agent-coord-mcp 0.26.23 → 0.26.24

package/src/capabilities.ts

@@ -51,7 +51,8 @@ import { queueWriteSchema } from "./tools/queue-write.js";
 import { treeProvenance } from "./tools/tree-provenance.js";
 import { detectSpread } from "./server-spread.js";
 import { HerdrTransport, herdrKeyName } from "./transports/herdr.js";
-import { HERDR } from "./transports/types.js";
+import { tickVerdict } from "./tools/tick.js";
+import { HERDR, TICK_READS_AS, TICK_STORED_AS, type TickState } from "./transports/types.js";
 
 export type ProbeResult = {
   id: string;
@@ -237,6 +238,35 @@ const PROBES: Probe[] = [
       };
     },
   },
+  {
+    // ⟨q-b607005a⟩ — a WRITER must not impose this queue's id grammar on a
+    // document that does not use it. Measured on a consumer fleet 2026-09-16: filing ONE item
+    // stamped `⟨q-…⟩` onto ALL 168 rows of a queue keyed by `[Q-nnn]` and broke
+    // two green guards. The property is not "it stamps" — stamping a queue that
+    // ALREADY records ids is correct and must not regress. It is that the
+    // document's own prior art decides, and the row THIS CALL authored is the
+    // exception that keeps the absorption defect closed.
+    id: "stamp-respects-foreign-grammar",
+    since: "0.26.24",
+    run: () => {
+      const head = ["---", 'title: "Queue"', "---", "", "## Queue", ""];
+      const foreign = parseWorkDoc(head.concat(["- [ ] (P1) [Q-001] a consumer's own convention"]).join("\n"));
+      const native = parseWorkDoc(
+        head.concat(["- [ ] (P1) ⟨q-11111111⟩ records its id", "- [ ] (P2) appended by hand"]).join("\n"),
+      );
+      const foreignOwn = queueItemsOf(foreign)[0]?.id ?? "";
+      const left = stampQueueIds(foreign).stamped.length;
+      const owned = stampQueueIds(foreign, { own: [foreignOwn] }).stamped.length;
+      const absorbed = stampQueueIds(native).stamped.length;
+      const present = left === 0 && owned === 1 && absorbed === 1;
+      return {
+        present,
+        evidence:
+          `foreign doc, not ours -> stamped ${left} · foreign doc, our own row -> stamped ${owned} · ` +
+          `doc that already records ids -> absorbed ${absorbed} -> present=${present}`,
+      };
+    },
+  },
   {
     // #293 — `detectSpread` did not exist before 0.26.22. The property is not
     // "it answers": an UNREADABLE seat must poison the verdict rather than be
@@ -272,6 +302,28 @@ const PROBES: Probe[] = [
       return { present, evidence: `"⛔ Blocked — was 🚧 …" in flight: ${blocked} (0.26.21 said true) · "🔍 In Review": ${review} -> present=${present}` };
     },
   },
+  {
+    // ⟨q-1c95f7d4⟩ Phase 5.4 Task 5 — the external tick, probed by CALLING the code that
+    // decides what a reading MEANS (every probe here is synchronous, so the async read is
+    // exercised by its test suite and this asserts the decision layer plus the wiring):
+    // a `blocked` reading is a measured HIT, an `idle` one is coverage and NOT a hit, an
+    // unreadable one is neither, and herdr's measured write/read asymmetry is in place.
+    id: "external-tick-evidence",
+    since: "0.26.24",
+    run: () => {
+      const seat = (state: TickState) => ({ agentId: "probe", transport: HERDR, readable: true as const, state, source: "herdr pane w0:p0" });
+      const blocked = tickVerdict(seat("blocked"));
+      const idle = tickVerdict(seat("idle"));
+      const blind = tickVerdict({ agentId: "probe", transport: HERDR, readable: false as const, why: "no agent there" });
+      const wired = typeof new HerdrTransport().readTick === "function" && typeof new HerdrTransport().publishTick === "function";
+      const stored = TICK_STORED_AS.idle === "done" && TICK_READS_AS.done === "idle";
+      const present = blocked?.hit === true && idle?.hit === false && idle?.measured === true && blind?.measured === false && wired && stored;
+      return {
+        present,
+        evidence: `tickVerdict blocked -> hit=${blocked?.hit} · idle -> hit=${idle?.hit} measured=${idle?.measured} · unreadable -> measured=${blind?.measured} · readTick/publishTick wired=${wired} · TICK_STORED_AS.idle="${TICK_STORED_AS.idle}" -> present=${present}`,
+      };
+    },
+  },
   {
     // Phase 5.4 Task 4 (0.26.23) — the herdr transport exists and refuses by name: a scripted
     // dead pane reads dead from herdr's own reply, and a tmux key name is refused, not typed.
@@ -473,6 +525,7 @@ export function probeCapabilities(context: { module: string; versionLabel: strin
 import { resolveServerIdentity } from "./server-identity.js";
 import { seatBuildOf, installedFrom, psReader, type SeatBuild } from "./tools/seat-build.js";
 import { isInFlightStatus } from "./tools/stall.js";
+import { parseWorkDoc, queueItemsOf, stampQueueIds } from "@davidbalzan/groundwork-seam";
 
 export const capabilitiesSchema = {} as const;
 

package/src/gated-head.ts

@@ -207,13 +207,189 @@ export function gatedBy(verdicts: PassVerdict[], head: string, mergedAt: number
 }
 
 /**
- * The typed verdict line on a PR page (#313's grammar): `QA GATE — **PASS** @ \`sha\``
- * or the merge-time `**GATE: PASS** … @ \`sha\``. Uppercase PASS/FAIL as a whole
- * word on a line that opens with the gate marker and carries an `@ sha`. Prose
- * that says "passes", "verdict" or "FAILs" does not match — #299's shape, where
- * a PASS|FAIL substring scan would have counted an explicit non-verdict review.
+ * ⛔ #313's GRAMMAR, KEPT ONLY FOR BACKWARDS COMPATIBILITY — IT MATCHED NOTHING IN
+ * THE FIELD. `QA GATE — **PASS** @ \`sha\`` was ruled canonical and then had ZERO
+ * ADOPTION: measured against the 9 merges of 2026-09-15, it matched 0 verdict
+ * lines while all 9 merges carried one, so `unverdicted-merge` fired 9 times on 9
+ * correct merges — 100% false positive, which trains the room to ignore the one
+ * instrument protecting the convention.
+ *
+ * ⭐ THE LESSON IS WHY THIS CONSTANT IS NO LONGER THE PREDICATE: A REGEX OVER PROSE
+ * TESTS THE PHRASING, NOT THE CLAIM. The verdicts were never missing; only the
+ * agreed wording was. Nobody noticed because every verdict is read BY EYE at gate
+ * time and they all read fine — the instrument and the humans disagreed silently
+ * for a day.
+ *
+ * ⚠ SCOPE, CORRECTED: "zero adoption" IS TRUE OF A CONSUMER FLEET AND FALSE OF THIS REPO.
+ * Measured: 0 of 9 of that fleet's merges carry this grammar; 4 of 6 kit merges do, verbatim
+ * (`#342`, `#340`, `#337`, `#336`). The original write-up scoped a measurement to one
+ * consumer and stated it universally.
+ *
+ * ⛔⛔ AND DO NOT BELIEVE THIS CONSTANT IS WHAT KEEPS THAT KIT GRAMMAR WORKING — I
+ * CLAIMED THAT AND IT IS FALSE. `verdictBoundTo` → `verdictClaimsIn` NEVER references
+ * `VERDICT_COMMENT`; it survives only in the legacy `verdictShasIn`. Compatibility comes
+ * from `DECLARES` accepting the `(?:QA )?GATE\b` opener. ⇒ THE TRAP THAT MAKES THIS
+ * WORTH WRITING DOWN: deleting this constant as dead code leaves the kit grammar working,
+ * so the experiment CONFIRMS the false mechanism — whoever ran it would conclude they had
+ * removed something load-bearing and got away with it. If you are removing it, the thing
+ * to check is `DECLARES`, not this.
  */
 export const VERDICT_COMMENT = /^(?:QA GATE|\*\*GATE|GATE)\b[^\n]*?\b(PASS|FAIL)\b(?:\s*\([^)\n]*\))?[^\n]*?@\s*`?([0-9a-f]{7,40})`?/;
+
+/**
+ * WHAT MAKES A VERDICT BINDING, expressed as a shape instead of a phrase: a
+ * DISPOSITION and a SHA, on ONE LINE, with the disposition ahead of the `@`. The
+ * caller then decides bindingness by comparing that sha to the head it cares
+ * about — the claim, not the header.
+ *
+ * Derived from the five spellings actually in the field on 2026-09-15, none of
+ * which the constant above matches:
+ *   `## QA verdict — DONE: PASS \`#970\` @ \`sha\` · mode: full-local · base …`
+ *   `## QA verdict — DONE: CONTENT PASS \`#964\` @ \`sha\``
+ *   `## QA verdict — DONE: READINESS RELEASED \`#964\` @ \`sha\``
+ *   `## QA-2 — FULL PASS (content + readiness) @ \`sha\``
+ *   `## qa-2 — CONTENT PASS (re-bind) @ \`sha\` · READINESS NOT CLEAR`
+ *
+ * ⛔ THE HALVES ARE DISTINGUISHED, BECAUSE A CONTENT PASS IS NOT A CLEARANCE. It
+ * says so in its own body ("READINESS NOT ESTABLISHED — do not merge yet"), so
+ * counting it as a whole verdict would license exactly the merge it forbids. A
+ * caller wanting "was this clear to merge" needs a WHOLE verdict, or BOTH halves.
+ *
+ * ⛔ ORDER MATTERS IN THE CLASSIFIER: `CONTENT PASS` and `READINESS RELEASED` are
+ * tested before bare `PASS`, and `READINESS NOT CLEAR`/`NOT ESTABLISHED` must not
+ * read as a readiness half — the live `## qa-2 — CONTENT PASS (re-bind) @ sha ·
+ * READINESS NOT CLEAR` line carries both phrases and is a CONTENT half only.
+ */
+export type VerdictClaim = { result: string; sha: string; half: "whole" | "content" | "readiness" };
+const NEGATED_READINESS = /READINESS\s+(?:NOT|IS\s+NOT)\b/i;
+/**
+ * ⛔ THE LINE MUST DECLARE, NOT REMARK — and this anchor is here because removing it
+ * BROKE THE AIDE'S #299 CONTROL, which caught it immediately. That control's sharpest
+ * fixture is `Looks like a PASS to me — see the run @ \`sha\` for the log; not a gate.`:
+ * uppercase PASS, an `@`, and the MERGED HEAD's own sha. Disposition-plus-bound-sha alone
+ * counts it, and a chat remark then silences the check for a genuinely unverdicted merge.
+ *
+ * So a claim is a HEADING (every live verdict on 2026-09-15 is `## …`) or the legacy gate
+ * opener. That is still structure rather than phrasing — what it requires is that someone
+ * DECLARED a disposition, not that they used a particular sentence — and it is the part of
+ * #313's grammar worth keeping: `QA GATE` was the wrong half to demand, `is a declaration`
+ * was the right one.
+ */
+const DECLARES = /^\s*(?:#{1,6}\s+|\*\*(?:QA )?GATE|(?:QA )?GATE\b)/;
+/** An explicit disclaimer on the same line is dispositive — the author says it is not one. */
+const DISCLAIMED = /\bnot a (?:gate|verdict)\b/i;
+
+/**
+ * ⛔⛔ A WITHDRAWAL IS NOT THE VERDICT IT WITHDRAWS, AND THE NAIVE READING IS THE DANGEROUS ONE.
+ * A consumer fleet's gate seat posted these on one of its PRs; both bound as a clean PASS before this line
+ * existed:
+ *     `## ⛔ VOIDING my PASS-HOLD @ <sha> — that head is two moves dead`
+ *     `## ⛔ VOIDING my PASS @ <sha>`
+ * A line that revokes a verdict names that verdict — so matching the disposition word inside it
+ * turns a RETRACTION into a CLEARANCE. That is a FALSE NEGATIVE in a watchdog, which is
+ * indistinguishable from a clean run: `unverdicted-merge` would stay silent on a PR merged after
+ * its verdict was voided, which is precisely the merge it exists to catch.
+ *
+ * ⛔⛔ AND POSITION IS THE DISCRIMINATOR, NOT PRESENCE — the first version tested this pattern
+ * ANYWHERE on the line and failed in the OPPOSITE direction. A verdict that REPLACES an earlier
+ * one routinely says so in its own header, which is the practice that keeps a superseded verdict
+ * VISIBLE instead of silently edited:
+ *     `## QA GATE — **FAIL** @ <sha> — superseding my CONTENT PASS above`   ← verbatim, a consumer fleet's PR
+ * Discarding that one makes `unverdicted-merge` FIRE ON A PROPERLY GATED MERGE — and it
+ * concentrates where gating was MOST active, because a PR whose verdict got corrected is one that
+ * received MORE scrutiny. The instrument would go loudest exactly where it is least needed.
+ *
+ * ⇒ IN A WITHDRAWAL THE VERB PRECEDES THE DISPOSITION; IN A SUPERSEDING VERDICT THE DISPOSITION
+ * COMES FIRST. qa-2's shape, and it is measured rather than reasoned: across ALL 124 verdict-shaped
+ * lines in both repos (101 of them declaration-shaped), exactly TWO carry a revocation verb, and
+ * they split correctly by position — 1 withdrawal, 1 superseding verdict, 99 plain verdicts.
+ *
+ * ⚠ THE RESIDUAL, STATED WITH ITS DENOMINATOR RATHER THAN LEFT IMPLIED: `PASS @ <sha> —
+ * SUPERSEDED, see below` puts the verb after the disposition and would be ACCEPTED. qa-2 raised it
+ * as its own invention and flagged it as not field-observed; the corpus agrees — ZERO of 124. It is
+ * also partly self-correcting, since whatever supersedes it binds the same sha later.
+ */
+const REVOCATION_VERB = /\b(?:VOID(?:ING|ED)?|WITHDRAW(?:N|ING)?|RETRACT(?:ED|ING)?|SUPERSED(?:ED|ING|ES))\b/i;
+/** True only when the revocation verb comes BEFORE the disposition it names. */
+function isWithdrawal(line: string, dispositionIndex: number): boolean {
+  const verb = REVOCATION_VERB.exec(line);
+  return verb !== null && verb.index < dispositionIndex;
+}
+
+/**
+ * ⛔ `PASS-HOLD` IS A DOCUMENTED DO-NOT-MERGE VERDICT (`coord-qa/SKILL.md:71,74`) AND `\bPASS\b`
+ * MATCHED INSIDE IT, because `-` is a non-word character. So the one verdict type whose entire
+ * meaning is "do not merge" classified as a clearance and BOUND.
+ * ⚠ It had not yet fired, and that was LUCK: qa-2's own `#974` PASS-HOLD missed only because the
+ * head moved and the sha stopped agreeing. Nothing in the classifier prevented it.
+ */
+const HOLD = /\bPASS-HOLD\b/i;
+
+/**
+ * ⭐ FOUND BY THE CORPUS, NOT BY A GATE — the fourth non-clearance form, and the first one this
+ * suite caught itself rather than a reviewer catching it:
+ *     `## QA — **READINESS REFUSED** @ <sha> · the CONTENT PASS above still stands`   (a consumer fleet's PR)
+ * ⚠ IT ALREADY BEHAVED CORRECTLY, AND ONLY BY ACCIDENT: `READINESS REFUSED` is not a disposition,
+ * and the `CONTENT PASS` it mentions sits AFTER the `@ <sha>`, so no claim matched. Reorder that
+ * sentence — `the CONTENT PASS above still stands @ <sha>` — and the refusal would have BOUND as a
+ * content half. Naming it makes the behaviour a decision instead of a word-order coincidence.
+ */
+const REFUSED = /\bREADINESS\s+REFUSED\b/i;
+/** A disposition ahead of an `@ sha` on the same line. The sha's binding is the caller's test. */
+const CLAIM_LINE = /\b(READINESS\s+RELEASED|CONTENT\s+PASS|FULL\s+PASS|PASS-HOLD|PASS|FAIL)\b[^\n]*?@\s*`?([0-9a-f]{7,40})`?/i;
+export function verdictClaimsIn(comments: { body: string }[]): VerdictClaim[] {
+  const out: VerdictClaim[] = [];
+  for (const c of comments) {
+    for (const line of String(c.body ?? "").split("\n")) {
+      // ⛔ A HOLD IS A NON-CLEARANCE THAT NAMES ITS OWN DISPOSITION, so it is rejected outright.
+      if (!DECLARES.test(line) || DISCLAIMED.test(line) || HOLD.test(line) || REFUSED.test(line)) continue;
+      const m = CLAIM_LINE.exec(line);
+      if (!m) continue;
+      // ⛔ A WITHDRAWAL IS REJECTED BY POSITION, NOT BY PRESENCE — see isWithdrawal. Testing the
+      // verb anywhere on the line discards the superseding verdicts that carry it AFTER the
+      // disposition, which fires the watchdog on properly gated merges.
+      if (isWithdrawal(line, m.index)) continue;
+      const word = m[1]!.toUpperCase().replace(/\s+/g, " ");
+      const sha = m[2]!;
+      if (word === "READINESS RELEASED") {
+        out.push({ result: "PASS", sha, half: "readiness" });
+      } else if (word === "CONTENT PASS") {
+        out.push({ result: "PASS", sha, half: "content" });
+      } else if (word === "FAIL") {
+        out.push({ result: "FAIL", sha, half: "whole" });
+      } else {
+        // bare PASS / FULL PASS — a whole verdict unless the same line withholds readiness
+        out.push({ result: "PASS", sha, half: NEGATED_READINESS.test(line) ? "content" : "whole" });
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * Is there a verdict BOUND TO `head` — a whole one, or both halves? This is the
+ * question `unverdicted-merge` actually asks, and it is the seam #964 exposed:
+ * that PR published CONTENT PASS and READINESS RELEASED as two separate comments,
+ * so a rule scoped to a whole verdict misses a merge that was fully gated.
+ *
+ * ⭐ A SUPERSEDED VERDICT CANNOT SATISFY THIS, BY CONSTRUCTION RATHER THAN BY A
+ * SPECIAL CASE. #965's FAIL cited `ab58f9455` — an object that does not exist —
+ * and was corrected in a later comment. Requiring agreement with the head that
+ * MERGED means a sha naming any other tree (wrong, stale, or nonexistent) simply
+ * does not bind. No "is this superseded" heuristic is needed and none is used.
+ */
+export function verdictBoundTo(comments: { body: string }[], head: string): { bound: boolean; why: string } {
+  const claims = verdictClaimsIn(comments).filter((v) => shaAgrees(v.sha, head));
+  const whole = claims.find((v) => v.half === "whole");
+  if (whole) return { bound: true, why: `${whole.result} bound to ${head.slice(0, 7)}` };
+  const content = claims.some((v) => v.half === "content");
+  const readiness = claims.some((v) => v.half === "readiness");
+  if (content && readiness) return { bound: true, why: `CONTENT PASS + READINESS RELEASED bound to ${head.slice(0, 7)} (split halves)` };
+  if (content) return { bound: false, why: `only a CONTENT half at ${head.slice(0, 7)} — readiness never released, which is the half that clears a merge` };
+  if (readiness) return { bound: false, why: `only a READINESS half at ${head.slice(0, 7)} — no content verdict` };
+  return { bound: false, why: `no disposition bound to ${head.slice(0, 7)}` };
+}
+
 export function verdictShasIn(comments: { body: string }[]): { result: string; sha: string }[] {
   const out: { result: string; sha: string }[] = [];
   for (const c of comments) {

package/src/tools/away.ts

@@ -92,6 +92,18 @@ export const COVERAGE_THRESHOLD = "EVERY in-flight lane the clock scores must be
  * carries the reading's age and labels it stale past this many minutes.
  */
 export const COVERAGE_STALE_MINUTES = 60;
+/**
+ * ⟨q-1c95f7d4⟩ 5.4 — the tick's own sentence for the announcement and the refusal. A fleet
+ * with NO tick source says so (that is this fleet today: six tmux seats, zero herdr), and a
+ * fleet with a source that answered for nobody says BLIND rather than saying nothing.
+ */
+export const tickSentence = (t?: AwayTick): string => {
+  if (!t || t.seats === 0) return " No external tick: no seat has an observer to ask, so every lane above was measured from its branch and the board alone.";
+  if (t.readable === 0) return ` External tick BLIND: ${t.seats} seat(s) have an observer and none answered — a source that cannot be read is not a quiet fleet.`;
+  const states = Object.entries(t.states).map(([k, v]) => `${v} ${k}`).join(", ");
+  return ` External tick: ${t.readable}/${t.seats} seat(s) answered${states ? ` (${states})` : ""} — evidence about the seats, beside the branch axes, never instead of them.`;
+};
+
 export const fmtAge = (ms: number): string => (ms < 60_000 ? `${Math.max(0, Math.round(ms / 1000))}s` : ms < 3_600_000 ? `${Math.floor(ms / 60_000)}m` : ms < 86_400_000 ? `${Math.floor(ms / 3_600_000)}h` : `${Math.floor(ms / 86_400_000)}d`);
 export function coverageAgeOf(coverage: { at: string }, now = Date.now()): { ageMs: number | null; stale: boolean; label: string } {
   const at = Date.parse(coverage.at);
@@ -103,10 +115,28 @@ export function coverageAgeOf(coverage: { at: string }, now = Date.now()): { age
 /** Met when nothing scored is unseen — an empty board (0 of 0) is idle, not blind, and needs no special case. */
 export const meetsCoverageThreshold = (c: { checked: number; measurable: number }): boolean => c.measurable >= c.checked;
 
+/**
+ * ⟨q-1c95f7d4⟩ Task 5.4 — WHAT THE EXTERNAL TICK CONTRIBUTES TO THE AWAY PRECONDITION.
+ *
+ * The precondition asks what the clock could actually SEE. A seat observed from OUTSIDE
+ * this process — herdr answering `idle | working | blocked` for its pane — is seen in a way
+ * a pid and a branch cannot manage: it is the only signal here that separates a thinking
+ * lane from a wedged one. So a readable tick counts as measured, through `stall_check`'s
+ * own coverage arithmetic, and nothing is special-cased here.
+ *
+ * ⛔ WHAT IS NOT DONE, DELIBERATELY: a tick NEVER raises coverage for a seat the branch
+ * axes could not measure into "observed enough to go away on". It credits the seat it read
+ * and nothing else, and a fleet with a tick source that answered for NOBODY is reported as
+ * blind — `0 of N readable` is the blind case this verb exists to refuse, not a quiet one.
+ */
+export type AwayTick = { seats: number; readable: number; states: Record<string, number>; note: string };
+
 export type AwayCoverage = {
   checked: number;
   measurable: number;
   blind: string[];
+  /** ⟨q-1c95f7d4⟩ the external tick behind this coverage number, named so the announcement can say what watched the fleet. */
+  tick?: AwayTick;
   /** ⟨q-5d1c8e04⟩ — standing seats on the board: present, not scored, and therefore not blind. */
   roles?: number;
   /** Lanes that declare no per-agent branch: out of the population by their own statement. */
@@ -220,6 +250,7 @@ async function measureCoverage(repo?: string): Promise<AwayCoverage | null> {
   try {
     const r = (await stallCheckTool({ repo })) as unknown as {
       ok?: boolean; checked?: number; measurable?: number; blind?: string[]; roles?: unknown[]; deliberate?: unknown[];
+      tick?: { seats?: unknown[]; readable?: number; states?: Record<string, number>; note?: string };
       boardParse?: { readable: boolean; rowsPresent: number; rowsParsed: number; why: string };
     };
     // ⟨q-3d82f1a9⟩ — AN UNREADABLE BOARD IS A NAMED STATE, not "could not measure".
@@ -237,6 +268,9 @@ async function measureCoverage(repo?: string): Promise<AwayCoverage | null> {
       checked: r.checked ?? 0,
       measurable: r.measurable ?? 0,
       blind: r.blind ?? [],
+      tick: r.tick
+        ? { seats: r.tick.seats?.length ?? 0, readable: r.tick.readable ?? 0, states: (r.tick.states ?? {}) as Record<string, number>, note: r.tick.note ?? "" }
+        : undefined,
       roles: r.roles?.length ?? 0,
       deliberate: r.deliberate?.length ?? 0,
       at: new Date().toISOString(),
@@ -352,7 +386,8 @@ export async function coordAwayTool(args: {
           `"The clock ran" and "the fleet is observed" are different facts, and this verb must not treat the first as the second. ` +
           `The usual cause is a board 'Branch · Worktree' cell holding a PATH rather than a branch ref: a path resolves for ` +
           `git and measures the wrong thing, so the check reports it unmeasurable rather than guessing. Fix those cells and ` +
-          `coverage returns. If you mean to go anyway, pass acknowledgeBlindFleet:true — it is recorded in the state and in the announcement.`,
+          `coverage returns. If you mean to go anyway, pass acknowledgeBlindFleet:true — it is recorded in the state and in the announcement.` +
+          tickSentence(coverage.tick),
       };
     }
 
@@ -382,7 +417,8 @@ export async function coordAwayTool(args: {
         `Decides: planning · priority · curation · roadmap · canon · releases under standing authorisation. ` +
         `Never: merges, gates, or takes a code lane. Parks for David: ${PARKED_CATEGORIES.join(" · ")}. ` +
         `Decisions logged to ${args.decisionLog}. ` +
-        `Stall coverage ${coverage.measurable}/${coverage.checked}${!meetsCoverageThreshold(coverage) ? ` — ACKNOWLEDGED BLIND${coverage.measurable === 0 ? ": the clock runs and sees nothing" : ""}${coverage.blind.length ? ` on: ${coverage.blind.join(", ")}` : ""}` : ""}.`,
+        `Stall coverage ${coverage.measurable}/${coverage.checked}${!meetsCoverageThreshold(coverage) ? ` — ACKNOWLEDGED BLIND${coverage.measurable === 0 ? ": the clock runs and sees nothing" : ""}${coverage.blind.length ? ` on: ${coverage.blind.join(", ")}` : ""}` : ""}.` +
+        tickSentence(coverage.tick),
     };
   }
 

package/src/tools/queue-write.ts

@@ -395,7 +395,10 @@ export async function queueWriteTool(args: {
               `item by hand once, or move the queue section last.`,
           );
         }
-        const w0 = writeDoc(repo, QUEUE_DOC, reparsed, original);
+        // `own` names the row this call authored. It is already recorded above, so this
+  // changes nothing today — it is stated so the guarantee survives a refactor that
+  // stops pre-stamping, rather than depending on line 361 staying where it is.
+  const w0 = writeDoc(repo, QUEUE_DOC, reparsed, original, [], [target.id]);
         return {
           ok: true,
           op: args.op,

package/src/tools/record-events.ts

@@ -120,6 +120,48 @@ const norm = (s: string) => String(s).toLowerCase().replace(/[`*_]/g, "").replac
  * against them by the caller (`eventIsDerived`), so a diff that has since been
  * reverted cannot produce an event that outlives the record.
  */
+/**
+ * ⟨q-…⟩ PHASE COMPLETENESS IS THE ABSENCE OF AN UNTICKED BOX, AND IT MUST NOT DEPEND ON WHAT
+ * A BOX IS CALLED.
+ *
+ * ⛔ MEASURED, NOT REASONED — a false "phase 5.4 complete" event was emitted and DELIVERED on
+ * 2026-09-16 at `579db9d`. The detector's box pattern required a label shaped `\d+\.\d+`, so
+ * against the real document it saw **31 of 36** checkboxes, every one of them ticked, and
+ * fired. The three it could not see were `3B.2`, `3B.3` and `3B.4` — labels with a LETTER
+ * inside the number — and `3B.3` is deliberately unticked and not recoverable.
+ *
+ * ⚠ SO THE CAUSE IS THE LABEL PATTERN, NOT THE POSITION OF THE LAST BOX. The event cited
+ * `- [x] 6.4`, the document's final line, which made it look like a last-line rule; the ref is
+ * only what it cites. Any doc whose remaining work carries an unanticipated label reported
+ * itself finished, wherever that work sat.
+ *
+ * ⭐ THE FIX IS A DIFFERENT QUESTION, not a wider regex for the same one: "is any checkbox in
+ * this document unticked" is asked over EVERY markdown checkbox, whatever follows it. A label
+ * shape nobody has invented yet cannot defeat it. The failure direction is deliberate — an
+ * unticked box anywhere blocks the event, so an unrecognised box costs a MISSED completion,
+ * never a FALSE one. This code's own comment already said which way to lean: *"A false
+ * completion is worse than a missing one: it closes a phase nobody finished."*
+ */
+export const ANY_BOX = /^[ \t]*[-*+][ \t]*\[([ xX])\][ \t]*(.*)$/;
+export const TICKED_BOX = /^[ \t]*[-*+][ \t]*\[[xX]\]/;
+
+export type PhaseBox = { ticked: boolean; label: string | null; line: string };
+
+/** Every markdown checkbox in a phase document, in file order, label-agnostic. */
+export function checkboxesIn(text: string): PhaseBox[] {
+  const out: PhaseBox[] = [];
+  for (const raw of String(text).split("\n")) {
+    const m = ANY_BOX.exec(raw);
+    if (!m) continue;
+    const rest = m[2] ?? "";
+    out.push({ ticked: m[1]!.toLowerCase() === "x", label: (/^\*{0,2}([A-Za-z0-9][A-Za-z0-9.]*)\b/.exec(rest) ?? [])[1] ?? null, line: raw.trim() });
+  }
+  return out;
+}
+
+/** The unticked boxes, for a caller that wants to say WHY it did not fire. */
+export const untickedIn = (text: string): PhaseBox[] => checkboxesIn(text).filter((b) => !b.ticked);
+
 export function eventsFromCommittedChange(
   diff: string,
   after: { done?: string; phases?: Record<string, string> } = {},
@@ -257,14 +299,14 @@ export function eventsFromCommittedChange(
   // finished.
   for (const [rel, text] of Object.entries(after.phases ?? {})) {
     if (!isPhaseDoc(rel)) continue;
-    const boxes = [...String(text).matchAll(/^\s*-\s*\[( |x)\]\s*\*{0,2}(\d+\.\d+[a-z]?)\b/gim)];
-    if (!boxes.length || boxes.some((m) => m[1] !== "x")) continue;
+    const boxes = checkboxesIn(String(text));
+    if (!boxes.length || boxes.some((b) => !b.ticked)) continue;
     // This commit must have ticked a box IN THIS FILE.
-    const closedHere = (byFile.get(rel)?.added ?? []).some((l) => /^\s*-\s*\[x\]\s*\*{0,2}\d+\.\d+/.test(l));
+    const closedHere = (byFile.get(rel)?.added ?? []).some((l) => TICKED_BOX.test(l));
     if (!closedHere) continue;
     const phase = /phase(\d+(?:\.\d+)?)/i.exec(rel)?.[1];
     if (!phase) continue;
-    events.push({ kind: "phase", target: phase, ref: boxes[boxes.length - 1]![0].trim(), summary: `phase ${phase} — every task box ticked` });
+    events.push({ kind: "phase", target: phase, ref: boxes[boxes.length - 1]!.line, summary: `phase ${phase} — every task box ticked` });
   }
 
   lastUnattributedItems = unattributedItems;

package/src/tools/records.ts

@@ -149,8 +149,12 @@ export function writeDoc(
   doc: WorkDoc,
   original: string,
   alreadyWritten: string[] = [],
+  own: readonly string[] = [],
 ): { written: boolean; stamped: string[] } {
-  const { text, stamped } = renderWorkDocForWrite(doc);
+  // `own` = the rows THIS CALL authored. Everything else is stamped only if the
+  // document already speaks the recorded-id grammar — see `stampQueueIds`, which
+  // holds the rule so both writers cannot drift apart on it.
+  const { text, stamped } = renderWorkDocForWrite(doc, { own });
   if (text === original) return { written: false, stamped: [] };
   const p = path.join(repo, rel);
   const current = existsSync(p) ? readFileSync(p, "utf8") : "";
@@ -1265,7 +1269,7 @@ export async function landTool(
   try {
   if (args.write) {
     if (queueChanged) {
-      const w = writeDoc(repo, QUEUE_DOC, q.doc, q.text, wrote);
+      const w = writeDoc(repo, QUEUE_DOC, q.doc, q.text, wrote, args.queueItemId ? [args.queueItemId] : []);
       if (w.written) wrote.push(QUEUE_DOC);
       // Rows stamped that this call did not ask to touch. `queueItemId` is the
       // one item the caller supplied, so anything else here is a row that