agent-coord-mcp 0.26.39 → 0.26.41

package/src/server.ts

@@ -2,6 +2,7 @@
 // @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
 import { readyProfileStartupLine } from "../hooks/submit.mjs";
 import { randomUUID } from "node:crypto";
+import { bindingDecision } from "./binding-decision.js";
 import { HERDR, initTransportFromConfig } from "./transports/index.js";
 import { startTailOnBind, stopHerdrTail } from "./tools/herdr-tail.js";
 import { createServer, IncomingMessage, ServerResponse } from "node:http";
@@ -168,6 +169,11 @@ function jsonResult(data: unknown) {
 //     make pid-liveness meaningless.
 function buildServer(initialBound?: string, opts: { trackSession?: boolean } = {}): McpServer {
   let bound = initialBound;
+  // ⟨q-bf7fd8f3⟩ HOW the binding was acquired, not just what it is. A binding a
+  // gated tool TOFU'd on the caller's behalf is PROVISIONAL: the session never
+  // said "I am this", it merely named an id while unbound. An ASSERTED binding
+  // (env/bearer pre-bind, or an explicit `join`) is sticky and may not be replaced.
+  let boundAsserted = initialBound !== undefined;
   const trackSession = opts.trackSession ?? false;
   let sessionMarker: string | undefined;
   let exitHooksInstalled = false;
@@ -344,13 +350,16 @@ function buildServer(initialBound?: string, opts: { trackSession?: boolean } = {
       if (field) {
         const claimed = args[field];
         if (typeof claimed === "string") {
+          const decision = bindingDecision({ bound, boundAsserted, claimed, asserting: false, bindOnClaim });
           if (bound === undefined) {
-            if (bindOnClaim) {
+            if (decision === "bind") {
               // TOFU: first claim wins, then sticky — but only after the
               // first-claim guard agrees the id isn't someone else's live
               // session (see guardFirstClaim).
               const via = await guardFirstClaim(claimed, args);
               bound = claimed;
+              // provisional: no one asserted this identity, a tool just named it.
+              boundAsserted = false;
               recordSessionBinding(claimed, via);
               // ⛔ THE TAIL STARTS HERE, AT THE BINDING — not from an env var no seat sets.
               startTailOnBind(claimed);
@@ -404,16 +413,30 @@ function buildServer(initialBound?: string, opts: { trackSession?: boolean } = {
     async (args: Record<string, unknown>) => {
       const claimed = args["agentId"];
       if (typeof claimed === "string") {
-        if (bound === undefined) {
+        // ⟨q-bf7fd8f3⟩ `join` is the one place a session SAYS who it is, so it is the
+        // one place a PROVISIONAL binding may be corrected. Measured 2026-09-28: a
+        // resumer's fresh server was TOFU-bound to another seat by `attach_agent`,
+        // after which every verb — including read-only `status` — refused it as
+        // itself, and the only documented remedy was relaunching the process. A
+        // session that can never say "no, I am this" has to be killed to be fixed.
+        const jd = bindingDecision({ bound, boundAsserted, claimed, asserting: true, bindOnClaim: true });
+        if (jd === "bind" || jd === "rebind") {
           const via = await guardFirstClaim(claimed, args);
+          const rebound = bound !== undefined && bound !== claimed;
           bound = claimed;
-          recordSessionBinding(claimed, via);
+          boundAsserted = true;
+          recordSessionBinding(claimed, rebound ? `${via}+rebind` : via);
           // ⛔ THE TAIL STARTS HERE, AT THE BINDING — not from an env var no seat sets.
           startTailOnBind(claimed);
         } else if (bound !== claimed) {
           throw new Error(
-            `identity bound to '${bound}'; rejected attempt to act as '${claimed}'`,
+            `identity bound to '${bound}'; rejected attempt to act as '${claimed}'. ` +
+              `That binding was ASSERTED (join/token/env), so it is not provisional and ` +
+              `cannot be replaced from inside this session.`,
           );
+        } else {
+          // re-joining as itself asserts the binding it already holds
+          boundAsserted = true;
         }
       }
       return jsonResult(await (joinTool as (a: Record<string, unknown>) => Promise<unknown>)(args));
@@ -611,28 +634,28 @@ function buildServer(initialBound?: string, opts: { trackSession?: boolean } = {
     "attach_agent",
     "Start the tmux-push transport for an agent: spawns hooks/tmux-pusher.mjs as a background process so peer DMs (and optionally room messages) get typed into the agent's tmux pane in real time. tmuxTarget defaults to the MCP server's own $TMUX_PANE if this server is running inside tmux. allowlist restricts which peer agentIds can push. Updates list_agents to show transport=tmux-push.",
     attachAgentSchema,
-    gate("agentId", attachAgentTool as (a: Record<string, unknown>) => Promise<unknown>),
+    gate("agentId", attachAgentTool as (a: Record<string, unknown>) => Promise<unknown>, { bindOnClaim: false }),
   );
 
   addTool(
     "detach_agent",
     "Stop the tmux-push transport for an agent: kills the pusher process and clears the transport marker.",
     detachAgentSchema,
-    gate("agentId", detachAgentTool as (a: Record<string, unknown>) => Promise<unknown>),
+    gate("agentId", detachAgentTool as (a: Record<string, unknown>) => Promise<unknown>, { bindOnClaim: false }),
   );
 
   addTool(
     "report_transport",
     "Publish a transport marker for an agent (used by the remote tmux pusher, scripts/coord-pusher.mjs, to surface itself in list_agents). Set transport='tmux-push-remote' and optionally host/tmuxTarget. Liveness for remote markers is heartbeat-based — keep calling heartbeat or this marker gets GC'd after staleness.",
     reportTransportSchema,
-    gate("agentId", reportTransportTool as (a: Record<string, unknown>) => Promise<unknown>),
+    gate("agentId", reportTransportTool as (a: Record<string, unknown>) => Promise<unknown>, { bindOnClaim: false }),
   );
 
   addTool(
     "clear_transport",
     "Idempotent delete of an agent's transport marker. The wire-callable counterpart to detach_agent for remote pushers: it only removes the marker — there's no local process to kill.",
     clearTransportSchema,
-    gate("agentId", clearTransportTool as (a: Record<string, unknown>) => Promise<unknown>),
+    gate("agentId", clearTransportTool as (a: Record<string, unknown>) => Promise<unknown>, { bindOnClaim: false }),
   );
 
   addTool(

package/src/tools/away.ts

@@ -112,8 +112,26 @@ export function coverageAgeOf(coverage: { at: string }, now = Date.now()): { age
   const stale = ageMs > COVERAGE_STALE_MINUTES * 60_000;
   return { ageMs, stale, label: `measured ${fmtAge(ageMs)} ago${stale ? ` — STALE (older than ${COVERAGE_STALE_MINUTES}m; re-arm or run stall_check for a current reading)` : ""}` };
 }
-/** Met when nothing scored is unseen — an empty board (0 of 0) is idle, not blind, and needs no special case. */
-export const meetsCoverageThreshold = (c: { checked: number; measurable: number }): boolean => c.measurable >= c.checked;
+/*
+ * ⛔⛆ ⟨q-b0d4e45a⟩ THE DENOMINATOR IS THE IN-FLIGHT POPULATION, NOT THE SCORED SUBSET. This armed a
+ * fleet on `checked: 0, measurable: 0, blind: []` while its own population said `rows: 4, inFlight: 2`:
+ * both in-flight lanes carried a PROSE cell, so each one hit `deliberate` and `continue`d out of the
+ * scoring loop before `scored.push`, and `checked` counted only what survived that filter. `0 >= 0` armed.
+ *
+ * ⛔ SO THE GUARD INVERTED AT ITS OWN LIMIT: `2 of 5` REFUSED while `0 of 2` ARMED SILENTLY — the
+ * partially blind fleet was stopped and the totally blind one waved through. An EMPTY blind-list and a
+ * blind-list THAT WAS NEVER POPULATED are indistinguishable, and this read the second as the first.
+ *
+ * ⭐ `deliberate` STAYS a category — a deliberately unwatched lane is real. The bug was that it was
+ * subtracted from the POPULATION rather than reported within it: a classification is a REASON a lane is
+ * unscored, never an exemption from being counted.
+ *
+ * ⚠ `inFlight === 0` is the ONE case that still arms, and it is a different sentence: nothing is in
+ * flight, so there is nothing to see — idle, not blind. That distinction is why the old `checked > 0`
+ * reasoning existed; it was right about idle and wrong about what `checked` measured.
+ */
+export const meetsCoverageThreshold = (c: { measurable: number; inFlight: number }): boolean =>
+  c.inFlight === 0 ? true : c.measurable >= c.inFlight;
 
 /**
  * ⟨q-1c95f7d4⟩ Task 5.4 — WHAT THE EXTERNAL TICK CONTRIBUTES TO THE AWAY PRECONDITION.
@@ -139,8 +157,19 @@ export type AwayCoverage = {
   tick?: AwayTick;
   /** ⟨q-5d1c8e04⟩ — standing seats on the board: present, not scored, and therefore not blind. */
   roles?: number;
-  /** Lanes that declare no per-agent branch: out of the population by their own statement. */
+  /**
+   * ⛔ ⟨q-b0d4e45a⟩ THE IN-FLIGHT POPULATION — the denominator. `checked` is the SCORED SUBSET and is
+   * reported beside it, never as the divisor: a lane filtered out before scoring still has to be counted,
+   * or the reading congratulates itself for the rows it dropped.
+   */
+  inFlight: number;
+  /**
+   * Lanes in flight that declare no per-agent branch. COUNTED IN `inFlight`, unscored, and named with the
+   * offending cell — a reason, not an exemption ⟨q-b0d4e45a⟩.
+   */
   deliberate?: number;
+  /** The `deliberate` lanes themselves, so a refusal can name the ROW and the CELL rather than a count. */
+  deliberateRows?: { agentId: string; stream: string; cell: string }[];
   /** ⟨q-3d82f1a9⟩ — the board could not be read: rows present vs parsed, as stall_check stated it. */
   unreadable?: { rowsPresent: number; rowsParsed: number; why: string };
   at: string;
@@ -245,11 +274,20 @@ export const coordAwaySchema = {
   agentId: z.string().optional(),
 };
 
-async function measureCoverage(repo?: string): Promise<AwayCoverage | null> {
+/**
+ * ⛔ THE SEAM EXISTS TO FEED THE GUARD BELOW, NOT TO BYPASS IT ⟨q-b0d4e45a⟩. `checkStall` replaces only
+ * the CLOCK'S REPLY; every line of the arithmetic and every refusal still runs on it. A seam that stood
+ * in for `measureCoverage` itself could not test the missing-population guard, because the guard is the
+ * thing under test — so the injection point is deliberately UPSTREAM of it.
+ */
+export type StallReplyForCoverage = { ok?: boolean; checked?: number; measurable?: number; blind?: string[]; roles?: unknown[]; deliberate?: unknown[]; population?: { rows?: number; inFlight?: number }; tick?: unknown; boardParse?: unknown };
+async function measureCoverage(repo?: string, checkStall: (a: { repo: string }) => Promise<unknown> = stallCheckTool): Promise<AwayCoverage | null> {
   if (!repo) return null;
   try {
-    const r = (await stallCheckTool({ repo })) as unknown as {
-      ok?: boolean; checked?: number; measurable?: number; blind?: string[]; roles?: unknown[]; deliberate?: unknown[];
+    const r = (await checkStall({ repo })) as unknown as {
+      ok?: boolean; checked?: number; measurable?: number; blind?: string[]; roles?: unknown[];
+      deliberate?: { agentId?: string; stream?: string; cell?: string }[];
+      population?: { rows?: number; inFlight?: number };
       tick?: { seats?: unknown[]; readable?: number; states?: Record<string, number>; note?: string };
       boardParse?: { readable: boolean; rowsPresent: number; rowsParsed: number; why: string };
     };
@@ -258,21 +296,42 @@ async function measureCoverage(repo?: string): Promise<AwayCoverage | null> {
     // promise a watched fleet over a table nobody can read.
     if (r?.boardParse && !r.boardParse.readable) {
       return {
-        checked: 0, measurable: 0, blind: [], roles: 0, deliberate: 0,
+        checked: 0, measurable: 0, inFlight: 0, blind: [], roles: 0, deliberate: 0,
         unreadable: { rowsPresent: r.boardParse.rowsPresent, rowsParsed: r.boardParse.rowsParsed, why: r.boardParse.why },
         at: new Date().toISOString(),
       };
     }
     if (!r?.ok) return null;
+    // ⛔⛆ ⟨q-b0d4e45a⟩ A MISSING POPULATION IS NOT A POPULATION OF ZERO, and `?? 0` here would rebuild the
+    // defect one layer up: `inFlight: 0` is the one value that passes the threshold unconditionally. If the
+    // clock cannot state its own denominator the fleet is UNMEASURED, and `null` sends it to the
+    // "cannot measure" refusal.
+    // ⭐ MEASURED, by removing this line in the COMPILED dist (tsc refuses the mutation, so the matrix runs
+    // against dist — qa's technique) — and it is worth stating exactly, because the danger is NOT uniform:
+    //   • plain call            → refuses, but INCOHERENTLY: "covers 0 of undefined … (NaN short)"
+    //   • acknowledgeBlindFleet → ⛔ ARMS, recording `coverage.inFlight: undefined` and announcing
+    //                             "Stall coverage 0/undefined — ACKNOWLEDGED BLIND"
+    // ⚠ So the acknowledged path is the one that actually goes away on an unmeasured fleet, and an earlier
+    // draft of this comment said "would ARM" without that split. Both outcomes are wrong; only one ships a
+    // fleet unwatched. The test covers BOTH, including that the flag cannot buy past it.
+    const inFlight = r.population?.inFlight;
+    if (typeof inFlight !== "number") return null;
+    const deliberateRows = (r.deliberate ?? []).map((d) => ({
+      agentId: String(d?.agentId ?? "-"),
+      stream: String(d?.stream ?? "-"),
+      cell: String(d?.cell ?? "").trim(),
+    }));
     return {
       checked: r.checked ?? 0,
       measurable: r.measurable ?? 0,
+      inFlight,
       blind: r.blind ?? [],
       tick: r.tick
         ? { seats: r.tick.seats?.length ?? 0, readable: r.tick.readable ?? 0, states: (r.tick.states ?? {}) as Record<string, number>, note: r.tick.note ?? "" }
         : undefined,
       roles: r.roles?.length ?? 0,
-      deliberate: r.deliberate?.length ?? 0,
+      deliberate: deliberateRows.length,
+      deliberateRows,
       at: new Date().toISOString(),
     };
   } catch {
@@ -280,16 +339,23 @@ async function measureCoverage(repo?: string): Promise<AwayCoverage | null> {
   }
 }
 
-export async function coordAwayTool(args: {
-  project: string;
-  on?: boolean;
-  leadId?: string;
-  decisionLog?: string;
-  until?: string;
-  repo?: string;
-  acknowledgeBlindFleet?: boolean;
-  agentId?: string;
-}) {
+export async function coordAwayTool(
+  args: {
+    project: string;
+    on?: boolean;
+    leadId?: string;
+    decisionLog?: string;
+    until?: string;
+    repo?: string;
+    acknowledgeBlindFleet?: boolean;
+    agentId?: string;
+  },
+  /**
+   * ⚠ A SECOND PARAMETER RATHER THAN A FIELD ON `args`, so nothing here can reach the MCP tool schema:
+   * a caller on the bus cannot supply its own clock. Tests only.
+   */
+  deps: { checkStall?: (a: { repo: string }) => Promise<unknown> } = {},
+) {
   const state = readAway();
   const prior = state[args.project];
 
@@ -320,7 +386,10 @@ export async function coordAwayTool(args: {
       summary:
         `'${args.project}' is ARMED — '${prior.leadId}' leads since ${prior.at}` +
         `${prior.until ? ` until ${prior.until}` : ""}. ` +
-        `Coverage ${prior.coverage.measurable}/${prior.coverage.checked} lane(s) ${coverageAgeOf(prior.coverage).label}` +
+        // ⚠ A RECORD WRITTEN BEFORE ⟨q-b0d4e45a⟩ HAS NO POPULATION, and a query must not invent one.
+        // Printing `/${checked}` for it would quote the scored subset as the denominator — the very
+        // reading this row fixed — so an unrecorded population says so in words.
+        `Coverage ${prior.coverage.measurable}/${typeof prior.coverage.inFlight === "number" ? prior.coverage.inFlight : `?? (population not recorded at arm time; ${prior.coverage.checked} scored)`} lane(s) ${coverageAgeOf(prior.coverage).label}` +
         `${prior.coverage.roles ? ` · ${prior.coverage.roles} role(s) present, not scored` : ""}` +
         `${prior.blindAcknowledged ? " (ACKNOWLEDGED BLIND)" : ""}. ` +
         `Decisions logged to ${prior.decisionLog}.`,
@@ -347,7 +416,7 @@ export async function coordAwayTool(args: {
     }
 
     // THE PRECONDITION: what could the clock actually SEE?
-    const coverage = await measureCoverage(args.repo);
+    const coverage = await measureCoverage(args.repo, deps.checkStall);
     if (!coverage) {
       return {
         ok: false as const,
@@ -370,18 +439,29 @@ export async function coordAwayTool(args: {
           `Away mode promises a watched fleet; a board the clock cannot read is not a quiet fleet, it is an unwatched one. Fix the row and re-arm.`,
       };
     }
-    // `checked > 0` MATTERS: an empty board is an IDLE fleet, not a blind one.
-    // Without it, arming while nothing is in flight refuses with "the clock
-    // covers 0 of 0" — a refusal that reads as a fleet nobody can see when in
-    // fact there is nothing to see, and the only way past it would be to
-    // acknowledge a blindness that does not exist.
     // ⟨q-5a71fc3b⟩ — below the threshold, not only at zero: "2 of 5" refuses.
+    // ⛔⛆ ⟨q-b0d4e45a⟩ — AND "0 of 2" REFUSES THE SAME WAY. The denominator is the in-flight
+    // population, so a lane filtered out of `checked` before scoring cannot buy silence. An empty
+    // board still arms, because `inFlight === 0` is idle rather than blind — the one thing the old
+    // `checked > 0` reasoning got right, now expressed against the population instead of against
+    // the scored subset it was mistaken for.
     if (!meetsCoverageThreshold(coverage) && !args.acknowledgeBlindFleet) {
+      // ⭐ NAME THE ROW AND THE CELL, not a count. "1 deliberate" tells a reader nothing they can act
+      // on; the stream and the offending cell text tell them which line to fix — or that the lane is
+      // legitimately unscoreable because nothing has been pushed yet.
+      const unscored = coverage.deliberateRows ?? [];
+      const unscoredSentence = unscored.length
+        ? ` UNSCORED BUT COUNTED — ${unscored.length} in-flight lane(s) declare no branch ref, and each is counted in the ${coverage.inFlight}: ` +
+          unscored.map((d) => `${d.agentId} (${d.stream}) cell reads ${JSON.stringify(d.cell)}`).join(" · ") +
+          `. A cell like this is a REASON a lane is unscored, never an exemption from being counted: if the lane has genuinely pushed nothing there is no ref to write, and that is UNSCOREABLE-AND-COUNTED, not covered.`
+        : "";
       return {
         ok: false as const,
         error:
-          `REFUSING: the stall clock covers ${coverage.measurable} of ${coverage.checked} in-flight row(s); the threshold is that ${COVERAGE_THRESHOLD} ` +
-          `(${coverage.checked - coverage.measurable} short)${coverage.blind.length ? ` — blind on: ${coverage.blind.join(", ")}` : ""}. ` +
+          `REFUSING: the stall clock covers ${coverage.measurable} of ${coverage.inFlight} in-flight row(s) ` +
+          `(${coverage.checked} scored); the threshold is that ${COVERAGE_THRESHOLD} ` +
+          `(${coverage.inFlight - coverage.measurable} short)${coverage.blind.length ? ` — blind on: ${coverage.blind.join(", ")}` : ""}.` +
+          unscoredSentence + " " +
           `${coverage.measurable === 0 ? "It would RUN and see nothing. " : "The seats it cannot see are exactly the ones an absence leaves unattended. "}` +
           `"The clock ran" and "the fleet is observed" are different facts, and this verb must not treat the first as the second. ` +
           `The usual cause is a board 'Branch · Worktree' cell holding a PATH rather than a branch ref: a path resolves for ` +
@@ -417,7 +497,12 @@ export async function coordAwayTool(args: {
         `Decides: planning · priority · curation · roadmap · canon · releases under standing authorisation. ` +
         `Never: merges, gates, or takes a code lane. Parks for David: ${PARKED_CATEGORIES.join(" · ")}. ` +
         `Decisions logged to ${args.decisionLog}. ` +
-        `Stall coverage ${coverage.measurable}/${coverage.checked}${!meetsCoverageThreshold(coverage) ? ` — ACKNOWLEDGED BLIND${coverage.measurable === 0 ? ": the clock runs and sees nothing" : ""}${coverage.blind.length ? ` on: ${coverage.blind.join(", ")}` : ""}` : ""}.` +
+        // ⭐ ⟨q-b0d4e45a⟩ TWO DIFFERENT SENTENCES, AND ONLY ONE OF THEM IS REASSURING. An idle fleet says
+        // "0 in flight"; it must never render as "0/0 covered", which reads as a measured fleet and is
+        // exactly how a never-populated reading passed for a clean one.
+        (coverage.inFlight === 0
+          ? `Stall coverage: 0 in flight — nothing to watch, so nothing was measured (idle, not blind; ${coverage.checked} scored).`
+          : `Stall coverage ${coverage.measurable}/${coverage.inFlight}${!meetsCoverageThreshold(coverage) ? ` — ACKNOWLEDGED BLIND${coverage.measurable === 0 ? ": the clock runs and sees nothing" : ""}${coverage.blind.length ? ` on: ${coverage.blind.join(", ")}` : ""}` : ""}.`) +
         tickSentence(coverage.tick),
     };
   }

package/src/tools/registry.ts

@@ -292,7 +292,9 @@ export const heartbeatSchema = { agentId: z.string().min(1) };
  * ⟨q-18a719c5⟩ THE ANSWERING SERVER'S IDENTITY — what `serverSpread` places a seat by. It exists
  * only inside the process that serves the seat, so every path on which a session binds an
  * identity stamps it: `register` (which `join` calls), the first-claim binding in server.ts
- * (a server that restarts and re-binds through any gated tool, `attach_agent` included),
+ * (a server that restarts and re-binds through a gated tool — ⟨q-bf7fd8f3⟩: NO LONGER
+ * `attach_agent`, `detach_agent`, `report_transport` or `clear_transport`, which pass
+ * `bindOnClaim: false` because administering a seat is not a claim to BE it),
  * `rename_agent` (the renaming session serves the new id), and `heartbeat`. Before this,
  * only `heartbeat` stamped, no code path called it, and `register` rebuilt the entry and
  * dropped whatever it had written.
@@ -655,6 +657,22 @@ export async function liveClaimEvidence(agentId: string, now: number): Promise<C
     reasons.push(
       `live ${marker.transport} transport (pid ${marker.pid}${targetOf(marker) ? `, pane ${targetOf(marker)}` : ""})`,
     );
+  }
+  // ⛔⛆ ⟨q-f995c3c7⟩ THE OWN-PANE DETERMINATION IS NOT GATED ON THE MARKER READING LIVE, AND THE NESTING
+  // THAT GATED IT WAS THE DEFECT. Everything below used to sit inside the `isMarkerLive` branch above, so a
+  // marker herdr no longer recognises — `paneExists` false, which `isMarkerLive` correctly calls dead —
+  // skipped the escape entirely. `live` then stayed true from the REGISTRY HEARTBEAT ALONE and the seat was
+  // refused with no way out but a token.
+  // ⚠ That is this function's own documented case (1): "own pane + a marker NO PROCESS HOLDS -> ACCEPTED".
+  // A DEAD MARKER IS A MARKER NO PROCESS HOLDS, so the gate contradicted the requirement it implements.
+  // ⭐ REAL TRIGGER, not hypothetical: any seat whose pane id herdr stops recognising — a recreated pane, a
+  // renamed workspace, a herdr restart that renumbers. 4 of 14 seats moved panes across the 2026-09-28
+  // standdown and nobody hit this only because herdr keeps an old id RESOLVING after a move; that is luck,
+  // and a renumbering restart removes it.
+  // ⛔ AND IT WIDENS NOTHING: `samePane` still requires the marker to name THIS process's pane, and the
+  // permit at `server.ts` pairs it with `boundElsewhere === 0`, so a genuinely live SESSION still refuses.
+  // Being in one's own pane has never been the whole permit and is not now.
+  if (marker) {
     // ⟨q-f995c3c7⟩ THE SAME SEAT RESTARTING INTO ITS OWN PANE, for herdr as well as tmux. This read
     // `process.env.TMUX_PANE` alone, which a herdr seat never has, so the exception could not fire
     // for the fleet that runs on herdr: every seat was refused by its own leftover marker (6 of 6 on