@sabaiway/agent-workflow-kit 14.1.0 → 14.2.0

package/CHANGELOG.md

@@ -4,6 +4,41 @@ Semantically versioned ([semver](https://semver.org)), newest first. The `versio
 is the current release. `upgrade` mode reads a project's `docs/ai/.workflow-version` and applies
 every `migrations/<version>-<slug>.md` newer than it, in semver order.
 
+## 14.2.0 — a task thread is measured over its own files: file-disjoint tasks of one checkpoint run as a wave, `open` refuses `task-files-scope`, `return` and `fold` refuse `out-of-files`, and `checkpoint restore <oid> --nonce <n>` undoes one task (AD-146)
+
+**Tasks can now run side by side.** In 14.1.0 a delegation thread could name its task, but it was still measured over
+the whole tree, so a second task's edits spoiled the first one's fingerprints and only one exec dispatch could run at a
+time. From 14.2.0 a task thread is measured over the files its brief lists, so tasks whose files do not overlap can run
+on one checkpoint at once, each on its own codex session. Untasked threads measure and restore exactly as in 14.1.0.
+Story S9 of the epic `EPICS-STORIES-TASKS-AS-THE-UNIT-OF-WORK`; the contract `docs/ai/specs/kit/task-thread/` is now
+live.
+
+**Before you upgrade:** close every task thread opened under 14.1.0. A thread opened there is measured under two rules
+and is not guaranteed to refuse. To undo a stray change: inside the files of a task thread closed without a fold, run
+that thread's task restore on its own checkpoint; otherwise close every thread and run the whole-tree `restore <oid>`.
+
+- **The files scope (`tools/dispatch-baseline.mjs`, `tools/dispatch-store.mjs`, `tools/exec-producer.mjs`).** The
+  base-relative diff, payload, fingerprint and clean probe take the thread's file list; the store fingerprint, the
+  returned-object enumeration and the returned diff pass it. Without a list every value is byte-identical to 14.1.0.
+- **`dispatch open --task` refuses `task-files-scope`** for a listed path a task may not claim, naming the path and
+  its kind.
+- **`dispatch return` and `fold` refuse `out-of-files`** for a task thread, naming every changed path that no open or
+  folded task thread on the same checkpoint lists (since the last commit); they fail closed on an undecidable domain or
+  an unreadable ledger.
+- **`task-brief check` tolerates a wave.** A checkpoint dirtied only in files that other open or folded task threads on
+  it list (since the last commit) still passes; dirt in the brief's own files or in a path no such thread lists refuses
+  `checkpoint-stale`, and an unreadable ledger refuses with its reason.
+- **`checkpoint restore <oid> --nonce <n>`** (`tools/checkpoint-restore.mjs` exports `restoreTaskThread`) restores
+  exactly one closed task thread's files and leaves every other path alone; it refuses `open-thread`, `task-folded` and
+  `task-target` in the contract's states, proves the result with git's own diff (external diff helpers and textconv off)
+  and prints `checkpoint restore <oid> task <n> proof clean`. The whole-tree `restore <oid>` is unchanged.
+- **Copy.** `DISPATCH_CONTRACT` and the dispatch mode doc gain the task clause; D10 is stated as a bar for untasked
+  threads and a mechanism for task threads in the mode doc, the module comment and HELP, and `await`'s no-slot message
+  no longer restates it; the README's dispatch row names both refusals.
+- **Tests.** New suites `dispatch-baseline.test/files-scope.test.mjs`, `dispatch.test/task-scope.test.mjs`,
+  `dispatch.test/task-wave.test.mjs` (two tasks, two sessions, no degrade) and `checkpoint.test/task-restore.test.mjs`;
+  six wave cases in `task-brief.test.mjs`.
+
 ## 14.1.0 — a dispatch names its task: `dispatch open --task <brief>` records the brief and its files, the ledger refuses overlapping and mixed task threads (`files-overlap`, `mixed-open`), and the held-session judge holds one session per task instead of one per commit (AD-145)
 
 **A held session now belongs to a task.** Until 14.0.0 the held-session judge kept ONE held session per commit, so a

package/README.md

@@ -245,7 +245,7 @@ file), or run the guarded `/agent-workflow-kit uninstall`.
 | `/agent-workflow-kit commit-guard` | any time | **the read-only pre-commit guard** (D10) — makes the commit capture the whole current working tree, so «verified» and «about to be committed» are the same bytes (the receipt itself has a stated residual — see the mode doc). FIRST it refuses an **INDEX that lags the verified working tree** (the gates and the fingerprint describe the WORKING tree while `git commit` takes the INDEX alone, and the fingerprint cannot tell them apart — so a lagging index used to ship a strict subset of what was verified): unstaged tracked paths or reviewable untracked-not-ignored paths, named up to a bounded cap with the remainder stated, a dirty tracked **submodule** named separately with its own recovery, and fail-closed on an undecidable probe. This deliberately blocks a partial commit. Then it binds the LATEST completed `run-gates --final` receipt to the EXACT current tree: refuses on a missing/red/stale receipt, fingerprint drift under the run, a dangling later attempt, declaration content drift, evidence-hash or lcov drift, or unsatisfied review obligations (the same review-state decision, recomputed over a sanitized env — forged out-of-repo stores never satisfy). Re-runs NO gate or test. Wire it into `.git/hooks/pre-commit` (the installer writes the RESOLVED invocation). `git commit --no-verify` stays the stated residual. |
 | `/agent-workflow-kit recommendations` | any time (every `upgrade` ends with it) | **read-only deployment advisor** (AD-044) — computes what in THIS deployment is configured sub-optimally (allowlist not seeded, autonomy render drifted, OS sandbox unavailable, gates undeclared, bridge friction, sandbox-mask clutter, an unacknowledged sandbox recipe, a feature-spec layer never adopted) and renders **verdict-first**: one composed verdict line (does anything need attention?), then each item as **{severity · what · one-line benefit · an optional `recipe:` line (the sandbox-lane live recipe, the worktrees-dir hand-apply-first grant advice, the agents hidden-mode reconcile follow-up, or the spec-adoption decline preview) · the exact consent-gated apply one-liner}**. The agent PRESENTS the section in the user's conversational language — every fact and count, nothing added or dropped; commands, paths, hosts and rule strings byte-exact; raw tool block on request — and runs EXACTLY the rendered one-liners only on your yes, surfacing each item's posture note first. Renders **present-even-when-empty** (`no recommendations — flow optimal.`); a failed probe degrades to a stated skip line. Registry strings are fact-true frozen one-line data (posture/risk notes live in the mode doc at the consent moment); the kit never seeds `sandbox.network.allowedDomains` / `filesystem.allowWrite` (**HAND-APPLY** territory), and the sandbox-lane item's convergence is a neutral fingerprint acknowledgement recorded by a consent-gated ack writer into `docs/ai/acks.json` — never a security key (the recipe is documented per bridge in `capability.json` `networkHosts` + `writableDirs`). `--cwd` is required (the target project is explicit); never writes, never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit doc-parity` | any time | **read-only doc-parity lint** (AD-049) — kills the doc-drift class where a mode-contract doc silently lags a code constant (a `--check` doc still reading `300` after the diff cap moved to `400`): a **closed, exported registry** binds each live constant (review caps, schema versions, the ledger's own class/scope vocabulary, and the autonomy-doctor EXIT/status/trusted-dir contract) to the exact token its `references/modes/*.md` contract must carry, and asserts the CURRENT value renders into every bound file — a drifted doc, an unreadable file, or an absent token **fails closed**. The values are sourced from the live imports (never re-typed), so the lint can't itself go stale; adding a binding is adding a checked entry (closed-world, edit-safe). `--check` is a gate exit code for `docs/ai/gates.json`. Never writes, never commits, never runs a subscription CLI. |
-| `/agent-workflow-kit dispatch` | any time | **the delegation engine** — makes "how much does delegating a sub-task actually buy?" a measured number instead of a feeling. `check <file>` validates a sub-task brief's contract block and exits 0/1 naming the first violated field — **form only**: whether the task is genuinely bounded, its design decided and its acceptance adequate stays your judgment, and a well-formed absurdity passes here by construction. `advise --step-class <c>` answers the question that comes BEFORE that one — which vehicle should carry this kind of sub-task, whether it is even present on this machine, and what the ledger has already recorded for threads of that class (finished, failed, closed without a fold, and still open — counted separately) — and it decides nothing: it refuses no dispatch, gates no verb, and a choice that diverges from the advice is noted rather than blocked. It reads the filesystem only: nothing is launched to find out what is installed, an absent ledger prints "no recorded history", an unreadable one prints the store's own words, and either way the advice still prints. The same block appears as a footer under a form-valid `check` — never under a refusal, so it can never hide one. `register` pre-registers an acceptance wave (step classes, pairing key, minimum observations per class, the mean and first-pass thresholds) so the bar can never be chosen after the results it judges — immutable per wave. `observe` records ONE hand-written observation (`solo-construction`, the baseline whose ratio is 1 by construction — except over a scope measuring zero bytes, which has no ratio at all and is recorded ineligible by name — or `self-reported`) — delegated numbers are never hand-written, they are derived. The writer verbs are where that derivation happens: `open` puts a delegated thread on the record with every mint-time field copied from the brief's own header, refusing a deadline the wrapper's cap plus its kill grace would not fit inside, and recording whether the tree it started from was clean against the thread's base — HEAD by default, or the tree `--checkpoint <oid>` names, so the second task of a story is measured over the first one's uncommitted work instead of opening dirty (a dirty one makes the result honestly unmeasurable rather than quietly counted), while `--task <brief>` also records which task brief the thread carries out and the files that brief lists, refusing, since the last commit, a task thread whose files overlap by path prefix those of an open task thread or of a folded thread of another brief (`files-overlap`), and a mix of the two kinds — an untasked open beside an open task thread or, for a `code` open of backend `codex`, after a task fold, and a task open beside an open untasked thread (`mixed-open`); `await` waits for that one dispatch to answer and writes nothing — only the finished receipt satisfies it, a run still holding the nonce means keep waiting, and a wait that runs out says so with its own exit code, names whether the deadline or your own timeout ended it, and authorizes nothing: a wait that ended without an answer is a question for you, never permission to dispatch again; `return` absorbs the receipt the wrapper minted — only a finished one, checked against the contract it actually ran, its deadline and its own report, and refused outright when the tree hides changes from git or moves while the return is being computed — and derives the bytes from git rather than from anyone's claim; `fold` is the acceptance, and it refuses if the tree moved since the return — precisely, it re-confirms **equality of the visible canonical payload**, which is a change detector rather than a cryptographic identity of the tree: under the default head base that payload's untracked section is unframed and carries no file mode, so a content or symlink target that imitates the marker opening the next entry can alias two trees, and making an untracked file executable moves nothing (both named as residuals in the mode doc, with the fix queued); under a checkpoint base it is one indexed diff that carries modes. A change set carrying a binary, a non-regular path, a submodule, or a symlink whose target is not valid UTF-8 is **refused** at `return` and `fold` — CONSERVATIVELY, rather than promise what the default head payload may not be able to follow — and the same refusals hold for a checkpoint thread. `degrade` closes a thread that never earned a fold, on the record and with its reason. `aggregate` prints one wave: the registered thresholds, every observation as context, and per step class the finished threads — a folded success with git-provable bytes contributes its ratio, one whose bytes are unprovable is excluded from the mean but still counts in the first-pass rate, and a failed thread, a degrade-closed one, or one folded after failing acceptance each count as a real zero. Below the registered minimum nothing is computed (insufficient); at or above it is computed and labeled PILOT evidence. It REFUSES rather than guessing: no pre-registration, an unfinished thread in scope, a recorded refusal-to-delegate that never opened a thread, or an ambiguous wave each stop the computation by name. `handoff-return --slug <s>` closes the worktree loop after `land --prepare`: it re-attests that main still holds exactly the prepared tree under the same HEAD (both recorded in the handoff at prepare time), prints the satellite handoff's user-owned content byte for byte with its boundaries, byte lengths and the main-owned destinations each part folds into, prints the handoff digest and both OIDs as its proof, states the after-the-fold order (a fold landed after the gates leaves them stale), and records ONE self-reported worktree-stream observation only when the whole prepared change set is measurable — a deletion, a rename, a symlink, a submodule or a mode-only change ends with a named NOT RECORDED instead, never a partial number. Appends only to its own ledger inside the git dir (never committable); it also writes `handoff-return`'s `write-tree` tree object and, for a checkpoint measurement, the leaf's OWN temporary index file and the blobs its forced adds store — never a ref, never the real index; never commits, never runs a subscription CLI. |
+| `/agent-workflow-kit dispatch` | any time | **the delegation engine** — makes "how much does delegating a sub-task actually buy?" a measured number instead of a feeling. `check <file>` validates a sub-task brief's contract block and exits 0/1 naming the first violated field — **form only**: whether the task is genuinely bounded, its design decided and its acceptance adequate stays your judgment, and a well-formed absurdity passes here by construction. `advise --step-class <c>` answers the question that comes BEFORE that one — which vehicle should carry this kind of sub-task, whether it is even present on this machine, and what the ledger has already recorded for threads of that class (finished, failed, closed without a fold, and still open — counted separately) — and it decides nothing: it refuses no dispatch, gates no verb, and a choice that diverges from the advice is noted rather than blocked. It reads the filesystem only: nothing is launched to find out what is installed, an absent ledger prints "no recorded history", an unreadable one prints the store's own words, and either way the advice still prints. The same block appears as a footer under a form-valid `check` — never under a refusal, so it can never hide one. `register` pre-registers an acceptance wave (step classes, pairing key, minimum observations per class, the mean and first-pass thresholds) so the bar can never be chosen after the results it judges — immutable per wave. `observe` records ONE hand-written observation (`solo-construction`, the baseline whose ratio is 1 by construction — except over a scope measuring zero bytes, which has no ratio at all and is recorded ineligible by name — or `self-reported`) — delegated numbers are never hand-written, they are derived. The writer verbs are where that derivation happens: `open` puts a delegated thread on the record with every mint-time field copied from the brief's own header, refusing a deadline the wrapper's cap plus its kill grace would not fit inside, and recording whether the tree it started from was clean against the thread's base — HEAD by default, or the tree `--checkpoint <oid>` names, so the second task of a story is measured over the first one's uncommitted work instead of opening dirty (a dirty one makes the result honestly unmeasurable rather than quietly counted), while `--task <brief>` also records which task brief the thread carries out and the files that brief lists, refusing, since the last commit, a task thread whose files overlap by path prefix those of an open task thread or of a folded thread of another brief (`files-overlap`), and a mix of the two kinds — an untasked open beside an open task thread or, for a `code` open of backend `codex`, after a task fold, and a task open beside an open untasked thread (`mixed-open`), refusing at open a Files path the snapshot scope can never hold (`task-files-scope`), and measuring a task thread over its files alone, so `return` and `fold` refuse a changed path that no open or folded task thread on the same base claims (`out-of-files`); `await` waits for that one dispatch to answer and writes nothing — only the finished receipt satisfies it, a run still holding the nonce means keep waiting, and a wait that runs out says so with its own exit code, names whether the deadline or your own timeout ended it, and authorizes nothing: a wait that ended without an answer is a question for you, never permission to dispatch again; `return` absorbs the receipt the wrapper minted — only a finished one, checked against the contract it actually ran, its deadline and its own report, and refused outright when the tree hides changes from git or moves while the return is being computed — and derives the bytes from git rather than from anyone's claim; `fold` is the acceptance, and it refuses if the tree moved since the return — precisely, it re-confirms **equality of the visible canonical payload**, which is a change detector rather than a cryptographic identity of the tree: under the default head base that payload's untracked section is unframed and carries no file mode, so a content or symlink target that imitates the marker opening the next entry can alias two trees, and making an untracked file executable moves nothing (both named as residuals in the mode doc, with the fix queued); under a checkpoint base it is one indexed diff that carries modes. A change set carrying a binary, a non-regular path, a submodule, or a symlink whose target is not valid UTF-8 is **refused** at `return` and `fold` — CONSERVATIVELY, rather than promise what the default head payload may not be able to follow — and the same refusals hold for a checkpoint thread. `degrade` closes a thread that never earned a fold, on the record and with its reason. `aggregate` prints one wave: the registered thresholds, every observation as context, and per step class the finished threads — a folded success with git-provable bytes contributes its ratio, one whose bytes are unprovable is excluded from the mean but still counts in the first-pass rate, and a failed thread, a degrade-closed one, or one folded after failing acceptance each count as a real zero. Below the registered minimum nothing is computed (insufficient); at or above it is computed and labeled PILOT evidence. It REFUSES rather than guessing: no pre-registration, an unfinished thread in scope, a recorded refusal-to-delegate that never opened a thread, or an ambiguous wave each stop the computation by name. `handoff-return --slug <s>` closes the worktree loop after `land --prepare`: it re-attests that main still holds exactly the prepared tree under the same HEAD (both recorded in the handoff at prepare time), prints the satellite handoff's user-owned content byte for byte with its boundaries, byte lengths and the main-owned destinations each part folds into, prints the handoff digest and both OIDs as its proof, states the after-the-fold order (a fold landed after the gates leaves them stale), and records ONE self-reported worktree-stream observation only when the whole prepared change set is measurable — a deletion, a rename, a symlink, a submodule or a mode-only change ends with a named NOT RECORDED instead, never a partial number. Appends only to its own ledger inside the git dir (never committable); it also writes `handoff-return`'s `write-tree` tree object and, for a checkpoint measurement, the leaf's OWN temporary index file and the blobs its forced adds store — never a ref, never the real index; never commits, never runs a subscription CLI. |
 | `/agent-workflow-kit worktrees` | any time | **parallel feature worktrees** — run several features in DIFFERENT agent sessions on one repo, zero interference on working-tree files (the ONE exception is the dependency cache, below): `provision <slug> --plan <file>` creates a sibling git worktree on branch `aw/<slug>` and populates it (registry-derived footprint copy-if-missing — a tracked file is never overwritten; EXACTLY ONE seeded feature plan; the `handoff-<slug>.md` record from minute zero; `node_modules` symlinked where the link stays ignored — a shared MUTABLE dependency cache: writes through it hit MAIN's node_modules; for isolation run the printed isolated-install command (`--install` only PRINTS it; on `--resume` run the printed unlink-first recovery first — printed only for a link whose RAW TARGET is MAIN's `node_modules`, since a foreign or unreadable link is reported as such with no removal advised); absolute root-pinned gate commands rebased on untracked copies only, and only while their bytes equal the MAIN source or its rebased form — user-modified copies stay untouched); `list` is read-only (slug, branch, base, dirty, handoff); `prompt <slug>` is read-only too and re-prints the satellite's cold-start prompt — the same text `provision` ends its report with: where the worktree is, its ONE seeded plan, the handoff as the one channel back, MAIN's orientation (shared series index, landing) and, under its own heading because it is probed on the satellite, that checkout's install posture — every value derived LIVE rather than replayed from the frozen provision record, a recorded value that no longer matches NAMED as a divergence (with the cause its source makes likely) instead of printed as the runnable one, every offered command marked with WHO runs it (`MAIN $ …` for the landing, `HERE $ …` for this checkout's own install, a posture with nothing to run staying prose), and a control character in any rendered value a typed STOP rather than a forged prompt line; `land <slug> --prepare` locks the common git dir, fail-closes on divergence or incomplete satellite state, transfers the complete accepted satellite diff onto a CLEAN main, runs sync plus the declared gates, and reports HEAD/TRANSFER/PREPARED OIDs — the commit ALWAYS stays a dialogue ask; `cleanup <slug>` takes the same lock and removes a LANDED worktree only after live landed-verification against main HEAD, while `--abandon` is the ONE destructive arm (destroys unlanded work; **no preview step** on any writer). The parent dir is the `docs/ai/worktrees.json` `parentDir` setting (default: the repo's sibling parent); an unwritable parent degrades to printed maintainer-pasted commands, and the one-time host consent that makes it promptless surfaces via `recommendations`. Never commits, never pushes, never runs a subscription CLI. |
 | `/agent-workflow-kit uninstall` | opt-in, any time | **guarded teardown** — the inverse of `init` / `setup`. Removes only what's **provably ours** (managed skill dirs + bridge wrappers; in a project, the hidden-mode git-ignore block it added + the pre-commit hook it installed); **never deletes** your `docs/ai` / `AGENTS.md` (prints the exact `rm` to run by hand) or your `.claude/settings.json` (prints an **edit** — remove the attribution key, review any velocity `permissions.*` — never an `rm`). Always `--dry-run` first; preflight-then-mutate; never commits. |
 | `/agent-workflow-kit velocity` | Claude Code · opt-in | **onboarding velocity profile** — seeds a fixed, audited **read-only** allowlist into `.claude/settings.json` so routine read-only commands stop idling on approval prompts while you're away; opt-in `acceptEdits`; plus a **read-only advisory** of likely project gate commands to add by hand. Writes **only** `.claude/settings.json` — **never** allowlists commit/push/publish, never writes `settings.local.json`, never commits. A seeded entry is a **trust posture, not a sandbox** (a runtime residual remains at the settings level — its guard ships as the opt-in `hook` command); a direct commit/push/publish still asks. `--dry-run` first. |

package/SKILL.md

@@ -3,7 +3,7 @@ name: agent-workflow-kit
 description: Deploy or upgrade a portable AI-agent memory-and-workflow system in any project. Use when the user wants to bootstrap `docs/ai/` + an entry-point `AGENTS.md` (+ `CLAUDE.md` alias) + cap/archive/index enforcement in a new or existing repo, set up the Memory Map and session protocols, install the docs-rotation pre-commit hook, or run `/agent-workflow-kit` / `/agent-workflow-kit upgrade`. Triggers on phrases like "set up the memory system", "deploy the AI workflow here", "bootstrap docs/ai", "upgrade the workflow".
 disable-model-invocation: true
 metadata:
-  version: '14.1.0'
+  version: '14.2.0'
 ---
 
 # agent-workflow-kit

package/capability.json

@@ -3,7 +3,7 @@
   "schema": 1,
   "name": "agent-workflow-kit",
   "kind": "composition-root",
-  "version": "14.1.0",
+  "version": "14.2.0",
   "provides": [],
   "roles": {},
   "detect": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sabaiway/agent-workflow-kit",
-  "version": "14.1.0",
+  "version": "14.2.0",
   "description": "Portable, cross-agent memory & workflow for AI coding agents — Claude Code, Codex, Cursor, Devin Desktop. One command deploys an AGENTS.md entry point + docs/ai context with cap/archive/index enforcement into any repo.",
   "keywords": [
     "ai-agents",

package/references/modes/dispatch.md

@@ -6,7 +6,7 @@ The **delegation engine** (delegation Plans 1–2): the sub-task **contract chec
 
 Run **`node ${CLAUDE_SKILL_DIR}/tools/dispatch.mjs <check|advise|register|observe|open|await|return|fold|degrade|handoff-return|aggregate> …`**:
 
-1. **`check <dispatch-file>`** — validates the ONE ```` ```aw-dispatch-contract ```` fenced block the dispatch file carries: exit `0` when its form is valid, `1` naming the FIRST violated field. The contract of the whole mode, in one sentence: the contract check is FORM-only — fields present, grammars respected, never boundedness, design-decidedness or acceptance adequacy — and `aggregate` REFUSES instead of computing acceptance for a wave with no pre-registration record, over an OPEN thread in scope, over a PRE-DISPATCH degrade that opens no thread, or across several waves with no `--wave`; the writer verbs add NO second legality door — the store's preflight is the only one, and its refusals travel verbatim — while `open` copies every mint-time field from the contract header and refuses a deadline below the wrapper cap plus the kill grace, `return` absorbs only a TERMINAL exec receipt whose backend, nonce and independently computed contractDigest match the dispatch it answers, and `fold` binds the CURRENT tree to the folded return's postTreeDigest, so a tree that moved between the two never folds, and `await` is satisfied ONLY by the TERMINAL exec receipt of its own dispatch's {backend, nonce} — never by a review receipt, a ledger line or a finding manifest — while an expiry names a supervision question and releases NO writer slot; `open` records the thread's BASE (`head` by default, `checkpoint` under `--checkpoint <oid>`), `return` and `fold` measure against the base the dispatch recorded, never a flag, and the `fold` VERB itself refuses a checkpoint `code` thread the held-session judge names SUBSTITUTED in that thread's own verdict — a precondition like its hidden-path and content-blind guards, the store's preflight staying the only door on the record. Whether the sub-task is genuinely bounded, whether its design is decided, and whether its acceptance criteria are adequate stay **explicit orchestrator judgment** — a well-formed absurdity passes here by construction.
+1. **`check <dispatch-file>`** — validates the ONE ```` ```aw-dispatch-contract ```` fenced block the dispatch file carries: exit `0` when its form is valid, `1` naming the FIRST violated field. The contract of the whole mode, in one sentence: the contract check is FORM-only — fields present, grammars respected, never boundedness, design-decidedness or acceptance adequacy — and `aggregate` REFUSES instead of computing acceptance for a wave with no pre-registration record, over an OPEN thread in scope, over a PRE-DISPATCH degrade that opens no thread, or across several waves with no `--wave`; the writer verbs add NO second legality door — the store's preflight is the only one, and its refusals travel verbatim — while `open` copies every mint-time field from the contract header and refuses a deadline below the wrapper cap plus the kill grace, `return` absorbs only a TERMINAL exec receipt whose backend, nonce and independently computed contractDigest match the dispatch it answers, and `fold` binds the CURRENT tree to the folded return's postTreeDigest, so a tree that moved between the two never folds, and `await` is satisfied ONLY by the TERMINAL exec receipt of its own dispatch's {backend, nonce} — never by a review receipt, a ledger line or a finding manifest — while an expiry names a supervision question and releases NO writer slot; `open` records the thread's BASE (`head` by default, `checkpoint` under `--checkpoint <oid>`), `return` and `fold` measure against the base the dispatch recorded, never a flag, and the `fold` VERB itself refuses a checkpoint `code` thread the held-session judge names SUBSTITUTED in that thread's own verdict — a precondition like its hidden-path and content-blind guards, the store's preflight staying the only door on the record; `open --task` records the task, a task thread is measured over its Files and `open`, `return` and `fold` refuse `files-overlap`, `mixed-open` and `out-of-files`. Whether the sub-task is genuinely bounded, whether its design is decided, and whether its acceptance criteria are adequate stay **explicit orchestrator judgment** — a well-formed absurdity passes here by construction.
 2. **`advise --step-class <c>`** — the **vehicle-routing advisory**, and the question that comes BEFORE a contract check: *which vehicle carries this step class on THIS host, and what has the ledger already recorded for it.* It prints one block — the advised vehicle with its availability, the solo fallback, the recorded history, and the note below — and **decides nothing**: the advice never gates a dispatch: which vehicle carries a sub-task stays orchestrator judgment, and a divergence from the advice is recorded as a note rather than refused. Exit `0` for every legal step class, `2` only on usage. Its posture, stated exactly: the advisor module itself writes nothing, spawns nothing and opens no second ledger door; the VERB may run read-only git probes — the delegation store path (unless AW_DELEGATION_STORE names it outright) and the repository top-level the cheap vehicles are anchored at — and it never runs a vehicle, a subscription CLI, or anything that writes. Host capability is read from the filesystem — the execute backend from the bridge install (the detector spawns nothing at all), a cheap vehicle from the presence of `.claude/agents/<name>.md` **at the repository top-level**; where that root is not resolved, the lane answers **`unknown`** rather than claiming a vehicle is unplaced, because an absent file under an unanchored directory is not evidence of absence and a present one there is not evidence it is this repository's vehicle. The recorded history is the ledger's OWN thread walk, over the closed state set `folded | failure-terminal | degrade-closed | open` with **`open` counted separately** (a live thread is not evidence about a finished one). An **absent** ledger prints `no recorded history`; an **unreadable** one prints the store's own words and the advice still prints; neither is a refusal. The same block prints as a **footer on a form-valid `check`** (never under a refusal, so it cannot mask one), where the advised vehicle is compared against the contract's `vehicle.selected` and a difference is printed as a divergence NOTE naming `vehicle.requested` when the pair itself differs.
 
    The vehicle-routing matrix — one row per step class, and this copy is held to the code's registry CELL for cell by a structure check (a reorder, a duplicate, a dropped row, a mis-bound vehicle and a drifted availability or returns cell all leave every token present, so a token check would pass every one of them). The check reads only the anchored surface between the two markers below, so a copy of this table anywhere else in the doc can neither stand in for it nor mask its drift:
@@ -30,7 +30,7 @@ Run **`node ${CLAUDE_SKILL_DIR}/tools/dispatch.mjs <check|advise|register|observ
 
 3. **`register`** — appends the wave's **pre-registration** record (`--wave --step-classes --pairing-key --min-per-class --mean-l-threshold --first-pass-num --first-pass-den`). Acceptance is pre-registered so thresholds can never be chosen after the observations that will be judged against them; a registration is **immutable per wave** and a second one refuses. `--pairing-key` accepts only a key the aggregator actually implements (today `stepClass`) — a wave registered under any other key would record a contract the computation never follows, and the aggregator re-checks the registration independently, since a store can be hand-written.
 4. **`observe`** — appends ONE **observation** (`--wave --step-class --scope --plan --phase --provenance [--denominator-bytes]`). Provenance is `solo-construction` or `self-reported` **only**: delegated accounting is DERIVED from nonce threads and is never hand-appended. The numerator is the post-image bytes of the objects the scope names; a **solo** observation takes that same number as its denominator — `L = 1` by construction, so `--denominator-bytes` is refused — while a self-reported one states its own. One stated exception: a solo scope that measures **zero** bytes has no ratio at all, and is recorded INELIGIBLE by name (`zero-denominator`) rather than as `L = 1` — `0/0` is undefined before it is one, and a named ineligibility is what this family records instead of a silent number. **`--scope` is repeatable**, one repo-relative path per occurrence: no separator is safe inside a POSIX path, so a split list could not express `docs/my file.md` and would silently measure the wrong set wherever its fragments happened to exist. Paths are anchored at the **git top-level**, never at the caller's cwd, and the record carries a **JSON-encoded array of canonical repo-relative paths, carried in the schema's string field** (the record's `scope` is a string by D3, so the array travels encoded). An object's identity IS its canonical path, so two files with identical bytes are two objects and count twice, while one path reached twice (a repeated listing, an in-repo ancestor symlink) is one object and counts once. The run refuses by name outside a git work tree, for an absent or non-regular path, and for a path whose **real** location leaves the repository (an ancestor symlink is not a way out).
-5. **`open`** — appends the **dispatch** record that opens a thread (`--contract <dispatch-file> --wave --backend --rationale --wrapper-cap-s --kill-grace-s [--checkpoint <oid>] [--task <brief>] [--retry-of <nonce>]`). Every mint-time field — `nonce`, `stepClass`, `vehicle`, `deadlineS`, `retry.index`, `retry.cap` — is **COPIED from the contract header** and bound by `contractDigest`, so a dispatch can never disagree with the header it claims to carry. It fingerprints the tree (`preTreeDigest`) and probes it for a CLEAN baseline; a **dirty** one is recorded as such, and the eventual return is then metric-INELIGIBLE by the name `dirty-baseline` — the uncommitted-state fingerprint is blind to the index↔worktree split, so a dirty baseline cannot attribute bytes to a dispatch. It **refuses a `deadlineS` below `--wrapper-cap-s` + `--kill-grace-s`** (both explicit operands: the kit never reads another package's default), because a dispatch that cannot be capped inside its own deadline could never honour the terminal-exit rule. Every retry rule — one successor per thread, the cap read off the chain's ORIGIN, wave and class equality, a changed contract after a `contract-refusal` — is the **store's**, and `open` surfaces its refusals verbatim. `--checkpoint <oid>` records the checkpoint base: the operand must be a git object id of exactly 40 or 64 lowercase hex characters that resolves to a TREE (a commit, a blob, a tag and an unknown id each refuse by name, nothing written), and every measurement of that thread — the clean probe, `preTreeDigest`, the return's bracketing fingerprint and diff, the fold's fingerprint and enumeration — is computed against that tree over the snapshot scope — every work-tree path not ignored by git's standard excludes judged without the real index, plus every present kit-own path, plus every path HEAD's tree or the base tree names, minus `docs/plans/`, `.claude/settings.json`, `.claude/settings.local.json`, `.mcp.json`, every known foreign-tool footprint and `node_modules`; the base tree's non-excluded paths deleted since the snapshot are measured as deletions; without the flag the base is `head` and every byte of the MEASUREMENT is today's (the writer always mints the `baseline` key, so the record itself is not byte-identical to 13.0.0's). The CLEAN line of a checkpoint open names the base. `--task <brief>` records the brief's path and its byte-ordered Files, requires `--checkpoint` (`task-base`), refuses a brief the parser refuses by the parser's name, and the store refuses `files-overlap` and `mixed-open` at append time.
+5. **`open`** — appends the **dispatch** record that opens a thread (`--contract <dispatch-file> --wave --backend --rationale --wrapper-cap-s --kill-grace-s [--checkpoint <oid>] [--task <brief>] [--retry-of <nonce>]`). Every mint-time field — `nonce`, `stepClass`, `vehicle`, `deadlineS`, `retry.index`, `retry.cap` — is **COPIED from the contract header** and bound by `contractDigest`, so a dispatch can never disagree with the header it claims to carry. It fingerprints the tree (`preTreeDigest`) and probes it for a CLEAN baseline; a **dirty** one is recorded as such, and the eventual return is then metric-INELIGIBLE by the name `dirty-baseline` — the uncommitted-state fingerprint is blind to the index↔worktree split, so a dirty baseline cannot attribute bytes to a dispatch. It **refuses a `deadlineS` below `--wrapper-cap-s` + `--kill-grace-s`** (both explicit operands: the kit never reads another package's default), because a dispatch that cannot be capped inside its own deadline could never honour the terminal-exit rule. Every retry rule — one successor per thread, the cap read off the chain's ORIGIN, wave and class equality, a changed contract after a `contract-refusal` — is the **store's**, and `open` surfaces its refusals verbatim. `--checkpoint <oid>` records the checkpoint base: the operand must be a git object id of exactly 40 or 64 lowercase hex characters that resolves to a TREE (a commit, a blob, a tag and an unknown id each refuse by name, nothing written), and every measurement of that thread — the clean probe, `preTreeDigest`, the return's bracketing fingerprint and diff, the fold's fingerprint and enumeration — is computed against that tree over the snapshot scope — every work-tree path not ignored by git's standard excludes judged without the real index, plus every present kit-own path, plus every path HEAD's tree or the base tree names, minus `docs/plans/`, `.claude/settings.json`, `.claude/settings.local.json`, `.mcp.json`, every known foreign-tool footprint and `node_modules`; the base tree's non-excluded paths deleted since the snapshot are measured as deletions; without the flag the base is `head` and every byte of the MEASUREMENT is today's (the writer always mints the `baseline` key, so the record itself is not byte-identical to 13.0.0's). The CLEAN line of a checkpoint open names the base. `--task <brief>` records the brief's path and its byte-ordered Files, requires `--checkpoint` (`task-base`), refuses a brief the parser refuses by the parser's name, refuses `task-files-scope` for a Files path the snapshot domain can never hold, and the store refuses `files-overlap` and `mixed-open` at append time; a task thread is measured over its Files.
 6. **`await`** — watches for ONE dispatch to **answer**, and writes nothing at all (`--nonce [--timeout <s>]`). Satisfaction is the arrival of the **TERMINAL** exec receipt for the dispatch's own `{backend, nonce}`: a `reserved` artifact means the run holds the nonce and has published nothing about how it ended, so the wait continues — the same artifact that is a **supervision refusal** at `return`, because absorbing it would record an outcome nobody observed. Satisfaction is decided **positively**, by the exec-receipt reader itself, so an artifact of a neighbouring family standing at that path — a review receipt, a delegation ledger line, a finding manifest — **refuses** rather than satisfies: only an exec receipt answers an exec dispatch, which is the D10 rule the review waiter states from its own side. The bound is the **ABSOLUTE** deadline, measured from the DISPATCH record's timestamp rather than from whenever this wait began: `--timeout` defaults to the time **remaining**, and one reaching past the deadline is **refused** rather than silently clamped (a shortened wait would let a caller believe they waited longer than they did). An already-expired dispatch is **answered immediately**, never waited on. **Arrival is read first, before EVERY bound** — the two wait bounds and the `--timeout` admissibility check alike, so a receipt already on disk answers `ARRIVED` even when the supplied `--timeout` is inadmissible, and the check runs only once there genuinely IS a wait to bound. A receipt already on disk is a fact this verb reports; whether a *late* one may be absorbed is the absorb door's question, refused there by name — **lateness has exactly one decision site, and it is `return`**. The review waiter checks its deadline first for the opposite reason: a receipt *line* carries no dispatch-bound timestamp at all, so there the clock is the only evidence there is. Each pass consults the clock over the poll that has already happened, then sleeps and polls again, so a receipt landing during the last sleep is reported rather than lost to a cutoff a moment later. An unanswered wait exits **`3`** — its own status so a caller that **branches** on the code can tell it from a refusal, never a defence against one that discards failure wholesale — names whether the **deadline** or the `--timeout` ended it, and states that **no writer slot was released**: a wait that ended without an answer never authorizes the next dispatch. Every artifact read rides the store's own no-follow reader, so a symlinked, FIFO, unreadable or malformed artifact refuses **by class** instead of standing in for an answer.
 7. **`return`** — absorbs the wrapper's exec receipt and appends the **return** record (`--nonce [--outcome <o>] [--no-receipt --exit-status <n>]`). The receipt and its report live **beside the ledger**, in the store's own directory. It reads the **TERMINAL** receipt — a `reserved` one is a **supervision question**, not a timeout, and refuses by saying so — then checks the receipt's independently computed `contractDigest` against the dispatch's (a run that executed a *different* contract would otherwise correlate cleanly), its `{backend, nonce}` body against the dispatch it answers (the filename alone is composed by this side), its `capS + killGraceS` against the recorded `deadlineS`, and its timestamp against the **ABSOLUTE** deadline (`dispatch.timestamp + deadlineS`) — a late return refuses by name. It re-verifies the report's digest and length against the receipt, refuses a change set **hidden from the plain `git diff`** the head-base metric is computed over (assume-unchanged, skip-worktree, `diff.ignoreSubmodules`), and then enumerates the returned objects and frames the canonical integration bundle, **bracketed by the tree fingerprint**: a tree that moves mid-computation refuses rather than mixing two change sets. `--outcome` records an orchestrator judgment under the **closed override form** — a wrapper outcome either stays itself or moves to `contract-refusal | partial-edit | acceptance-failure | stale-return | store-failure`, and `success` is recordable only from a receipt that already says success; the record vocabulary's own cross-field rules cut the remaining incompatible pairs. **`--no-receipt`** means "no TERMINAL receipt", never "no evidence": it absorbs a **reservation ONLY** — over a `terminal` artifact it refuses, because a hand-stated outcome there would discard an exit status, a session id and a report digest the run actually proved, and skip the report check that guards them. It builds the return from that reservation (`wrapperVersion` and `posture`, never hand-typed), requires `--exit-status` and an `--outcome` from `transport-failure | contract-refusal | store-failure | missing-identity` (so `partial-edit` and `stale-return` are inexpressible there by name), and reads the report **if present** — an absent one records length 0 and the metric is then ineligible **by name**: `empty-report` where there IS a diff, and `no-op-diff` where the tree is unchanged too, since the eligibility rule names the diff first. That keeps a failed REPORT write and a failed TERMINAL write two separately named lanes. With **no artifact at all** there is no honest return — `--no-receipt` reads the same path and would refuse the same way — so close the thread with `degrade`.
 8. **`fold`** — appends the integration re-confirmation and CLOSES the thread (`--nonce --verdict <text>`). It runs the **same hidden-path guard** as `return`, and here for a sharper reason: `treeDigestAtFold` is computed from the very payload that is blind to those paths, so under a HEAD base a change made behind an `assume-unchanged` / `skip-worktree` bit between the return and the fold leaves the digest **equal** and the fold would accept bytes nobody returned — the digest cannot catch what the payload cannot see. It then computes the **current** tree digest, which the store binds to the folded return's `postTreeDigest`: a tree that moved between the return and the fold refuses in the store's own words, and the recovery it names is a fresh dispatch, never a fold. Under a HEAD base, staging usually moves the tree too — every change set carrying an untracked path does — so the order is `return` → review (own eyes + the configured review recipe) → a plain gate run → `fold` → `git add`. **The one shape staging does not move** is a tracked-only change passing from the worktree into a **clean** index: the payload concatenates the staged and unstaged diffs, so those bytes are identical either side of `git add` (the uncommitted-state fingerprint's stated blindness to the index↔worktree split). The fold is still honest there — identical payload bytes mean the folded content IS the returned content — so the rule is "**the fold precedes staging**", never "staging refuses the fold by construction". A checkpoint measurement never reads the real index, so staging moves nothing there, while the fold still precedes `git add` by the same rule. `fold` refuses a checkpoint `code` thread the held-session judge names SUBSTITUTED in its own verdict, naming the ledger degrade and retry as recovery, and fails closed on an error epoch or an unreadable ledger.
@@ -46,6 +46,6 @@ Run **`node ${CLAUDE_SKILL_DIR}/tools/dispatch.mjs <check|advise|register|observ
 
 **Which ledger the tree-binding verbs use.** For `open`, `return` and `fold` the resolved store must be the **canonical** one, exactly — `<git common dir>/agent-workflow-delegation.jsonl` — and every other store refuses. Three failures collapse into that one equality: a store placed inside the work tree is carried by the payload *and enumerated as an object*, so the metric would count its own bookkeeping as delegated work while the append that follows `postTreeDigest` moves the tree every later fold binds; a store belonging to another repository would measure this tree against a foreign thread, the frozen record schema binding no worktree identity; and a **second** ledger in the same git dir would share artifact names with the first, since those are a function of `{backend, nonce}` alone — so a return could absorb the neighbouring ledger's receipt. One repository, one delegation ledger, which is what resolving to the git *common* dir already meant. `register`, `observe`, `await` and `aggregate` keep the unrestricted override — they bind no tree. Path comparison canonicalizes through symlinks and **fails closed** on any error but `ENOENT` (a path this kit cannot resolve is not one it may approve); the check is repeated immediately before every append, which *narrows* the replacement window rather than closing it — a check-then-write pair is not atomic, and this module defends against a buggy or interrupted producer, never a racing adversary. `open` additionally refuses **pre-spend** when either exec artifact name for its `{backend, nonce}` is already taken: one nonce, one artifact pair. **Stated residual:** two *linked worktrees* of one repository share a common dir by design (the ledger is worktree-shared), so this rule cannot separate them — opening in one linked worktree and returning or folding in another measures the wrong tree, is **forbidden** under the D10 one-writer bar, and is named here rather than mechanized, because the frozen record schema carries no worktree identity to bind it with.
 
-**What the fold's binding IS, and its stated residuals.** The binding is **equality of the visible payload** between the return and the fold — never an identity of the tree, and the difference is not academic. Under a HEAD base the payload is an unframed concatenation, so **two different trees can produce the same bytes**: probed live, a single file containing the line `untracked:two.txt` yields the same fingerprint as a tree of two files, and a symlink's target can imitate the marker that opens the next untracked entry. Its UNTRACKED section carries **no git-relevant mode**, so `chmod 0644 → 0755` on an untracked file moves neither the fingerprint nor the enumeration — a blind attribute, not a fourth unsupported content class (a TRACKED file's mode flip rides the diff as `old mode` / `new mode` and does move it). Regular-file content and symlink targets are deliberately **not** subtracted: they are present in the payload, only ambiguously framed, and refusing them would refuse `new` and `symlink`, which is every delegated change set there is. The real fix — a framed payload carrying mode bits — is queued against that frozen surface, since it revalues every stored head-base fingerprint in the family. Under a checkpoint base the payload is one indexed diff: a mode change moves it and no untracked marker line exists. A **receipt is forgeable**, exactly like every record in this family, so what the absorb door defends against is a buggy or interrupted producer, not a hostile one; under a head base the numerator **over-counts a rename** (a delegate's rename arrives as a deletion plus a creation, and no identity matching is done — that machinery was built and deliberately subtracted), so the metric reads optimistic, except in the rename-then-recreate case, which is indeterminate and named in the producer's own header; under a checkpoint base git's own rename detection applies inside the one base-relative layer and a detected rename is counted once as `renamed`; and **D10 is a bar, not a mechanism** — at most ONE in-tree exec dispatch runs at a time, and nothing here refuses a second one, task threads included; `files-overlap` and `mixed-open` additionally refuse conflicting task threads at append time.
+**What the fold's binding IS, and its stated residuals.** The binding is **equality of the visible payload** between the return and the fold — never an identity of the tree, and the difference is not academic. Under a HEAD base the payload is an unframed concatenation, so **two different trees can produce the same bytes**: probed live, a single file containing the line `untracked:two.txt` yields the same fingerprint as a tree of two files, and a symlink's target can imitate the marker that opens the next untracked entry. Its UNTRACKED section carries **no git-relevant mode**, so `chmod 0644 → 0755` on an untracked file moves neither the fingerprint nor the enumeration — a blind attribute, not a fourth unsupported content class (a TRACKED file's mode flip rides the diff as `old mode` / `new mode` and does move it). Regular-file content and symlink targets are deliberately **not** subtracted: they are present in the payload, only ambiguously framed, and refusing them would refuse `new` and `symlink`, which is every delegated change set there is. The real fix — a framed payload carrying mode bits — is queued against that frozen surface, since it revalues every stored head-base fingerprint in the family. Under a checkpoint base the payload is one indexed diff: a mode change moves it and no untracked marker line exists. A **receipt is forgeable**, exactly like every record in this family, so what the absorb door defends against is a buggy or interrupted producer, not a hostile one; under a head base the numerator **over-counts a rename** (a delegate's rename arrives as a deletion plus a creation, and no identity matching is done — that machinery was built and deliberately subtracted), so the metric reads optimistic, except in the rename-then-recreate case, which is indeterminate and named in the producer's own header; under a checkpoint base git's own rename detection applies inside the one base-relative layer and a detected rename is counted once as `renamed`; and **D10 is a bar, not a mechanism, for untasked threads** — at most ONE untasked in-tree exec dispatch runs at a time, and nothing here refuses a second one; for task threads it is a mechanism: file-disjoint task threads on one checkpoint may run as a wave, `files-overlap` and `mixed-open` refuse conflicting opens at append time, and `return` and `fold` refuse `out-of-files`.
 
 **Invariants:** writer — appends only to the delegation ledger, `<git common dir>/agent-workflow-delegation.jsonl` (`AW_DELEGATION_STORE` overrides, absolute only), through the store's own lock-serialized append; the store's preflight is the single legality door and this mode adds no second validator · every verb that DERIVES anything from the ledger (`return`, `fold`, `degrade`, `aggregate`) replays the store's preflight over the whole file first and refuses at the first record the append path would have refused, except `files-overlap` and `mixed-open`, which are judged at append time only, naming its physical line — a verb never computes over a "legal prefix" · **never commits**, never runs a subscription CLI, spawns nothing but git READS — with TWO stated exceptions: `handoff-return` attests MAIN's index with `git write-tree`, which may write a tree OBJECT into the odb (the same probe `land --prepare` itself uses), and checkpoint measurement writes the leaf's OWN temporary index file and forced-add blob objects — never a ref, never the real index; the ledger stays the only thing this mode APPENDS to · the ledger is separate from the review receipts and the flow store, and a line of one family never satisfies a reader of another.

package/tools/checkpoint-restore.mjs

@@ -1,8 +1,11 @@
-// spec:checkpoint — docs/ai/specs/kit/checkpoint/restore.md
+// restoreCheckpoint, restoreTaskThread — spec:checkpoint, spec:task-thread; docs/ai/specs/kit/checkpoint/restore.md
 import { unlinkSync, rmdirSync } from 'node:fs';
 import { dirname, join } from 'node:path';
-import { resolveTreeObject, snapshotScope } from './dispatch-baseline.mjs';
+import { resolveTreeObject, snapshotScope, computeBasePayload } from './dispatch-baseline.mjs';
 import { readDelegationLedger } from './dispatch-store-read.mjs';
+import { isThreadTerminalRecord } from './dispatch-record.mjs';
+import { readsTask, readsInsideEpoch, epochClaims } from './task-thread.mjs';
+import { hasPathOverlap } from './claim-relation.mjs';
 import { CHECKPOINT_REF_PREFIX, withRepository, readGit, readGitBytes, readCheckpointRefs,
   withTemporaryIndex, readScopeStat, writeSnapshot, findOpenCheckpointThread } from './checkpoint-core.mjs';
 
@@ -20,8 +23,14 @@ const SEQUENCE_REF_PATTERN = /^[^/]+\/(?:0|[1-9][0-9]*)$/;
 const ALLOWED_MODES = ['100644', '100755', '120000'];
 const LEDGER_ABSENT = 'absent';
 const LEDGER_OK = 'ok';
+const HEAD_ERROR = 'error';
+const DISPATCH_KIND = 'dispatch';
+const FOLD_KIND = 'fold';
+const CHECKPOINT_KIND = 'checkpoint';
+const FOLDED = 'folded';
 const NONEMPTY_CODES = ['ENOTEMPTY', 'EEXIST'];
-const NAMES = { scope: 'target-scope', ledger: 'ledger', open: 'open-thread', conflict: 'type-conflict' };
+const NAMES = { scope: 'target-scope', ledger: 'ledger', open: 'open-thread', conflict: 'type-conflict',
+  task: 'task-target', folded: 'task-folded' };
 const ENCODING_ERROR = 'target tree paths are not lossless UTF-8';
 const ENTRY_ERROR = 'unreadable target tree entry';
 const UNREFERENCED_ERROR = 'no checkpoint sequence carries target';
@@ -31,10 +40,11 @@ const GIT_ARGS = {
   entries: ['ls-tree', '-r', '-z'],
   read: ['read-tree'],
   checkout: ['checkout-index', '-a', '-f'],
+  checkoutPaths: ['checkout-index', '-f', '--'],
 };
 
 const refuse = (reason) => ({ ok: false, code: REFUSE, reason });
-const readTargetEntries = (context, target) => {
+const readTargetEntries = (context, target, files = null) => {
   const bytes = readGitBytes(context, [...GIT_ARGS.entries, target]);
   const text = bytes.toString(UTF8);
   if (!Buffer.from(text, UTF8).equals(bytes)) throw new Error(`${NAMES.scope}: ${ENCODING_ERROR}`);
@@ -42,11 +52,12 @@ const readTargetEntries = (context, target) => {
     const parsed = ENTRY_PATTERN.exec(entry);
     if (parsed === null) throw new Error(`${NAMES.scope}: ${ENTRY_ERROR}`);
     const [, mode, path] = parsed;
+    if (files !== null && !files.includes(path)) return null;
     if (!ALLOWED_MODES.includes(mode) || path.split(SLASH).some((segment) => FORBIDDEN_SEGMENTS.includes(segment))) {
       throw new Error(`${NAMES.scope}: ${path}`);
     }
     return path;
-  });
+  }).filter((path) => path !== null);
 };
 const readHeldSet = (context, target) => {
   const refs = readCheckpointRefs(context).filter(({ ref }) => SEQUENCE_REF_PATTERN.test(ref.slice(CHECKPOINT_REF_PREFIX.length)));
@@ -124,3 +135,49 @@ export const restoreCheckpoint = (cwd, oid, io = {}) => withRepository(cwd, io,
   return snapshot.oid === target ? { ok: true, target, proof: snapshot.oid }
     : refuse(`${MISMATCH}: ${target} ${snapshot.oid}`);
 });
+
+export const restoreTaskThread = (cwd, oid, nonce, io = {}) => withRepository(cwd, io, (context) => {
+  const tree = resolveTreeObject(context.top, oid, context.io);
+  if (!tree.ok) return refuse(tree.reason);
+  const target = readGit(context, [...GIT_ARGS.resolve, oid]);
+  const ledger = readDelegationLedger(context.cwd, context.env);
+  if (ledger.state !== LEDGER_OK) return refuse(`${NAMES.ledger}: ${ledger.reason ?? ledger.state}`);
+  if (ledger.head.state === HEAD_ERROR) return refuse(`${NAMES.ledger}: ${ledger.head.reason}`);
+  const { records, head } = ledger;
+  const index = records.findIndex((record) => record.kind === DISPATCH_KIND && record.nonce === nonce);
+  if (index === LAST) return refuse(`${NAMES.task}: ${nonce}`);
+  const dispatch = records[index];
+  const task = readsTask(dispatch);
+  if (task === null) return refuse(`${NAMES.task}: ${nonce}`);
+  const later = records.slice(index + NEXT).filter((record) => record.nonce === nonce);
+  if (!later.some(isThreadTerminalRecord)) return refuse(`${NAMES.open}: ${nonce}`);
+  if (later.some((record) => record.kind === FOLD_KIND)) return refuse(`${NAMES.folded}: ${nonce}`);
+  if (dispatch.baseline.treeOid !== target) return refuse(`${NAMES.task}: ${nonce}: ${target}`);
+  const scope = snapshotScope(context.top, { baseTreeOid: target }, context.io);
+  if (!scope.ok) return refuse(scope.reason);
+  const paths = scope.paths.filter((path) => task.files.includes(path));
+  const domain = new Set(paths);
+  for (const claim of epochClaims(records, head, isThreadTerminalRecord)) {
+    if (claim.nonce === nonce || !claim.files.some((file) => paths.some((path) => hasPathOverlap(file, path)))) continue;
+    return refuse(`${claim.state === FOLDED ? NAMES.folded : NAMES.open}: ${claim.nonce}`);
+  }
+  const untasked = records.filter((record) => record.kind !== DISPATCH_KIND || readsTask(record) === null);
+  const folded = untasked.find((record, position) => record.kind === DISPATCH_KIND && readsInsideEpoch(record, head)
+    && untasked.slice(position + NEXT).some((successor) => successor.nonce === record.nonce && successor.kind === FOLD_KIND));
+  if (folded !== undefined) return refuse(`${NAMES.folded}: ${folded.nonce}`);
+  const held = readHeldSet(context, target);
+  const open = findOpenCheckpointThread(untasked, held);
+  if (open !== undefined) return refuse(`${NAMES.open}: ${open.nonce}`);
+  const entries = readTargetEntries(context, target, task.files);
+  const outside = entries.find((path) => !domain.has(path));
+  if (outside !== undefined) return refuse(`${NAMES.scope}: ${outside}`);
+  const types = checkTypes(context, entries);
+  if (!types.ok) return types;
+  withTemporaryIndex(context.env, (env) => {
+    readGit(context, [...GIT_ARGS.read, target], env);
+    if (entries.length > START) readGit(context, [...GIT_ARGS.checkoutPaths, ...entries], env);
+  });
+  removeExtras(context, paths, new Set(entries));
+  const proof = computeBasePayload(context.top, { kind: CHECKPOINT_KIND, treeOid: target }, context.io, task.files);
+  return proof !== null && proof.length === START ? { ok: true, target, nonce } : refuse(MISMATCH);
+});

package/tools/checkpoint.mjs

@@ -7,7 +7,7 @@ import { PLANS_REL, isScratchPlanName } from './plan-files.mjs';
 import { isDirectRun } from './direct-run.mjs';
 import { CHECKPOINT_REF_PREFIX, refuse, withRepository, readGit, readCheckpointRefs, writeSnapshot,
   findOpenCheckpointThread } from './checkpoint-core.mjs';
-import { restoreCheckpoint } from './checkpoint-restore.mjs';
+import { restoreCheckpoint, restoreTaskThread } from './checkpoint-restore.mjs';
 
 export { CHECKPOINT_REF_PREFIX } from './checkpoint-core.mjs';
 const ACCEPT = 0;
@@ -30,11 +30,15 @@ const LEDGER_OK = 'ok';
 const CLEAN = 'CLEAN';
 const DIRTY = 'DIRTY';
 const PROOF = 'proof';
+const TASK_KIND = 'task';
+const TASK_PROOF = 'clean';
 const PLAN_FLAG = '--plan';
+const NONCE_FLAG = '--nonce';
 const PLAN_ARG_COUNT = 3;
 const OID_ARG_COUNT = 2;
+const TASK_ARG_COUNT = 4;
 const ARGV_OFFSET = 2;
-const USAGE_TEXT = 'usage: checkpoint mint|newest|prune --plan <plan> | verify|restore <oid>';
+const USAGE_TEXT = 'usage: checkpoint mint|newest|prune --plan <plan> | verify <oid> | restore <oid> [--nonce <n>]';
 const PLAN_ERROR = 'expected a readable regular plan directly under docs/plans';
 const SEQUENCE_ERROR = 'expected contiguous numbered refs on trees';
 const GIT_ARGS = {
@@ -122,17 +126,22 @@ const PLAN_OPERATIONS = { [VERBS.mint]: mintCheckpoint, [VERBS.newest]: newestCh
 const formatRef = ({ stem, n, oid }) => `${CHECKPOINT_KIND} ${stem}/${n} ${oid}${NEWLINE}`;
 const formatRefusal = ({ code, reason }) => ({ code, stdout: EMPTY, stderr: `${reason}${NEWLINE}` });
 export const main = (argv = process.argv.slice(ARGV_OFFSET), deps = {}) => {
-  const [verb, operand, planPath] = argv;
+  const [verb, operand, planPath, nonce] = argv;
   const planVerb = Object.hasOwn(PLAN_OPERATIONS, verb);
   const oidVerb = verb === VERBS.verify || verb === VERBS.restore;
+  const taskRestore = verb === VERBS.restore && argv.length === TASK_ARG_COUNT && operand
+    && planPath === NONCE_FLAG && typeof nonce === STRING && nonce !== EMPTY;
   if (!(planVerb && argv.length === PLAN_ARG_COUNT && operand === PLAN_FLAG && planPath)
-    && !(oidVerb && argv.length === OID_ARG_COUNT && operand)) return formatRefusal(refuse(USAGE_TEXT, USAGE));
+    && !(oidVerb && argv.length === OID_ARG_COUNT && operand) && !taskRestore) return formatRefusal(refuse(USAGE_TEXT, USAGE));
   const cwd = deps.cwd ?? process.cwd();
   const operation = verb === VERBS.restore ? restoreCheckpoint : verifyCheckpoint;
-  const result = planVerb ? PLAN_OPERATIONS[verb](cwd, planPath, deps) : operation(cwd, operand, deps);
+  const result = taskRestore ? restoreTaskThread(cwd, operand, nonce, deps)
+    : planVerb ? PLAN_OPERATIONS[verb](cwd, planPath, deps) : operation(cwd, operand, deps);
   if (!result.ok) return formatRefusal(result);
-  if (verb === VERBS.restore) return { code: ACCEPT,
-    stdout: `${CHECKPOINT_KIND} ${VERBS.restore} ${result.target} ${PROOF} ${result.proof}${NEWLINE}`, stderr: EMPTY };
+  if (verb === VERBS.restore) {
+    const proof = taskRestore ? `${TASK_KIND} ${nonce} ${PROOF} ${TASK_PROOF}` : `${PROOF} ${result.proof}`;
+    return { code: ACCEPT, stdout: `${CHECKPOINT_KIND} ${VERBS.restore} ${result.target} ${proof}${NEWLINE}`, stderr: EMPTY };
+  }
   if (verb === VERBS.verify) return { code: result.clean ? ACCEPT : REFUSE,
     stdout: `${result.clean ? CLEAN : DIRTY} ${result.target} ${result.oid}${NEWLINE}`, stderr: EMPTY };
   return { code: ACCEPT, stdout: verb === VERBS.prune ? EMPTY : formatRef(result), stderr: EMPTY };

package/tools/dispatch-baseline.mjs

@@ -1,4 +1,4 @@
-// dispatch-baseline.mjs — snapshotScope, computeBasePayload, computeBaseFingerprint,
+// dispatch-baseline.mjs — snapshotScope, computeBasePayload, computeBaseFingerprint, taskFilesScopeRefusal,
 // isCleanAgainstBase, runBaseDiff and resolveTreeObject; spec:dispatch-baseline.
 // Writes only its own temporary indexes and the blob objects stored by forced adds.
 // Head measurements delegate unchanged to core-evidence without a temporary index.
@@ -20,6 +20,8 @@ const PAYLOAD_DIFF_ARGS = ['--no-ext-diff', '--no-textconv', '--ignore-submodule
 const SCOPE_EXCLUSIONS = ['/docs/plans/', '/.claude/settings.json', '/.claude/settings.local.json', '/.mcp.json'];
 const MISSING_PATH_CODES = ['ENOENT', 'ENOTDIR'];
 const ABSENT_HEAD_STATUS = 1;
+const CHECK_IGNORE_CLEAR_STATUS = 1;
+const EXCLUDE_SOURCES = ['.gitignore', '.gitattributes'];
 const splitPaths = (bytes) => {
   const text = bytes.toString('utf8');
   if (!Buffer.from(text).equals(bytes)) throw new Error('git path names are not lossless UTF-8');
@@ -62,12 +64,12 @@ const readStat = (path, lstat) => {
     throw error;
   }
 };
-const readTreePaths = (run, top, treeOid, env) => splitPaths(readGit(run, ['ls-tree', '-r', '--name-only', '-z', treeOid], top, env));
-const readHeadPaths = (run, top, env) => {
+const readTreePaths = (run, top, treeOid, env, directories = false) => splitPaths(readGit(run, ['ls-tree', '-r', ...(directories ? ['-d', '-t'] : []), '--name-only', '-z', treeOid], top, env));
+const readHeadPaths = (run, top, env, directories = false) => {
   const head = run(['rev-parse', '--verify', '--quiet', 'HEAD'], top, undefined, env);
   if (head && !head.error && !head.signal && head.status === ABSENT_HEAD_STATUS) return [];
   if (!head || head.error || head.signal || head.status !== 0) throw new Error('cannot resolve HEAD');
-  return readTreePaths(run, top, 'HEAD', env);
+  return readTreePaths(run, top, 'HEAD', env, directories);
 };
 const excludePatterns = (top, paths) => [
   ...SCOPE_EXCLUSIONS,
@@ -99,8 +101,7 @@ const collectScope = (top, baseTreeOid, run, lstat, env) => withTemporaryIndex(e
 
 export const snapshotScope = (cwd, { baseTreeOid = null } = {}, io = {}) => {
   try {
-    const env = io.env ?? process.env;
-    const run = makeRunner(io);
+    const env = io.env ?? process.env, run = makeRunner(io);
     const top = locateTop(cwd, run, env);
     return { ok: true, paths: collectScope(top, baseTreeOid, run, io.lstat ?? lstatSync, env) };
   } catch (error) {
@@ -110,8 +111,7 @@ export const snapshotScope = (cwd, { baseTreeOid = null } = {}, io = {}) => {
 
 export const resolveTreeObject = (cwd, oid, io = {}) => {
   try {
-    const env = io.env ?? process.env;
-    const run = makeRunner(io);
+    const env = io.env ?? process.env, run = makeRunner(io);
     const top = locateTop(cwd, run, env);
     const type = readGit(run, ['cat-file', '-t', oid], top, env).toString('utf8').trim();
     return type === 'tree' ? { ok: true } : { ok: false, reason: `${oid} names a ${type}, not a tree` };
@@ -120,19 +120,47 @@ export const resolveTreeObject = (cwd, oid, io = {}) => {
   }
 };
 
-export const runBaseDiff = (cwd, base, args, io = {}) => {
+export const taskFilesScopeRefusal = (cwd, base, paths, io = {}) => {
+  if (paths.length === 0) return null;
+  const current = { path: paths[0] };
+  try {
+    const env = io.env ?? process.env, run = makeRunner(io), lstat = io.lstat ?? lstatSync;
+    const top = locateTop(cwd, run, env);
+    return withTemporaryIndex(env, (indexEnv) => {
+      readGit(run, ['read-tree', '--empty'], top, indexEnv);
+      const treePaths = readHeadPaths(run, top, indexEnv).concat(base.kind === 'checkpoint' ? readTreePaths(run, top, base.treeOid, indexEnv) : []);
+      const directories = readHeadPaths(run, top, indexEnv, true).concat(base.kind === 'checkpoint' ? readTreePaths(run, top, base.treeOid, indexEnv, true) : []);
+      const matchesPattern = (path, pattern) => { const probe = patternToProbe(pattern); return isDirPattern(pattern) ? path === probe.slice(0, -1) || path.startsWith(probe) : path === probe; };
+      const exclusions = excludePatterns(top, paths);
+      for (const path of paths) {
+        current.path = path;
+        if (EXCLUDE_SOURCES.includes(basename(path))) return `${path}: exclude-source`;
+        if (path.split('/').includes('node_modules') || exclusions.some((pattern) => matchesPattern(path, pattern))) return `${path}: excluded`;
+        if (readStat(join(top, path), lstat)?.isDirectory() || directories.includes(path)) return `${path}: directory`;
+        const prefixes = path.split('/').slice(0, -1).map((segment, index, parts) => parts.slice(0, index + 1).join('/'));
+        if (prefixes.some((prefix) => { const stat = readStat(join(top, prefix), lstat); return (stat !== null && !stat.isDirectory()) || treePaths.includes(prefix); })) return `${path}: beneath-non-directory`;
+        if (treePaths.includes(path) || KIT_OWN_PATHS.some((pattern) => matchesPattern(path, pattern))) continue;
+        const { GIT_LITERAL_PATHSPECS: _literalPathspecs, ...ignoreEnv } = indexEnv; const ignored = run(['check-ignore', '--no-index', '-q', '--', path], top, undefined, ignoreEnv);
+        if (!ignored || ignored.error || ignored.signal || ![0, CHECK_IGNORE_CLEAR_STATUS].includes(ignored.status)) throw new Error(`git check-ignore failed: ${ignored?.error?.message ?? String(ignored?.stderr ?? '').trim()}`);
+        if (ignored.status === 0) return `${path}: ignored`;
+      }
+      return null;
+    });
+  } catch (error) { return `${current.path}: ${error.message}`; }
+};
+
+export const runBaseDiff = (cwd, base, args, io = {}, paths = null) => {
   if (base.kind !== 'checkpoint') return null;
   try {
-    const env = io.env ?? process.env;
-    const run = makeRunner(io);
+    const env = io.env ?? process.env, run = makeRunner(io);
     const top = locateTop(cwd, run, env);
     if (!resolveTreeObject(top, base.treeOid, io).ok) return null;
     const scope = snapshotScope(top, { baseTreeOid: base.treeOid }, io);
     if (!scope.ok) return null;
     const basePaths = readTreePaths(run, top, base.treeOid, env);
-    const present = [];
-    const removed = [];
-    for (const path of scope.paths) {
+    const scopedPaths = paths === null ? scope.paths : scope.paths.filter((path) => paths.includes(path));
+    const present = [], removed = [];
+    for (const path of scopedPaths) {
       const stat = readStat(join(top, path), io.lstat ?? lstatSync);
       const baseHoldsPath = basePaths.includes(path);
       const neverCommittable = stat !== null && isNeverCommittableStat(stat);
@@ -141,7 +169,7 @@ export const runBaseDiff = (cwd, base, args, io = {}) => {
       if (materialized) present.push(path);
       if (!materialized && !neverCommittable && (stat === null || baseHoldsPath)) removed.push(path);
     }
-    const excludedBasePaths = basePaths.filter((path) => !scope.paths.includes(path));
+    const excludedBasePaths = basePaths.filter((path) => !scopedPaths.includes(path));
     const conflict = present.find((path) => excludedBasePaths.some((excluded) =>
       path.startsWith(`${excluded}/`) || excluded.startsWith(`${path}/`)));
     if (conflict !== undefined) throw new Error(`live path ${conflict} conflicts with an excluded base path`);
@@ -156,17 +184,17 @@ export const runBaseDiff = (cwd, base, args, io = {}) => {
   }
 };
 
-export const computeBasePayload = (cwd, base, io = {}) => base.kind === 'head'
+export const computeBasePayload = (cwd, base, io = {}, paths = null) => base.kind === 'head'
   ? computeFingerprintPayload(cwd, io)
-  : runBaseDiff(cwd, base, PAYLOAD_DIFF_ARGS, io);
+  : runBaseDiff(cwd, base, PAYLOAD_DIFF_ARGS, io, paths);
 
-export const computeBaseFingerprint = (cwd, base, io) => {
-  const payload = computeBasePayload(cwd, base, io);
+export const computeBaseFingerprint = (cwd, base, io, paths = null) => {
+  const payload = computeBasePayload(cwd, base, io, paths);
   return payload === null ? null : createHash(HASH_ALGORITHM).update(payload).digest('hex');
 };
 
-export const isCleanAgainstBase = (cwd, base, io) => {
+export const isCleanAgainstBase = (cwd, base, io, paths = null) => {
   if (base.kind === 'head') return isTreeClean(cwd, io);
-  const payload = computeBasePayload(cwd, base, io);
+  const payload = computeBasePayload(cwd, base, io, paths);
   return payload === null ? null : payload.length === 0;
 };

package/tools/dispatch-store.mjs

@@ -33,8 +33,8 @@ export const resolveDelegationLockPath = (storePath) => `${storePath}${DELEGATIO
 
 export const UNCOMMITTED_STATE_FINGERPRINT = 'the uncommitted-state fingerprint';
 
-export const uncommittedStateFingerprint = (cwd = process.cwd(), fsx, base = HEAD_BASELINE) => {
-  const fingerprint = base.kind === 'head' ? computeTreeFingerprint(cwd, fsx) : computeBaseFingerprint(cwd, base, fsx);
+export const uncommittedStateFingerprint = (cwd = process.cwd(), fsx, base = HEAD_BASELINE, paths = null) => {
+  const fingerprint = base.kind === 'head' ? computeTreeFingerprint(cwd, fsx) : computeBaseFingerprint(cwd, base, fsx, paths);
   if (fingerprint == null) {
     throw stop(`cannot compute ${UNCOMMITTED_STATE_FINGERPRINT} — not inside a git work tree (or a git probe failed); a record never carries a null tree digest (fail closed)`);
   }

package/tools/dispatch.mjs

@@ -53,8 +53,8 @@
 //     `gate-output` component is emitted in v1. The metric counts the returned change set only.
 //   • a receipt is FORGEABLE, exactly like every record in this family. What the absorb door defends
 //     against is a buggy or interrupted producer, not a hostile one.
-//   • D10 stands as a bar, not a mechanism: at most ONE in-tree exec dispatch runs at a time, and
-//     nothing here refuses a second one, task threads included; files-overlap and mixed-open additionally refuse conflicting task threads at append time.
+//   • D10 stands as a bar, not a mechanism, for untasked threads: at most ONE untasked in-tree exec dispatch
+//     runs at a time, and nothing here refuses a second one; for task threads it is a mechanism: files-overlap and mixed-open refuse conflicting opens at append time, and return and fold refuse out-of-files.
 //   • `await` observes ARRIVAL and nothing else: an expiry never authorizes the next writer, and the
 //     verb releases no slot it never held. Whether the run may be ABSORBED stays `return`'s question. A parallel-write story is not this plan's.
 //
@@ -74,7 +74,7 @@ import {
   DELEGATION_SCHEMA_VERSION, STEP_CLASSES, OBSERVATION_PROVENANCE, RETURN_OUTCOMES,
   SESSION_ID_NULLABLE_OUTCOMES, checkDispatchContractForm, checkDispatchMintConsistency,
   contractDigest, canonicalDelegationDigest, computeNumerator, evaluateMetricEligibility,
-  HEAD_BASELINE, readsBaseline, isTreeOid,
+  HEAD_BASELINE, readsBaseline, isTreeOid, isThreadTerminalRecord,
 } from './dispatch-record.mjs';
 import {
   appendDelegationRecord, readDelegationStore, resolveDelegationStorePath, delegationThreadState,
@@ -89,7 +89,7 @@ import {
   enumerateReturnedObjects, computeReturnedDiff, assembleIntegrationBundle,
 } from './exec-producer.mjs';
 import { gitBuf } from './core-evidence.mjs';
-import { isCleanAgainstBase, resolveTreeObject } from './dispatch-baseline.mjs';
+import { isCleanAgainstBase, resolveTreeObject, taskFilesScopeRefusal, runBaseDiff } from './dispatch-baseline.mjs';
 import { readDelegationLedger } from './dispatch-store-read.mjs';
 import { judgeLedger, threadVerdict, HELD_RECEIPT_BACKEND } from './held-session.mjs';
 import { degradeRecordSet, selectHeldSessionDegrades } from './review-state.mjs';
@@ -100,13 +100,13 @@ import {
 } from './observation-builder.mjs';
 import { handoffReturn, HANDOFF_SLUG_RE } from './worktree-handoff-return.mjs';
 import { parseBrief } from './task-brief.mjs';
-import { byteOrder, validateTask } from './task-thread.mjs';
+import { byteOrder, validateTask, readsTask, claimedPaths } from './task-thread.mjs';
 
 const usageFail = (message) => Object.assign(new Error(message), { exitCode: 2 });
 
 // The ONE contract sentence, doc-parity-bound into references/modes/dispatch.md: the FORM-only limit
 // and the aggregator's refusals are what a reader must not be able to mis-learn from the mode doc.
-export const DISPATCH_CONTRACT = 'the contract check is FORM-only — fields present, grammars respected, never boundedness, design-decidedness or acceptance adequacy — and `aggregate` REFUSES instead of computing acceptance for a wave with no pre-registration record, over an OPEN thread in scope, over a PRE-DISPATCH degrade that opens no thread, or across several waves with no `--wave`; the writer verbs add NO second legality door — the store\'s preflight is the only one, and its refusals travel verbatim — while `open` copies every mint-time field from the contract header and refuses a deadline below the wrapper cap plus the kill grace, `return` absorbs only a TERMINAL exec receipt whose backend, nonce and independently computed contractDigest match the dispatch it answers, and `fold` binds the CURRENT tree to the folded return\'s postTreeDigest, so a tree that moved between the two never folds, and `await` is satisfied ONLY by the TERMINAL exec receipt of its own dispatch\'s {backend, nonce} — never by a review receipt, a ledger line or a finding manifest — while an expiry names a supervision question and releases NO writer slot; `open` records the thread\'s BASE (`head` by default, `checkpoint` under `--checkpoint <oid>`), `return` and `fold` measure against the base the dispatch recorded, never a flag, and the `fold` VERB itself refuses a checkpoint `code` thread the held-session judge names SUBSTITUTED in that thread\'s own verdict — a precondition like its hidden-path and content-blind guards, the store\'s preflight staying the only door on the record';
+export const DISPATCH_CONTRACT = 'the contract check is FORM-only — fields present, grammars respected, never boundedness, design-decidedness or acceptance adequacy — and `aggregate` REFUSES instead of computing acceptance for a wave with no pre-registration record, over an OPEN thread in scope, over a PRE-DISPATCH degrade that opens no thread, or across several waves with no `--wave`; the writer verbs add NO second legality door — the store\'s preflight is the only one, and its refusals travel verbatim — while `open` copies every mint-time field from the contract header and refuses a deadline below the wrapper cap plus the kill grace, `return` absorbs only a TERMINAL exec receipt whose backend, nonce and independently computed contractDigest match the dispatch it answers, and `fold` binds the CURRENT tree to the folded return\'s postTreeDigest, so a tree that moved between the two never folds, and `await` is satisfied ONLY by the TERMINAL exec receipt of its own dispatch\'s {backend, nonce} — never by a review receipt, a ledger line or a finding manifest — while an expiry names a supervision question and releases NO writer slot; `open` records the thread\'s BASE (`head` by default, `checkpoint` under `--checkpoint <oid>`), `return` and `fold` measure against the base the dispatch recorded, never a flag, and the `fold` VERB itself refuses a checkpoint `code` thread the held-session judge names SUBSTITUTED in that thread\'s own verdict — a precondition like its hidden-path and content-blind guards, the store\'s preflight staying the only door on the record; `open --task` records the task, a task thread is measured over its Files and `open`, `return` and `fold` refuse `files-overlap`, `mixed-open` and `out-of-files`';
 
 // ── the flag surface (the CLI tests pin it against the D3 key sets) ────────────────────────────────
 // flag → the record field it decides. The fields NOT on a flag are DERIVED and listed beside them,
@@ -557,8 +557,10 @@ const runOpen = ({ baseCwd, env, argv, now }) => {
     task = { brief, files: [...new Set(parsed.files.map(({ path }) => path))].sort(byteOrder) };
     const checked = validateTask(task, base.kind);
     if (!checked.ok) return refusal('open', checked.reason);
+    const scope = taskFilesScopeRefusal(cwd, base, task.files);
+    if (scope !== null) return refusal('open', `task-files-scope: ${scope}; nothing was written`);
   }
-  const baselineClean = isCleanAgainstBase(cwd, base);
+  const baselineClean = isCleanAgainstBase(cwd, base, undefined, task?.files ?? null);
   if (baselineClean === null) {
     return refusal('open', 'the working state could not be probed, so the baseline is undecidable — a dispatch never records a guessed baseline, and outside a git work tree there is no tree to fingerprint either (fail closed); nothing was written');
   }
@@ -577,7 +579,7 @@ const runOpen = ({ baseCwd, env, argv, now }) => {
   // delegate's account at return time. `open` is where that lie is cheapest to catch.
   const honest = hiddenFromPlainDiff(top);
   if (!honest.ok) return refusal('open', `${honest.reason}; nothing was written`);
-  const preTreeDigest = uncommittedStateFingerprint(cwd, undefined, base);
+  const preTreeDigest = uncommittedStateFingerprint(cwd, undefined, base, task?.files ?? null);
   const record = {
     schema: DELEGATION_SCHEMA_VERSION,
     kind: 'dispatch',
@@ -668,7 +670,7 @@ export const pollExecArrival = ({ dir, backend, nonce, io = {} }) => {
   return { state: 'satisfied', reason: `the TERMINAL exec receipt landed (${path}) — outcome ${receipt.outcome} · exit ${receipt.exitStatus} · session ${receipt.sessionId ?? 'none'}` };
 };
 
-const NO_SLOT_RELEASED = 'NO writer slot was released: a wait that ended without an answer never authorizes the next dispatch (D10 — one in-tree exec dispatch at a time)';
+const NO_SLOT_RELEASED = 'NO writer slot was released: a wait that ended without an answer never authorizes the next dispatch';
 
 // The bound arithmetic is BigInt, and it HAS to be. The frozen record vocabulary admits any positive
 // SAFE INTEGER `deadlineS` (dispatch-record.mjs), so `deadlineS * 1000` leaves the exactly
@@ -1056,6 +1058,18 @@ export const treeDriftRefusal = (openingDigest, closingDigest) => (openingDigest
   ? null
   : `the tree moved WHILE the return was being computed (${openingDigest.slice(0, 12)}… → ${closingDigest.slice(0, 12)}…) — the enumeration and the diff would then describe two different change sets, and the record would bind a postTreeDigest neither of them saw; nothing was written, so leave the tree alone and return again`);
 
+const getOutOfFilesRefusal = (cwd, base, env) => {
+  const changed = runBaseDiff(cwd, base, ['--name-only', '--no-renames', '-z'], {}, null);
+  if (changed === null) return 'out-of-files: the snapshot domain is undecidable (fail closed); nothing was written';
+  const ledger = readDelegationLedger(cwd, env);
+  if (ledger.state !== 'ok') return `out-of-files: ${ledger.reason ?? `delegation ledger is ${ledger.state}`} (fail closed); nothing was written`;
+  const { records, head } = ledger;
+  if (head.state === 'error') return `out-of-files: ${head.reason} (fail closed); nothing was written`;
+  const claimed = new Set(claimedPaths(records, base.treeOid, head, isThreadTerminalRecord));
+  const unclaimed = changed.toString('utf8').split('\0').filter((path) => path !== '' && !claimed.has(path)).sort(byteOrder);
+  return unclaimed.length === 0 ? null : `out-of-files: ${unclaimed.join(', ')}; nothing was written`;
+};
+
 const runReturn = ({ baseCwd, env, argv, now }) => {
   const { values, operands, cwd } = scan(argv, { ...RETURN_FLAG_FIELDS, ...RETURN_INPUT_FLAGS }, baseCwd, { booleans: RETURN_BOOLEAN_FLAGS });
   refuseOperands('return', operands);
@@ -1156,20 +1170,23 @@ const runReturn = ({ baseCwd, env, argv, now }) => {
   // A tree that moved between them would hand the numerator one change set and the denominator
   // another, and the record would bind a postTreeDigest neither of them describes.
   const base = readsBaseline(dispatch);
-  const openingDigest = uncommittedStateFingerprint(cwd, undefined, base);
-  const enumerated = enumerateReturnedObjects(cwd, { base });
+  const paths = readsTask(dispatch)?.files ?? null;
+  const openingDigest = uncommittedStateFingerprint(cwd, undefined, base, paths);
+  const enumerated = enumerateReturnedObjects(cwd, { base, paths });
   if (!enumerated.ok) return refusal('return', enumerated.reason);
   const opaque = contentBlindRefusal(enumerated.entries);
   if (opaque !== null) return refusal('return', `${opaque}; nothing was written`);
   const lostTarget = symlinkTargetRefusal(top, enumerated.entries);
   if (lostTarget !== null) return refusal('return', `${lostTarget}; nothing was written`);
-  const produced = computeReturnedDiff(cwd, { base });
+  const produced = computeReturnedDiff(cwd, { base, paths });
   if (!produced.ok) return refusal('return', produced.reason);
   // The payload IS the diff and its digest IS the uncommitted-state fingerprint — one computation,
   // so diffDigest and postTreeDigest are equal by construction rather than by coincidence.
   const postTreeDigest = sha256(produced.diff);
   const drift = treeDriftRefusal(openingDigest, postTreeDigest);
   if (drift !== null) return refusal('return', drift);
+  const outOfFiles = paths === null ? null : getOutOfFilesRefusal(cwd, base, env);
+  if (outOfFiles !== null) return refusal('return', outOfFiles);
   // The fail-closed arm of a producer contradiction (one objectId claimed at two sizes). The
   // enumeration is this kit's own and emits one entry per object, so nothing here can reach it —
   // the vocabulary stays the authority on what a component is, and its refusal is surfaced whole.
@@ -1290,7 +1307,8 @@ const runFold = ({ baseCwd, env, argv, now }) => {
   // return and the fold without moving the digest this fold is about to bind. The enumeration runs
   // here for that one question — the fold computes no metric of its own.
   const base = readsBaseline(state.dispatch);
-  const enumerated = enumerateReturnedObjects(cwd, { base });
+  const paths = readsTask(state.dispatch)?.files ?? null;
+  const enumerated = enumerateReturnedObjects(cwd, { base, paths });
   if (!enumerated.ok) return refusal('fold', enumerated.reason);
   const opaque = contentBlindRefusal(enumerated.entries);
   if (opaque !== null) return refusal('fold', `${opaque}; nothing was written`);
@@ -1327,7 +1345,9 @@ const runFold = ({ baseCwd, env, argv, now }) => {
   // fold is honest there — identical payload bytes, identical content — so the rule is "the fold
   // precedes staging", never "staging refuses the fold by construction". A checkpoint measurement
   // never reads the real index, so staging moves nothing there; the fold still precedes `git add`.
-  const treeDigestAtFold = uncommittedStateFingerprint(cwd, undefined, base);
+  const treeDigestAtFold = uncommittedStateFingerprint(cwd, undefined, base, paths);
+  const outOfFiles = paths === null ? null : getOutOfFilesRefusal(cwd, base, env);
+  if (outOfFiles !== null) return refusal('fold', outOfFiles);
   const record = {
     schema: DELEGATION_SCHEMA_VERSION,
     kind: 'fold',
@@ -1672,7 +1692,7 @@ refusal from the store verbatim.
 --checkpoint <oid> records a resolvable TREE object of exactly 40 or 64 lowercase hex characters
 (a commit, blob, tag or unknown id refuses by name); the base rides the record and return/fold read
 it there, while a checkpoint CLEAN line names the base.
---task records the brief's path and its byte-ordered Files, requires --checkpoint (task-base), refuses a brief the parser refuses by the parser's name, and the store refuses files-overlap and mixed-open at append time.
+--task records the brief's path and its byte-ordered Files, requires --checkpoint (task-base), refuses a brief the parser refuses by the parser's name, refuses task-files-scope for a Files path the snapshot domain can never hold, and the store refuses files-overlap and mixed-open at append time; a task thread is measured over its Files.
 
 THE LEDGER a tree-binding verb uses is the CANONICAL one, exactly: <git common dir>/
 agent-workflow-delegation.jsonl. A store inside the work tree is measured as part of the change set
@@ -1800,8 +1820,8 @@ diff: a mode change moves it and no untracked marker line exists. Under a head b
 arrives as a deletion plus a creation, over-counting a plain rename; under a checkpoint base git's own
 rename detection applies inside the one base-relative layer and a detected rename is counted once.
 A receipt is forgeable exactly like every record here;
-and D10 stands as a BAR, not a mechanism — at most one in-tree exec dispatch at a time, and nothing
-refuses a second, task threads included; files-overlap and mixed-open additionally refuse conflicting task threads at append time.
+and D10 stands as a BAR, not a mechanism, for untasked threads — at most one untasked in-tree exec dispatch at a time,
+and nothing refuses a second; for task threads it is a mechanism: files-overlap and mixed-open refuse conflicting opens at append time, and return and fold refuse out-of-files.
 
 Never commits, never runs a subscription CLI, spawns nothing but git READS — with TWO stated exceptions: handoff-return,
 which attests MAIN's index with git write-tree: that may write a tree OBJECT into the odb and moves

package/tools/exec-producer.mjs

@@ -14,7 +14,7 @@
 // the DENOMINATOR) while HEAD→worktree shows nothing at all, so the object would vanish from the
 // NUMERATOR and the two halves of one ratio would describe different change sets. The diff bytes are
 // computeFingerprintPayload's own bytes, imported rather than rebuilt. Under a checkpoint base the
-// walk is one layer against the base tree, through the leaf's temporary index.
+// walk is one layer against the base tree, through the leaf's temporary index; io.paths absent or null = the whole domain.
 //
 // ONE OBJECT, ONE ENTRY. Under a head base an object touched in both layers is a single entry, and its pre-image is
 // always the HEAD blob — never the index blob: the numerator answers what the delegate could have
@@ -359,11 +359,11 @@ const entryForUntracked = (top, rel, lstat) => {
 };
 
 const enumerateCheckpointObjects = (top, base, io) => {
-  const raw = runBaseDiff(top, base, BASE_RAW_ARGS, io);
+  const raw = runBaseDiff(top, base, BASE_RAW_ARGS, io, io.paths ?? null);
   if (raw === null) return refuse('git could not read the base-relative change set (fail closed)');
   const parsed = parseRawRecords(raw, 'the base-relative change set');
   if (!parsed.ok) return parsed;
-  const numstat = runBaseDiff(top, base, BASE_NUMSTAT_ARGS, io);
+  const numstat = runBaseDiff(top, base, BASE_NUMSTAT_ARGS, io, io.paths ?? null);
   if (numstat === null) return refuse('git could not read the numstat binary markers (fail closed)');
   const binary = parseNumstatMarkers(numstat, 'the base-relative binary markers');
   if (!binary.ok) return binary;
@@ -482,7 +482,7 @@ export const computeReturnedDiff = (cwd = process.cwd(), io = {}) => {
   // caller that framed a bundle around a thrown read would have no bytes and no reason either.
   try {
     const base = io.base ?? HEAD_BASELINE;
-    const payload = base.kind === 'checkpoint' ? computeBasePayload(cwd, base, io) : computeFingerprintPayload(cwd);
+    const payload = base.kind === 'checkpoint' ? computeBasePayload(cwd, base, io, io.paths ?? null) : computeFingerprintPayload(cwd);
     return payload == null
       ? refuse('the canonical payload could not be computed (fail closed)')
       : { ok: true, diff: payload };

package/tools/task-brief.mjs

@@ -6,7 +6,10 @@ import { readFileBytesNoFollow } from './fs-read-nofollow.mjs';
 import { parseLedger, isSweep, PLAN_HEADINGS } from './plan-shape.mjs';
 import { expandSweepPaths } from './plan-shape-facts.mjs';
 import { readStoryLine, PIN_FILE } from './plan-shape-ownership.mjs';
-import { parseDispatchContract } from './dispatch-record.mjs';
+import { parseDispatchContract, isThreadTerminalRecord } from './dispatch-record.mjs';
+import { runBaseDiff } from './dispatch-baseline.mjs';
+import { readDelegationLedger } from './dispatch-store-read.mjs';
+import { claimedPaths } from './task-thread.mjs';
 import { newestCheckpoint, verifyCheckpoint } from './checkpoint.mjs';
 import { withRepository, readGit } from './checkpoint-core.mjs';
 import { isDirectRun } from './direct-run.mjs';
@@ -19,6 +22,7 @@ const START = 0;
 const ONE = 1;
 const EMPTY = '';
 const NL = '\n';
+const NUL = '\0';
 const CR_END = /\r$/;
 const UTF8 = 'utf8';
 const STRING = 'string';
@@ -49,6 +53,9 @@ const GROUP_SEPARATOR = ', ';
 const PARENT = '..';
 const CURRENT = '.';
 const READ_OK = 'ok';
+const READ_ERROR = 'error';
+const CHECKPOINT_KIND = 'checkpoint';
+const CHANGED_PATH_ARGS = ['--name-only', '--no-renames', '-z'];
 const SCHEMA = 1;
 const BINDING_KEYS = ['schema', 'plan', 'reads', 'checkpoint', 'head'];
 const FILE_KEYS = ['path', 'sha256'];
@@ -243,7 +250,18 @@ export const checkBrief = (cwd, briefPath, { dispatchPath } = {}, io = {}) => wi
     entry.path !== binding.reads[index].path || entry.sha256 !== binding.reads[index].sha256)) reject(NAMES.read);
   if (binding.checkpoint !== newest.oid) reject(NAMES.checkpoint);
   const verified = verifyCheckpoint(cwd, binding.checkpoint, context.io);
-  if (!verified.ok || !verified.clean) reject(NAMES.stale, verified.reason);
+  if (!verified.ok) reject(NAMES.stale, verified.reason);
+  if (!verified.clean) {
+    const changed = runBaseDiff(context.top, { kind: CHECKPOINT_KIND, treeOid: binding.checkpoint }, CHANGED_PATH_ARGS, context.io);
+    if (changed === null) reject(NAMES.stale, verified.reason);
+    const paths = changed.toString(UTF8).split(NUL).filter(Boolean);
+    const ledger = readDelegationLedger(context.cwd, context.env);
+    if (ledger.state === READ_ERROR) reject(NAMES.stale, ledger.reason);
+    const claimed = new Set(ledger.state === READ_OK
+      ? claimedPaths(ledger.records, binding.checkpoint, ledger.head, isThreadTerminalRecord) : []);
+    const ownFiles = new Set(brief.files.map(({ path }) => path));
+    if (!paths.every((path) => claimed.has(path) && !ownFiles.has(path))) reject(NAMES.stale, verified.reason);
+  }
   if (binding.head !== readHead(context, NAMES.boundHead)) reject(NAMES.boundHead);
   if (dispatchPath !== undefined) checkDispatch(context, dispatchPath, briefPath, file.sha256);
   return { ok: true, digest: file.sha256 };