agent-coord-mcp 0.26.36 → 0.26.40

package/scripts/coord-stall-clock.mjs

@@ -42,31 +42,30 @@ const dist = path.join(here, "..", "dist");
 
 const LABEL = "com.davidbalzan.coord-stall-clock";
 
-if (argv.install) {
-  const repo = String(argv.repo ?? process.cwd());
-  const duty = String(argv.duty ?? "<duty-officer-agent-id>");
+// ⟨q-6d37c349⟩ `--install` INSTALLS, and refuses unless launchd reports the label loaded. It used to
+// print this plist to stdout with instructions for a human, and nobody ever ran them: measured
+// 2026-09-26, `launchctl print gui/501/com.davidbalzan.coord-stall-clock` exits 113 and no plist
+// exists, so every one of this clock's 200 recorded runs was a HAND run by whoever last polled it.
+// The printed recipe is still available, named for what it is: `--print-plist`.
+if (argv.install || argv.verify || argv.uninstall || argv["print-plist"]) {
+  const { handleUnitArgs } = await import("./lib/clock-unit-cli.mjs");
   const every = Number(argv.every ?? 30);
-  const self = path.join(here, "coord-stall-clock.mjs");
-  const node = process.execPath;
-  console.log(`# macOS — launchd. Label: ${LABEL}
-# Write to ~/Library/LaunchAgents/${LABEL}.plist, then:
-#   launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/${LABEL}.plist
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0"><dict>
-  <key>Label</key><string>${LABEL}</string>
-  <key>ProgramArguments</key><array>
-    <string>${node}</string><string>${self}</string>
-    <string>--repo=${repo}</string><string>--duty=${duty}</string>
-  </array>
-  <key>StartInterval</key><integer>${every * 60}</integer>
-  <key>RunAtLoad</key><true/>
-  <key>StandardErrorPath</key><string>${path.join(homedir(), "agent-coord", "logs", "stall-clock.err")}</string>
-</dict></plist>
-
-# Linux — cron:
-# */${every} * * * * ${node} ${self} --repo=${repo} --duty=${duty}
-`);
+  await handleUnitArgs(argv, {
+    dist,
+    repoRoot: path.join(here, "..", "..", ".."),
+    label: LABEL,
+    program: process.execPath,
+    programArgs: [
+      path.join(here, "coord-stall-clock.mjs"),
+      `--repo=${String(argv.repo ?? process.cwd())}`,
+      `--duty=${String(argv.duty ?? "<duty-officer-agent-id>")}`,
+      ...(argv.david ? [`--david=${String(argv.david)}`] : []),
+      ...(argv["board-owner"] ? [`--board-owner=${String(argv["board-owner"])}`] : []),
+    ],
+    everyMinutes: every,
+    stderrPath: path.join(homedir(), "agent-coord", "logs", "stall-clock.err"),
+    stdoutPath: path.join(homedir(), "agent-coord", "logs", "stall-clock.log"),
+  });
   process.exit(0);
 }
 

package/scripts/lib/clock-unit-cli.mjs

@@ -0,0 +1,134 @@
+/*
+ * ⟨q-6d37c349⟩ THE INSTALL/VERIFY/UNINSTALL CLI BOTH CLOCKS SHARE.
+ *
+ * Both clocks had the same `--install` that PRINTED a plist and instructions for a human, and neither
+ * unit was ever created: measured 2026-09-26, `launchctl print gui/501/<label>` exits 113 for both.
+ * Writing this once means a third clock gets a real installer by importing it, and — the part that
+ * matters — it cannot drift into two versions where one reads launchd back and the other does not.
+ *
+ * ⛔ `--install` SUCCEEDS ONLY IF launchd REPORTS THE LABEL LOADED, and exits non-zero otherwise. The
+ * old behaviour is still available as `--print-plist`, explicitly named as a recipe rather than an
+ * installation, because a printed plist was the thing everyone mistook for one.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+
+export const runner = (cmd, args) => {
+  const r = spawnSync(cmd, args, { encoding: "utf8" });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+};
+export const unitFs = { writeFileSync, mkdirSync, existsSync, readFileSync, rmSync };
+
+/**
+ * Handle `--install`, `--verify`, `--uninstall` and `--print-plist` for one clock. Returns false when
+ * the argv asked for none of them, so the caller falls through to its actual work.
+ *
+ * ⛔ macOS ONLY, AND IT SAYS SO RATHER THAN PRETENDING. On any other platform `--install` REFUSES and
+ * prints the cron line: claiming an installation this code cannot verify is the failure being fixed,
+ * and a cron line printed under a refusal cannot be mistaken for a unit that exists.
+ */
+export async function handleUnitArgs(argv, spec, io = {}) {
+  /*
+   * ⛔ THE EXECUTOR IS INJECTED, AND THAT IS NOT TIDINESS — IT IS THE FIX FOR AN INCIDENT.
+   *
+   * The test for the linked-worktree refusal used to SPAWN this script with `--install`. On 2026-09-26 a
+   * mutation matrix removed the refusal (`if (false)`) and that test then installed
+   * `com.davidbalzan.coord-stall-clock` into the operator's own launchd — twice — while still failing its
+   * assertion. A refusal suite hides unsafe success: the assertion fires AFTER the side effect.
+   *
+   * With `run` and `exit` injectable, the refusal can be exercised against a RECORDING runner, and the
+   * test asserts something stronger than the exit code: that ZERO launchctl calls were made. A guard
+   * mutated away then fails the test by making calls, without those calls reaching launchd.
+   */
+  const run = io.run ?? runner;
+  const exit = io.exit ?? ((code) => process.exit(code));
+  /*
+   * ⛔ AND THE FILESYSTEM IS INJECTED TOO, because injecting only the RUNNER was not enough and I found
+   * that the same way I found everything else here — by measuring. With `run` recorded but `fs` real, a
+   * guard mutated away still WROTE the plist into the operator's `~/Library/LaunchAgents`; only the
+   * bootstrap was withheld, so the label stayed unloaded and the file did not. Three layers of the same
+   * lesson: a refusal test has to inject EVERY executor the path can reach, and prove it with a
+   * postcondition on the real world rather than on the return value.
+   */
+  const fs = io.fs ?? unitFs;
+  const { label, program, programArgs, everyMinutes, stderrPath, stdoutPath, cronNote } = spec;
+  const mod = await import(path.join(spec.dist, "launch-unit.js"));
+  const unitIo = { run, fs };
+  const startIntervalSec = Math.round(everyMinutes * 60);
+  const unitSpec = { label, program, programArgs, startIntervalSec, stderrPath, stdoutPath };
+
+  if (argv["print-plist"]) {
+    console.log(`# A RECIPE, NOT AN INSTALLATION — ${label}`);
+    console.log(`# \`--install\` writes this, bootstraps it, and refuses unless launchd reports it loaded.`);
+    console.log(mod.plistFor(unitSpec));
+    console.log(`# Linux — cron:\n# */${everyMinutes} * * * * ${program} ${programArgs.join(" ")}${cronNote ? `   # ${cronNote}` : ""}`);
+    return true;
+  }
+
+  if (argv.verify) {
+    const s = mod.isLoaded(label, run);
+    console.log(`${s.loaded ? "LOADED " : "ABSENT "} ${label} — ${s.evidence}`);
+    if (!s.loaded) {
+      console.error(
+        `⛔ NOTHING IS SCHEDULED for ${label}. A plist on disk that was never bootstrapped is exactly as\n` +
+          `   inert as no plist at all, and it looks more installed. Install it: --install --repo=<path> …`,
+      );
+    }
+    return exit(s.loaded ? 0 : 1);
+  }
+
+  if (argv.uninstall) {
+    const r = mod.uninstallUnit(label, unitIo);
+    console.log(`${r.ok ? "removed" : "REFUSED"} ${label} — wasLoaded=${r.wasLoaded} plistRemoved=${r.plistRemoved} · ${r.evidence}`);
+    return exit(r.ok ? 0 : 1);
+  }
+
+  if (argv.install) {
+    /*
+     * ⛔ NEVER PIN A UNIT TO A DISPOSABLE TREE. `ProgramArguments` holds an absolute path to the script,
+     * and a slice worktree is REMOVED after its PR merges — so a unit installed from one runs until that
+     * directory disappears and then fails every tick forever, which on disk is indistinguishable from a
+     * clock that was never installed. A linked worktree has a `.git` FILE where the primary checkout has
+     * a directory, which is how this is detected rather than guessed from the path's spelling.
+     */
+    const gitEntry = path.join(spec.repoRoot ?? "", ".git");
+    if (spec.repoRoot && existsSync(gitEntry) && !statSync(gitEntry).isDirectory()) {
+      const primary = (() => {
+        try {
+          return readFileSync(gitEntry, "utf8").replace(/^gitdir:\s*/, "").trim().replace(/\/worktrees\/.*$/, "").replace(/\/\.git$/, "");
+        } catch {
+          return "<the primary checkout>";
+        }
+      })();
+      console.error(
+        `⛔ INSTALL REFUSED — ${label} would be pinned to a LINKED WORKTREE:\n` +
+          `   ${spec.repoRoot}\n` +
+          `   A slice tree is removed once its PR merges, and the unit would then fail every tick forever —\n` +
+          `   which looks exactly like a clock that was never installed. Install from the primary checkout:\n` +
+          `   ${primary}`,
+      );
+      return exit(2);
+    }
+    if (process.platform !== "darwin") {
+      console.error(
+        `⛔ REFUSED — no installer for platform "${process.platform}". This would have printed a cron line and\n` +
+          `   exited 0, which is how a documented unit gets mistaken for an installed one. Install it yourself:\n` +
+          `   */${everyMinutes} * * * * ${program} ${programArgs.join(" ")}`,
+      );
+      return exit(2);
+    }
+    const r = mod.installUnit(unitSpec, unitIo);
+    if (!r.ok) {
+      console.error(`⛔ INSTALL REFUSED — ${r.label}\n   ${r.why}\n   ${r.evidence}`);
+      return exit(1);
+    }
+    console.log(
+      `${r.action} ${r.label} — every ${everyMinutes}m · plist ${r.plistPath}\n` +
+        `  VERIFIED BY READBACK: ${r.evidence}`,
+    );
+    return exit(0);
+  }
+
+  return false;
+}

package/src/auth-faults.ts

@@ -0,0 +1,166 @@
+// ⟨q-a441f1e1⟩ — ONE 401 STOOD FOR EVERY AUTH FAULT, AND IT READ AS A BROKEN DAEMON IN ALL OF THEM.
+//
+// Asked for by David 2026-09-21. The HTTP bus answered `unauthorized` — one string — whether the
+// bearer was never minted, had just been rotated, or was absent from the request entirely. Measured
+// consequence: the other machine spent real time reading a stale tokens.json as infrastructure.
+// The daemon knows which fault it is at the moment it refuses; it simply did not say.
+//
+// ⛔ THE SPLIT THAT DECIDES WHERE EACH FAULT MAY BE NAMED (coordinator's ruling, 2026-09-24,
+// escalated to David as a risk acceptance):
+//
+//   A fault about the REQUEST'S SHAPE may be named freely to the caller.
+//   A fault about the CREDENTIAL'S VALIDITY must not be distinguishable to the caller.
+//
+// Shape faults — no header, wrong scheme, empty bearer — describe what the caller just sent, so
+// naming them tells an attacker nothing they did not already know, and tells a misconfigured client
+// exactly what to fix. Validity faults are different in kind: distinguishing "never minted" from
+// "retired at 11:02 for agent worker-3" answers a question ONLY the holder of a real former
+// credential can ask, and the answer is "yes, that was genuine" — it confirms the leak source,
+// confirms the agent exists, and dates the rotation, for someone who has just failed to
+// authenticate. The legitimate operator diagnosing "my seat stopped working" reads the DAEMON LOG;
+// an attacker cannot. That asymmetry is the point.
+//
+// ⛔ SO `unknown-bearer`, `retired-bearer` AND `advisory-mismatch` SHARE ONE RESPONSE STRING, BYTE
+// FOR BYTE. If they differed by so much as punctuation the string itself would be the oracle. A
+// test compares them for EQUALITY (not "both non-empty"), so any mutation that makes the response
+// distinguish them turns it red.
+//
+// ⛔ AND NO REFUSAL OR LOG LINE MAY CONTAIN ANY PART OF A BEARER — not the value, not a prefix, not
+// its hash, not a hash prefix. Messages are built from the fault kind, an agent id and a timestamp
+// only. qa measured this across 8 refusals on ⟨q-4b9cdeab⟩; the same bar applies here and there is
+// a test that feeds a real bearer through every branch and greps every output for it.
+//
+// ⚠ WHAT THIS DOES NOT COVER, MEASURED AT MAIN `1e4712a` RATHER THAN ASSUMED: the queue row lists
+// "(b) the bearer maps to a DIFFERENT agent than the one the caller claims". That fault CANNOT
+// REACH THIS BOUNDARY — at the auth gate the caller claims nothing; identity arrives FROM the
+// bearer. Where a claim does meet a bearer it is already named: the tool path refuses with
+// `identity bound to '<bound>'; rejected attempt to act as '<claimed>'` (server.ts:362, 413, 587)
+// and a session opened by another agent's bearer refuses 403 `session/identity mismatch`
+// (server.ts:1190-1196). ⟨q-0c5476ec⟩ removed the fault at its source and ⟨q-4b9cdeab⟩'s `claim()`
+// closed the last way two agents could share a key. A (b) branch here would be an empty case that
+// reads as coverage.
+
+/** Why a request was refused at the auth gate. One kind per genuinely distinct operator action. */
+export type AuthFaultKind =
+  | "no-header" // SHAPE: no Authorization header at all
+  | "not-bearer" // SHAPE: an Authorization header that is not a Bearer scheme
+  | "empty-bearer" // SHAPE: `Bearer` with nothing after it
+  | "unknown-bearer" // VALIDITY: a bearer the token map has never held
+  | "retired-bearer" // VALIDITY: a bearer this daemon SAW leave the map
+  | "advisory-mismatch"; // VALIDITY: advisory mode, the shared bearer does not match
+
+/** Which half of the split a kind belongs to. Exported so the rule is checkable, not folklore. */
+export const SHAPE_FAULTS: readonly AuthFaultKind[] = ["no-header", "not-bearer", "empty-bearer"];
+export const VALIDITY_FAULTS: readonly AuthFaultKind[] = ["unknown-bearer", "retired-bearer", "advisory-mismatch"];
+
+/** What this daemon remembers about a bearer that left the map while it was watching. */
+export type RetiredBearer = { agentId: string; at: number; cause: "replaced" | "revoked" };
+
+export type AuthFault = { kind: AuthFaultKind; retired?: RetiredBearer };
+
+/**
+ * ⛔ THE ONE STRING EVERY VALIDITY FAULT RETURNS. Named as a constant rather than repeated, because
+ * three copies of a sentence are three chances for one of them to drift into an oracle.
+ *
+ * ⭐ AND IT NAMES WHERE TO LOOK, WHICH IS PART OF DAVID'S RULING (2026-09-25, "ok do as you
+ * recommend") RATHER THAN A COURTESY. Log-only is defensible ONLY because the legitimate operator
+ * always has the log and an attacker never does — so a 401 whose log the reader cannot REACH has not
+ * protected the information, it has LOST it. That loss is not hypothetical: it is the hour David's
+ * other machine spent reading a stale tokens.json as a broken daemon, which is why this row exists.
+ *
+ * ⛔ THE POINTER NAMES THE LOG BY ROLE, NEVER BY ABSOLUTE PATH. An unauthenticated caller must not be
+ * handed `/Users/<name>/agent-coord/…` — that discloses the operator's account for no benefit to
+ * them, since they cannot read the file either way. The EXACT path is printed to the daemon log at
+ * bind, where only someone who can already read it will see it.
+ */
+export const VALIDITY_REFUSAL =
+  "unauthorized: this bearer is not current — the reason is recorded in this bus's daemon log " +
+  "(the stderr of the process serving this port); ask whoever runs the bus if you cannot reach it";
+
+/**
+ * The switch the coordinator asked to keep while David rules on the disclosure trade-off. Default
+ * is log-only. `AGENT_COORD_401_DETAIL=response` moves the validity detail into the response.
+ * ⚠ It is read per call, not cached, so a test can flip it without a fresh process.
+ */
+export function detailInResponse(env: NodeJS.ProcessEnv = process.env): boolean {
+  return env.AGENT_COORD_401_DETAIL === "response";
+}
+
+/** What the CALLER is told. Shape faults are specific; validity faults are uniform. */
+export function responseText(fault: AuthFault, env: NodeJS.ProcessEnv = process.env): string {
+  switch (fault.kind) {
+    case "no-header":
+      return "unauthorized: no Authorization header. This bus is in bound mode; send `Authorization: Bearer <token>` minted by `coord-token add <agent-id>`.";
+    case "not-bearer":
+      return "unauthorized: the Authorization header is not a Bearer scheme. Send `Authorization: Bearer <token>`.";
+    case "empty-bearer":
+      return "unauthorized: the Bearer scheme carried no token — the header is present and empty, which is what an unset variable in a client config produces.";
+    default:
+      // Every validity fault, one string. The escape hatch exists for David's ruling and is the
+      // ONLY way these can differ; with it unset they are identical by construction, not by care.
+      return detailInResponse(env) ? logText(fault) : VALIDITY_REFUSAL;
+  }
+}
+
+/**
+ * What the DAEMON LOG is told: every fault distinguished, including which retirement it was and
+ * when. This is the half an operator diagnosing "my seat stopped working" actually reads.
+ *
+ * ⛔ EACH KIND GETS ITS OWN SENTENCE AND ITS OWN REMEDY — a message covering two faults sends the
+ * reader to the wrong file, which is the defect this row exists for. The guard is a PAIRWISE
+ * inequality over every kind, so collapsing two branches into one string cannot pass.
+ */
+export function logText(fault: AuthFault): string {
+  switch (fault.kind) {
+    case "no-header":
+      return "401 no Authorization header — bound mode expects `Bearer <token>`";
+    case "not-bearer":
+      return "401 Authorization header is not a Bearer scheme";
+    case "empty-bearer":
+      return "401 Bearer scheme carried no token (header present, value empty)";
+    case "unknown-bearer":
+      return "401 bearer is not in the token map — never minted on this bus, or minted for another bus. `coord-token add <agent-id>`, then SIGHUP (the daemon also reloads when the file changes)";
+    case "retired-bearer": {
+      // Reaching this kind REQUIRES the record; without it the line would print "undefined" into an
+      // auth log, so the fallback says what it knows rather than what it does not.
+      if (!fault.retired) return "401 bearer is no longer current (no retirement record in this process)";
+      const when = new Date(fault.retired.at).toISOString();
+      const how = fault.retired.cause === "revoked" ? "revoked" : "replaced by a newer token";
+      return `401 bearer was ${how} at ${when} for agent '${fault.retired.agentId}' — it authenticated until then, so this daemon is healthy and the client holds a superseded token`;
+    }
+    case "advisory-mismatch":
+      return "401 shared bearer does not match — this bus has no tokens.json, so it is in advisory mode and checks one shared secret";
+  }
+}
+
+/**
+ * Classify a refusal. Pure: every input is a value, so the whole taxonomy is testable without a
+ * daemon, a socket or a file — which is what lets a mutation matrix reach each branch.
+ *
+ * `lookup` answers "is this bearer live?" and `retiredLookup` "did I watch it leave?". Both are
+ * injected rather than imported so a test can pose a state the filesystem cannot.
+ */
+export function classifyAuthFault(args: {
+  authHeader: string | undefined;
+  bound: boolean;
+  lookup: (bearer: string) => string | undefined;
+  retiredLookup: (bearer: string) => RetiredBearer | undefined;
+  sharedMatches?: boolean;
+}): { ok: true; agentId?: string } | { ok: false; fault: AuthFault } {
+  const { authHeader, bound, lookup, retiredLookup, sharedMatches } = args;
+  if (!authHeader) return { ok: false, fault: { kind: "no-header" } };
+  if (!authHeader.startsWith("Bearer ")) return { ok: false, fault: { kind: "not-bearer" } };
+  const bearer = authHeader.slice("Bearer ".length);
+
+  if (!bound) {
+    // Advisory mode: there is no map, so "unknown" and "retired" are not answerable and must not be
+    // guessed at. One fault, and the LOG says which mode the daemon is in.
+    return sharedMatches ? { ok: true } : { ok: false, fault: { kind: "advisory-mismatch" } };
+  }
+  if (bearer === "") return { ok: false, fault: { kind: "empty-bearer" } };
+  const agentId = lookup(bearer);
+  if (agentId) return { ok: true, agentId };
+  const retired = retiredLookup(bearer);
+  if (retired) return { ok: false, fault: { kind: "retired-bearer", retired } };
+  return { ok: false, fault: { kind: "unknown-bearer" } };
+}

package/src/capabilities.ts

@@ -39,7 +39,7 @@ import path from "node:path";
 import { prRefsIn } from "./tools/record-events.js";
 import { EVENT_KIND_IDS } from "./tools/event-kinds.js";
 import { suggestRecordType, typedRecordMode } from "./typed-records.js";
-import { LEAD_REFUSED, PARKED_CATEGORIES } from "./tools/away.js";
+import { LEAD_REFUSED, PARKED_CATEGORIES, meetsCoverageThreshold } from "./tools/away.js";
 import { recordAuthorityFor } from "./roles.js";
 // ⟨q-e5cb3538⟩ The renderer and the byte class live in hooks/, shared with both pushers.
 // @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
@@ -61,7 +61,10 @@ import {
   type TransportKind,
 } from "./transports/index.js";
 import { readAllTransportMarkers, markerHoldsLiveProcess } from "./tools/registry.js";
-import { decideTokenMapRefresh, bearerHash, TOKEN_HASH_ALGS, moveCursorOffset, planArchive } from "./store.js";
+import { decideTokenMapRefresh, bearerHash, TOKEN_HASH_ALGS, moveCursorOffset, planArchive, withDeliveryLock, DELIVERY_LOCK_STALE_MS } from "./store.js";
+import { pushLogLine, sourceKey as deliverySourceKey } from "./tools/herdr-delivery.js";
+import { testCountKey } from "./test-count-key.js";
+import { SHAPE_FAULTS, VALIDITY_FAULTS, responseText, logText, detailInResponse } from "./auth-faults.js";
 import { queueWriteSchema } from "./tools/queue-write.js";
 import { treeProvenance } from "./tools/tree-provenance.js";
 import { detectSpread } from "./server-spread.js";
@@ -667,6 +670,38 @@ const PROBES: Probe[] = [
     // APPLICABLE and says so with both counts; a landing whose PR announced no window is a problem,
     // which is the violation the control exists to catch and the one a count-based rule would skip
     // green. Asked of the running function, so a server on the pre-fix build answers false.
+    // ⟨q-a441f1e1⟩ — one 401 stood for every auth fault, and it read as a broken daemon in all of
+    // them. Asked of the classifier's own message builders, which the HTTP path calls: the SHAPE
+    // faults must be named distinctly to a caller, and every VALIDITY fault must return ONE
+    // byte-identical string while the LOG tells them apart. A build without the split answers false.
+    id: "auth-faults-named-by-class",
+    since: "0.26.38",
+    run: () => {
+      // ⛔ THE REAL ENV, NEVER `{}`. qa, gating this PR: with a hard-coded empty env the probe
+      // evaluated the code's DEFAULT instead of THIS BUS's behaviour, so a daemon running with
+      // AGENT_COORD_401_DETAIL=response — actively distinguishing validity faults to unauthenticated
+      // callers — still answered `validityUniform=true`. Capabilities is how a seat interrogates a
+      // LIVE daemon; a probe that says "uniform" on a bus that is leaking is worse than no probe,
+      // because it is the thing a reader trusts instead of checking.
+      const retired = { agentId: "a", at: 0, cause: "replaced" } as const;
+      const shape = SHAPE_FAULTS.map((kind) => responseText({ kind }, process.env));
+      const validity = VALIDITY_FAULTS.map((kind) => responseText({ kind, retired }, process.env));
+      const logs = [...SHAPE_FAULTS, ...VALIDITY_FAULTS].map((kind) => logText({ kind, retired }));
+      const shapeDistinct = new Set(shape).size === shape.length;
+      const validityUniform = new Set(validity).size === 1;
+      const logsDistinct = new Set(logs).size === logs.length;
+      const present = shapeDistinct && validityUniform && logsDistinct;
+      return {
+        present,
+        evidence:
+          `AGENT_COORD_401_DETAIL=${process.env.AGENT_COORD_401_DETAIL || "unset"} (detail in response=${detailInResponse()}) · ` +
+          `shape faults distinct=${shapeDistinct} (${shape.length}) · validity responses uniform=${validityUniform} ` +
+          `(${new Set(validity).size} distinct; >1 means THIS BUS is answering an unauthenticated caller's question about a credential) · ` +
+          `log lines distinct=${logsDistinct} (${logs.length}) -> present=${present}`,
+      };
+    },
+  },
+  {
     // ⟨q-4b9cdeab⟩ RELEASE A: can this daemon authenticate a HASHED tokens.json, and does it refuse an
     // alg it cannot evaluate? A version label cannot answer either — and the second half is the one
     // that matters, because ignoring an unknown entry drops a seat silently while treating it as
@@ -738,6 +773,62 @@ const PROBES: Probe[] = [
       return { present, evidence: `live pane -> ${live.state} · gone pane -> ${gone.state} · foreign marker -> ${foreign.state} -> present=${present}` };
     },
   },
+  {
+    // ⟨q-524305dd⟩ — a message is typed into a pane at most once, whichever processes deliver it. The sender's
+    // send-time push and the recipient's tail both typed a message while the other was mid-verify; the only guard
+    // was a per-process flag. Both now take ONE cross-process lock per (seat, source), on ONE key spelling, and log
+    // which path typed. A probe runs synchronously and must not write the bus's lock directory, so it cannot run
+    // the exclusion itself — delivery-once.test.mjs does that against a real second process. What it asks here is
+    // what a pre-fix build does not have: the shared key, a stale bound above the lock library's floor, and push
+    // lines that name their path. A server on the pre-fix build has none of them and answers false.
+    // ⟨q-b0d4e45a⟩ — `coord_away` armed a fleet on `checked: 0, measurable: 0, blind: []` while its own
+    // population said `inFlight: 2`: every in-flight lane carried a prose cell, so each left the scored
+    // subset before it was counted, and `checked` was the divisor. `0 >= 0` armed. So the guard INVERTED at
+    // its own limit — `2 of 5` refused while `0 of 2` armed silently.
+    // ⛔ ASKED WITH THE CELL THAT ACTUALLY ARMED, AND IT IS `checked: 0` THAT MAKES IT DISCRIMINATE. The
+    // incident was `checked 0 · measurable 0 · inFlight 2`: both in-flight lanes left the SCORED subset
+    // before being counted, so the old predicate compared `0 >= 0` and said COVERED. The new one divides by
+    // the population and refuses. A pre-fix build answers TRUE here; this build answers FALSE.
+    // ⚠ A `3 of 5` CELL WOULD BE INERT AND AN EARLIER VERSION OF THIS PROBE SHIPPED ONE (qa caught it):
+    // `3 >= checked` was already false before the fix, so old and new agree and the cell proves nothing.
+    // Being SHORT of coverage always refused; being short with an EMPTY scored subset is what armed.
+    // ⛔ AND THE CELL IS PASSED IN THE SHAPE THE REAL CALLER USES, `checked` INCLUDED: the earlier probe
+    // omitted `checked`, which turned `3 >= undefined` into false on BOTH predicates — the discriminating
+    // field was the one dropped between verifying the cell and shipping it.
+    // ⭐ The IDLE cell is the opposite direction, so the two cannot both pass on one predicate: nothing in
+    // flight must still ARM, where the old predicate refused because it compared against a non-zero
+    // `checked`. (`inFlight === 0` is documentation rather than arithmetic — `0 >= 0` is already true — so
+    // this cell is about the DIVISOR, not about that ternary.)
+    id: "coverage-counts-the-in-flight-population",
+    since: "0.26.40",
+    run: () => {
+      const armedSilently = meetsCoverageThreshold({ checked: 0, measurable: 0, inFlight: 2 } as unknown as { measurable: number; inFlight: number });
+      const idle = meetsCoverageThreshold({ checked: 5, measurable: 0, inFlight: 0 } as unknown as { measurable: number; inFlight: number });
+      const present = armedSilently === false && idle === true;
+      return {
+        present,
+        // ⛔ CANON, filed 2026-09-27 off this very probe: AN EVIDENCE STRING NAMES AN INPUT AND A RESULT
+        // THAT WERE OBSERVED — PRINT THE COMPARISON, NEVER DESCRIBE IT. This process runs ONE predicate, so
+        // what the pre-fix build "said" is not observable from here and does not belong in the output. The
+        // expected values are printed as the required ones; WHY each cell discriminates is in the comment
+        // above, where a reader can check it against the diff rather than take a string's word for it.
+        evidence: `meetsCoverageThreshold(checked 0 · measurable 0 · inFlight 2) -> ${armedSilently} [required false] · meetsCoverageThreshold(checked 5 · measurable 0 · inFlight 0) -> ${idle} [required true] -> present=${present}`,
+      };
+    },
+  },
+  {
+    id: "delivery-lock-shared-by-both-paths",
+    since: "0.26.39",
+    run: () => {
+      const room = deliverySourceKey({ kind: "room", chan: "kit" });
+      const dm = deliverySourceKey({ kind: "dm" });
+      const lines = [pushLogLine("send-time", "m1", "w1:p1", "delivered"), pushLogLine("tail", "m1", "w1:p1", "delivered")];
+      const named = /path=send-time$/.test(lines[0]!) && /path=tail$/.test(lines[1]!);
+      const bounded = DELIVERY_LOCK_STALE_MS >= 2_000 && Number.isFinite(DELIVERY_LOCK_STALE_MS);
+      const present = room === "room:kit" && dm === "dm" && named && bounded && typeof withDeliveryLock === "function";
+      return { present, evidence: `lock key room -> ${room}, dm -> ${dm} · stale ${DELIVERY_LOCK_STALE_MS}ms · push lines name their path: ${named} · withDeliveryLock: ${typeof withDeliveryLock} -> present=${present}` };
+    },
+  },
   {
     // ⟨q-f44f17a7⟩ — a compaction moves each cursor in ITS OWN unit. adjustCursors subtracted the LINES
     // removed from every cursor file, and a push cursor is a BYTE offset, so each compaction left a
@@ -779,6 +870,28 @@ const PROBES: Probe[] = [
       };
     },
   },
+  {
+    // ⟨q-f2cf9e0f⟩ (0.26.34) — a passing test is attributed to the file it ran in, by a key relative
+    // to the PACKAGE. The old key was `test/${basename}`, identical for every file directly in
+    // `test/` and wrong for any below it: when the live conformance suite moved to `test/live/`, its
+    // passes landed on a phantom key while its real record entry read zero. Asked of the function
+    // check-test-count keys its comparison with, so a server on the pre-fix build answers false.
+    id: "test-count-key-is-package-relative",
+    since: "0.26.37",
+    run: () => {
+      const root = "/pkg";
+      const nested = testCountKey(root, "/pkg/test/live/x.test.mjs");
+      const flat = testCountKey(root, "/pkg/test/y.test.mjs");
+      const none = testCountKey(root, undefined);
+      const present = nested === "test/live/x.test.mjs" && flat === "test/y.test.mjs" && none === "(unattributed)";
+      return {
+        present,
+        evidence:
+          `nested -> ${nested} (the pre-fix key was test/x.test.mjs) · flat -> ${flat} (unchanged, which is why this went unseen) · ` +
+          `no file -> ${none} -> present=${present}`,
+      };
+    },
+  },
   {
     // ⟨q-0c5476ec⟩ — a seat's identity is stated once, and the launcher refuses a config that states
     // another seat. Probed through the function coord-seat itself calls, so a build whose launcher