devrites 6.0.3 → 6.1.0

package/engine/internal/lib/taskgraph.go

@@ -1,6 +1,11 @@
 package lib
 
-import "github.com/devrites/devrites/internal/state"
+import (
+	"fmt"
+	"strings"
+
+	"github.com/devrites/devrites/internal/state"
+)
 
 // TaskSlice is one SLICE-### block parsed from tasks.md.
 type TaskSlice = state.TaskSlice
@@ -21,3 +26,28 @@ func CheckTaskGraph(root, slug string) (TaskGraphResult, error) {
 	}
 	return ParseTaskGraph(raw), nil
 }
+
+// edgeAdvisories names each dependency edge that does not say what crosses it:
+// no `(via <interface>)`, or a via the dependency's Consumes / Produces lacks.
+// An edge the dependent reads nothing across only serializes work.
+func edgeAdvisories(graph TaskGraphResult) []string {
+	produces := make(map[string]string, len(graph.Slices))
+	for _, s := range graph.Slices {
+		produces[s.ID] = s.ConsumesProduces
+	}
+	var lines []string
+	for _, s := range graph.Slices {
+		for _, dep := range s.Dependencies {
+			via := s.Via[dep]
+			switch {
+			case via == "":
+				lines = append(lines, fmt.Sprintf(`ADVISORY edge: %s -> %s names no crossing interface (add "(via <interface>)" or drop the edge)`, s.ID, dep))
+			case produces[dep] == "":
+				lines = append(lines, fmt.Sprintf("ADVISORY edge: %s -> %s via %q but %s declares no Consumes / Produces", s.ID, dep, via, dep))
+			case !strings.Contains(strings.ToLower(produces[dep]), strings.ToLower(via)):
+				lines = append(lines, fmt.Sprintf("ADVISORY edge: %s -> %s via %q is not in %s Consumes / Produces", s.ID, dep, via, dep))
+			}
+		}
+	}
+	return lines
+}

package/engine/internal/lib/util.go

@@ -94,13 +94,15 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 		"PAGER=cat",
 		"LC_ALL=C",
 	)
-	var output cappedGitOutput
+	// stderr gets its own buffer: git warnings (e.g. core.autocrlf) must never
+	// be parsed as output, only reported when the command fails.
+	var output, errOutput cappedGitOutput
 	if stdout == nil {
 		cmd.Stdout = &output
 	} else {
 		cmd.Stdout = stdout
 	}
-	cmd.Stderr = &output
+	cmd.Stderr = &errOutput
 	err := cmd.Run()
 	if err == nil {
 		if output.truncated {
@@ -116,8 +118,8 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 	if ctx.Err() != nil {
 		err = ctx.Err()
 	}
-	detail := output.String()
-	if output.truncated {
+	detail := errOutput.String()
+	if errOutput.truncated {
 		detail += "\n[git output truncated]"
 	}
 	return nil, &gitCommandError{
@@ -130,13 +132,21 @@ func runGitCommandIO(dir string, env []string, input []byte, stdout io.Writer, a
 
 // gitDiffNames lists the paths that differ, relative to gitRoot. With one ref it
 // diffs the working tree against that ref; with two it diffs the two tree objects.
+// Renames are split into their deletion and addition so both names surface, and
+// -z keeps non-ASCII paths unquoted.
 func gitDiffNames(gitRoot string, refs ...string) ([]string, error) {
-	args := append([]string{"diff", "--name-only"}, refs...)
+	args := append([]string{"diff", "--name-only", "--no-renames", "-z"}, refs...)
 	out, err := runGitCommand(gitRoot, nil, args...)
 	if err != nil {
 		return nil, err
 	}
-	return splitLinesNoTrailing(out), nil
+	var paths []string
+	for _, path := range strings.Split(string(out), "\x00") {
+		if path != "" {
+			paths = append(paths, path)
+		}
+	}
+	return paths, nil
 }
 
 // argAt returns args[i] or "": the Go analogue of bash's ${N:-} positional reads.
@@ -159,8 +169,9 @@ func activeSlug(root string) string {
 	return slug
 }
 
+// splitLinesNoTrailing splits data into lines, treating CRLF as LF.
 func splitLinesNoTrailing(data []byte) []string {
-	value := strings.TrimSuffix(string(data), "\n")
+	value := strings.TrimSuffix(strings.ReplaceAll(string(data), "\r\n", "\n"), "\n")
 	if value == "" {
 		return nil
 	}

package/engine/internal/lib/windows.go

@@ -50,12 +50,14 @@ Exit 0 clean or fully waived, 3 unwaived markers or blocked.`
 // deferralTokenRe catches uppercase comment markers: TODO, FIXME, XXX, HACK.
 var deferralTokenRe = regexp.MustCompile(`(?:^|[^A-Za-z0-9_])(TODO|FIXME|XXX|HACK)(?:[^A-Za-z0-9_]|$)`)
 
-// deferralIdioms are substring signals for skipped tests and stub bodies.
+// deferralIdioms are signals for skipped tests and stub bodies. An idiom that
+// starts with an identifier character matches only at a word start, so
+// os.Exit( is not xit( and benefit( is not fit(.
 var deferralIdioms = []string{
 	"t.Skip(", "t.Skipf(",
 	"test.skip(", "it.skip(", "describe.skip(", "context.skip(",
 	"xit(", "xdescribe(", "xtest(", "xcontext(", "fit(", "fdescribe(",
-	"pytest.mark.skip", "unittest.skip", "SkipTest",
+	"pytest.mark.skip", "pytest.skip(", "pytest.xfail(", "unittest.skip", "SkipTest",
 	"@Disabled", "#[ignore]",
 	"todo!(", "unimplemented!(",
 	"NotImplementedError",
@@ -104,7 +106,7 @@ type windowWaiver struct {
 func windowsMarkers(line string) []string {
 	var idioms []string
 	for _, idiom := range deferralIdioms {
-		if strings.Contains(line, idiom) {
+		if containsIdiom(line, idiom) {
 			idioms = append(idioms, idiom)
 		}
 	}
@@ -128,6 +130,37 @@ func windowsMarkers(line string) []string {
 	return out
 }
 
+// containsIdiom reports whether idiom occurs in line at a word start.
+func containsIdiom(line, idiom string) bool {
+	for i := 0; ; {
+		j := strings.Index(line[i:], idiom)
+		if j < 0 {
+			return false
+		}
+		at := i + j
+		if at == 0 || !isIdentByte(idiom[0]) || !isIdentByte(line[at-1]) {
+			return true
+		}
+		i = at + 1
+	}
+}
+
+func isIdentByte(b byte) bool {
+	return b == '_' || b >= '0' && b <= '9' || b >= 'a' && b <= 'z' || b >= 'A' && b <= 'Z'
+}
+
+// diffHeaderPath decodes a `--- `/`+++ ` header path, unquoting git's C-style
+// quoting of non-ASCII and special characters.
+func diffHeaderPath(raw string) string {
+	p := strings.TrimSpace(raw)
+	if strings.HasPrefix(p, `"`) {
+		if decoded, err := strconv.Unquote(p); err == nil {
+			return decoded
+		}
+	}
+	return p
+}
+
 // isTestPath reports whether a project-relative path names a test source file.
 func isTestPath(p string) bool {
 	base := path.Base(p)
@@ -157,9 +190,9 @@ func removedTestHits(diff string) []windowHit {
 		case strings.HasPrefix(line, "diff --git "):
 			inHeader, deleted, file = true, false, ""
 		case inHeader && strings.HasPrefix(line, "--- "):
-			oldPath = strings.TrimPrefix(strings.Trim(strings.TrimSpace(line[4:]), `"`), "a/")
+			oldPath = strings.TrimPrefix(diffHeaderPath(line[4:]), "a/")
 		case inHeader && strings.HasPrefix(line, "+++ "):
-			newPath := strings.Trim(strings.TrimSpace(line[4:]), `"`)
+			newPath := diffHeaderPath(line[4:])
 			if newPath == "/dev/null" {
 				deleted = true
 				if isTestPath(oldPath) {
@@ -203,8 +236,7 @@ func addedLinesFromDiff(diff string) ([]windowHit, map[string]bool) {
 	for _, line := range strings.Split(diff, "\n") {
 		switch {
 		case strings.HasPrefix(line, "+++ "):
-			p := strings.TrimSpace(strings.TrimPrefix(line, "+++ "))
-			p = strings.Trim(p, `"`)
+			p := diffHeaderPath(strings.TrimPrefix(line, "+++ "))
 			if p == "/dev/null" {
 				path = ""
 				continue
@@ -272,14 +304,16 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 		dir = opts.root
 	}
 	var hits []windowHit
-	var diffArgs []string
+	// Repository diff config (color, external diff, textconv, mnemonic or no
+	// prefixes) must not reshape the patch this parser reads.
+	diffArgs := []string{"diff", "--no-ext-diff", "--no-textconv", "--no-color", "--src-prefix=a/", "--dst-prefix=b/"}
 	switch opts.mode {
 	case "staged":
-		diffArgs = []string{"diff", "--cached", "-M", "-U0", "--"}
+		diffArgs = append(diffArgs, "--cached", "-M", "-U0", "--")
 	case "base":
-		diffArgs = []string{"diff", opts.base, "-M", "-U0", "--"}
+		diffArgs = append(diffArgs, opts.base, "-M", "-U0", "--")
 	default:
-		diffArgs = []string{"diff", "HEAD", "-M", "-U0", "--"}
+		diffArgs = append(diffArgs, "HEAD", "-M", "-U0", "--")
 	}
 	diff, err := runGitCommand(dir, nil, diffArgs...)
 	var diffPaths map[string]bool
@@ -293,6 +327,9 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 	default:
 		return nil, err
 	}
+	// Git paths are repo-root-relative; the project's own workspace may sit
+	// in a subdirectory ("sub/.devrites") when the project is nested.
+	control := devritesRepoPrefix(dir, opts.root)
 	if opts.mode == "worktree" {
 		// Whole files whose diff produced no hunks: staged additions land in
 		// `git diff HEAD`, untracked files never do — scan those in full.
@@ -307,17 +344,26 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 		}
 		repo := strings.TrimSpace(string(repoRoot))
 		for _, p := range status {
-			if diffPaths[p] || strings.HasPrefix(p, ".devrites/") {
+			if diffPaths[p] || strings.HasPrefix(p, control+"/") {
 				continue
 			}
 			hits = scanWholeFile(repo, p, hits)
 		}
 	}
+	// windows.md rows name project-relative paths, so hits are rebased from
+	// the repository root onto the project directory that holds control.
+	project := path.Dir(control)
 	var kept []windowHit
 	for _, h := range hits {
-		if !strings.HasPrefix(h.Path, ".devrites/") {
-			kept = append(kept, h)
+		if strings.HasPrefix(h.Path, control+"/") {
+			continue
 		}
+		if project != "." {
+			if rel, err := filepath.Rel(filepath.FromSlash(project), filepath.FromSlash(h.Path)); err == nil {
+				h.Path = filepath.ToSlash(rel)
+			}
+		}
+		kept = append(kept, h)
 	}
 	return kept, nil
 }
@@ -362,7 +408,7 @@ func parseWindowsWaivers(raw string) (map[windowWaiver]int, []string) {
 // parseWindowsArgs accepts the diff-scope mode flags plus a slug; the allowlist
 // flags do not apply to marker scanning.
 func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOpts, int) {
-	opts := diffScopeOpts{mode: "worktree", phase: "seal", root: root}
+	opts := diffScopeOpts{mode: "worktree", root: root}
 	var positional []string
 	for i := 0; i < len(args); i++ {
 		switch args[i] {
@@ -376,6 +422,10 @@ func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOp
 		case "--base":
 			opts.mode = "base"
 			opts.base = argAt(args, i+1)
+			if strings.HasPrefix(opts.base, "-") {
+				fmt.Fprintln(stderr, "windows: --base requires a ref (not a flag)")
+				return opts, 2
+			}
 			i++
 		case "--cwd":
 			opts.cwd = argAt(args, i+1)
@@ -393,6 +443,9 @@ func parseWindowsArgs(root string, args []string, stderr io.Writer) (diffScopeOp
 		return opts, 2
 	}
 	opts.slug = positional[0]
+	if opts.phase == "" {
+		opts.phase = cursorPhase(root, opts.slug)
+	}
 	return opts, 0
 }
 

package/engine/internal/markdowntext/markdowntext.go

@@ -54,6 +54,16 @@ func Structural(input []byte) ([]byte, error) {
 					start = closeEnd + 1
 					continue
 				}
+			} else if fence, closeEnd := markerLineFence(input, line, lineEnd, afterBlank || anchor >= 0); closeEnd >= 0 {
+				anchor, afterBlank = -1, false
+				if !loneCR(input[start:closeEnd]) {
+					mask(out[start+fence : closeEnd])
+				}
+				if closeEnd == len(input) {
+					break
+				}
+				start = closeEnd + 1
+				continue
 			} else {
 				column, ok := topLevelItem(line)
 				if ok && (afterBlank || anchor >= 0) {
@@ -167,23 +177,52 @@ func fenceStart(line []byte, limit int) (int, bool) {
 	return start, columns <= limit && start < len(line) && (line[start] == '`' || line[start] == '~')
 }
 
+// markerLineFence handles a top-level list item whose content opens a fence
+// (`- ```bash`). It returns the fence's byte offset in line and the end offset
+// of the closer, or -1 unless a closer at the item's content column follows
+// and every line before it stays inside the item. Without this, an indented
+// closer would reopen a top-level fence and mask the rest of the file.
+// Ordered items other than 1 cannot interrupt a paragraph, so they need
+// separated (a preceding blank line or list item).
+func markerLineFence(input, line []byte, lineEnd int, separated bool) (int, int) {
+	column, next, ok := itemContent(line)
+	if !ok || (!separated && line[0] >= '2' && line[0] <= '9') {
+		return 0, -1
+	}
+	marker, width, ok := openingFence(line[next:], 0)
+	if !ok {
+		return 0, -1
+	}
+	return next, listFenceEnd(input, lineEnd, marker, width, column, column)
+}
+
 // topLevelItem returns the content column of a list item whose marker sits at
 // column 0 and whose content is neither another list marker, a heading marker,
 // a fence nor part of a thematic break.
 func topLevelItem(line []byte) (int, bool) {
-	if len(line) < 2 || isThematicBreak(line) {
+	column, next, ok := itemContent(line)
+	if !ok || startsBlock(line[next:]) {
 		return 0, false
 	}
+	return column, true
+}
+
+// itemContent returns the content column and byte offset of a list item whose
+// marker sits at column 0.
+func itemContent(line []byte) (int, int, bool) {
+	if len(line) < 2 || isThematicBreak(line) {
+		return 0, 0, false
+	}
 	markerEnd := 1
 	switch c := line[0]; {
 	case c == '-' || c == '*' || c == '+':
 	case c >= '1' && c <= '9' && line[1] == '.':
 		markerEnd = 2
 	default:
-		return 0, false
+		return 0, 0, false
 	}
 	if markerEnd >= len(line) || (line[markerEnd] != ' ' && line[markerEnd] != '\t') {
-		return 0, false
+		return 0, 0, false
 	}
 	column, next := markerEnd, markerEnd
 	for next < len(line) && (line[next] == ' ' || line[next] == '\t') {
@@ -194,10 +233,10 @@ func topLevelItem(line []byte) (int, bool) {
 		}
 		next++
 	}
-	if next == len(line) || column-markerEnd > 4 || startsBlock(line[next:]) {
-		return 0, false
+	if next == len(line) || column-markerEnd > 4 {
+		return 0, 0, false
 	}
-	return column, true
+	return column, next, true
 }
 
 // startsBlock reports content that opens a list marker, heading or fence.

package/engine/internal/notes/cli.go

@@ -93,11 +93,13 @@ func cmdAdd(root string, args []string, stdout, stderr io.Writer) int {
 	}
 	slug := args[0]
 	subject := filepath.ToSlash(oneLine(args[1]))
-	quote := oneLine(args[2])
-	title := oneLine(args[3])
+	// ParseNotes trims attribute values, so a value is stored trimmed and a
+	// whitespace-only one is blank.
+	quote := strings.TrimSpace(oneLine(args[2]))
+	title := strings.TrimSpace(oneLine(args[3]))
 	body := ""
 	if len(args) == 5 {
-		body = oneLine(args[4])
+		body = strings.TrimSpace(oneLine(args[4]))
 	}
 	if err := ValidateSubject(subject); err != nil {
 		fmt.Fprintf(stderr, "note add: %v\n", err)

package/engine/internal/notes/notes.go

@@ -550,12 +550,17 @@ func Render(text, newline, id, summary, subject, quote, body string) string {
 }
 
 // RemoveEntry deletes one note block (its `- NOTE-` row through its last
-// contiguous attribute row) from the source text.
+// attribute row) from the source text. Like ParseNotes, blank lines do not end
+// the block; trailing blank lines stay.
 func RemoveEntry(text, newline string, note *Note) string {
 	lines := strings.Split(strings.ReplaceAll(text, "\r\n", "\n"), "\n")
 	end := note.Line
-	for end < len(lines) && attrLineRE.MatchString(lines[end]) {
-		end++
+	for i := end; i < len(lines); i++ {
+		if attrLineRE.MatchString(lines[i]) {
+			end = i + 1
+		} else if strings.TrimSpace(lines[i]) != "" {
+			break
+		}
 	}
 	kept := append([]string{}, lines[:note.Line-1]...)
 	kept = append(kept, lines[end:]...)

package/engine/internal/overhaul/admit/run.go

@@ -25,6 +25,7 @@ import (
 	"unicode/utf8"
 
 	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/packet"
 	"github.com/devrites/devrites/internal/overhaul/records"
 )
 
@@ -46,22 +47,15 @@ func Run(args []string, stdout, stderr io.Writer) int {
 	var code int
 	var err error
 	switch {
-	case len(args) >= 3 && args[0] == "receipt":
-		observed, hasObserved := "", false
-		for i, a := range args {
-			if a == "--observed" {
-				if i+1 >= len(args) {
-					fmt.Fprint(stderr, usage)
-					return 2
-				}
-				observed, hasObserved = args[i+1], true
-				break
-			}
+	case len(args) >= 3 && args[0] == "receipt" && (len(args) == 3 || len(args) == 5 && args[3] == "--observed"):
+		observed, hasObserved := "", len(args) == 5
+		if hasObserved {
+			observed = args[4]
 		}
 		code, err = receipt(args[1], args[2], observed, hasObserved, stdout)
 	case len(args) == 3 && args[0] == "packet":
 		code, err = packetAdmit(args[1], args[2], stdout)
-	case len(args) >= 3 && args[0] == "anchor":
+	case len(args) == 3 && args[0] == "anchor":
 		code, err = anchor(args[1], args[2], stdout, stderr)
 	default:
 		fmt.Fprint(stderr, usage)
@@ -228,6 +222,16 @@ func receipt(run, path, observed string, hasObserved bool, stdout io.Writer) (in
 			verdict(stdout, "DUPLICATE_OR_LATE", "attempt_status", x["status"])
 			return 3, nil
 		}
+		// Only the attempt's own receipt file counts: not a copy elsewhere (such
+		// as in the target repository) and not a symlink to one.
+		canon := filepath.Join(realpath(run), "receipts", packet.Name(map[string]any{"run_id": rj["run_id"],
+			"task_id": x["task_id"], "attempt_id": x["attempt_id"], "role": x["role"]})+".json")
+		if realpath(path) != canon {
+			why = append(why, "receipt must be the attempt's file <run>/receipts/<run_id>__<task_id>__<attempt_id>__<role>.json")
+		}
+		if r := ovio.Str(x["receipt"]); r != "" && realpath(join(run, r)) != canon {
+			why = append(why, "receipt differs from the dispatched attempt's receipt")
+		}
 		for _, k := range []string{"role", "lane", "snapshot"} {
 			if !eq(rc[k], x[k]) {
 				why = append(why, k+" differs from the dispatch packet")

package/engine/internal/overhaul/overhaul.go

@@ -25,6 +25,7 @@ const Usage = `usage: devrites-engine overhaul <tool> ...
   overhaul records stage <run>
   overhaul records publish <run>
   overhaul records validate <run>
+  overhaul records prune <run> [--keep K]
   overhaul admit receipt <run> <receipt.json> [--observed <paths.txt>]
   overhaul admit packet <run> <packet.json>
   overhaul admit anchor <tree> <proposals.json>

package/engine/internal/overhaul/records/check.go

@@ -13,6 +13,7 @@ import (
 	"strings"
 
 	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/score"
 	"github.com/devrites/devrites/internal/overhaul/snapshot"
 )
 
@@ -65,6 +66,9 @@ var (
 	required     = []string{"run.json", "coverage.json", "findings.json", "evidence.json", "dispatch.json",
 		"approval.json", "cycles.json"}
 	channels = set("conversation", "host-structured-action")
+	// finishedVerdict is the readiness verdict each finished-repair outcome requires.
+	finishedVerdict = map[string]string{"READY_FOR_USER_REVIEW": "MEETS_TARGETS",
+		"COMPLETED_WITH_APPROVED_DEGRADATION": "MEETS_TARGETS_WITH_APPROVED_DEGRADATION"}
 )
 
 // Repr renders a decoded JSON value the way Python's repr() does, so rule
@@ -198,13 +202,8 @@ func BadPath(p any, repo string) string {
 	if path.Clean(s) != s || strings.Split(s, "/")[0] == ".." {
 		return "not normalized or escapes the repository"
 	}
-	for _, part := range strings.Split(s, "/") {
-		if part == ".git" {
-			return "names a directory or git metadata"
-		}
-	}
-	if strings.HasPrefix(s, snapshot.RunAreaDir) {
-		return "names the overhaul run area"
+	if why := reserved(s); why != "" {
+		return why
 	}
 	if isDir(join(repo, s)) {
 		return "names a directory or git metadata"
@@ -212,6 +211,30 @@ func BadPath(p any, repo string) string {
 	if !inside(repo, s) {
 		return "resolves outside the repository (symlink or traversal)"
 	}
+	// A symlink alias must not reach git metadata or the run area either.
+	root := realpath(repo)
+	full := realpath(join(root, s))
+	if why := reserved(filepath.ToSlash(strings.TrimPrefix(full, root+string(os.PathSeparator)))); why != "" {
+		return why
+	}
+	if area := realpath(join(root, snapshot.RunAreaDir)); strings.HasPrefix(strings.ToLower(full), strings.ToLower(area)+string(os.PathSeparator)) {
+		return "names the overhaul run area"
+	}
+	return ""
+}
+
+// reserved names why a repository-relative path is off limits: any .git
+// component or the run area, compared case-folded for case-insensitive filesystems.
+func reserved(rel string) string {
+	l := strings.ToLower(rel)
+	for _, part := range strings.Split(l, "/") {
+		if part == ".git" {
+			return "names a directory or git metadata"
+		}
+	}
+	if strings.HasPrefix(l, snapshot.RunAreaDir) {
+		return "names the overhaul run area"
+	}
 	return ""
 }
 
@@ -586,6 +609,27 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			add("run.json: readiness_verdict differs from scorecard.json")
 		}
 	}
+	// A finished repair claims readiness only on a complete, passing scorecard.
+	outcome := str(rj, "execution_outcome")
+	if want := finishedVerdict[outcome]; want != "" {
+		if !isFile(scp) {
+			add("run.json: %s needs scorecard.json", outcome)
+		} else if sc, err := ovio.LoadObject(scp); err != nil {
+			return nil, err
+		} else {
+			if !eq(sc["readiness_verdict"], want) || !eq(rj["readiness_verdict"], want) {
+				add("run.json: %s needs readiness_verdict %s in run.json and scorecard.json", outcome, want)
+			}
+			gates := ovio.Obj(sc["gates"])
+			for _, g := range score.GateIDs(!ovio.Truthy(rj["assessment_only"])) {
+				st := str(gates, g)
+				waived := g == "G-CONCURRENCY" && st == "WAIVED_OPERATIONAL" && want == "MEETS_TARGETS_WITH_APPROVED_DEGRADATION"
+				if st != "PASS" && st != "NOT_APPLICABLE" && !waived {
+					add("run.json: %s needs gate %s to pass in scorecard.json (got %s)", outcome, g, Repr(gates[g]))
+				}
+			}
+		}
+	}
 	if err := consistency(run, genDir, R, add); err != nil {
 		return nil, err
 	}
@@ -686,7 +730,7 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 		if set("returned", "admitted", "rejected")[status] && !(str(x, "receipt") != "" && isFile(join(run, str(x, "receipt")))) {
 			add("attempt %s: receipt file missing", xid)
 		}
-		if set("dispatched", "running", "returned")[status] {
+		if !set("admitted", "rejected", "cancelled")[status] {
 			unsettled = append(unsettled, xid)
 		}
 		if !writers[str(x, "role")] {
@@ -721,7 +765,6 @@ func Check(run, genDir, prevDir string) ([]string, error) {
 			}
 		}
 	}
-	outcome := str(rj, "execution_outcome")
 	if outcome != "RUNNING" && len(unsettled) > 0 {
 		add("attempts must be admitted, rejected or cancelled before the run leaves RUNNING: %s", Repr(unsettled[:min(5, len(unsettled))]))
 	}

package/engine/internal/overhaul/render/run.go

@@ -530,6 +530,7 @@ type built struct {
 	laneCov        map[string][2]int // lane -> reviewed, eligible ranges
 	secs           []section
 	approve, stamp string
+	hasPlan        bool // run.json names a plan revision
 	finds          []map[string]any
 	lanes          []string
 	cards          map[string][]map[string]any // section anchor -> findings drawn as cards in HTML
@@ -787,7 +788,7 @@ func build(run, gen string) (*built, error) {
 	}
 	stamp := sf("overhaul-stamp run=%s generation=%s plan=%s", rj["run_id"],
 		strings.ReplaceAll(filepath.Base(strings.TrimRight(gen, "/")), ".tmp", ""), planStamp)
-	return &built{rj: rj, sc: sc, base: base, rubric: rubric, domains: domains, tasks: tasks, laneCov: laneCov, secs: S, approve: approve, stamp: stamp, finds: finds, lanes: lanes,
+	return &built{rj: rj, sc: sc, base: base, rubric: rubric, domains: domains, tasks: tasks, laneCov: laneCov, secs: S, approve: approve, stamp: stamp, hasPlan: len(pr) > 0, finds: finds, lanes: lanes,
 		cards: map[string][]map[string]any{"findings": confirmed, "opportunities": opps}, byF: byF}, nil
 }
 
@@ -816,7 +817,7 @@ func render(run, gen, kind, home string) (string, error) {
 	runID := pyStr(b.rj["run_id"])
 	if kind == "review" {
 		for _, s := range b.secs {
-			if s.anchor != "plan" || len(s.body) == 0 {
+			if s.anchor != "plan" || !b.hasPlan { // a zero-task plan still gets plan.md
 				continue
 			}
 			lines := append([]string{"<!-- " + b.stamp + " -->", "# Overhaul plan " + runID, ""}, mdTable(v, s.cols, s.body)...)

package/engine/internal/overhaul/snapshot/run.go

@@ -239,7 +239,7 @@ func dirty(root string, tracked []string) (map[string]bool, error) {
 		return set, nil
 	}
 	b, err := git(root, "-c", "diff.autoRefreshIndex=false", "diff", "--no-ext-diff", "--no-textconv", "--no-renames",
-		"--name-only", "-z", "HEAD")
+		"--relative", "--name-only", "-z", "HEAD") // --relative: same base as ls-files when root is a subdirectory
 	if err != nil {
 		return nil, err
 	}
@@ -465,7 +465,7 @@ func capture(root, out string, stdout io.Writer) error {
 	safe := []string{"--", "."}
 	for p, v := range st {
 		if v.Sensitive {
-			safe = append(safe, ":(top,exclude,literal)"+p)
+			safe = append(safe, ":(exclude,literal)"+p) // cwd-relative, like p, when root is a subdirectory
 		}
 	}
 	for _, o := range []struct {

package/engine/internal/parallel/git.go

@@ -108,18 +108,17 @@ func isAncestor(repo, ancestor, descendant string) (bool, error) {
 }
 
 func diffNames(repo, a, b string) ([]string, error) {
-	out, err := git(repo, "diff", "--name-only", a, b)
+	// --no-renames reports a rename's source as a deletion; -z keeps paths raw
+	// instead of C-quoted.
+	out, err := git(repo, "diff", "--name-only", "--no-renames", "-z", a, b)
 	if err != nil {
 		return nil, err
 	}
+	out = strings.TrimSuffix(out, "\x00")
 	if out == "" {
 		return nil, nil
 	}
-	lines := strings.Split(out, "\n")
-	for i := range lines {
-		lines[i] = strings.TrimSpace(lines[i])
-	}
-	return lines, nil
+	return strings.Split(out, "\x00"), nil
 }
 
 func headSHA(repo string) (string, error) {

package/engine/internal/parallel/ops.go

@@ -584,6 +584,9 @@ func cleanupLocked(repoRoot, slug string, force bool) ([]Salvage, error) {
 		inScratch := sl.WorktreePath != "" && ownedWorktreePath(repoRoot, lease.BatchID, sl)
 		owned := inScratch && createdWorktree(registered, sl.WorktreePath)
 		if sl.WorktreePath != "" && !owned {
+			// Never salvaged, so the batch sweep must not delete this slice's
+			// scratch entry either (e.g. a --root spelled through a symlink).
+			keptWorktrees[sl.ID] = true
 			if inScratch {
 				warnf("slice %s worktree_path %q is not a worktree git registered; leaving it untouched",
 					sl.ID, sl.WorktreePath)