@r1z4x/tezgah 1.8.2 → 1.9.0

package/docs/gate.md

@@ -183,7 +183,7 @@ Trigger: a write tool, or a shell command that writes a file, while an active ta
 against `hooks/tezgah_gate.py::SHELL_WRITE`); the allowlist refuses a target outside it (`hooks/tezgah_gate.py::TASK_SCOPE_DENY`) — a write tool's path, and a shell command's redirect or `tee` target (`hooks/tezgah_gate.py::write_paths`); and a write whose target IS the record, by a write tool or a shell redirect/`tee`, is refused
 (`hooks/tezgah_gate.py::TASK_RECORD_DENY`) - the active task's record and any other open plan that carries a phase (`hooks/tezgah_task.py::phased_record`), matched without case and read against the main checkout, so a session in a worktree meets the same rule - because only `bin/tezgah-task` writes it and that CLI makes the checks a retyped frontmatter would skip. Told:
 the move that lifts it, made by the session itself — `tezgah-task phase implementation` or `tezgah-task allow <glob> ... --why "<reason>"` — since the orchestrator owns the plan lifecycle and the CLI refuses
-the move until the plan's Acceptance, spike and checkpoint are in order, and records the reason for a widened scope (`allowed_why:`). The record's body has its own writers, on any open plan, run from the main checkout or from any of its worktrees. `tezgah-task tick NNN <n> [--undo]` ticks Acceptance item n (`bin/tezgah-task::cmd_tick`). `tezgah-task note NNN state|next "<text>"` replaces the newest `## State` or the `## Next` body (`bin/tezgah-task::cmd_note`). `tezgah-task spike NNN "<answer>"` writes `spike_recorded:`, the answer `implementation` waits for (`bin/tezgah-task::cmd_spike`). None of them commits. Standing: only the record changing lifts it.
+the move until the plan's Acceptance, spike and checkpoint are in order, and records the reason for a widened scope (`allowed_why:`). The record's body has its own writers, on any open plan, run from the main checkout or from any of its worktrees. `tezgah-task tick NNN <n> [--undo]` ticks Acceptance item n (`bin/tezgah-task::cmd_tick`). `tezgah-task note NNN state|next "<text>"` replaces the newest `## State` or the `## Next` body (`bin/tezgah-task::cmd_note`). `tezgah-task spike NNN "<answer>"` writes `spike_recorded:`, the answer `implementation` waits for (`bin/tezgah-task::cmd_spike`). `tezgah-task unmet <NNN> <n> "<reason, who accepted it>"` annotates Acceptance item n with `UNMET:`, the form `close NNN done` accepts in place of a ticked box (`bin/tezgah-task::cmd_unmet`). `tezgah-task sweep` makes one idempotent pass over what the last session left behind (`bin/tezgah-task::cmd_sweep`). It lists every pending slice as one line. It removes the landed worktrees and branches, and clears a `phase:` whose branch is gone. It prints the pending slices instead of closing them, because resuming one is the session's move. None of them commits. Standing: only the record changing lifts it.
 Scratch meets no allowlist: a temp file or a device, such as `pytest > /tmp/check.log` (`hooks/tezgah_gate.py::task_reason`). Build output inside the repo stays held. So does a file in the repo or its worktrees when the checkout lives under the temp dir, as CI's does.
 The task rule holds repository paths only. A target under no git checkout and no configured root, such as `~/.config/runpod/key`, is no plan's work (`hooks/tezgah_gate.py::_no_repo`). Neither the phase nor the allowlist refuses it, while every other rule, the secret rule among them, still reads that write. The gate reads a relative target in the call's own directory. Any doubt keeps the target held. A line that moves the directory stays held, however it spells the `cd`, `pushd` or `popd`. So does a line that reads `$PWD` back. A line that makes a link stays held: `ln`, `install`, `cp -s`, `cp -l`. So does a target whose parent directory does not exist yet. So does a file with a second hard link. Host agent and instruction files and the shell rc files stay held too, in any letter case (`hooks/tezgah_gate.py::HOME_HELD`). Under `~/.claude` those are `agents/**`, `hooks/**`, `commands/**`, `skills/**` and `CLAUDE.md`. Elsewhere they are `~/.omp/agent/**`, `~/.codex/AGENTS.md`, `~/.codex/prompts/**`, `~/.cursor/**` and `~/.config/opencode/**`. The rc files are `~/.zshrc`, `~/.zshenv`, `~/.zprofile`, `~/.zlogin`, `~/.bashrc`, `~/.bash_profile`, `~/.bash_login` and `~/.profile`. A target in another repository stays refused as outside this one.
 Three targets are no project file, so neither the phase nor the allowlist refuses them (`hooks/tezgah_gate.py::unnamed_target`). A URI is one: a tool device (`xd://<tool>`), an agent message (`agent://X`) or a conflict resolution (`conflict://2`). A `file://` URI names a checkout file and stays held. A shell target with an unknown variable is another. `write_paths` first expands a variable from an assignment earlier on the line. So the allowlist holds `B=src; git diff > $B/x.patch` as `src/x.patch`. A variable the same line set to the checkout, such as `R=$(git rev-parse --show-toplevel)`, is read as the checkout (`hooks/tezgah_gate.py::known_tail`). The third is tezgah's own workspace under `.tezgah/`, such as research lines, lessons and briefs (`hooks/tezgah_gate.py::workspace_free`). The slice journal stays held. So does every shell write into `.tezgah/plans/open/`, because such a file could make itself the active task. A plan file stays held too when its text, once the write lands, carries a `phase:` line (`hooks/tezgah_gate.py::_text_after`). The gate judges the whole text, so two edits cannot each pass on their own. The record rule still refuses the active record there.
@@ -240,17 +240,22 @@ Three triggers, one per shape a credential takes on its way into a file (`hooks/
 
 Standing, no escape hatch, and outside `verify-off`.
 
-### Plan — a turn's third product file on `main`
-
-Trigger: a write tool, or a shell redirect/`tee` (`hooks/tezgah_gate.py::write_paths`), whose target is a product path, while the checkout holding that target is on `main` or `master` and this turn has
-already written two other product files into the same checkout (`hooks/tezgah_gate.py::plan_reason`, `hooks/tezgah_gate.py::_branch`, `hooks/tezgah_gate.py::_checkout`, `hooks/tezgah_gate.py::_product`). The branch comes from that checkout, not from the session's cwd. The
-count folds the turn's own write rows (`hooks/tezgah_integrity.py::turn_rows`) together with the files the call in hand names, so it needs no state of its own, and it counts DISTINCT
-paths - a turn that rewrites one file three times is still one file's work. The product paths are the ones at the repository root that a plan exists to scope - `hooks/`, `tests/`, `bin/`,
-`skills/`, `docs/`, `statusline.py` and `MANIFEST` (`PLAN_DIRS`/`PLAN_FILES` `hooks/tezgah_gate.py::PLAN_DIRS`, `hooks/tezgah_gate.py::PLAN_FILES`); a `.tezgah/` path is never one of them, and neither is a path outside any git
-repository. Told: the branch it read, how many files the turn has written, and the command that opens a plan - the `plan-add` skill, `/tezgah:plan-add <description>` (`PLAN_DENY`
-`hooks/tezgah_gate.py::PLAN_DENY`). Standing: only changing the tree's state changes it - the work moves to the `plan/NNN-slug` branch the skill creates (a one- or two-file fix is free either
-way), or the repository carries a `.no-plan-gate` mark (the shape of `.no-graph` and `.no-lessons`). It passes wherever the question cannot be answered: no session or ledger, a directory that is
-not a git repository, and a detached HEAD with no branch to name.
+### Plan — a turn's third product file on a branch no plan binds
+
+Trigger: a write tool, or a shell redirect/`tee` (`hooks/tezgah_gate.py::write_paths`), whose target is a product path, while the checkout holding that target is on a branch that binds no open plan
+and this turn has already written two other product files into the same checkout (`hooks/tezgah_gate.py::plan_reason`, `hooks/tezgah_gate.py::_branch`, `hooks/tezgah_gate.py::_checkout`,
+`hooks/tezgah_gate.py::_product`). The branch comes from that checkout, not from the session's cwd. A branch binds a plan when it is `plan/NNN-slug` for an open plan NNN, or when an open plan
+declares it in its `branch:` frontmatter (`hooks/tezgah_gate.py::_unplanned`, `hooks/tezgah_task.py::plan_of_branch`, `hooks/tezgah_task.py::declared_branches`). So `plan/999-nope` binds
+nothing, and Orca's `r1z4x/<slug>` branches bind by declaration. The task rule holds a bound checkout, by its plan's phase and allowlist. `main` and `master` never bind a plan, whatever a plan
+declares. The count folds the turn's own write rows (`hooks/tezgah_integrity.py::turn_rows`) together with the files the call in hand names, so it needs no state of its own, and it counts DISTINCT
+paths - a turn that rewrites one file three times is still one file's work. A product path is any path in the checkout, whatever the project's layout (`apps/`, `packages/`, `.maestro/` count as
+`hooks/` does). Tezgah's and git's own state does not count: `.tezgah/`, `.codegraph/` and `.git/` (`hooks/tezgah_gate.py::PLAN_SKIP`). Neither does a host's generated `agents/` set
+(`hooks/tezgah_gate.py::PLAN_AGENT_HOSTS`). A path outside any git repository never counts. Told: the branch it read, how many files the turn has written, and
+the command that opens a plan - the `plan-add` skill, `/tezgah:plan-add <description>` (`hooks/tezgah_gate.py::PLAN_DENY`). It also names the bind route: `tezgah-task start NNN --phase P --branch
+<branch>` writes the plan's `branch:` (`bin/tezgah-task::cmd_start`). The record rule refuses a hand edit of a phased record. Standing: only changing the tree's state changes it - the
+work moves to the `plan/NNN-slug` branch the skill creates or to a bound branch (a one- or two-file fix is free either way), or the repository carries a `.no-plan-gate` mark (the shape of
+`.no-graph` and `.no-lessons`). It passes while a merge or rebase is in progress (`MERGE_HEAD`, `rebase-merge/` or `rebase-apply/` in the checkout's gitdir, `hooks/tezgah_gate.py::_merging`):
+resolving conflicts is not new work. It passes wherever the question cannot be answered: no session or ledger, a directory that is not a git repository, and a detached HEAD with no branch to name.
 
 ### Ordering — a commit while the newest check failed
 
@@ -391,7 +396,7 @@ A rule is a refusal with a cause: something happened, the check was written, and
 only as a sentence inside each rule's own paragraph above. It is a table here instead, so it is one place and a machine reads it: `bin/tezgah-docs --citations`
 opens `docs/gate.md`, reads this table, and refuses a rule name the source can still produce with no row, and a row whose `pin` names a test that does not exist.
 The names are read off the source, not restated: the gate's rules are the `_deny(session_id, "<rule>", ...)` calls in `hooks/tezgah_gate.py`, and the Stop
-rule's triggers are the classes `_stop_block` returns, the four `_shape_block` and the six `_evidence_block` hand back included.
+rule's triggers are the classes `_stop_block` returns, the four `_shape_block` hands back and the six `_evidence_text` words for the temporal spec included.
 
 - `incident` — what produced the rule; `designed` where none is recorded. The ratio of incident-derived to designed rules is the maturity signal the research
   entry names, which is why the distinction is written down rather than smoothed over.
@@ -419,7 +424,7 @@ rule's triggers are the classes `_stop_block` returns, the four `_shape_block` a
 | `evidence tampered` | a terminated garbage line made `_parse` raise, and the guard then failed the Stop rule open for the turn; corrupting a `verify_fail` row was an allow route. A `verify_ok` appended with `python3 -c` licensed a claim (security-03), so a pass with no `began` row is an orphan (`hooks/tezgah_integrity.py::_pair`) | `hooks/tezgah_integrity.py::_parse` | `tests/test_integrity.py::test_a_damaged_ledger_blocks_a_done_claim_as_evidence_tampered` |
 | `check failed` | designed | the newest check failing is its own class; no incident recorded | `tests/test_integrity.py::test_failed_check_blocks` |
 | `partial failure` | designed | a failure the turn never resolved; no incident recorded | `tests/test_integrity.py::test_an_unresolved_failure_blocks_even_after_an_earlier_pass` |
-| `no ui_ok` | reading the fold the old way refused honest turns and named a screen check the turn had in fact run | `hooks/tezgah_integrity.py::_evidence_block` | `tests/test_integrity.py::test_a_green_unit_run_does_not_license_a_ui_change` |
+| `no ui_ok` | reading the fold the old way refused honest turns and named a screen check the turn had in fact run | `hooks/tezgah_stopspec.py::FORMULAS` | `tests/test_integrity.py::test_a_green_unit_run_does_not_license_a_ui_change` |
 | `stale evidence` | measured 2026-09-19: reading a rewrite as a change refused honest turns | `hooks/tezgah_integrity.py::_post_write` | `tests/test_integrity.py::test_a_write_after_the_check_makes_the_check_stale` |
 | `no verify_ok` | E2: 0 of 10 description-shaped claims refused before the `worked` trigger | `hooks/tezgah_integrity.py::_stop_block` | `tests/test_integrity.py::test_work_with_no_passing_check_is_refused_without_a_claim_word` |
 | `no external read` | two turns: "npm 0.22.0 is missing" off a stale client, and "make NPM_TOKEN an automation token" when it already was | `hooks/tezgah_integrity.py::_external_read_row` | `tests/test_integrity.py::test_an_external_claim_with_no_read_is_refused` |

package/docs/models.md

@@ -215,13 +215,20 @@ moved against the snapshot (`SNAPSHOT`, `hooks/tezgah_models.py::SNAPSHOT`;
 re-applies omp's overrides. Scores are not re-read - they need a key - so
 `tezgah-route --check` reports the snapshot's age and exits 1 past 60 days or with
 a flag (`check`, `hooks/tezgah_models.py::check`); that is the moment to re-read
-the leaderboards and edit `SLOTS`. `tezgah-route --mode anthropic|zai|any|auto|off` pins
+the leaderboards and edit `SLOTS`. `tezgah-route --mode anthropic|zai|any|openai|auto|off` pins
 omp's family instead of following the session default; `off` removes every entry
 and role the table wrote and writes nothing, which is the way back when the
 provider those selectors need has no budget - a measured case, not a
-hypothetical one. `tezgah-setup --install`
+hypothetical one. The switch reaches every routed agent in one command. It writes
+the table over a selector set by hand and names each one it replaced
+(`apply_omp`, `hooks/tezgah_models.py::apply_omp`). The automatic re-apply at
+session start leaves a hand-set selector alone. `tezgah-setup --install`
 writes omp's overrides and `--uninstall` removes only the `tezgah-*` entries; the
 omp status report carries a row for them.
+`openai` runs every routed agent on omp's `openai-codex` provider, a ChatGPT
+login (`OMP_OPENAI`, `hooks/tezgah_models.py::OMP_OPENAI`). Its ids are not the
+Codex host's `openai` column, which omp does not list. The mode is never a
+fallback for the others, and with no `openai-codex` login it writes nothing.
 
 ## Source of truth
 

package/docs/operations.md

@@ -701,11 +701,14 @@ background child. That child's SubagentStop closes it as `done`
 record settles from the newest child transcript in the parent's session dir.
 omp names a same-name re-dispatch `<name>-2.jsonl`. The last 64 KB of that file
 decide `stopped` or `done` (`hooks/tezgah_task.py::pending`). A record
-nothing moved for six hours closes `stale`, and a background `job` after
-omp's 3600 s deadline. Codex reports no child end tezgah can see, so its
-records end `stale`. Every prompt lists up to three pending records, newest
-first, each with the command that resumes it (`hooks/tezgah_task.py::slice_lines`).
-They are the records this session spawned or nobody owns, such as one opened by hand. The resume block at
+nothing moved for six hours closes `stopped` with no failure class. It stays
+owed, because an end this machine cannot see is not a finished slice. A
+background `job` past omp's 3600 s deadline closes `stale`, since the parent
+transcript already holds its result. Codex reports no child end tezgah can see,
+so its records take the `stopped` path too. Every prompt lists up to three
+pending records, newest first, each with the command that resumes it
+(`hooks/tezgah_task.py::slice_lines`). They are the records this session spawned
+or nobody owns, such as one opened by hand. The resume block at
 session start and after a compaction adds one line that counts the other
 sessions' records. `tezgah-task slice reconcile` lists them all.
 
@@ -718,6 +721,7 @@ sessions' records. `tezgah-task slice reconcile` lists them all.
 | `tezgah-task slice stats [--window DAYS] [--json]` | counts records per status, failure class and host. A `class+host` signature with 3 or more events is an RSI lever candidate, and so is one with 5% of a window that holds 20 or more slices. The line names the lever |
 | `tezgah-task slice board [--parent P]` | lists the open slices one parent spawned - the session's own, or for a subagent its parent's - newest first: the `Owns:` globs, worktree, branch and last commit of each, bounded to 12 lines (`hooks/tezgah_task.py::board`) |
 | `tezgah-task slice merge-plan [--base REF]` | forecasts every done slice branch that carries unmerged work against REF (HEAD) and against the others with `git merge-tree`, and leaves out a `merge=union` file such as CHANGELOG.md. A branch touching `MANIFEST` or the citation baseline comes last, the rest fewest conflicts first. A branch merge-tree cannot forecast is printed as `not judged` and the exit is 1 (`bin/tezgah-task::merge_plan`) |
+| `tezgah-task sweep` | one idempotent pass over what the last session left behind: every pending slice as one line with its resume command, the landed worktrees and branches `reconcile --prune` removes, and a `phase:` whose branch is gone while the record carries a `checkpoint` (`bin/tezgah-task::cmd_sweep`). It prints the pending slices rather than closing them, and a second run reports `0 change(s)` |
 
 `tezgah-task review NNN <reviewer> approve` refuses while an open, stopped or
 stale record names that reviewer as its id, agent or spawned name. Under

package/docs/testing.md

@@ -17,6 +17,12 @@ ruff check .                                              # lint; config in pypr
 [`CONTRIBUTING.md`](../CONTRIBUTING.md) repeats the same three before a pull
 request (`CONTRIBUTING.md:15-20`).
 
+`bin/tezgah-optimize next` decides which checks a change owes, and when
+(`AGENTS.md`, "Checks, by tier"). It spends a green row for the same change on a
+clean tree. It defers a command whose recorded median is at or above 105 s to the
+merge step. Everything else runs now. `bin/tezgah-optimize push` coalesces the CI
+run: one push per change.
+
 | Check | What it catches that the other two do not |
 |---|---|
 | `compileall` | A syntax error in any `.py` under `hooks/` and `hosts/`, plus `statusline.py`, without running a line of it and with no environment set up. The `bin/` CLIs are Python sources with no `.py` suffix, so only running one compiles it (`test_setup.py::SetupBase.setup`). |
@@ -109,11 +115,13 @@ generates the gate half: one `gate-<rule>` mutant per rule `decision` refuses wi
 It reads HEAD with the AST reader of the `--citations` rule check. Each mutant turns
 every `return _deny(...)` of its rule into `pass` at its line span.
 The script generates the Stop half too. Each `return ("<class>", ...)` site of
-`_stop_block`, `_shape_block` and `_evidence_block` gets one `stop-<class>` mutant. Hand-written
-rows cover the guards around those classes: the pass predicate, the empty-run
-read and the "doğrulanmadı" clear. The lost call, the bookkeeping and idle-turn
-fallbacks and the refusal row have rows too. The shortcut half is still
-hand-written (`MUTANTS`), so a new guard there needs a row.
+`_stop_block`, `_shape_block`, `_evidence_text` and `_residual_block` gets one
+`stop-<class>` mutant. Hand-written rows cover the guards around those classes:
+the pass predicate, the empty-run read and the "doğrulanmadı" clear. The lost
+call, the unseen pass, the bookkeeping and idle-turn fallbacks and the refusal
+row have rows too. So do the two guards of the spec's decision list. The
+shortcut half is still hand-written (`MUTANTS`), so a new guard there needs a
+row.
 Each mutant first runs alone the test that killed it last time, read from
 `tests/neuter_killers.json`. When that test passes or is gone, the mutant runs
 every module in its own HOME and TMPDIR. The module that reads the mutated file
@@ -132,15 +140,11 @@ opencode plugin's ports. That step runs even when the core step failed.
 (`tests/fuzz_shell.py::main`). So a reader that misreads a bash 5 line fails
 the leg instead of printing a count. `tests/test_packaging.py` pins the job.
 
-The Stop rule's temporal spec (`hooks/tezgah_stopspec.py`, plan 063) has its own
-local script, `tests/stop_spec_eval.py`. `--replay` judges plan 055's replayed
-Stop events with both folds and reads GO 2 only on the events whose selector
-reached the fold. `--shadow-rows` reads the live `stop_spec` rows the same way.
-`--timing` times both folds in-process. `--stop-cost` times the whole
-`stop_reason`, shadow on and off, on copies of the real ledgers. `--mutants`, also reached through
-`tests/neuter_matrix.py --stop-generated`, runs seeded mutants of the formula
-table through the in-process Stop tests of `tests/test_integrity.py`. On any
-suite run, `TEZGAH_STOPSPEC_STRICT=1` fails the test that reached a disagreement.
+The Stop rule's temporal spec (`hooks/tezgah_stopspec.py`, plan 063) decides
+classes 5-10. Its formulas have their own local script, `tests/stop_spec_eval.py`.
+`--mutants`, also reached through `tests/neuter_matrix.py --stop-generated`, runs
+seeded mutants of the formula table through the in-process Stop tests of
+`tests/test_integrity.py`.
 
 The plan report (`render_table.py --acceptance --strict`) is not in CI: it reads
 the gitignored `.tezgah/`, so on a runner it reads nothing and cannot fail. Run

package/hooks/lang/en.json

@@ -211,6 +211,9 @@
   "never_default": [
    "force[- ]?push\\w*|--force\\b|rewrit\\w* (?:the )?history|reset --hard|\\bdelet\\w*|\\bdrop (?:the )?(?:table|database|volume)s?|unpublish\\w*|deprecat\\w*|production|\\bprod\\b|migrat\\w*|credential\\w*|password\\w*|secret\\w*|api key|\\baccount\\w*|e-?mail|send (?:it |this |them )?to\\b"
   ],
+  "plan_build": [
+   "\\bplans?\\b[^.?!\\n]{0,40}\\b(?:is ready|ready|written|drafted)\\b|\\b(?:wrote|opened|drafted|added|created) (?:the |a |this )?plans?\\b|\\b(?:build|implement|execute|start on|start) (?:the |this |that )?plans?\\b"
+  ],
   "spend": [
    "spend\\w*|\\bpaid\\b|billing|\\bcost\\w*|\\bbudget\\w*|\\busd\\b|\\$\\s?\\d"
   ],

package/hooks/lang/tr.json

@@ -255,6 +255,9 @@
   "never_default": [
    "zorla|geçmiş\\w* (?:yeniden yaz|değiştir)\\w*|\\bsil\\w*|kaldır\\w*|yok et\\w*|üretim\\w*|\\bcanlı\\w*|\\bprod\\w*|göç\\w*|kimlik bilgi\\w*|şifre\\w*|parola\\w*|\\bhesa[bp]\\w*|e-?posta\\w*|gönder\\w*"
   ],
+  "plan_build": [
+   "\\bplan\\w*[^.?!\\n]{0,40}(?:hazır|yazıldı|yazdım|oluşturdum|oluşturuldu|açtım|açıldı|eklendi|uygula\\w*|başla\\w*|kur\\w*)|(?:yazdığım|açtığım|hazırladığım|oluşturduğum) plan\\w*"
+  ],
   "spend": [
    "ücret\\w*|ödeme\\w*|harca\\w*|bütçe\\w*|maliyet\\w*|\\bpara\\b|dolar\\w*|\\$\\s?\\d"
   ],

package/hooks/tezgah_context.py

@@ -33,9 +33,11 @@ from tezgah_paths import (CACHE, CONTEXT_NUDGE_TOKENS, REPO_MARKS, SWITCHES,
                           ai_research_dir, alts, armed,
                           cache_dir, codegraph_bin, consult_options,
                           ensure_workspace, fallback_cache, have_judge_key, language,
+                          link_workspace,
                           off, orx_bin, packs, pony_level, project_top, root_for,
                           roots, say, tool,
-                          workspace, workspace_from_repo, worktrees, writable_dir)
+                          work_tree, workspace, workspace_from_repo, worktrees,
+                          writable_dir)
 
 try:  # The task record is the active plan's frontmatter (see tezgah_task), read
     # once per user prompt for the phase line. The module is newer than some
@@ -537,18 +539,22 @@ def open_plans(root):
 def sibling_line(root):
     """One line naming every checkout of this repository, or "" when it has one.
     The main checkout's `.tezgah` is the repository's one workspace (plan 097),
-    named with its open plan and research line counts. A linked checkout whose
-    own `.tezgah` still holds data is named with what it holds, because `git
-    worktree remove` deletes it with the checkout. Fork-free (the pinned
-    session-start git budget): `worktrees` reads `.git/worktrees/*/gitdir`, and
-    the counts are directory listings."""
+    named with its open plan and research line counts; a bare repository's git
+    directory holds it in the main checkout's place (plan 098), and is named as
+    that, not counted as a checkout. A linked checkout whose own `.tezgah` still
+    holds data is named with what it holds, because `git worktree remove`
+    deletes it with the checkout. Fork-free (the pinned session-start git
+    budget): `worktrees` reads `.git/worktrees/*/gitdir`, and the counts are
+    directory listings."""
     checkouts = worktrees(root)
     here = os.path.realpath(root)
     if here not in checkouts:
         checkouts.append(here)
-    if len(checkouts) < 2:
-        return ""
     main = checkouts[0]
+    bare = not os.path.lexists(os.path.join(main, ".git"))
+    if len(checkouts) - bare < 2:
+        return ""
+    owner = "the bare repository" if bare else "the main checkout"
     items = []
     for checkout in checkouts:
         ws = workspace(checkout)
@@ -566,19 +572,20 @@ def sibling_line(root):
             except OSError:
                 held = []
             lines = tezgah_research.slugs(checkout) if held else []
-            state = ("uses the main checkout's `.tezgah`" if not held else
+            state = ("uses %s's `.tezgah`" % owner if not held else
                      "its own `.tezgah` still holds %s, which `git worktree remove` "
                      "deletes: move each research line with `%s import %s <slug>` "
-                     "from the main checkout, and the rest by hand"
-                     % (", ".join(held), tool("tezgah-research"), checkout))
+                     "from %s, and the rest by hand"
+                     % (", ".join(held), tool("tezgah-research"), checkout,
+                        "another worktree" if bare else "the main checkout"))
             if lines:
                 state += " (lines: %s)" % ", ".join(lines)
         items.append("%s (%s%s)" % (checkout, "this checkout, " if checkout == here
                                     else "", state))
-    return ("Worktrees: %d checkouts of this repository share the main checkout's "
-            "`.tezgah` - plans, lessons, research and analysis are written there, "
-            "never into a worktree's own: %s. Detail: `%s --all`."
-            % (len(checkouts), "; ".join(items), tool("tezgah-research")))
+    return ("Worktrees: %d checkouts of this repository share %s's `.tezgah` - "
+            "plans, lessons, research and analysis are written there, never into a "
+            "worktree's own: %s. Detail: `%s --all`."
+            % (len(checkouts) - bare, owner, "; ".join(items), tool("tezgah-research")))
 
 
 def task_line(task):
@@ -1274,11 +1281,14 @@ def session_of(payload):
 # Moved again on 2026-10-12 (plan 086, S3): the integrity paragraph carries
 # the Ask policy (+913 B of core), and at 14500 B the healthy fixture gave up
 # its lessons, plans or knowledge block (235-338 B), so the session budgets
-# move to 15500 B. A
+# move to 15500 B. Moved again on 2026-10-13 (plan 105): the fidelity rule says
+# a research, analysis, review or plan ask ends at the plan (+105 B of core), and
+# the fixture's subagent brief reached 5500 B exactly, so subagent_start moves to
+# 5800 B. A
 # budget in bytes, not tokens: this file has no tokenizer and a wrong estimate
 # would be worse than a bound.
 CONTEXT_BUDGET = {"session_start": 15500, "post_compact": 15500,
-                  "subagent_start": 5500, "user_prompt": 6500}
+                  "subagent_start": 5800, "user_prompt": 6500}
 DEFAULT_BUDGET = 13000
 # The blocks in the order they are given up when the budget is exceeded, lowest
 # value first: text another surface already carries (the plan table lives in the
@@ -1569,7 +1579,8 @@ def context_nudge(payload, session_id):
 
 # The ledger kinds a hook other than the tool hooks writes: the prompt hook's
 # turn marker, judge row, lesson rows and disarm row, the Stop hook's claim,
-# refusal, after_block, shape and stop_spec rows, the subagent-end hook's subagent_end row,
+# refusal, after_block and shape rows and the stop_spec rows of plan 063's shadow
+# (old ledgers only), the subagent-end hook's subagent_end row,
 # compaction, the subagent mark and the `subagent_start` lineage row (both from
 # SubagentStart), the omp fork's `forked` row, the guard's crash
 # row (any hook), the damage row any reader writes and the session start's
@@ -2254,7 +2265,10 @@ def context_for(event, cwd, payload=None, with_core=True):
         # the project and given its private git before anything writes there.
         # A root is not a project, and the helper returns None outside a work tree.
         if ws not in roots():
-            ensure_workspace(ws)
+            # never link to a `.tezgah` ensure_workspace refused: one the
+            # project tracks or a link the clone placed (review of plan 100)
+            if ensure_workspace(ws) and ws != root:
+                link_workspace(root, ws)
         # The live turn state, first in this region: on a compacted or resumed
         # session it is the one thing the rest of the block cannot re-derive.
         resume = resume_state(root, session_of(payload))
@@ -2329,7 +2343,9 @@ def context_for(event, cwd, payload=None, with_core=True):
         # bulk import at most daily (tezgah_store.import_later).
         if event == "session_start":
             tezgah_store.import_later(cache_dir())
-        broken = tezgah_research.failing(ws) if not off("research-off") else []
+        # the line's cited files are the session checkout's in a bare repository
+        broken = (tezgah_research.failing(ws, code=work_tree(ws, root))
+                  if not off("research-off") else [])
         if broken:
             line_slug, err = broken[0]
             parts.append(("research_broken",

package/hooks/tezgah_gate.py

@@ -1549,7 +1549,8 @@ TASK_SCOPE_OUTSIDE = (
 TASK_RECORD_DENY = (
     "Task gate: %s is the active task's own record; only `tezgah-task` writes it, checking the plan's "
     "Acceptance, spike and review on the way. The phase and allowlist: `tezgah-task phase|allow`; an "
-    "Acceptance box: `tezgah-task tick NNN <n>`; State/Next: `tezgah-task note NNN state|next \"...\"`.")
+    "Acceptance box: `tezgah-task tick NNN <n>`; an item the owner accepted unmet: "
+    "`tezgah-task unmet NNN <n> \"<reason>\"`; State/Next: `tezgah-task note NNN state|next \"...\"`.")
 # The shapes that make a shell command a write, for the phase rule below. The
 # tools are not the only way to change a file, and E7b measured the other one:
 # with `edit` and `write` refused twelve and six times, the armed arm wrote the
@@ -2222,7 +2223,7 @@ def shell_write_body(command, cwd=None):
 # reported done unless the output was seen - given a mechanical half at the one
 # moment a claim is written into the repository's history.
 #
-# The reader is the Stop rule's own fold over the tail (`_last_verify` on the
+# The reader is the newest-check fold the Stop rule's `check failed` class asks (`_last_verify` on the
 # last ORDER_TAIL rows), and the rule is structurally incapable of firing in
 # either direction that would punish honest work: no check at all folds to None
 # and a passing newest check folds to "ok", so a commit in a session that ran no
@@ -2412,15 +2413,20 @@ def ready_advice(tool, session_id, cwd=None):
     return READY_WAIT % (len(heads), "; ".join(cut(h, 48) for h in heads[:3]))
 
 
-# --- plan required: work that spans files on main has no plan ----------------
+# --- plan required: work that spans files on an unplanned branch -------------
 # What this closes: a turn that wrote four product files - a hook, its tests, its
-# docs and the changelog - straight onto `main`, with the plan opened afterwards.
-# The task rule constrains a write only through a record the user made, so with
-# no active task every product write passes and "work for a plan happens on its
-# branch" is advice rather than a mechanism. Here the checkout is the record: on
-# `main`/`master` the third distinct product file a single turn writes is
-# refused, while a one- or two-file fix stays free - a plan is what makes work
-# that spans files reviewable and closeable.
+# docs and the changelog - straight onto `main`, with the plan opened afterwards;
+# and Orca worktrees on `r1z4x/<name>` that built five branches of work with no
+# plan at all (plan 105). The task rule constrains a write only through a record
+# the user made, so with no active task every product write passes and "work for
+# a plan happens on its branch" is advice rather than a mechanism. Here the
+# checkout is the record: on a branch that binds no open plan the third distinct
+# product file a single turn writes is refused, while a one- or two-file fix
+# stays free - a plan is what makes work that spans files reviewable and
+# closeable. A branch binds a plan when it is `plan/NNN-*` or an open plan
+# declares it in `branch:` (`tezgah_task.plan_of_branch`); such a checkout is
+# the task rule's to hold. `main`/`master` never bind one, whatever a plan
+# declares: the trunk is where unplanned work lands.
 #
 # The count is a fold over the turn's own write rows (`turn_rows`), so it needs
 # no state of its own, and the call in hand contributes the files it names before
@@ -2428,32 +2434,41 @@ def ready_advice(tool, session_id, cwd=None):
 # itself.
 #
 # Fail-open wherever the question cannot be answered: no session, no ledger, a
-# checkout that is not a git repository, a detached HEAD (no branch to name), and
-# a repo carrying the `.no-plan-gate` mark all pass - the direction every rule
-# here takes, because a refusal has to rest on something a reader can check.
+# checkout that is not a git repository, a detached HEAD (no branch to name), a
+# missing task module (no binding to read), and a repo carrying the
+# `.no-plan-gate` mark all pass - the direction every rule here takes, because a
+# refusal has to rest on something a reader can check. A merge or rebase in
+# progress passes too: resolving its conflicts is not new work that spans files,
+# and neither way out the refusal names fits it.
 #
 # ponytail: a PRIOR write recorded through the shell is a `run` row whose detail
 # is the command, so it is not counted; only the call in hand contributes a shell
 # target (`write_paths` reads the redirect). The turn this rule answers is the
 # write-tool turn, and reading a shell command's target off a stored command line
 # would be a second reader of the same table, not a new fact.
-PLAN_BRANCHES = ("main", "master")
+PLAN_TRUNKS = ("main", "master")
 # The product paths the count reads, relative to the checkout holding the write:
-# the code and docs a plan exists to scope. `.tezgah/` - and every other
-# directory - is not one of them, and neither is a path outside any git checkout
-# or a checkout outside every configured root (a scratch fixture repo).
-PLAN_DIRS = ("hooks", "tests", "bin", "skills", "docs")
-PLAN_FILES = ("statusline.py", "MANIFEST")
+# every path of the project, whatever its layout (ServisTek's unplanned merges
+# wrote `apps/`, `packages/` and `.maestro/`, review of plan 105), except what
+# tezgah or git keeps there - the workspace, the graph index, git's own
+# directory and the generated agent sets. Neither is a path outside any git
+# checkout or a checkout outside every configured root (a scratch fixture repo).
+PLAN_SKIP = (".tezgah", ".codegraph", ".git")
+PLAN_AGENT_HOSTS = (".claude", ".codex", ".cursor", ".opencode")   # their agents/
 # The third file: two writes in a turn are a fix, three are work that spans files.
 PLAN_WRITES = 3
+# git's marks of an operation in progress, in the checkout's own gitdir
+PLAN_MERGING = ("MERGE_HEAD", "rebase-merge", "rebase-apply")
 PLAN_DENY = (
-    "This turn has written %d distinct product files while the checkout is on "
-    "`%s`. Work that spans files on `main`/`master` has no plan to review or "
-    "close, so the third product file in one turn is refused: open a plan with "
-    "the `plan-add` skill (`/tezgah:plan-add <description>`) and do the work on "
-    "the `plan/NNN-slug` branch it creates. A one- or two-file fix stays free. "
-    "Only `hooks/`, `tests/`, `bin/`, `skills/`, `docs/`, `statusline.py` and "
-    "`MANIFEST` are counted; a `.tezgah/` path never is.")
+    "This turn has written %(count)d distinct product files while the checkout is "
+    "on `%(branch)s`, a branch that binds no open plan. Work that spans files there "
+    "has no plan to review or close, so the third product file in one turn is "
+    "refused: open a plan with the `plan-add` skill (`/tezgah:plan-add "
+    "<description>`) and do the work on the `plan/NNN-slug` branch it creates, or "
+    "bind this branch to the open plan with `tezgah-task start NNN --phase P "
+    "--branch %(branch)s` (it writes the plan's `branch:`). A one- or two-file fix "
+    "stays free. Every path in the checkout counts except `.tezgah/`, "
+    "`.codegraph/`, `.git/` and the generated `<host>/agents/` sets.")
 
 
 def _gitdir(root):
@@ -2566,7 +2581,8 @@ def _checkout(path, cwd):
     session on `main` writing into a linked worktree on a plan branch is plan
     work, and one on a plan branch writing into a `main` checkout is not. A
     relative path is resolved against the call's own `cwd`."""
-    text = str(path or "").strip()
+    # `~/x` is a home path, not one under the cwd (plan 106)
+    text = os.path.expanduser(str(path or "").strip())
     if not text or not cwd and not os.path.isabs(text):
         return None
     full = os.path.realpath(os.path.join(cwd or "", text))
@@ -2582,15 +2598,38 @@ def _checkout(path, cwd):
 
 
 def _product(rel):
-    """True when a checkout-relative path is one a plan exists to scope."""
+    """True when a checkout-relative path is project work a plan exists to
+    scope: anything but `PLAN_SKIP` and a host's generated `agents/` set."""
     parts = rel.split(os.sep)
-    return parts[0] in PLAN_DIRS or len(parts) == 1 and parts[0] in PLAN_FILES
+    return parts[0] not in PLAN_SKIP and not (
+        parts[0] in PLAN_AGENT_HOSTS and len(parts) > 2 and parts[1] == "agents")
+
+
+def _merging(top):
+    """True while a merge or rebase is in progress in the checkout at `top`:
+    git's mark of it stands in the checkout's own gitdir."""
+    gitdir = _gitdir(top)
+    return bool(gitdir) and any(os.path.exists(os.path.join(gitdir, mark))
+                                for mark in PLAN_MERGING)
+
+
+def _unplanned(branch, top):
+    """True when `branch`, checked out at `top`, binds no open plan of its
+    repository: a trunk always, else neither `plan/NNN-*` nor a branch an open
+    plan declares. An empty branch or a missing task module cannot be read, and
+    reads as planned (fail-open)."""
+    if branch in PLAN_TRUNKS:
+        return True
+    if not branch or tezgah_task is None:
+        return False
+    return tezgah_task.plan_of_branch(branch, linked_main(top) or top) is None
 
 
 def plan_reason(inp, cwd, session_id):
     """A deny reason when this write would be a turn's third distinct product
-    file in a checkout on `main`/`master`, else None. The section above carries
-    the trigger, the counted paths and the fail-open direction."""
+    file in a checkout on a branch that binds no open plan, else None. The
+    section above carries the trigger, the counted paths and the fail-open
+    direction."""
     if not session_id or turn_rows is None:
         return None
     targets = {}
@@ -2603,8 +2642,8 @@ def plan_reason(inp, cwd, session_id):
     rows = None
     for top, written in targets.items():
         branch = _branch(top)
-        if branch not in PLAN_BRANCHES \
-                or os.path.exists(os.path.join(top, ".no-plan-gate")):
+        if os.path.exists(os.path.join(top, ".no-plan-gate")) \
+                or not _unplanned(branch, top) or _merging(top):
             continue
         if rows is None:
             # a row's `target` is already absolute against the cwd it was
@@ -2614,7 +2653,7 @@ def plan_reason(inp, cwd, session_id):
         written |= {rel for hit in rows if hit and hit[0] == top
                     for rel in (hit[1],) if _product(rel)}
         if len(written) >= PLAN_WRITES:
-            return PLAN_DENY % (len(written), branch)
+            return PLAN_DENY % {"count": len(written), "branch": branch}
     return None
 
 
@@ -3577,8 +3616,8 @@ def decision(tool, inp, cwd, session_id=None, record=True, agent=None):
     body = inp if t in WRITE_TOOLS else shell_body
     if body and secret_edit(body, cwd):
         return _deny(session_id, "secret", SECRET_EDIT_DENY, tool, inp, base)
-    # Plan required: the turn's third product file while the checkout is on
-    # main/master (see plan_reason). Below the task, workspace and secret rules,
+    # Plan required: the turn's third product file while the checkout is on a
+    # branch no open plan binds (see plan_reason). Below the task, workspace and secret rules,
     # because each names a more specific fault in the same write, and above the
     # repeat guards, because it is the call that is refused and not a repeat of
     # one. Standing: only changing the tree's state changes it.