waits_prose" ;;
         # The REASON, where the plan recorded one. A bare `deferred` beside a
         # branch with no commits reads as two unrelated facts when the first is
         # the reason for the second, and the sentence that says so was already
@@ -4033,20 +4684,48 @@ for plan in "${plans[@]}"; do
         # must not parse a string that exists for humans to read.
         json_branches+="${json_branches:+,}{\"branch\":\"$(json_str "$br")\""
         json_branches+=",\"state\":\"$st\",\"deferred\":$deferred"
+        # WHAT PROVED THE LANDING, where the proof is weaker than the host's.
+        #
+        # EMITTED ONLY WHERE THE BRANCH READS `merged` AND THE HOST HAS NOT
+        # CONFIRMED IT. `merged_by_host` leaves its own word in
+        # `_merged_by_host_state`, and the scan does not even ask for a proven
+        # branch that is not a delivery candidate — so the absence of a host
+        # `MERGED` is what the field reports. The branch loses the field the
+        # moment the host answers merged.
+        #
+        # A QUALIFIER, NOT A STATE. The state stays `merged`, the wave
+        # arithmetic is unmoved and the next slice still opens; what reads this
+        # is `allSlicesConfirmed`, in front of a delivery, which is the one
+        # decision here that cannot be undone.
+        if [ "$st" = merged ] && merged_by_subject "$plan_base" "$br" \
+           && [ "${host_merged_branches#*$'\n'"$br"$'\n'}" = "$host_merged_branches" ]; then
+          json_branches+=",\"evidence\":\"subject\""
+        fi
+        # WHY A SUBJECT NAMING THIS BRANCH PROVED NOTHING. A reused name whose
+        # merge predates the plan: the slice reads as it would with no subject
+        # at all, and this is what tells a reader the two cases apart.
+        if subject_predates_plan "$plan_base" "$br"; then
+          json_branches+=",\"subjectIgnored\":\"predates-plan\""
+        fi
         # WHY it was deferred, straight from the plan's annotation. "" where the
         # branch is not deferred, and "" where it is deferred with nothing
         # recorded — the flag says which of those two a reader is looking at.
         json_branches+=",\"deferred_reason\":\"$(json_str "$why")\""
         # WHAT THIS BRANCH WAITS ON, straight from the plan's `waits:`
-        # annotation. "" where the branch declares nothing, which is the answer
-        # every branch gave before this field existed.
+        # annotation. `[]` where the branch declares nothing — `FleetBranchSchema`
+        # carries the key on every branch since #1253, so absence is an empty
+        # list here rather than a missing key, unlike the parser's own
+        # `waits_on` which omits the key entirely.
         #
         # THE ANNOTATION, NOT THE VERDICT, and it is emitted whatever `state`
         # says. A branch whose prerequisite has MERGED reports `waits_on` with
         # its ordinary state — the declaration is still a fact about the plan,
         # and a reader who sees a cleared dependency learns why the slice is
         # now startable. Consumers test `state`, never the presence of this.
-        json_branches+=",\"waits_on\":\"$(json_str "$waits")\""
+        #
+        # `$waits` IS COMMA-JOINED NAMES, never PR states: one name per line
+        # for `json_array`, which escapes each.
+        json_branches+=",\"waits_on\":$(json_array "${waits//,/$'\n'}")"
         json_branches+=",\"claimed\":\"$(json_str "$claim")\""
         # What this machine knows and the refs do not. Absent everywhere else:
         # `local_dirty:false` and `local_worktree:""` are what a branch checked
@@ -4674,4 +5353,9 @@ if [ "$build_doc" = 1 ] && [ "$record" = 1 ] && [ -n "$reading_doc" ]; then
 fi
 write_bridge
 echo "Pulse complete. This report is derived — nothing was changed."
-echo "summary: plans=$n_plans waves=$n_waves branches=$n_branches claimed=$n_claimed claimable=$n_eligible eligible=$n_eligible blocked=$n_blocked deferred=$n_deferred waiting=$n_waiting prereq_missing=$n_prereq_missing merge_detect=$MERGE_DETECT host=$HOST_VERDICT main=$MAIN"
+# `subject_predates_plan` NAMES A SUBJECT THE AGE RULE REFUSED, and it is its
+# own counter rather than a silence. A slice whose subject was refused reads
+# `unknown` under a refused host, exactly as a slice with no subject does — and
+# only this one has an explanation an operator can act on, which is that a
+# later plan reused a merged branch name.
+echo "summary: plans=$n_plans waves=$n_waves branches=$n_branches claimed=$n_claimed claimable=$n_eligible eligible=$n_eligible blocked=$n_blocked deferred=$n_deferred waiting=$n_waiting prereq_missing=$n_prereq_missing merge_detect=$MERGE_DETECT subject_predates_plan=$SUBJECT_PREDATES_PLAN host=$HOST_VERDICT main=$MAIN"