freeharness 0.4.1 → 0.4.3

package/canonical/skills/subagent-driven-development/scripts/validate-handoff.mjs

@@ -1,10 +1,13 @@
 #!/usr/bin/env node
 // Validator for the subagent-driven-development artifacts (reference/brief.md and
 // reference/handoff.md). Zero dependencies; exit 0 on success, 1 on a rejected artifact or
-// on usage. USAGE lists the subcommands.
+// on usage, 2 when `gate` cannot read its ledger or a round number is not a positive integer.
+// USAGE lists the subcommands.
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 
 /** Allowed handoff statuses. */
 const STATUSES = new Set(["completed", "partial", "blocked"]);
@@ -14,16 +17,136 @@ const TEST_RESULTS = new Set(["pass", "fail", "unavailable"]);
 const STOP_TOKENS = new Set(["too-big", "needs-confirm", "ambiguous", "regressed", "scope"]);
 /** Tiers a brief may declare. */
 const TIERS = new Set(["strong", "standard", "fast"]);
+/** Climb order of tiers and efforts; a value outside it ranks below every listed one. */
+const TIER_RANK = new Map([["fast", 0], ["standard", 1], ["strong", 2]]);
+const EFFORT_RANK = new Map([["medium", 0], ["high", 1]]);
+/** Classes a standard reviewer covers whatever the diff size (S3). */
+const STANDARD_REVIEW_CLASSES = new Set(["docs", "mechanical", "extraction", "exploration", "summary"]);
+/** Diff size a standard reviewer covers: changed lines and files since the base (S3). */
+const REVIEW_LINE_BOUND = 200;
+const REVIEW_FILE_BOUND = 3;
+/** Lowercased `Class:` values the standard tier may run; any other class, or none, needs strong. */
+export const STANDARD_CLASSES = new Set(["docs", "extraction", "exploration", "mechanical", "summary", "code"]);
+/** Lowercased `Class:` values the fast tier may run; its small window suits only reading tasks. */
+export const FAST_CLASSES = new Set(["extraction", "summary"]);
+/** Lowercased `Class:` values that run only on strong at high effort, whatever else the brief says. */
+export const HIGH_EFFORT_CLASSES = new Set(["security", "complex"]);
+/** Accepted `Effort:` values, matched exactly; an absent header means medium. */
+export const EFFORTS = new Set(["medium", "high"]);
+/** The `Route:` a standard `code` brief needs; C6 and C7 are judgment, so only the reason says so. */
+const ROUTE_RE = /^C1-C7 - (.*)$/;
+/** Most non-test write-scope files a standard `code` route may name (C1). */
+const ROUTE_SOURCE_BOUND = 2;
+/** Name parts and directory names that mark a risky file: a standard `code` route may not touch
+ * it (C2) and a diff holding it needs a strong reviewer (S1). */
+const ROUTE_RISKY = ["guard", "hook", "auth", "secret", "parse"];
+const ROUTE_RISKY_DIRS = new Set(["hooks", "guards"]);
+/** Manifest and lockfile names a standard `code` route may not touch (C5). */
+const ROUTE_MANIFEST_RE = /^(?:package\.json|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|pyproject\.toml|uv\.lock|poetry\.lock|requirements.*\.txt|cargo\.toml|cargo\.lock|go\.mod|go\.sum)$/;
 /** A `D:<kebab-slug>` or `R:<task>.<n>` digest id; `<task>` is dotted, batch (`1.3b`) or `final`. */
 const DIGEST_ID = /^(D:[a-z0-9]+(?:-[a-z0-9]+)*|R:(?:\d+(?:\.\d+)*b?|final)\.\d+):\s*(.*)$/;
 /** Non-empty-line budget for the `## Why and rulings` section. */
 const DIGEST_BUDGET = 15;
 /** A valid `Ceiling:` header value: a positive integer, no sign, no leading zero. */
 const CEILING_RE = /^[1-9]\d*$/;
-/** Default budget ceiling (cache-read tokens) when a brief or `--ceiling` gives none. */
+/** Budget ceiling (cache-read tokens) of a task of no security, complex or final class. */
 const DEFAULT_CEILING = 25000000;
+/** Class ceilings (cache-read tokens): security and complex tasks share the ordinary limit, so
+ * extra spend on them needs the owner's run authorization; only the final review, which reads
+ * the whole branch, gets more. */
+export const CLASS_CEILINGS = Object.freeze({ security: DEFAULT_CEILING, complex: DEFAULT_CEILING, final: 50000000, other: DEFAULT_CEILING });
+/** Fix rounds a task may open when the change's run authorization sets no `Rounds:`. */
+const DEFAULT_ROUNDS = 3;
+/** The run authorization's lines; anything else in its section is refused, never skipped. */
+const AUTH_HEADING = "## Run authorization";
+const AUTH_LINE_RE = /^(?:Ceiling (security|complex|final|other)|Rounds): (.*)$/;
+const AUTH_ROUNDS_RE = /^[1-9]$/;
 /** Task id a ledger line may carry: dotted, batch (`1.3b`), or `final`. */
 const LEDGER_TASK_RE = /^(?:\d+(?:\.\d+)*b?|final)$/;
+/** The `Task:` value a new brief may declare: one dotted id or `final`. Stricter than
+ * `LEDGER_TASK_RE`, which still accepts the `b` ids old batch ledgers carry. */
+export const BRIEF_TASK_RE = /^(?:\d+(?:\.\d+)*|final)$/;
+/** The converge hook's checkbox pattern, kept as an identical literal so both read one task list. */
+const TASK_LINE = /^\s*(?:[-*+]|\d{1,9}[.)])\s*\[(?:\s*([^\]\s])\s*\](?![([])|\](?![([])|\s+\])\s*(.*)/;
+const TASK_ANNOTATION_RE = /^ {2,}(?:Verify|Interfaces|Boundary|Depends|Disposition):/;
+/** What `brief-init` leaves where only the lead's judgment can supply the value. */
+export const PLACEHOLDER_RE = /<fill:/;
+const SPACE_RE = /\s/;
+const LINE_END = /[\n\r\p{Zl}\p{Zp}]/u;
+/** The `no-full-suite` test as one pass over the text, linear in its length: a bullet opens at a
+ * `- ` with a space or the text start before it and runs to the next ` - ` or line end. A bullet
+ * opening right inside the one before it is skipped when its text is a suffix of that one's, so
+ * the scan never rereads a character. */
+function noFullSuiteBullet(text) {
+  const n = text.length;
+  const isSpace = (ch) => ch !== undefined && SPACE_RE.test(ch);
+  let i = 0;
+  while (i < n) {
+    if (text[i] !== "-" || !isSpace(text[i + 1]) || (i > 0 && !isSpace(text[i - 1]))) {
+      i++;
+      continue;
+    }
+    let k = i + 2;
+    while (k < n && !LINE_END.test(text[k]) && !(isSpace(text[k]) && text[k + 1] === "-" && isSpace(text[k + 2]))) k++;
+    const bullet = text.slice(i + 2, k);
+    const run = /\b(?:never|do\s+not)\s+run\b/i.exec(bullet);
+    if (run && /suite:/i.test(bullet.slice(run.index + run[0].length)) && /verify/i.test(bullet)) return true;
+    i = k < n && !LINE_END.test(text[k]) ? k + 1 : Math.max(i + 1, k - 1);
+  }
+  return false;
+}
+/** One short fragment (or a `pattern`, or a `phrases` list needing every member) per required
+ * `## Run rules` line; a brief missing one reports its `key`. `phrase` is a case-insensitive
+ * substring; `phrases` needs each entry as its own substring, any order; `pattern` tests the
+ * section text as-is. A brief may restate a rule in its own words around the match.
+ * `no-full-suite` needs `never run` or `do not run` before `Suite:`, and verify, in one bullet
+ * bounded by the next ` - ` or line end, so borrowed fragments never pass. */
+export const REQUIRED_RUN_RULES = [
+  { key: "build-before-tests", phrase: "build before" },
+  { key: "comment-share", phrase: "comment share" },
+  { key: "edit-tools-only", phrase: "edit and write tools" },
+  { key: "env-override-same-command", phrase: "same shell command" },
+  { key: "foreground-timeout", phrases: ["foreground", "timeout"] },
+  { key: "git-stash-checkout-reset", phrase: "git stash" },
+  { key: "head-reader", phrase: "head-reader" },
+  { key: "no-full-suite", pattern: { test: noFullSuiteBullet } },
+  { key: "no-index-writes", pattern: /^(?=[\s\S]*git index)(?=[\s\S]*plain `?rm\b)/i },
+  { key: "no-tail-head", pattern: /`?tail`?\s+or\s+`?head`?/i },
+  { key: "real-home", phrase: "real home" },
+  { key: "reply-json-skeleton", phrase: "skeleton" },
+];
+/** Most write-scope files outside test and fixture directories one brief may name: more means
+ * more than one behavior, so the task is split. */
+export const SOURCE_FILE_BOUND = 3;
+/** Estimated tokens a brief's reading set stays under; cost is bytes read, not file count. */
+export const READING_SET_BOUND = 60000;
+/** Bytes per estimated token: 4 is the common estimate for English and code, kept coarse on purpose
+ * because the bound only needs the right order of magnitude. */
+const BYTES_PER_TOKEN = 4;
+/** Lines a `path#symbol` entry counts, since a symbol's real extent is unknown without parsing. */
+const SYMBOL_LINES = 200;
+/** Path segments that mark a test or fixture entry, which never counts toward the file bound. */
+const TEST_SEGMENTS = new Set(["test", "tests", "__tests__", "fixtures"]);
+/** Suffix of every size-bound refusal, naming both ways out. */
+const SPLIT_HINT = " (split the task, or add Split: refused - <reason>)";
+/** One acceptance probe line: id, check, expected; the lazy check makes the first ` -> ` the
+ * split, so an expected outcome may itself hold an arrow. */
+export const PROBE_RE = /^(P[1-9]\d*): (.+?) -> (.+)$/;
+/** Most probe lines a brief may carry: more is a bar no single task can be held to. */
+export const PROBE_BOUND = 12;
+/** An expected outcome that admits the behavior, so a fix that over-denies fails a probe. */
+const ALLOW_SIDE_RE = /\b(?:allow|allowed|accept|accepted|accepts|pass|passes|passed|ok|exit 0)\b/i;
+/** Most non-blank lines a brief's `## Project rules` may hold: workers run without CLAUDE.md, so
+ * the section carries only the rules that bear on the write scope, never the whole file. */
+export const PROJECT_RULES_BOUND = 20;
+/** The probe form a refusal quotes, so the lead sees the expected shape. */
+const PROBE_FORM = "'P<n>: <check> -> <expected>'";
+/** The `### ` subsections a report's `## Checkpoint` holds, in this order: a fresh fix
+ * implementer reads them instead of a transcript, so none may be dropped. */
+export const CHECKPOINT_SECTIONS = ["Intent", "Files and code", "Decisions", "Errors and fixes", "Open work", "Next step"];
+/** Most code points a checkpoint may hold, heading included: it is re-read on every turn of the
+ * next dispatch, so an oversized one is refused, never truncated. */
+export const CHECKPOINT_BOUND = 8000;
 /** A valid dispatch name: role, underscore-joined task, optional round, optional slug. */
 const DISPATCH_NAME_RE = /^(impl|review|fix)-(\d+(?:_\d+)*b?|final)(?:-r(\d+))?(?:-([a-z0-9-]+))?$/;
 /** Charset a dispatch name may use before correction (letters of either case, digits, `_.-`). */
@@ -79,7 +202,7 @@ export function validateHandoff(h) {
 }
 
 /** Trimmed non-empty lines of one `## ` section; empty if absent. */
-function readSection(text, title) {
+export function readSection(text, title) {
   const re = new RegExp(`^## ${title}\\s*$`, "m");
   const section = text.split(/^(?=## )/m).find((s) => re.test(s.split("\n")[0]));
   if (!section) return [];
@@ -90,21 +213,61 @@ function readSection(text, title) {
     .filter((l) => l !== "");
 }
 
-/** Parses a brief into `{ file, header, scope, digest, digestIds, ceiling }`; `ceiling` is null
- * without the header, NaN when not a positive integer. */
+/** Parses a brief into `{ file, header, scope, entries, reads, digest, digestIds, ceiling,
+ * runRules, projectRules, probes, probeErrors, changes, changesNone, unaffected, verify }`;
+ * `ceiling` is null without the header, NaN when not a positive integer. */
 export function readBrief(file) {
-  const text = fs.readFileSync(file, "utf8");
+  return parseBrief(file, fs.readFileSync(file, "utf8"));
+}
+
+/** Splits a `path:<a>-<b>` or `path#<symbol>` entry into `{ path, range, symbol }`, plus
+ * `append: true` for a `:append` suffix. Only the size and append checks use a suffix; every
+ * scope match takes the bare path. */
+function parseEntry(text) {
+  const tail = /^(.+):append$/.exec(text);
+  const body = tail ? tail[1] : text;
+  const range = /^(.+):(\d+)-(\d+)$/.exec(body);
+  const symbol = range ? null : /^(.+)#([^#/]+)$/.exec(body);
+  const e = range ? { path: range[1], range: [Number(range[2]), Number(range[3])], symbol: null } : { path: symbol ? symbol[1] : body, range: null, symbol: symbol ? symbol[2] : null };
+  e.path = path.posix.normalize(e.path);
+  return tail ? { ...e, append: true } : e;
+}
+
+/** An entry as a brief writes it, so a refusal names what the lead typed. */
+function entryText(e) {
+  const bare = e.range ? `${e.path}:${e.range[0]}-${e.range[1]}` : e.symbol ? `${e.path}#${e.symbol}` : e.path;
+  return e.append ? `${bare}:append` : bare;
+}
+
+/** Parses brief `text` read from `file`; the shape `readBrief` returns. */
+function parseBrief(file, text) {
   const header = {};
+  const unaffected = [];
+  let keyList = null;
   for (const line of text.split("\n")) {
     if (/^## /.test(line)) break;
+    const u = /^Unaffected:\s*`?([^`\s]*)`?(\s+-\s*(.*))?/.exec(line.trimEnd());
+    if (u) unaffected.push({ path: u[1] === "" ? "" : path.posix.normalize(u[1]), reason: (u[3] ?? "").trim() });
+    // The hyphen keeps `Key-list:` out of the generic header pattern, so it is read on its own.
+    if (line.startsWith("Key-list:")) keyList = changedTerms(line.slice("Key-list:".length));
     const m = /^([A-Z][\w ]*):\s*(.+)$/.exec(line);
     if (m) header[m[1]] = m[2].trim();
+    // A bare `Split:` or `Route:` must still reach its check, which refuses an empty value; a
+    // valued `Route:` line elsewhere in the header wins over a bare one.
+    else if (/^Split:\s*$/.test(line)) header.Split = "";
+    else if (/^Route:[ \t]*\r?$/.test(line)) header.Route ??= "";
   }
-  const scope = [];
+  const entries = [];
   for (const line of readSection(text, "Write scope")) {
     const item = /^\s*-\s+`?([^`\s]+)`?\s*$/.exec(line);
-    if (item) scope.push(path.posix.normalize(item[1]));
+    if (item) entries.push(parseEntry(item[1]));
   }
+  const scope = entries.map((e) => e.path);
+  const reads = (header.Read ?? "")
+    .split(",")
+    .map((s) => s.trim().replace(/^`(.*)`$/, "$1").trim())
+    .filter((s) => s !== "")
+    .map(parseEntry);
   const digest = readSection(text, "Why and rulings");
   const digestIds = [];
   for (const line of digest) {
@@ -112,7 +275,174 @@ export function readBrief(file) {
     if (m) digestIds.push(m[1]);
   }
   const ceiling = header.Ceiling === undefined ? null : CEILING_RE.test(header.Ceiling) ? Number(header.Ceiling) : NaN;
-  return { file, header, scope, digest, digestIds, ceiling };
+  const runRules = readSection(text, "Run rules");
+  const projectRules = readSection(text, "Project rules");
+  const { probes, probeErrors } = parseProbes(readSection(text, "Acceptance probes"));
+  const none = /^none(?:\s+-\s*(.*))?$/i.exec(header.Changes ?? "");
+  const changesNone = none && (none[1] ?? "").trim() !== "" ? none[1].trim() : null;
+  const terms = none ? [] : changedTerms(header.Changes ?? "");
+  const changes = terms.length > 0 ? [...new Set(terms)] : null;
+  const verify = readSection(text, "Verify");
+  keyList = keyList && keyList.length > 0 ? keyList : null;
+  return { file, header, scope, entries, reads, digest, digestIds, ceiling, runRules, projectRules, probes, probeErrors, changes, changesNone, keyList, unaffected, verify, placeholders: placeholderNames(text) };
+}
+
+/** Each header or section of `text` still holding a placeholder, once, in document order. */
+function placeholderNames(text) {
+  const names = new Set();
+  let section = null;
+  for (const line of text.split("\n")) {
+    if (line.startsWith("## ")) section = line.slice(3).trim();
+    if (!PLACEHOLDER_RE.test(line)) continue;
+    if (section !== null) names.add(section);
+    else if (line.startsWith("# ")) names.add("title");
+    else names.add(/^([A-Z][\w ]*):/.exec(line)?.[1] ?? "header");
+  }
+  return [...names];
+}
+
+/** The terms of a `Changes:` value: comma-separated, but a comma inside backticks belongs to its
+ * term, since a number like `3,000,000` is one term; one wrapping pair of backticks is dropped,
+ * and an unclosed one runs to the end of the line. One pass, as the value is untrusted. */
+function changedTerms(value) {
+  const terms = new Set();
+  const add = (s, unclosed) => {
+    let t = s.trim();
+    if (t.length >= 2 && t[0] === "`" && t[t.length - 1] === "`") t = t.slice(1, -1).trim();
+    else if (unclosed && t[0] === "`") t = t.slice(1).trim();
+    if (t !== "") terms.add(t);
+  };
+  if (!value.includes("`")) {
+    for (const s of value.split(",")) add(s, false);
+    return [...terms];
+  }
+  let start = 0;
+  let open = false;
+  for (let i = 0; i < value.length; i++) {
+    if (value[i] === "`") open = !open;
+    else if (value[i] === "," && !open) {
+      add(value.slice(start, i), false);
+      start = i + 1;
+    }
+  }
+  add(value.slice(start), open);
+  return [...terms];
+}
+
+/** Splits the `## Acceptance probes` lines into `probes` and `probeErrors`, the section's
+ * problems without the brief name: missing, over the bound, a line off the form, a repeated id. */
+function parseProbes(lines) {
+  const probes = [];
+  const probeErrors = [];
+  if (lines.length === 0) probeErrors.push("'## Acceptance probes' section missing");
+  if (lines.length > PROBE_BOUND) probeErrors.push(`'## Acceptance probes' has ${lines.length} probe lines, bound is ${PROBE_BOUND}`);
+  const ids = new Set();
+  for (const line of lines) {
+    const m = PROBE_RE.exec(line);
+    if (!m || m[2].trim() === "" || m[3].trim() === "") {
+      probeErrors.push(`probe line not in ${PROBE_FORM} form: ${line}`);
+      continue;
+    }
+    if (ids.has(m[1])) probeErrors.push(`duplicate probe id ${m[1]}`);
+    ids.add(m[1]);
+    probes.push({ id: m[1], check: m[2], expected: m[3] });
+  }
+  return { probes, probeErrors };
+}
+
+/** Probe problems of one brief: the section's own, then, for a security or complex class, a
+ * missing allow-side probe, judged only once the section exists. */
+function probeRuleErrors(name, b) {
+  const errors = (b.probeErrors ?? []).map((e) => `${name}: ${e}`);
+  const probes = b.probes ?? [];
+  const cls = b.header.Class ? b.header.Class.toLowerCase() : null;
+  if (probes.length === 0 || cls === null || !HIGH_EFFORT_CLASSES.has(cls)) return errors;
+  if (!probes.some((p) => ALLOW_SIDE_RE.test(p.expected))) {
+    errors.push(`${name}: Class ${cls} needs an allow-side probe (expected outcome an allow or a pass)`);
+  }
+  return errors;
+}
+
+/** `probe-missing <id>` for every brief probe no `evidence` line cites; the id must stand as a
+ * whole word, so `P20` never cites `P2`. */
+function missingProbes(h, probes) {
+  const evidence = Array.isArray(h && h.evidence) ? h.evidence.filter((e) => typeof e === "string") : [];
+  return probes.filter((p) => !evidence.some((e) => new RegExp(`\\b${p.id}\\b`).test(e))).map((p) => `probe-missing ${p.id}`);
+}
+
+/** Code points, so the source holds no raw separator. */
+const LINE_TERMINATOR_RE = new RegExp(`[${[0x0a, 0x0d, 0x2028, 0x2029].map((c) => String.fromCharCode(c)).join("")}]`);
+
+/** `/^### (.+?)\s*$/` without backtracking: the lazy group is quadratic on a long run of spaces. */
+function headingName(line) {
+  if (!line.startsWith("### ") || line.length === 4) return null;
+  const rest = line.slice(4);
+  const name = rest.trimEnd();
+  if (name === "") return LINE_TERMINATOR_RE.test(rest[0]) ? null : rest[0];
+  return LINE_TERMINATOR_RE.test(name) ? null : name;
+}
+
+/**
+ * Extracts and checks a report's checkpoint. Pure, so the SDD context hook can mirror it and a
+ * parity test can pin both. The last `## Checkpoint` line wins, since the section closes the
+ * report; the section runs to the next `## ` line or the end, trailing whitespace trimmed.
+ * @param {string} text Report text.
+ * @returns {{ text: string | null, errors: string[], size: number }} The section (null when
+ *   absent), its `checkpoint-missing <subsection>` / `checkpoint-oversized <n>` problems, and its
+ *   size in code points, so an astral character counts once.
+ */
+export function checkpointOf(text) {
+  const lines = String(text).split("\n");
+  let start = -1;
+  lines.forEach((l, i) => {
+    if (/^## Checkpoint\s*$/.test(l)) start = i;
+  });
+  if (start === -1) return { text: null, errors: ["checkpoint-missing section"], size: 0 };
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (lines[i].startsWith("## ")) {
+      end = i;
+      break;
+    }
+  }
+  const body = lines.slice(start, end).join("\n").trimEnd();
+  const size = [...body].length;
+  // Each `### ` heading with whether a non-blank line follows it before the next heading.
+  const headings = [];
+  for (const line of body.split("\n").slice(1)) {
+    const name = headingName(line);
+    if (name !== null) headings.push({ name, filled: false });
+    else if (headings.length > 0 && line.trim() !== "") headings[headings.length - 1].filled = true;
+  }
+  // Known headings are accepted while their order rises; the first one out of order (or
+  // repeated) ends acceptance, so it and every subsection after it count as missing.
+  const accepted = new Map();
+  let last = -1;
+  for (const h of headings) {
+    const rank = CHECKPOINT_SECTIONS.indexOf(h.name);
+    if (rank === -1) continue;
+    if (rank <= last) break;
+    accepted.set(h.name, h.filled);
+    last = rank;
+  }
+  const errors = CHECKPOINT_SECTIONS.filter((n) => accepted.get(n) !== true).map((n) => `checkpoint-missing ${n}`);
+  if (size > CHECKPOINT_BOUND) errors.push(`checkpoint-oversized ${size}`);
+  return { text: body, errors, size };
+}
+
+/** `REQUIRED_RUN_RULES` keys absent from a brief's `## Run rules` section, sorted; every key
+ * when the section is missing. */
+function missingRunRules(runRules) {
+  const text = (runRules ?? []).join(" ");
+  const lower = text.toLowerCase();
+  const satisfied = (r) => {
+    if (r.pattern) return r.pattern.test(text);
+    if (r.phrases) return r.phrases.every((p) => lower.includes(p));
+    return lower.includes(r.phrase);
+  };
+  return REQUIRED_RUN_RULES.filter((r) => !satisfied(r))
+    .map((r) => r.key)
+    .sort();
 }
 
 /** Parses a ledger, one JSON object per line, into `{ lines, warnings }`; an unusable field is
@@ -170,21 +500,27 @@ function groupByDispatch(lines) {
   return perDispatch;
 }
 
+/** The lower middle of `values`, 0 when empty: the median of an even count would be an average
+ * no dispatch ever cost, so the reserve stays an observed dispatch. */
+function medianReserve(values) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  return sorted[Math.floor((sorted.length - 1) / 2)];
+}
+
 /**
  * Sums a task's `cache_read` spend against `ceiling`: total, reserve, dispatch count,
- * remaining and `over`. A dispatch is one distinct `agent_id`; the reserve (the task's
- * largest dispatch value) covers the next dispatch still to land, so the task is over once
- * total plus reserve reaches the ceiling.
+ * remaining and `over`. A dispatch is one distinct `agent_id`; the reserve covers the next
+ * dispatch still to land, sized as a typical one (the median), since the largest dispatch would
+ * reserve a second copy of one outlier; the task is over once total plus reserve reaches the
+ * ceiling.
  */
 export function budget(lines, task, ceiling) {
   const taskLines = lines.filter((l) => l && l.task === task);
   const perDispatch = groupByDispatch(taskLines);
   let total = 0;
-  let reserve = 0;
-  for (const v of perDispatch.values()) {
-    total += v;
-    if (v > reserve) reserve = v;
-  }
+  for (const v of perDispatch.values()) total += v;
+  const reserve = medianReserve([...perDispatch.values()]);
   const over = total + reserve >= ceiling;
   const remaining = Math.max(0, ceiling - total - reserve);
   return { total, reserve, dispatches: perDispatch.size, remaining, over };
@@ -232,13 +568,14 @@ function countWhyDigestP0(file) {
 }
 
 /** p50/p75/p90 (nearest-rank) of a task-id-keyed map of total-plus-reserve values, plus the
- * ids at or over `DEFAULT_CEILING`. */
-function percentileSummary(totalPlusReserve) {
+ * ids at or over their own entry in `ceilings`, since one shared limit would flag every
+ * security task that is still inside its class. */
+function percentileSummary(totalPlusReserve, ceilings) {
   const entries = Object.entries(totalPlusReserve);
   const sorted = entries.map(([, v]) => v).sort((a, b) => a - b);
   const rank = (p) => (sorted.length === 0 ? 0 : sorted[Math.min(sorted.length, Math.max(1, Math.ceil((p / 100) * sorted.length))) - 1]);
   const atOrOver = entries
-    .filter(([, v]) => v >= DEFAULT_CEILING)
+    .filter(([k, v]) => v >= ceilings[k])
     .map(([k]) => k)
     .sort(compareTaskIds);
   return { p50: rank(50), p75: rank(75), p90: rank(90), atOrOver };
@@ -248,9 +585,16 @@ function percentileSummary(totalPlusReserve) {
  * Groups a change directory's `ledger.jsonl` by task: `impl`, `review`, `fix`, `other`
  * (dispatch counts, one per distinct `agent_id`), `resumed` (the line count), `cache_read`
  * (per dispatch the largest line, summed, as in `budget`), `max_reviewers_per_round`,
- * `why_digest_p0` and `percentiles` (total plus reserve per task), plus `readLedger`'s
- * warnings. A missing ledger yields empty tasks; round 0 covers a missing one; the totals
- * line's `dispatches` counts distinct `agent_id`s across the whole ledger.
+ * `why_digest_p0` and `percentiles` (total plus reserve per task, the reserve as in `budget`, so
+ * the two commands never disagree, judged against the task's class ceiling), plus `readLedger`'s
+ * warnings. The summary reports rather than gates, so a malformed run authorization is one more
+ * warning and the class defaults judge instead. A missing ledger yields empty tasks; round 0
+ * covers a missing round; `dispatches` counts distinct `agent_id`s across the whole ledger.
+ * `handoffs` counts `handoffs.jsonl`, the one append-only record of handoff outcomes (review
+ * packages are overwritten on re-dispatch): `state` absent, read or unreadable, per-task status
+ * and stop counts, change stop totals, `skipped` and `truncated` (bytes cut by the tail read). A
+ * duplicate SubagentStop repeats a line, so a task counts each (`agent_id`, `status`, `stop`)
+ * once; a null `agent_id` cannot be told apart and counts as written.
  */
 export function ledgerSummary(dir) {
   const file = path.join(dir, "ledger.jsonl");
@@ -287,14 +631,37 @@ export function ledgerSummary(dir) {
   }
   const totals = { dispatches: seenAgents.size, cache_read: 0, max_reviewers_per_round: 0, why_digest_p0: 0 };
   const totalPlusReserve = {};
+  const ceilings = {};
+  // The change's briefs are read once, so an unreadable one warns once per run, not per task.
+  let briefs = null;
+  let authWarned = false;
+  const readBriefs = () => {
+    let names = [];
+    try {
+      names = fs.readdirSync(dir).filter((f) => f.endsWith(".brief.md")).sort();
+    } catch {
+      return [];
+    }
+    const found = [];
+    for (const name of names) {
+      const read = readBriefContained(path.join(dir, name));
+      if (read.text === null) console.error(`WARN ${path.join(dir, name)}: brief unreadable (${read.reason})`);
+      else found.push(parseBrief(path.join(dir, name), read.text));
+    }
+    return found;
+  };
   for (const [key, bucket] of Object.entries(tasks)) {
     const perDispatch = groupByDispatch(taskLines.get(key) ?? []);
-    let reserve = 0;
-    for (const v of perDispatch.values()) {
-      bucket.cache_read += v;
-      if (v > reserve) reserve = v;
+    for (const v of perDispatch.values()) bucket.cache_read += v;
+    if (key !== "other") {
+      totalPlusReserve[key] = bucket.cache_read + medianReserve([...perDispatch.values()]);
+      briefs ??= readBriefs();
+      const cls = classOf(dir, key, briefs.filter((b) => b.header.Task && matchesTaskHeader(b.header.Task, key)));
+      const limit = classCeiling(dir, cls);
+      if ("error" in limit && !authWarned) warnings.push(limit.error);
+      authWarned ||= "error" in limit;
+      ceilings[key] = "error" in limit ? CLASS_CEILINGS[cls] : limit.ceiling;
     }
-    if (key !== "other") totalPlusReserve[key] = bucket.cache_read + reserve;
     const rounds = roundCounts.get(key);
     bucket.max_reviewers_per_round = rounds ? Math.max(...rounds.values()) : 0;
     bucket.why_digest_p0 = countWhyDigestP0(path.join(dir, `${key}.review.md`));
@@ -302,7 +669,66 @@ export function ledgerSummary(dir) {
     totals.max_reviewers_per_round = Math.max(totals.max_reviewers_per_round, bucket.max_reviewers_per_round);
     totals.why_digest_p0 += bucket.why_digest_p0;
   }
-  return { tasks, totals, warnings, percentiles: percentileSummary(totalPlusReserve) };
+  const handoffs = { state: "absent", tasks: {}, stops: {}, skipped: 0, truncated: 0 };
+  const handoffFile = path.join(dir, "handoffs.jsonl");
+  let present;
+  let size = 0;
+  try {
+    const st = fs.lstatSync(handoffFile, { throwIfNoEntry: false });
+    present = st !== undefined;
+    size = st?.size ?? 0;
+  } catch {
+    present = true;
+  }
+  const read = present ? readBoundedNoFollow(handoffFile, SCAN_BOUND, true) : null;
+  if (present) handoffs.state = read === null ? "unreadable" : "read";
+  if (read !== null) {
+    const statuses = ["completed", "partial", "blocked", "unreadable"];
+    const valid = (h) =>
+      h !== null &&
+      typeof h === "object" &&
+      !Array.isArray(h) &&
+      typeof h.ts === "string" &&
+      typeof h.task === "string" &&
+      BRIEF_TASK_RE.test(h.task) &&
+      (h.round === null || (Number.isInteger(h.round) && h.round >= 1)) &&
+      (h.agent_id === null || (typeof h.agent_id === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(h.agent_id))) &&
+      statuses.includes(h.status) &&
+      (h.stop === null || STOP_TOKENS.has(h.stop));
+    const raws = read.text.split("\n");
+    // A tail read past the bound starts mid-line: truncation, not a bad line.
+    if (read.cut) {
+      raws.shift();
+      handoffs.truncated = Math.max(1, size - Buffer.byteLength(raws.join("\n")));
+    }
+    const seen = new Set();
+    for (const raw of raws) {
+      if (raw.trim() === "") continue;
+      let h = null;
+      try {
+        h = JSON.parse(raw);
+      } catch {
+        // Counted below with the schema failures.
+      }
+      if (!valid(h)) {
+        handoffs.skipped += 1;
+        continue;
+      }
+      if (h.agent_id !== null) {
+        const key = JSON.stringify([h.task, h.agent_id, h.status, h.stop]);
+        if (seen.has(key)) continue;
+        seen.add(key);
+      }
+      handoffs.tasks[h.task] ??= { completed: 0, partial: 0, blocked: 0, unreadable: 0, stops: {} };
+      const t = handoffs.tasks[h.task];
+      t[h.status] += 1;
+      if (h.stop !== null) {
+        t.stops[h.stop] = (t.stops[h.stop] ?? 0) + 1;
+        handoffs.stops[h.stop] = (handoffs.stops[h.stop] ?? 0) + 1;
+      }
+    }
+  }
+  return { tasks, totals, warnings, percentiles: percentileSummary(totalPlusReserve, ceilings), handoffs };
 }
 
 /** Git from an absolute PATH entry only; a relative one cannot supply it. */
@@ -320,22 +746,54 @@ function resolveGit() {
   return null;
 }
 
-/** Runs one git command in `cwd`, throwing with its stderr on a bad exit. */
-function runGit(args, cwd) {
+/** Runs one git command in `cwd`, throwing with `status` and `stderr` on an exit outside
+ * `okExits`; `-c` keeps a foreign repo's fsmonitor off, and `--no-optional-locks` keeps a read
+ * from rewriting an index a peer may be using. Unless `hooks` is set, `core.hooksPath=/dev/null`
+ * keeps the repository's hooks (post-index-change on an index refresh) from running; only the
+ * `commit` subcommand's add and commit set it, so they run as on any lead commit. */
+function runGit(args, cwd, { okExits = [0], maxBuffer, hooks = false, input } = {}) {
   const bin = resolveGit();
   if (!bin) throw new Error(`git ${args.join(" ")}: git not found on an absolute PATH entry`);
-  const r = spawnSync(bin, args, { cwd, encoding: "utf8" });
-  if (r.status !== 0) throw new Error(`git ${args.join(" ")}: ${(r.stderr || (r.error && r.error.message) || "").trim()}`);
+  const r = spawnSync(bin, ["-c", "core.fsmonitor=false", "-c", "core.untrackedCache=false", "--no-optional-locks", ...(hooks ? [] : ["-c", "core.hooksPath=/dev/null"]), ...args], { cwd, encoding: "utf8", ...(maxBuffer ? { maxBuffer } : {}), ...(input !== undefined ? { input } : {}) });
+  if (!okExits.includes(r.status)) {
+    const err = new Error(`git ${args.join(" ")}: ${(r.stderr || (r.error && r.error.message) || "").trim()}`);
+    err.status = r.status;
+    err.stderr = r.stderr || "";
+    throw err;
+  }
   return r.stdout || "";
 }
 
+/** Any C0 control (tab and line feed too), DEL or C1 control: each can drive a terminal or start
+ * a forged output line. */
+const CONTROL_RE = /[\u0000-\u001f\u007f-\u009f]/;
+const CONTROL_RE_ALL = /[\u0000-\u001f\u007f-\u009f]/g;
+
+/** `text` with every control character as a lowercase `\uXXXX` escape: the one renderer for
+ * untrusted text in an output line, so no printer escapes a narrower set than another. */
+function escapeControls(text) {
+  return text.replace(CONTROL_RE_ALL, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+
+/** `text` JSON-quoted when it holds a control character, so a name from the tree cannot forge an
+ * output line; as is otherwise. JSON keeps its short C0 forms (`\n`) that the other subcommands
+ * print, and the helper takes the DEL and C1 characters JSON leaves raw. */
+function quoted(text) {
+  return CONTROL_RE.test(text) ? escapeControls(JSON.stringify(text)) : text;
+}
+
+/** `text` JSON-quoted with every control as `\uXXXX` when it holds one, as is otherwise: the
+ * transcript scan's form, one escape style for every character a worker chose. */
+function quotedText(text) {
+  return CONTROL_RE.test(text) ? `"${escapeControls(text.replace(/[\\"]/g, "\\$&"))}"` : text;
+}
+
 /** Runs one git command and returns its trimmed stdout. */
 function git(args, cwd) {
   return runGit(args, cwd).trim();
 }
 
-/** Untracked (`??`) paths of a `git status --porcelain -z` stream; a rename or copy entry's
- * extra NUL field is skipped, not misread as an entry. */
+/** Untracked (`??`) paths of a `git status --porcelain -z` stream; a rename/copy's extra NUL field is skipped. */
 function untrackedPaths(raw) {
   const entries = raw.split("\0");
   if (entries.length && entries[entries.length - 1] === "") entries.pop();
@@ -350,17 +808,216 @@ function untrackedPaths(raw) {
   return out;
 }
 
-/** Repository-relative paths changed since `base` (a bare base diffs against the working tree,
- * so commits and uncommitted edits both land) plus untracked paths; `--` keeps a path-shaped
- * base off the pathspec list. */
+/** Repository-relative paths changed since `base` (working tree diff, so uncommitted edits land too) plus untracked paths; `--` keeps a path-shaped base off the pathspec list.
+ * `--no-renames` keeps every deletion listed. */
 export function changedPaths(base, cwd) {
-  const diff = git(["diff", "--name-only", base, "--"], cwd);
+  const diff = git(["diff", "--name-only", "--no-renames", "--no-ext-diff", "--no-textconv", base, "--"], cwd);
   const status = runGit(["status", "--porcelain", "-z", "--untracked-files=all"], cwd);
   const changed = new Set(diff.split("\n").filter((l) => l !== ""));
   for (const p of untrackedPaths(status)) changed.add(p);
   return [...changed];
 }
 
+/** Paths whose index entry differs from HEAD; any such entry rides into the next task commit. */
+export function stagedPaths(cwd) {
+  const raw = runGit(["diff", "--cached", "--name-only", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", "HEAD", "--"], cwd);
+  return raw.split("\0").filter((p) => p !== "");
+}
+
+/** Whether `base` is an ancestor of HEAD. Exit 128 (unknown object, shallow history) throws the
+ * `base-not-ancestor` failure with git's first stderr line. */
+export function isAncestor(base, cwd) {
+  try {
+    runGit(["merge-base", "--is-ancestor", base, "HEAD"], cwd);
+    return true;
+  } catch (err) {
+    if (err.status === 1) return false;
+    if (err.status !== 128) throw err;
+    const first = String(err.stderr).split("\n").find((l) => l.trim() !== "") ?? "";
+    throw new Error(`base-not-ancestor ${base} ${first.trim()}`.trim());
+  }
+}
+
+/** True when `file` resolves outside the repository or via a symlink. */
+function pathEscapesOrSymlinks(file, cwd) {
+  const abs = path.resolve(cwd, file);
+  const rel = path.relative(cwd, abs);
+  if (rel === "" || rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel)) return true;
+  let current = cwd;
+  for (const part of rel.split(path.sep)) {
+    current = path.join(current, part);
+    let st;
+    try {
+      st = fs.lstatSync(current);
+    } catch {
+      return false;
+    }
+    if (st.isSymbolicLink()) return true;
+  }
+  return false;
+}
+
+/** Bytes from the start of a file searched for a NUL byte, the test that marks it binary. */
+const BINARY_SNIFF_BYTES = 8 * 1024;
+
+/** True when the first 8 KiB of `buf` holds a NUL byte (binary content). */
+function looksBinary(buf) {
+  const len = Math.min(buf.length, BINARY_SNIFF_BYTES);
+  for (let i = 0; i < len; i++) if (buf[i] === 0x00) return true;
+  return false;
+}
+
+/** True when `line` holds a C0 control byte (not tab/LF/CR) or DEL. */
+function hasControlByte(line) {
+  for (let i = 0; i < line.length; i++) {
+    const c = line.charCodeAt(i);
+    if (c <= 0x08 || c === 0x0b || c === 0x0c || (c >= 0x0e && c <= 0x1f) || c === 0x7f) return true;
+  }
+  return false;
+}
+
+/** True when `line` opens a comment: blank, or `//`, `#`, `/*`, `*`. */
+function isHeaderCommentLine(line) {
+  const t = line.trim();
+  return t === "" || t.startsWith("//") || t.startsWith("#") || t.startsWith("/*") || t.startsWith("*");
+}
+
+/** 1-based end of `lines`' leading comment block; 0 when there is none. */
+function headerBlockEnd(lines) {
+  let end = 0;
+  let sawComment = false;
+  for (let i = 0; i < lines.length; i++) {
+    if (!isHeaderCommentLine(lines[i])) break;
+    end = i + 1;
+    if (lines[i].trim() !== "") sawComment = true;
+  }
+  return sawComment ? end : 0;
+}
+
+/** Matches a `test`/`it`/`describe` call opening on a string literal (2nd capture). */
+const TEST_TITLE_OPEN_RE = /\b(?:test|it|describe)\(\s*(["'`])((?:\\.|(?!\1)[^\\])*)\1/;
+
+/** True when `text` mentions task `<n>` not continued by a digit, a letter, or `.` plus a digit,
+ * so a sentence-ending `task 1.1.` leaks while `task 1.10` and `task 1.1.2` do not. */
+function hasTaskMention(text, n) {
+  const lower = text.toLowerCase();
+  const needle = `task ${n}`.toLowerCase();
+  let from = 0;
+  for (;;) {
+    const idx = lower.indexOf(needle, from);
+    if (idx === -1) return false;
+    const end = idx + needle.length;
+    const after = text[end];
+    const continues = after !== undefined && (/[0-9a-zA-Z]/.test(after) || (after === "." && /[0-9]/.test(text[end + 1] ?? "")));
+    if (!continues) return true;
+    from = idx + 1;
+  }
+}
+
+/** True when `content` leaks a task number or the change id (test title or header comment). */
+function isLeak(content, lineNumber, headerEnd, taskNumbers, changeId) {
+  const titleMatch = TEST_TITLE_OPEN_RE.exec(content);
+  if (titleMatch) {
+    const literal = titleMatch[2];
+    for (const n of taskNumbers) {
+      if (hasTaskMention(literal, n)) return true;
+      if (literal.startsWith(`${n}:`) || literal.startsWith(`${n} `)) return true;
+    }
+    if (changeId && literal.includes(changeId)) return true;
+  }
+  if (headerEnd > 0 && lineNumber <= headerEnd) {
+    for (const n of taskNumbers) if (hasTaskMention(content, n)) return true;
+    if (changeId && content.includes(changeId)) return true;
+  }
+  return false;
+}
+
+/** New-file line numbers a `-U0` diff marks added; `+++`/`---` are headers only before the
+ * first `@@`, so a later added line starting the same way (`++i;` diffed as `+++i;`) counts. */
+function parseAddedFromDiff(diffText) {
+  const numbers = [];
+  let newLine = 0;
+  let sawHunk = false;
+  for (const line of diffText.split("\n")) {
+    const hunk = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      newLine = Number(hunk[1]);
+      sawHunk = true;
+      continue;
+    }
+    if (!sawHunk && (line.startsWith("+++") || line.startsWith("---"))) continue;
+    if (line.startsWith("+")) {
+      numbers.push(newLine);
+      newLine++;
+    }
+  }
+  return numbers;
+}
+
+/** One file's added `{ lineNumber, content }` pairs since `base`. `--literal-pathspecs` keeps a
+ * hostile path from acting as a pathspec prefix; the `--no-*` flags keep `@@` markers plain
+ * regardless of git config. */
+function addedLineEntries(base, file, lines, cwd) {
+  const tracked = git(["--literal-pathspecs", "ls-files", "--", file], cwd) !== "";
+  if (!tracked) return lines.map((content, i) => ({ lineNumber: i + 1, content }));
+  const diffText = git(
+    ["--literal-pathspecs", "diff", "--no-color", "--no-ext-diff", "--no-textconv", "-U0", "--find-renames", base, "--", file],
+    cwd,
+  );
+  return parseAddedFromDiff(diffText).map((lineNumber) => ({ lineNumber, content: lines[lineNumber - 1] ?? "" }));
+}
+
+/** `leak`/`control-byte` findings since `base`; `needles` (or null) drives the leak scan. */
+export function scanAddedLines(base, files, needles, cwd) {
+  const findings = [];
+  for (const file of files) {
+    if (typeof file !== "string" || file === "" || pathEscapesOrSymlinks(file, cwd)) continue;
+    const abs = path.resolve(cwd, file);
+    let raw;
+    let fd;
+    try {
+      fd = fs.openSync(abs, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+    } catch {
+      continue;
+    }
+    let isRegularFile;
+    try {
+      isRegularFile = fs.fstatSync(fd).isFile();
+    } catch {
+      isRegularFile = false;
+    }
+    if (!isRegularFile) {
+      fs.closeSync(fd);
+      continue;
+    }
+    try {
+      raw = fs.readFileSync(fd);
+    } catch {
+      continue;
+    } finally {
+      fs.closeSync(fd);
+    }
+    if (looksBinary(raw)) continue;
+    const text = raw.toString("utf8");
+    const lines = text.endsWith("\n") ? text.slice(0, -1).split("\n") : text.split("\n");
+    const headerEnd = needles ? headerBlockEnd(lines) : 0;
+    for (const { lineNumber, content } of addedLineEntries(base, file, lines, cwd)) {
+      if (hasControlByte(content)) findings.push(`control-byte ${file}:${lineNumber}`);
+      if (needles && isLeak(content, lineNumber, headerEnd, needles.taskNumbers ?? [], needles.changeId ?? null)) {
+        findings.push(`leak ${file}:${lineNumber}`);
+      }
+    }
+  }
+  return findings;
+}
+
+/** `scanAddedLines`' needles: a brief's `Task:` numbers, `Change:` id. */
+function needlesFromBrief(b) {
+  const taskNumbers = (b.header.Task ?? "").match(/\d+(?:\.\d+)*/g) ?? [];
+  const changeId = b.header.Change ?? null;
+  return { taskNumbers, changeId };
+}
+
 /** Matches a write-scope or lead entry against a repository-relative path (trailing-`/` prefix,
  * `*`/`**`/`?` glob, or exact). Every other regex character of an entry is a literal, so a glob
  * never widens the scope it was written for. */
@@ -392,134 +1049,919 @@ export function guardHandoff(h, changed, scope, peerScope = [], leadPaths = [])
   const claimed = Array.isArray(h && h.files_changed) ? h.files_changed.filter((p) => typeof p === "string") : [];
   const changedSet = new Set(changed);
   const claimedSet = new Set(claimed);
-  const peer = new Set(peerScope);
+  const underPeer = (p) => peerScope.some((s) => scopeMatches(s, p));
   const underLead = (p) => leadPaths.some((l) => scopeMatches(l, p));
-  const owned = changed.filter((p) => !peer.has(p) && !underLead(p) && !isHarnessPath(p));
+  const owned = changed.filter((p) => !underPeer(p) && !underLead(p) && !isHarnessPath(p));
   for (const p of claimed) if (!changedSet.has(p)) errors.push(`claimed-unchanged ${p}`);
-  for (const p of claimed) if (peer.has(p)) errors.push(`peer-scope ${p}`);
+  for (const p of claimed) if (underPeer(p)) errors.push(`peer-scope ${p}`);
   for (const p of claimed) if (underLead(p)) errors.push(`lead-path ${p}`);
   for (const p of owned) if (!claimedSet.has(p)) errors.push(`changed-unclaimed ${p}`);
   if (scope) {
     const inScope = (p) => scope.some((s) => scopeMatches(s, p));
     const outside = new Set();
     for (const p of owned) if (!inScope(p)) outside.add(p);
-    for (const p of claimed) if (!inScope(p) && !peer.has(p) && !underLead(p) && !isHarnessPath(p)) outside.add(p);
+    for (const p of claimed) if (!inScope(p) && !underPeer(p) && !underLead(p) && !isHarnessPath(p)) outside.add(p);
     for (const p of outside) errors.push(`scope ${p}`);
   }
   return errors;
 }
 
-/** Problems of a batch: each brief's header and digest, plus scope overlap. */
-export function validateBriefs(briefs) {
-  const errors = [];
-  const digestOwner = new Map();
-  for (const b of briefs) {
-    const name = path.basename(b.file);
-    for (const key of ["Change", "Task", "Spec", "Tier"]) if (!b.header[key]) errors.push(`${name}: header line '${key}:' missing`);
-    if (b.header.Tier && !TIERS.has(b.header.Tier)) errors.push(`${name}: Tier must be strong|standard|fast; got ${b.header.Tier}`);
-    if (b.header.Spec && (/[\\/]|\.md$/.test(b.header.Spec))) errors.push(`${name}: Spec must be the change id, not a path (${b.header.Spec})`);
-    if (b.header.Spec && b.header.Change && b.header.Spec !== b.header.Change) errors.push(`${name}: Spec (${b.header.Spec}) differs from Change (${b.header.Change})`);
-    if (b.scope.length === 0) errors.push(`${name}: '## Write scope' must list at least one path`);
-    if (b.header.Ceiling !== undefined && !CEILING_RE.test(b.header.Ceiling)) {
-      errors.push(`${name}: Ceiling must be a positive integer; got ${b.header.Ceiling}`);
-    }
+/** Source extensions the comment share is measured for, with the lexer each takes. */
+const SHARE_LANGS = new Map([[".js", "js"], [".mjs", "js"], [".cjs", "js"], [".ts", "js"], [".tsx", "js"], [".mts", "js"], [".py", "py"]]);
+/** Bytes past which a worker-written file is skipped rather than scanned. */
+const SHARE_MAX_BYTES = 4 * 1024 * 1024;
+/** Punctuators after which a `/` cannot be division, so it opens a regular expression. */
+const REGEX_AFTER = new Set("(,=:[!&|?{};+-*%<>~^");
+/** Keywords after which a `/` opens a regular expression. */
+const REGEX_KEYWORDS = new Set(["return", "typeof", "case", "do", "else", "in", "instanceof", "new", "delete", "void", "throw", "yield", "await", "of"]);
+const PY_PREFIX_RE = /^[rbfu]{1,2}$/i;
 
-    if (b.digest.length === 0) errors.push(`${name}: '## Why and rulings' section missing`);
-    if (b.digest.length > DIGEST_BUDGET) errors.push(`${name}: '## Why and rulings' has ${b.digest.length} lines, budget is ${DIGEST_BUDGET}`);
-    if (b.digest.some((l) => l.startsWith("```"))) errors.push(`${name}: '## Why and rulings' must not contain a fenced block`);
+function isIdentChar(c) {
+  return (c >= 97 && c <= 122) || (c >= 65 && c <= 90) || (c >= 48 && c <= 57) || c === 95 || c === 36 || c > 127;
+}
 
-    const seen = new Set();
-    for (const line of b.digest) {
-      const m = DIGEST_ID.exec(line);
-      if (!m) continue;
-      const [, id, ruling] = m;
-      if (seen.has(id)) {
-        errors.push(`${name}: duplicate id ${id} inside the brief`);
-        continue;
+function isSpace(c) {
+  return c === 32 || c === 9 || c === 10 || c === 13 || c === 11 || c === 12;
+}
+
+/** End index of the quoted literal opening at `i` (`q` long, quote char `ch`), past `n` when
+ * unterminated; a backslash always skips the next character. With `eol`, an unescaped line
+ * terminator ends it, as in JavaScript. */
+function literalEnd(text, i, ch, q, eol = false) {
+  const n = text.length;
+  let k = i + q;
+  while (k < n) {
+    const c = text[k];
+    if (c === "\\") k += text[k + 1] === "\r" && text[k + 2] === "\n" ? 3 : 2;
+    else if (c === ch && (q === 1 || (text[k + 1] === ch && text[k + 2] === ch))) return k + q;
+    else if (eol && (c === "\n" || c === "\r")) return k;
+    else k++;
+  }
+  return n;
+}
+
+/** First line terminator at or after `k`, or the text length. */
+function lineEnd(text, k) {
+  while (k < text.length && text[k] !== "\n" && text[k] !== "\r") k++;
+  return k;
+}
+
+function jsCommentChars(text) {
+  const n = text.length;
+  let comment = 0;
+  let regexOk = true;
+  // Brace depth of each open template `${`; the template resumes when its own `}` closes.
+  const holes = [];
+  let i = 0;
+  while (i < n) {
+    const ch = text[i];
+    const c = text.charCodeAt(i);
+    if (isSpace(c)) i++;
+    else if (isIdentChar(c)) {
+      let k = i + 1;
+      while (k < n && isIdentChar(text.charCodeAt(k))) k++;
+      regexOk = REGEX_KEYWORDS.has(text.slice(i, k));
+      i = k;
+    } else if (ch === "/" && text[i + 1] === "/") {
+      const k = lineEnd(text, i);
+      comment += k - i;
+      i = k;
+    } else if (ch === "/" && text[i + 1] === "*") {
+      const close = text.indexOf("*/", i + 2);
+      const k = close < 0 ? n : close + 2;
+      comment += k - i;
+      i = k;
+    } else if (ch === "/" && regexOk) {
+      let k = i + 1;
+      let inClass = false;
+      while (k < n && text[k] !== "\n" && text[k] !== "\r") {
+        const r = text[k];
+        if (r === "\\") k++;
+        else if (r === "[") inClass = true;
+        else if (r === "]") inClass = false;
+        else if (r === "/" && !inClass) break;
+        k++;
       }
-      seen.add(id);
-      const prev = digestOwner.get(id);
-      if (!prev) digestOwner.set(id, { text: ruling, file: b.file });
-      else if (prev.text !== ruling) {
-        errors.push(`${name}: duplicate id ${id} differs from its text in ${path.basename(prev.file)}`);
+      i = k + 1;
+      regexOk = false;
+    } else if (ch === "'" || ch === '"') {
+      i = literalEnd(text, i, ch, 1, true);
+      regexOk = false;
+    } else if (ch === "`" || (ch === "}" && holes.length > 0 && holes[holes.length - 1] === 0)) {
+      if (ch === "}") holes.pop();
+      let k = i + 1;
+      while (k < n && text[k] !== "`" && !(text[k] === "$" && text[k + 1] === "{")) k += text[k] === "\\" ? 2 : 1;
+      if (k < n && text[k] === "$") {
+        holes.push(0);
+        regexOk = true;
+        i = k + 2;
+      } else {
+        regexOk = false;
+        i = k + 1;
       }
+    } else {
+      if (holes.length > 0 && ch === "{") holes[holes.length - 1]++;
+      else if (holes.length > 0 && ch === "}") holes[holes.length - 1]--;
+      regexOk = ch === "/" || REGEX_AFTER.has(ch);
+      i++;
     }
   }
-  const owner = new Map();
-  for (const b of briefs) {
-    for (const p of b.scope) {
-      const prev = owner.get(p);
-      if (prev && prev !== b.file) errors.push(`write scope overlap: ${p} in ${path.basename(prev)} and ${path.basename(b.file)}; batch refused`);
-      else owner.set(p, b.file);
+  return comment;
+}
+
+function pyCommentChars(text) {
+  const n = text.length;
+  let comment = 0;
+  let depth = 0;
+  // Whether the current logical line already holds a token, so a string here is no docstring.
+  let lineHasCode = false;
+  // The line terminator a code backslash joins to the next line (a comment's backslash joins none).
+  let joinAt = -1;
+  let i = 0;
+  while (i < n) {
+    const ch = text[i];
+    const c = text.charCodeAt(i);
+    const start = i;
+    let quote = ch === "'" || ch === '"' ? i : -1;
+    if (isIdentChar(c)) {
+      let k = i + 1;
+      while (k < n && isIdentChar(text.charCodeAt(k))) k++;
+      if (k - i <= 2 && (text[k] === "'" || text[k] === '"') && PY_PREFIX_RE.test(text.slice(i, k))) quote = k;
+      else {
+        lineHasCode = true;
+        i = k;
+        continue;
+      }
+    }
+    if (quote >= 0) {
+      const q = text[quote];
+      const end = literalEnd(text, quote, q, text[quote + 1] === q && text[quote + 2] === q ? 3 : 1);
+      if (!lineHasCode) {
+        let k = end;
+        while (k < n && (text[k] === " " || text[k] === "\t" || text[k] === "\f")) k++;
+        if (k >= n || text[k] === "\n" || text[k] === "\r" || text[k] === "#") comment += end - start;
+      }
+      lineHasCode = true;
+      i = end;
+    } else if (ch === "#") {
+      const k = lineEnd(text, i);
+      comment += k - i;
+      i = k;
+    } else if (ch === "\n" || ch === "\r") {
+      if (depth === 0 && joinAt !== (ch === "\n" && text[i - 1] === "\r" ? i - 1 : i)) lineHasCode = false;
+      i++;
+    } else {
+      if (ch === "\\") joinAt = i + 1;
+      else if (ch === "(" || ch === "[" || ch === "{") depth++;
+      else if ((ch === ")" || ch === "]" || ch === "}") && depth > 0) depth--;
+      if (!isSpace(c)) lineHasCode = true;
+      i++;
     }
   }
-  return errors;
+  return comment;
 }
 
-/** Every complete fenced json block; an unterminated fence never matches. */
-const JSON_BLOCK_RE = /```json\s*\n([\s\S]*?)\n```/g;
+/** Comment and docstring characters of `text` (`lang` `js` or `py`) and its length: the share
+ * the global rules budget, by characters rather than lines. One forward pass with no
+ * backtracking regex, since the text is worker-written; an unterminated comment or string runs
+ * to the end. */
+export function commentShare(text, lang) {
+  return { comment: lang === "py" ? pyCommentChars(text) : jsCommentChars(text), total: text.length };
+}
 
-/** Assistant-authored texts of one line's `message.content`: `text` blocks joined, plus a
- * `SendMessage` tool_use's `input.message` (the worker's reply channel in the teams runtime);
- * no other tool input. */
-function assistantCandidates(content) {
-  if (typeof content === "string") return content === "" ? [] : [content];
-  if (!Array.isArray(content)) return [];
-  const out = [];
-  let buf = [];
-  const flushText = () => {
-    if (buf.length > 0) out.push(buf.join(""));
-    buf = [];
-  };
-  for (const b of content) {
-    if (b && typeof b === "object" && b.type === "text" && typeof b.text === "string") {
-      buf.push(b.text);
+/** `comment-share` failures and notes for `paths` edited since `base`: FAIL above 30% unless
+ * the file was already above it at the base and did not grow, NOTE above 25%. */
+function commentShareChecks(base, paths, cwd) {
+  const errors = [];
+  const notes = [];
+  const above = (s, pct) => s.comment * 100 > s.total * pct;
+  for (const p of paths) {
+    const lang = SHARE_LANGS.get(path.posix.extname(p).toLowerCase());
+    if (!lang || pathEscapesOrSymlinks(p, cwd)) continue;
+    const read = readBoundedNoFollow(path.join(cwd, p), SHARE_MAX_BYTES, false);
+    if (read === null) continue;
+    if (read.cut || read.text.includes("\0")) {
+      notes.push(`comment-share-skipped ${quoted(p)}`);
       continue;
     }
-    flushText();
-    if (b && typeof b === "object" && b.type === "tool_use" && b.name === "SendMessage" && b.input && typeof b.input.message === "string") {
-      out.push(b.input.message);
+    let old = "";
+    try {
+      old = runGit(["cat-file", "blob", `${base}:${p}`], cwd, { maxBuffer: ROUND_DIFF_MAX_BUFFER });
+    } catch (err) {
+      if (err.status !== 128) throw err;
     }
+    const head = commentShare(read.text, lang);
+    const was = commentShare(old, lang);
+    const pct = `${((head.comment / (head.total || 1)) * 100).toFixed(1)}%`;
+    if (above(head, 30) && (!above(was, 30) || head.comment * was.total > was.comment * head.total)) errors.push(`comment-share ${quoted(p)} ${pct} over 30`);
+    else if (above(head, 25)) notes.push(`comment-share ${quoted(p)} ${pct}`);
   }
-  flushText();
-  return out;
+  return { errors, notes };
 }
 
-/** The last complete json block of a text plus the text after it; null if none. */
-function lastJsonBlock(text) {
-  JSON_BLOCK_RE.lastIndex = 0;
-  let match;
-  let last = null;
-  while ((match = JSON_BLOCK_RE.exec(text)) !== null) last = match;
-  if (!last) return null;
-  return { block: last[1], remaining: text.slice(last.index + last[0].length) };
+/** Class, tier and effort routing problems of one brief. A security or complex class skips the
+ * standard and fast class rules, since its own rule already names the cause; the Effort and
+ * Route placement rules still report. A standard `code` brief with a missing or malformed route
+ * reports that alone, since the criteria it claims are moot without it. */
+function routingErrors(name, b) {
+  const errors = [];
+  const header = b.header;
+  const tier = header.Tier;
+  const cls = header.Class ? header.Class.toLowerCase() : null;
+  const effort = header.Effort ?? "medium";
+  const standardCode = tier === "standard" && cls === "code";
+  if (!EFFORTS.has(effort)) errors.push(`${name}: Effort must be medium|high; got ${effort}`);
+  else if (effort === "high" && tier !== "strong") errors.push(`${name}: Effort high runs on Tier strong only`);
+  if (header.Route !== undefined && !standardCode) errors.push(`${name}: Route: belongs only to a Tier: standard Class: code brief`);
+  if (cls !== null && HIGH_EFFORT_CLASSES.has(cls)) {
+    if (tier !== "strong" || effort !== "high") errors.push(`${name}: Class ${cls} requires Tier: strong and Effort: high`);
+    return errors;
+  }
+  const got = cls ?? "none";
+  if (tier === "standard" && !STANDARD_CLASSES.has(got)) {
+    errors.push(`${name}: Tier standard allows Class: ${[...STANDARD_CLASSES].join("|")}; got ${got}`);
+  }
+  if (tier === "fast" && !FAST_CLASSES.has(got)) errors.push(`${name}: Tier fast allows Class: ${[...FAST_CLASSES].join("|")}; got ${got}`);
+  if (!standardCode) return errors;
+  const route = ROUTE_RE.exec(header.Route ?? "");
+  if (!route || route[1].trim() === "") {
+    const given = header.Route === undefined ? "" : `; got ${header.Route || "(empty)"}`;
+    errors.push(`${name}: Class code on Tier standard requires Route: C1-C7 - <reason>${given}`);
+    return errors;
+  }
+  const paths = new Set(briefEntries(b).map((e) => e.path));
+  const root = projectRoot(b.file);
+  const files = new Set();
+  const dirOrGlob = new Set();
+  for (const p of paths) {
+    if (isTestEntry(p)) continue;
+    const abs = insideRoot(root, p);
+    // No Split waives this: a directory or glob hides how many files the route touches.
+    if (abs !== null && isDirOrGlob(p, abs)) {
+      errors.push(`${name}: Route C1 refuses directory or glob entry ${p} outside test and fixture directories`);
+      dirOrGlob.add(p);
+    } else files.add(p);
+  }
+  if (files.size > ROUTE_SOURCE_BOUND) {
+    errors.push(`${name}: Route C1 allows at most ${ROUTE_SOURCE_BOUND} write-scope files outside test and fixture directories; got ${files.size}`);
+  }
+  for (const p of paths) {
+    // C1 already refuses a directory or glob entry, and its own path names any risky directory.
+    if (!dirOrGlob.has(p) && riskyPath(p)) errors.push(`${name}: Route C2 refuses ${p} (name holds ${ROUTE_RISKY.join("|")}, or a ${[...ROUTE_RISKY_DIRS].join(" or ")} directory)`);
+    if (ROUTE_MANIFEST_RE.test(path.posix.basename(p).toLowerCase())) errors.push(`${name}: Route C5 refuses manifest or lockfile ${p}`);
+  }
+  if ((b.reads ?? []).length === 0) errors.push(`${name}: Route C3 needs a Read: entry naming the pattern the task follows`);
+  const probes = (b.probes ?? []).length;
+  if (probes < 2) errors.push(`${name}: Route C4 needs at least 2 acceptance probes; got ${probes}`);
+  return errors;
 }
 
-/** The report's next text: its first json block replaced by `fenced`, or, when it has none (`existing` null for a report not yet on disk), the block before `remaining`. */
-function spliceReport(existing, fenced, remaining) {
-  if (existing !== null) {
-    const m = /```json\s*\n[\s\S]*?\n```/.exec(existing);
-    if (m) return existing.slice(0, m.index) + fenced + existing.slice(m.index + m[0].length);
-    return `${fenced}\n\n${existing}`;
-  }
-  const body = remaining.replace(/^\n+/, "").trimEnd();
-  return body === "" ? `${fenced}\n` : `${fenced}\n\n${body}\n`;
+/** Whether `p` is a guard, hook, auth, secret or parser file by name or by directory: one rule,
+ * so the write scope a standard route refuses is the diff a strong reviewer must see. */
+export function riskyPath(p) {
+  const parts = String(p).toLowerCase().split("/");
+  const base = parts[parts.length - 1];
+  return ROUTE_RISKY.some((w) => base.includes(w)) || parts.slice(0, -1).some((s) => ROUTE_RISKY_DIRS.has(s));
 }
 
-/** Identity and schema validity of a report's first json block; null if none. */
-function existingBlockInfo(text) {
-  const m = /```json\s*\n([\s\S]*?)\n```/.exec(text);
-  if (!m) return null;
-  let parsed;
+/** The tier and effort the brief's next dispatch needs: the brief's own, raised by the fix-round
+ * climb and never lowered. A brief without `Tier:` keeps a null tier until the climb sets one. */
+export function routeFor(brief, { round = 1, p0 = false, security = false } = {}) {
+  const header = brief.header;
+  const cls = header.Class ? header.Class.toLowerCase() : null;
+  const raise = security || p0 || round >= 3 || (round >= 2 && header.Tier === "standard" && cls === "code");
+  return { tier: raise ? "strong" : (header.Tier ?? null), effort: security ? "high" : (header.Effort ?? "medium") };
+}
+
+/** The review dispatch's tier by the first S1 to S4 criterion that holds, with the fact that
+ * decided it; `diff` holds `{ path, lines }` per file changed since the base. */
+export function reviewTierFor(brief, diff, { round = 1, p0 = false, finalSpec = false, probed = false } = {}) {
+  const header = brief.header;
+  const cls = header.Class ? header.Class.toLowerCase() : null;
+  const pick = (tier, criterion, reason) => ({ tier, criterion, reason });
+  if (cls !== null && HIGH_EFFORT_CLASSES.has(cls)) return pick("strong", "S1", `class ${cls}`);
+  if (header.Effort === "high") return pick("strong", "S1", "effort high");
+  const risky = diff.find((d) => riskyPath(d.path));
+  if (risky) return pick("strong", "S1", `risky path ${quoted(risky.path)}`);
+  if (round >= 2) return pick("strong", "S2", `round ${round}`);
+  if (p0) return pick("strong", "S2", "p0 finding");
+  if (finalSpec) return pick("strong", "S2", "final spec review");
+  if (cls !== null && STANDARD_REVIEW_CLASSES.has(cls)) return pick("standard", "S3", `class ${cls}`);
+  const lines = diff.reduce((sum, d) => sum + d.lines, 0);
+  if (lines <= REVIEW_LINE_BOUND && diff.length <= REVIEW_FILE_BOUND) return pick("standard", "S3", `${lines} lines in ${diff.length} files`);
+  if (probed) return pick("standard", "S4", "every finding probed");
+  return pick("strong", "S1", "default for an unclassified diff");
+}
+
+/** Whether `brief` sits below what `need` asks: a lower effort, or a lower tier once the climb sets
+ * one. A missing or unknown `Tier:` ranks below every tier, so the climb refuses it. */
+function belowRoute(brief, need) {
+  const rank = (map, v) => map.get(v) ?? -1;
+  const lowTier = need.tier !== null && rank(TIER_RANK, brief.header.Tier) < rank(TIER_RANK, need.tier);
+  return lowTier || rank(EFFORT_RANK, brief.header.Effort ?? "medium") < rank(EFFORT_RANK, need.effort);
+}
+
+/** The root a brief's entries resolve against: the directory above `.freeharness/` for a brief
+ * at `.freeharness/sdd/<change>/`, so the lead may validate from any directory; else `cwd`. */
+function projectRoot(file, cwd = process.cwd()) {
+  const sddDir = path.dirname(path.dirname(path.resolve(cwd, file)));
+  const harnessDir = path.dirname(sddDir);
+  if (path.basename(sddDir) === "sdd" && path.basename(harnessDir) === ".freeharness") return path.dirname(harnessDir);
+  return cwd;
+}
+
+/** Absolute path of `p` under `root`, or null when it leaves the root: absolute, through `..`,
+ * or through a symlink, so the estimate never reads or sizes a file outside the project. A
+ * path that does not exist yet stays inside when its text does. */
+function insideRoot(root, p) {
+  if (path.isAbsolute(p) || p.split("/").includes("..")) return null;
+  const abs = path.resolve(root, p);
+  let real;
   try {
-    parsed = JSON.parse(m[1]);
+    real = fs.realpathSync(abs);
   } catch {
-    return { task: null, status: null, valid: false };
+    return abs;
   }
-  const o = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  return {
-    task: typeof o.task === "string" ? o.task : null,
-    status: typeof o.status === "string" ? o.status : null,
+  const rel = path.relative(fs.realpathSync(root), real);
+  if (rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel)) return null;
+  return abs;
+}
+
+/** True for a test or fixture entry, which the file bound never counts and which may be a
+ * directory or a glob; a glob counts only by the whole segments before its first `*`: `**`
+ * crosses directories, so a `.test.` text in a glob does not make every match a test file. */
+function isTestEntry(p) {
+  const star = p.indexOf("*");
+  if (star >= 0) return p.slice(0, star).split("/").slice(0, -1).some((s) => TEST_SEGMENTS.has(s));
+  if (p.split("/").some((s) => TEST_SEGMENTS.has(s))) return true;
+  return path.posix.basename(p).includes(".test.");
+}
+
+/** True when an entry names a directory or a glob rather than one file; `[`/`]` stay literal,
+ * as in `scopeMatches`, so a `[id].tsx` route file is one file. */
+function isDirOrGlob(p, abs) {
+  if (p.endsWith("/") || /[*?]/.test(p)) return true;
+  try {
+    return fs.statSync(abs).isDirectory();
+  } catch {
+    return false;
+  }
+}
+
+/** Size and, when `needLines`, line count of a regular file; `kind` is `missing` or `other`
+ * otherwise. Opened without blocking, so a FIFO named in a brief cannot hang the check. */
+function fileFacts(abs, needLines) {
+  let fd;
+  try {
+    fd = fs.openSync(abs, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0));
+  } catch (e) {
+    return { kind: e && typeof e === "object" && "code" in e && e.code === "ENOENT" ? "missing" : "other" };
+  }
+  try {
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) return { kind: "other" };
+    if (!needLines || st.size === 0) return { kind: "file", size: st.size, lines: 0 };
+    const buf = fs.readFileSync(fd);
+    let lines = 0;
+    for (const byte of buf) if (byte === 0x0a) lines++;
+    if (buf[buf.length - 1] !== 0x0a) lines++;
+    return { kind: "file", size: buf.length, lines };
+  } catch {
+    return { kind: "other" };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** Estimated bytes one entry reads: the whole file, or its range or symbol lines at the file's
+ * mean bytes per line. A range is clamped to the file; a reversed or zero-based range counts the
+ * whole file, so a malformed suffix never shrinks the estimate. */
+function entryBytes(abs, e) {
+  const suffixed = e.range !== null || e.symbol !== null;
+  const facts = fileFacts(abs, suffixed);
+  if (facts.kind !== "file") return facts;
+  if (!suffixed || facts.lines === 0) return { kind: "file", bytes: facts.size };
+  let lines = facts.lines;
+  if (e.symbol !== null) lines = Math.min(SYMBOL_LINES, facts.lines);
+  else if (e.range[0] >= 1 && e.range[1] >= e.range[0]) lines = Math.max(0, Math.min(e.range[1], facts.lines) - e.range[0] + 1);
+  return { kind: "file", bytes: (lines * facts.size) / facts.lines };
+}
+
+/**
+ * Estimates a brief's reading set: its write-scope files (directories and globs excluded) plus
+ * every `Read:` entry, each distinct entry once, at 4 bytes per token.
+ * @param brief A parsed brief (`readBrief`).
+ * @param root The directory entries resolve against.
+ * @returns `tokens`, and the `Read:` entries that do not exist; a missing write-scope file
+ *   counts 0, since the worker creates it, and an entry outside `root` is skipped unread. Every
+ *   `Read:` entry is checked, since one repeating a write-scope file claims the file exists.
+ */
+export function estimateReadingSet(brief, root) {
+  const seen = new Set();
+  const missing = [];
+  let bytes = 0;
+  const add = (e, isRead) => {
+    const key = entryText(e);
+    const abs = insideRoot(root, e.path);
+    if (isRead && abs !== null && !missing.includes(key) && fileFacts(abs, false).kind === "missing") missing.push(key);
+    if (seen.has(key)) return;
+    seen.add(key);
+    if (abs === null || (!isRead && isDirOrGlob(e.path, abs))) return;
+    const r = entryBytes(abs, e);
+    if (r.kind === "file") bytes += r.bytes;
+  };
+  for (const e of briefEntries(brief)) add(e, false);
+  for (const e of brief.reads ?? []) add(e, true);
+  return { tokens: Math.ceil(bytes / BYTES_PER_TOKEN), missing };
+}
+
+/** A brief's write-scope entries; a brief object built without `entries` falls back to `scope`. */
+function briefEntries(b) {
+  return b.entries ?? (b.scope ?? []).map((p) => ({ path: p, range: null, symbol: null }));
+}
+
+/** Size-bound problems of one brief: the source-file count, directory or glob entries and the
+ * reading-set estimate, waived by `Split: refused - <reason>`; no split waives an entry outside
+ * the root, a missing `Read:` file or a malformed append entry. An append entry counts its
+ * file's last 200 lines, all an appending worker reads. */
+function sizeErrors(name, b) {
+  const errors = [];
+  const root = projectRoot(b.file);
+  let waived = false;
+  if (b.header.Split !== undefined) {
+    const m = /^refused - (.*)$/.exec(b.header.Split);
+    if (m && m[1].trim() !== "") waived = true;
+    else errors.push(`${name}: Split must be 'refused - <reason>'; got ${b.header.Split}`);
+  }
+  const inside = [];
+  const tails = new Map();
+  for (const e of briefEntries(b)) {
+    const abs = insideRoot(root, e.path);
+    const many = e.append && (e.path.includes("[") || (abs === null ? /[*?]|\/$/.test(e.path) : isDirOrGlob(e.path, abs)));
+    if (e.append && (e.range || e.symbol)) errors.push(`${name}: append-entry ${entryText(e)}: append takes no range or symbol`);
+    else if (many) errors.push(`${name}: append-entry ${entryText(e)}: append takes one file`);
+    if (abs === null) errors.push(`${name}: write scope entry ${entryText(e)} resolves outside the project root`);
+    else inside.push({ e, abs });
+    if (abs !== null && e.append && !many) tails.set(entryText(e), abs);
+  }
+  for (const e of b.reads ?? []) {
+    const abs = insideRoot(root, e.path);
+    if (abs === null) errors.push(`${name}: Read: ${entryText(e)} resolves outside the project root`);
+    else if (fileFacts(abs, false).kind === "other") errors.push(`${name}: Read: ${entryText(e)} is not a file`);
+  }
+  const { tokens: whole, missing } = estimateReadingSet({ ...b, entries: briefEntries(b).filter((e) => !e.append) }, root);
+  let tailBytes = 0;
+  const chunk = Buffer.alloc(65536);
+  for (const [entry, abs] of tails) {
+    let fd;
+    try {
+      fd = fs.openSync(abs, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0));
+    } catch {
+      // A missing or unreadable file counts 0, as a missing write-scope file does.
+      continue;
+    }
+    try {
+      const st = fs.fstatSync(fd);
+      if (!st.isFile()) continue;
+      // Past the bound the brief fails, so the scan stops.
+      let start = -1;
+      let pos = st.size;
+      for (let n = 0; pos > 0 && start < 0 && st.size - pos < READING_SET_BOUND * BYTES_PER_TOKEN; ) {
+        const len = Math.min(chunk.length, pos);
+        pos -= len;
+        for (let off = 0; off < len; ) {
+          const got = fs.readSync(fd, chunk, off, len - off, pos + off);
+          if (got === 0) throw Object.assign(new Error("short read"), { code: "EIO" });
+          off += got;
+        }
+        for (let i = len - 1; i >= 0; i--) {
+          if (chunk[i] === 0x0a && pos + i !== st.size - 1 && ++n === 200) {
+            start = pos + i + 1;
+            break;
+          }
+        }
+      }
+      tailBytes += st.size - (start < 0 ? pos : start);
+    } catch (err) {
+      errors.push(`${name}: append-entry ${entry}: tail read failed (${err && err.code ? err.code : String(err)})`);
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  const tokens = whole + Math.ceil(tailBytes / BYTES_PER_TOKEN);
+  for (const m of missing) errors.push(`${name}: Read: ${m} does not exist`);
+  if (waived) return errors;
+  const files = new Set();
+  for (const { e, abs } of inside) {
+    if (isTestEntry(e.path)) continue;
+    if (isDirOrGlob(e.path, abs)) {
+      errors.push(`${name}: write scope entry ${entryText(e)} is a directory or glob outside test and fixture directories${SPLIT_HINT}`);
+    } else files.add(e.path);
+  }
+  if (files.size > SOURCE_FILE_BOUND) errors.push(`${name}: write scope lists ${files.size} non-test files, bound is ${SOURCE_FILE_BOUND}${SPLIT_HINT}`);
+  if (tokens >= READING_SET_BOUND) errors.push(`${name}: reading set estimated at ${tokens} tokens, bound is ${READING_SET_BOUND}${SPLIT_HINT}`);
+  return errors;
+}
+
+/** A term as a regex literal spells it, since a test matching a path writes `src\/locked\.json`
+ * and a fixed-string search for `src/locked.json` misses it. */
+export function escapeTermSpelling(term) {
+  return term.replace(/[\\/.()[\]{}^$*+?|]/g, "\\$&");
+}
+
+/** How far before `Object.keys(` a deep-equality call may open, so `deepEqual(Object.keys(x), [...])`
+ * and its multi-line form count, while the forward window stays the bound on the scan. */
+const KEY_LIST_BACK = 200;
+const KEY_LIST_WINDOW = 4000;
+
+/** The `keys` a test pins as an exact key list: a quoted key after a `deepEqual(` or
+ * `deepStrictEqual(` near an `Object.keys(`. Every needle keeps a cursor that only moves forward
+ * past a stale position, so the scan stays linear on hostile test text. */
+export function keyListHits(text, keys) {
+  const cursor = (needle) => ({ needle, at: -2 });
+  const next = (c, from) => {
+    if (c.at !== -1 && c.at < from) c.at = text.indexOf(c.needle, from);
+    return c.at;
+  };
+  const eqs = [cursor("deepEqual("), cursor("deepStrictEqual(")];
+  let open = keys.map((k) => ({ key: k, needles: [`"${k}"`, `'${k}'`, `\`${k}\``].map(cursor) }));
+  const hits = [];
+  for (let i = text.indexOf("Object.keys("); i !== -1 && open.length > 0; i = text.indexOf("Object.keys(", i + 1)) {
+    const hi = i + KEY_LIST_WINDOW;
+    const found = eqs.map((c) => next(c, Math.max(0, i - KEY_LIST_BACK))).filter((p) => p !== -1);
+    if (found.length === 0) break;
+    const eq = Math.min(...found);
+    if (eq >= hi) continue;
+    const from = Math.max(eq, i);
+    for (const o of open) {
+      const at = o.needles.map((c) => next(c, from)).filter((p) => p !== -1);
+      if (at.length > 0 && Math.min(...at) < hi) o.hit = true;
+      else if (at.length === 0) o.dead = true;
+    }
+    for (const o of open) if (o.hit) hits.push(o.key);
+    open = open.filter((o) => !o.hit && !o.dead);
+  }
+  return keys.filter((k) => hits.includes(k));
+}
+
+/** Changed-term problems of one brief: a test naming a `Changes:` term, plain or regex-escaped,
+ * or pinning a `Key-list:` key, that no scope entry,
+ * reasoned `Unaffected:` line or `## Verify` command covers is the scope stop the worker would
+ * hit later. `cache` spans one `briefs` run: one listing, one read per file. */
+export function changedTermErrors(brief, cwd = process.cwd(), cache = new Map()) {
+  const MAX_BYTES = 4 * 1024 * 1024;
+  const BROAD = 40;
+  const errors = [];
+  const unaffected = brief.unaffected ?? [];
+  for (const u of unaffected) if (u.reason === "") errors.push(`unaffected-reason ${u.path}`.trim());
+  const terms = [];
+  // A reasoned none skips only the term search; a key list the brief names is still checked.
+  if (!brief.changesNone) {
+    if (!brief.changes || brief.changes.length === 0) errors.push("changes-missing (add Changes: <term>[, <term>...] or Changes: none - <reason>)");
+    else
+      for (const t of brief.changes) {
+        if (t.length < 3) errors.push(`changes-short ${t}`);
+        else terms.push(t);
+      }
+  }
+  const keys = [];
+  for (const k of brief.keyList ?? []) {
+    if (k.length < 3) errors.push(`changes-short key-list:${k}`);
+    else keys.push(k);
+  }
+  if (terms.length === 0 && keys.length === 0) return errors;
+  const root = projectRoot(brief.file, cwd);
+  const note = (err) => {
+    const line = String(err && err.message).split("\n")[0];
+    if (!cache.has(`note:${line}`)) console.log(`NOTE changes-skipped ${line}`);
+    cache.set(`note:${line}`, true);
+  };
+  if (!cache.has(`top:${root}`)) {
+    let top = null;
+    try {
+      top = runGit(["rev-parse", "--show-toplevel"], root).trim() || null;
+    } catch (err) {
+      // Outside a work tree nothing is tracked, so nothing can be missed; a git that cannot run is said.
+      if (!/not a git repository/i.test(String(err.stderr ?? ""))) note(err);
+    }
+    cache.set(`top:${root}`, top);
+  }
+  const top = cache.get(`top:${root}`);
+  if (top === null) return errors;
+  if (!cache.has(`ls:${top}`)) {
+    const isTest = (p) => {
+      const base = path.posix.basename(p);
+      return p.split("/").some((s) => TEST_SEGMENTS.has(s)) || /\.(test|spec)\.|_test\./.test(base) || /^test_.*\.py$/.test(base) || base === "conftest.py";
+    };
+    let listed = "";
+    try {
+      listed = runGit(["ls-files", "-z"], top, { maxBuffer: 256 * 1024 * 1024 });
+    } catch (err) {
+      note(err);
+    }
+    cache.set(`ls:${top}`, listed.split("\0").filter((p) => p !== "" && isTest(p)));
+  }
+  const read = (p) => {
+    const key = `text:${top}\0${p}`;
+    if (cache.has(key)) return cache.get(key);
+    let text = null;
+    const abs = insideRoot(top, p);
+    let fd;
+    try {
+      if (abs !== null) fd = fs.openSync(abs, fs.constants.O_RDONLY | (fs.constants.O_NONBLOCK || 0) | (fs.constants.O_NOFOLLOW || 0));
+      const st = fd === undefined ? null : fs.fstatSync(fd);
+      if (st && st.isFile() && st.size > MAX_BYTES) console.log(`NOTE changes-skipped ${quoted(p)} over 4 MiB`);
+      else if (st && st.isFile()) {
+        const buf = Buffer.alloc(st.size);
+        let n = 0;
+        for (let r = 1; n < st.size && r > 0; n += r) r = fs.readSync(fd, buf, n, st.size - n, n);
+        if (!looksBinary(buf.subarray(0, n))) text = buf.subarray(0, n).toString("utf8");
+      }
+    } catch (err) {
+      // A deleted file or a symlink holds nothing to search; any other failure is said.
+      if (err.code !== "ENOENT" && err.code !== "ELOOP") console.log(`NOTE changes-skipped ${quoted(p)} ${err.code ?? String(err.message).split("\n")[0]}`);
+    } finally {
+      if (fd !== undefined) fs.closeSync(fd);
+    }
+    cache.set(key, text);
+    return text;
+  };
+  const verify = (brief.verify ?? []).map((l) => l.replace(/^-\s+/, "").replace(/`/g, ""));
+  // Bounded on both sides, so a longer path that merely contains `p` never covers it; a `./`
+  // spelling and a shell separator right after the path still name it.
+  const names = (v, p) => p !== "" && new RegExp(`(?:^|[\\s"'=])(?:\\./)?${p.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?=$|[\\s"':),;&|])`).test(v);
+  const covered = (p) =>
+    (brief.scope ?? []).some((e) => scopeMatches(e, p)) ||
+    unaffected.some((u) => u.reason !== "" && u.path === p) ||
+    verify.some((v) => {
+      if (names(v, p)) return true;
+      const cd = /^cd\s+(["']?)([^"'\s&;]+)\1\s*&&/.exec(v);
+      return cd !== null && !path.isAbsolute(cd[2]) && names(v, path.posix.relative(path.posix.normalize(cd[2]), p));
+    });
+  const tests = cache.get(`ls:${top}`);
+  const report = (name, hits) => {
+    if (hits.length > BROAD) errors.push(`changes-broad ${name} (${hits.length} test files, bound is ${BROAD}; name a narrower term)`);
+    else for (const p of hits) if (!covered(p)) errors.push(`changes-unscoped ${name} ${quoted(p)}`);
+  };
+  for (const term of terms) {
+    const escaped = escapeTermSpelling(term);
+    report(
+      term,
+      tests.filter((p) => {
+        const text = read(p) ?? "";
+        return text.includes(term) || (escaped !== term && text.includes(escaped));
+      }),
+    );
+  }
+  if (keys.length > 0) {
+    const pinned = new Map(keys.map((k) => [k, []]));
+    for (const p of tests) {
+      const text = read(p);
+      if (text !== null && text.includes("Object.keys(")) for (const k of keyListHits(text, keys)) pinned.get(k).push(p);
+    }
+    for (const [k, hits] of pinned) report(`key-list:${k}`, hits);
+  }
+  return errors;
+}
+
+/** Problems of a batch: each brief's header, digest and tree (tree-path, setup-missing), plus
+ * scope overlap. `{ kind: "set", cap }` (named briefs) adds tree-required, resource-overlap,
+ * manifest-parallel and `band` past `cap`; `{ kind: "dir" }` (landed briefs) skips those and
+ * tree-absent; `single` skips the set checks. Another mode or a missing cap throws. A malformed
+ * run authorization is one error per run. */
+export function validateBriefs(briefs, mode = { kind: "single" }) {
+  const kind = mode && typeof mode === "object" ? mode.kind : undefined;
+  if (!["single", "set", "dir"].includes(kind)) throw new TypeError(`validateBriefs mode must be { kind: 'single' | 'set' | 'dir' }; got ${JSON.stringify(mode)}`);
+  if (kind === "set" && !(Number.isSafeInteger(mode.cap) && mode.cap > 0)) throw new TypeError(`validateBriefs mode set needs a positive integer cap; got ${JSON.stringify(mode.cap ?? null)}`);
+  const landed = kind === "dir";
+  const errors = [];
+  const digestOwner = new Map();
+  const termCache = new Map();
+  // Project rules are read once per project root, so a malformed file fails once and a note
+  // shared by several briefs prints once.
+  const lints = new Map();
+  const lintNotes = new Set();
+  // A Ceiling: header is judged against the task's class, as `budget` judges it: every brief in
+  // the same directory declaring the task counts, so a fix brief inherits the task's class.
+  const authErrors = new Set();
+  const peers = new Map();
+  const taskClass = (b) => {
+    const task = (b.header.Task ?? "").trim();
+    const dir = path.dirname(b.file);
+    if (!task) return briefClass(b);
+    const key = `${path.resolve(dir)}\0${task}`;
+    if (!peers.has(key)) peers.set(key, briefsForTask(dir, task));
+    const found = peers.get(key);
+    return classOf(dir, task, found.some((p) => path.resolve(p.file) === path.resolve(b.file)) ? found : [...found, b]);
+  };
+  const mainTree = (b) => b.header.Tree === undefined || /^none\s+-\s*\S/i.test(b.header.Tree);
+  let ignoreCheck = true;
+  const real = (p) => {
+    try {
+      return fs.realpathSync(p);
+    } catch {
+      return p;
+    }
+  };
+  // Ancestors by real path, the leaf as named, as `tree` compares.
+  const realish = (p) => {
+    const dir = path.dirname(p);
+    if (dir === p) return p;
+    return path.join(fs.existsSync(dir) ? real(dir) : realish(dir), path.basename(p));
+  };
+  for (const b of briefs) {
+    const name = path.basename(b.file);
+    if (!mainTree(b)) {
+      const root = real(projectRoot(b.file));
+      const { Tree: tree, Change: change = "", Task: task = "" } = b.header;
+      const want = /^[A-Za-z0-9][\w.-]*$/.test(change) && BRIEF_TASK_RE.test(task) ? path.join(root, ".worktrees", change, task) : null;
+      if (!want || !path.isAbsolute(tree) || realish(path.resolve(tree)) !== want) {
+        errors.push(`${name}: tree-path Tree must be ${quoted(want ?? "<root>/.worktrees/<change>/<task>")}; got ${quoted(tree)}`);
+      }
+      const info = treeInfo(root, path.resolve(root, tree));
+      if (!info.ok && !landed) errors.push(`${name}: tree-absent ${quoted(tree)} is not a linked worktree of ${quoted(root)} (${quoted(info.reason)}); run tree first`);
+      const setup = /^none(?:\s+-\s*(.*))?$/i.exec(b.header.Setup ?? "none");
+      if (setup && (setup[1] ?? "").trim() === "") errors.push(`${name}: setup-missing (add Setup: <command> or Setup: none - <reason>)`);
+      // No tree diff can show an ignored path; a glob or directory is judged by its literal prefix.
+      for (const e of briefEntries(b)) {
+        const lit = e.path.split(/[*?]/)[0];
+        if (lit === "" || insideRoot(root, lit) === null) continue;
+        let hit = `${lit}/`.startsWith(".freeharness/");
+        if (!hit && ignoreCheck) {
+          try {
+            runGit(["check-ignore", "-q", "--", `./${lit}`], root);
+            hit = true;
+          } catch (err) {
+            if (err.status == null) {
+              ignoreCheck = false;
+              console.log("NOTE ignored-check-unavailable");
+            } else if (err.status !== 1) {
+              const first = String(err.stderr ?? "").split("\n").find((l) => l.trim() !== "") ?? `exit ${err.status}`;
+              errors.push(`${name}: scope-ignored-unknown ${quoted(entryText(e))}: ${quoted(first.trim())}`);
+            }
+          }
+        }
+        if (hit) errors.push(`${name}: scope-ignored ${quoted(entryText(e))}`);
+      }
+    }
+    for (const key of b.placeholders ?? []) errors.push(`${name}: placeholder-left ${quoted(key)}`);
+    for (const key of ["Change", "Task", "Spec", "Tier"]) if (!b.header[key]) errors.push(`${name}: header line '${key}:' missing`);
+    if (!b.header.Suite) errors.push(`${name}: suite-missing (add Suite: <the project's full-suite command>)`);
+    if (b.header.Task && !BRIEF_TASK_RE.test(b.header.Task)) {
+      errors.push(`${name}: Task must name one task id (one task per brief); got ${b.header.Task}`);
+    }
+    if (b.header.Tier && !TIERS.has(b.header.Tier)) errors.push(`${name}: Tier must be strong|standard|fast; got ${b.header.Tier}`);
+    errors.push(...routingErrors(name, b));
+    if (b.header.Spec && (/[\\/]|\.md$/.test(b.header.Spec))) errors.push(`${name}: Spec must be the change id, not a path (${b.header.Spec})`);
+    if (b.header.Spec && b.header.Change && b.header.Spec !== b.header.Change) errors.push(`${name}: Spec (${b.header.Spec}) differs from Change (${b.header.Change})`);
+    if (b.scope.length === 0) errors.push(`${name}: '## Write scope' must list at least one path`);
+    const badCeiling = b.header.Ceiling !== undefined && !CEILING_RE.test(b.header.Ceiling);
+    if (badCeiling) errors.push(`${name}: Ceiling must be a positive integer; got ${b.header.Ceiling}`);
+    const cls = b.header.Ceiling === undefined || badCeiling ? briefClass(b) : taskClass(b);
+    const limit = classCeiling(path.dirname(b.file), cls);
+    if ("error" in limit) {
+      if (!authErrors.has(limit.error)) errors.push(limit.error);
+      authErrors.add(limit.error);
+    } else if (b.header.Ceiling !== undefined && !badCeiling && Number(b.header.Ceiling) > limit.ceiling) {
+      errors.push(overClassCeiling(name, Number(b.header.Ceiling), cls, limit.ceiling));
+    }
+    for (const key of missingRunRules(b.runRules)) errors.push(`${name}: run-rule missing: ${key}`);
+    errors.push(...probeRuleErrors(name, b));
+    const projectRules = b.projectRules ?? [];
+    if (projectRules.length === 0) errors.push(`${name}: '## Project rules' section missing`);
+    if (projectRules.length > PROJECT_RULES_BOUND) {
+      errors.push(`${name}: '## Project rules' has ${projectRules.length} lines, bound is ${PROJECT_RULES_BOUND}`);
+    }
+
+    if (b.digest.length === 0) errors.push(`${name}: '## Why and rulings' section missing`);
+    if (b.digest.length > DIGEST_BUDGET) errors.push(`${name}: '## Why and rulings' has ${b.digest.length} lines, budget is ${DIGEST_BUDGET}`);
+    if (b.digest.some((l) => l.startsWith("```"))) errors.push(`${name}: '## Why and rulings' must not contain a fenced block`);
+
+    const seen = new Set();
+    for (const line of b.digest) {
+      const m = DIGEST_ID.exec(line);
+      if (!m) continue;
+      const [, id, ruling] = m;
+      if (seen.has(id)) {
+        errors.push(`${name}: duplicate id ${id} inside the brief`);
+        continue;
+      }
+      seen.add(id);
+      const prev = digestOwner.get(id);
+      if (!prev) digestOwner.set(id, { text: ruling, file: b.file });
+      else if (prev.text !== ruling) {
+        errors.push(`${name}: duplicate id ${id} differs from its text in ${path.basename(prev.file)}`);
+      }
+    }
+    errors.push(...sizeErrors(name, b));
+    errors.push(...changedTermErrors(b, process.cwd(), termCache).map((e) => `${name}: ${e}`));
+    const lintRoot = path.resolve(projectRoot(b.file));
+    if (!lints.has(lintRoot)) {
+      const lint = readBriefLint(lintRoot);
+      lints.set(lintRoot, lint);
+      if ("error" in lint) errors.push(`lint-config ${lint.error}`);
+    }
+    const lint = lintErrors(b, lints.get(lintRoot));
+    errors.push(...lint.errors.map((e) => `${name}: ${e}`));
+    for (const n of lint.notes) {
+      if (lintNotes.has(n)) continue;
+      lintNotes.add(n);
+      console.log(`NOTE ${n}`);
+    }
+  }
+  const owner = new Map();
+  for (const b of briefs) {
+    for (const p of b.scope) {
+      const prev = owner.get(p);
+      if (prev && prev !== b.file) errors.push(`write scope overlap: ${p} in ${path.basename(prev)} and ${path.basename(b.file)}; batch refused`);
+      else owner.set(p, b.file);
+    }
+  }
+  if (kind !== "set") return errors;
+  const many = briefs.length > 1;
+  const resourceOwner = new Map();
+  const manifests = new Set();
+  for (const b of briefs) {
+    const name = path.basename(b.file);
+    if (many && mainTree(b)) errors.push(`tree-required ${name} (parallel briefs each need Tree: <root>/.worktrees/<change>/<task>)`);
+    const resources = b.header.Resources ?? "none";
+    const names = /^none(?:\s+-.*)?$/i.test(resources) ? [] : resources.split(",").map((s) => s.trim().toLowerCase());
+    for (const r of new Set(names.filter((s) => s !== ""))) {
+      const prev = resourceOwner.get(r);
+      if (prev === undefined) resourceOwner.set(r, name);
+      else errors.push(`resource-overlap ${quoted(r)} ${prev} ${name}`);
+    }
+    if (many) for (const p of b.scope) if (ROUTE_MANIFEST_RE.test(path.posix.basename(p).toLowerCase())) manifests.add(p);
+  }
+  for (const p of manifests) errors.push(`manifest-parallel ${quoted(p)}`);
+  if (briefs.length > mode.cap) errors.push(`band ${briefs.length} over ${mode.cap}`);
+  return errors;
+}
+
+/** Every complete fenced json block; an unterminated fence never matches. */
+const JSON_BLOCK_RE = /```json\s*\n([\s\S]*?)\n```/g;
+
+/** Assistant-authored texts of one line's `message.content`: `text` blocks joined, plus a
+ * `SendMessage` tool_use's `input.message` (the worker's reply channel in the teams runtime);
+ * no other tool input. */
+function assistantCandidates(content) {
+  if (typeof content === "string") return content === "" ? [] : [content];
+  if (!Array.isArray(content)) return [];
+  const out = [];
+  let buf = [];
+  const flushText = () => {
+    if (buf.length > 0) out.push(buf.join(""));
+    buf = [];
+  };
+  for (const b of content) {
+    if (b && typeof b === "object" && b.type === "text" && typeof b.text === "string") {
+      buf.push(b.text);
+      continue;
+    }
+    flushText();
+    if (b && typeof b === "object" && b.type === "tool_use" && b.name === "SendMessage" && b.input && typeof b.input.message === "string") {
+      out.push(b.input.message);
+    }
+  }
+  flushText();
+  return out;
+}
+
+/** The last complete json block of a text plus the text after it; null if none. */
+function lastJsonBlock(text) {
+  JSON_BLOCK_RE.lastIndex = 0;
+  let match;
+  let last = null;
+  while ((match = JSON_BLOCK_RE.exec(text)) !== null) last = match;
+  if (!last) return null;
+  return { block: last[1], remaining: text.slice(last.index + last[0].length) };
+}
+
+/** The report's next text: its first json block replaced by `fenced`, or, when it has none (`existing` null for a report not yet on disk), the block before `remaining`. */
+function spliceReport(existing, fenced, remaining) {
+  if (existing !== null) {
+    const m = /```json\s*\n[\s\S]*?\n```/.exec(existing);
+    if (m) return existing.slice(0, m.index) + fenced + existing.slice(m.index + m[0].length);
+    return `${fenced}\n\n${existing}`;
+  }
+  const body = remaining.replace(/^\n+/, "").trimEnd();
+  return body === "" ? `${fenced}\n` : `${fenced}\n\n${body}\n`;
+}
+
+/** Identity and schema validity of a report's first json block; null if none. */
+function existingBlockInfo(text) {
+  const m = /```json\s*\n([\s\S]*?)\n```/.exec(text);
+  if (!m) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(m[1]);
+  } catch {
+    return { task: null, status: null, valid: false };
+  }
+  const o = parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+  return {
+    task: typeof o.task === "string" ? o.task : null,
+    status: typeof o.status === "string" ? o.status : null,
     valid: validateHandoff(parsed).length === 0,
   };
 }
@@ -575,264 +2017,2517 @@ export function recover(transcript, report, force = false) {
   return { written: true, replaced, errors };
 }
 
-/** Brief paths from a directory (sorted `*.brief.md`) or as given. */
+/** Brief paths from a directory (sorted `*.brief.md`) or as given; `fromDir` when any argument
+ * was a directory. */
 function collectBriefs(args) {
-  const out = [];
+  const files = [];
+  let fromDir = false;
   for (const a of args) {
     if (fs.statSync(a).isDirectory()) {
-      for (const f of fs.readdirSync(a).sort()) if (f.endsWith(".brief.md")) out.push(path.join(a, f));
-    } else out.push(a);
+      fromDir = true;
+      for (const f of fs.readdirSync(a).sort()) if (f.endsWith(".brief.md")) files.push(path.join(a, f));
+    } else files.push(a);
   }
-  return out;
+  return { files, fromDir };
 }
 
-/** Usage text: one line per subcommand with its arguments, in order. */
-const USAGE = [
-  "usage: validate-handoff.mjs <subcommand> [args]",
-  "  briefs <dir|file...>",
-  "  handoff <file> [--base <sha>] [--brief <brief.md>] [--in-flight <brief.md>]... [--lead <path>]...",
-  "  budget <ledger.jsonl> <task> [--ceiling <n>]",
-  "  ledger <change-dir>",
-  "  recover <transcript.jsonl> <report> [--force]",
-  "  name <dispatch-name>",
-].join("\n");
+/** Most bytes read of a transcript or a ledger: a worker transcript stays far below it, so a
+ * larger file is runaway or hostile and its tail is dropped rather than buffered. */
+const SCAN_BOUND = 16 * 1024 * 1024;
+/** Most lines one scan kind prints; one `scan-capped` note counts the rest. */
+const SCAN_CAP = 50;
+/** Most characters of a command or path one scan line quotes. */
+const SCAN_DETAIL = 200;
+/** Longest path the scan resolves: past PATH_MAX no write can succeed. */
+const SCAN_PATH_MAX = 4096;
+/** Git subcommands that write the index or HEAD whatever their arguments; matched by whole word,
+ * so `merge-base` and `cherry` stay reads. */
+const INDEX_SUBCOMMANDS = new Set(["add", "rm", "mv", "commit", "reset", "switch", "merge", "rebase", "cherry-pick", "pull", "update-index"]);
+/** Git global options whose value is the next word. */
+const GIT_VALUED = new Set(["-c", "--git-dir", "--work-tree", "--namespace", "--config-env", "--super-prefix"]);
+/** Commands whose operands a Bash call writes or removes; `sed` counts only with `-i`. */
+const WRITE_WORDS = new Set(["tee", "cp", "mv", "install", "rm", "touch", "ln"]);
+/** Of those, the commands that take a `-t` target directory; all but `mv` write only the target. */
+const COPY_WORDS = new Set(["cp", "mv", "install", "ln"]);
+/** Words a command may run behind; only the bare word is skipped, never its options. */
+const WRAPPER_WORDS = new Set(["sudo", "env", "command", "nice", "nohup", "time", "exec", "xargs"]);
+/** The separators a Bash command is split on. Quotes are not parsed, so a separator inside a
+ * quoted string splits there too: the scan reports, the diff guards decide. */
+const SEPARATOR_RE = /;|&&|\|\||\|/;
+/** A redirect word: its fd or `&`, the operator, an fd-duplicating `&` and a joined target. */
+const REDIRECT_RE = /^(?:\d*|&)>>?\|?(&?)(.*)$/;
 
-/** Splits a runner's options out of its arguments: `--name value` pairs of `allowed`, every
- * repeated value kept, `valueless` switches recorded as `true`. A trailing valued option
- * yields `undefined`; an unlisted option is the one `unknown option` error every subcommand
- * prints. */
-function parseFlags(rest, allowed, valueless = []) {
-  const values = {};
-  for (let i = 0; i < rest.length; i++) {
-    const flag = rest[i];
-    if (!values[flag]) values[flag] = [];
-    if (valueless.includes(flag)) {
-      values[flag].push(true);
-      continue;
+/** Up to `bound` bytes of `file` (its tail when `fromEnd`) through one no-follow, non-blocking
+ * fd, so a symlinked leaf or a FIFO is refused rather than followed or waited on; null when
+ * unreadable. */
+function readBoundedNoFollow(file, bound, fromEnd) {
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+  } catch {
+    return null;
+  }
+  try {
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) return null;
+    const len = Math.min(st.size, bound);
+    const start = fromEnd ? st.size - len : 0;
+    const buf = Buffer.allocUnsafe(len);
+    let total = 0;
+    while (total < len) {
+      const n = fs.readSync(fd, buf, total, len - total, start + total);
+      if (n === 0) break;
+      total += n;
     }
-    if (!allowed.includes(flag)) return { values, error: `unknown option ${JSON.stringify(flag)}` };
-    values[flag].push(rest[i + 1]);
-    i++;
+    return { text: buf.toString("utf8", 0, total), cut: st.size > bound };
+  } catch {
+    return null;
+  } finally {
+    fs.closeSync(fd);
   }
-  return { values, error: null };
 }
 
-/** The last value given for an option; undefined when absent. */
-function lastValue(values, flag) {
-  const list = values[flag];
-  return list ? list[list.length - 1] : undefined;
-}
-
-/** Prints one `FAIL` per problem, or `OK <label>`; returns the exit code. */
-function report(errors, label) {
-  for (const e of errors) console.error(`FAIL ${e}`);
-  if (errors.length === 0) console.log(`OK ${label}`);
-  return errors.length === 0 ? 0 : 1;
+/** `p` relative to `root`, or null when it lies outside. */
+function relInside(root, p) {
+  const rel = path.relative(root, p);
+  return rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel) ? null : rel;
 }
 
-/** Runs `briefs`: headers, digests, scope overlap; null without a path. */
-function runBriefs(rest) {
-  if (rest.length < 1) return null;
-  return report(validateBriefs(collectBriefs(rest).map(readBrief)), rest.join(" "));
+/** The real path of one ledger transcript path for `agentId`, or the `note` reason it is not
+ * read. The name rule runs on the real path and after the symlink check, so neither a link nor
+ * a `..` alias turns another file into the agent's transcript. The check covers every component
+ * below the projects root, as a linked session or `subagents` directory swaps in a decoy too. */
+function acceptTranscript(found, agentId, changeDir, root, realRoot) {
+  const abs = path.resolve(changeDir, found);
+  let real = null;
+  try {
+    real = fs.realpathSync(abs);
+  } catch {
+    // A missing file is placed by its text below.
+  }
+  const lexical = relInside(root, abs) ?? relInside(realRoot, abs);
+  const rel = real !== null ? relInside(realRoot, real) : lexical;
+  if (rel === null || rel === "") return { note: "outside-projects" };
+  if (real === null || lexical === null || real !== path.join(realRoot, lexical)) return { note: "unreadable" };
+  let st;
+  try {
+    st = fs.statSync(real);
+  } catch {
+    return { note: "unreadable" };
+  }
+  if (path.basename(real) !== `agent-${agentId}.jsonl` || path.basename(path.dirname(real)) !== "subagents") return { note: "foreign-path" };
+  if (!st.isFile()) return { note: "unreadable" };
+  return { path: real };
 }
 
-/** Runs `handoff`: the schema and, with `--base`, the diff guards. */
-function runHandoff(rest) {
-  if (rest.length < 1) return null;
-  const file = rest[0];
-  const { values, error } = parseFlags(rest.slice(1), ["--base", "--brief", "--in-flight", "--lead"]);
-  if (error) {
-    console.error(`FAIL ${error}`);
+/** Every transcript the change ledger records for `agentId`, one per real path in ledger order,
+ * and the distinct reasons the rejected ones are not read. A worker can append a ledger line, so
+ * the scan covers every qualifying line rather than the last: a forged line naming a clean file
+ * adds a `foreign-path` note and hides nothing. Only a regular file named
+ * `agent-<agentId>.jsonl` in a `subagents` directory under the Claude Code projects directory
+ * qualifies, so a line cannot aim the scan at an arbitrary file. */
+export function transcriptFor(agentId, changeDir) {
+  const ledger = readBoundedNoFollow(path.join(changeDir, "ledger.jsonl"), SCAN_BOUND, true);
+  if (ledger === null) return { paths: [], notes: ["no-ledger"] };
+  const lines = ledger.text.split("\n");
+  if (ledger.cut) lines.shift();
+  // Distinct texts first: a ledger repeats one path per dispatch, and each costs filesystem calls.
+  const named = new Set();
+  for (const raw of lines) {
+    let obj;
+    try {
+      obj = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (obj && obj.agent_id === agentId && typeof obj.transcript === "string") named.add(obj.transcript);
+  }
+  if (named.size === 0) return { paths: [], notes: ["no-line"] };
+  const config = process.env.CLAUDE_CONFIG_DIR;
+  const root = config ? path.resolve(config, "projects") : path.join(os.homedir(), ".claude", "projects");
+  let realRoot = null;
+  try {
+    realRoot = fs.realpathSync(root);
+  } catch {
+    // No projects directory: every path lies outside it.
+  }
+  const paths = new Set();
+  const notes = new Set();
+  for (const found of named) {
+    const r = realRoot === null ? { note: "outside-projects" } : acceptTranscript(found, agentId, changeDir, root, realRoot);
+    if (r.note) notes.add(r.note);
+    else paths.add(r.path);
+  }
+  return { paths: [...paths], notes: [...notes] };
+}
+
+/** Whitespace-collapsed `text`, JSON-quoted when it holds a control character so it cannot forge
+ * an output line, bounded. */
+function scanDetail(text) {
+  return quotedText(text.replace(/\s+/g, " ").trim()).slice(0, SCAN_DETAIL);
+}
+
+/** `p` as a scan line shows it: JSON-quoted when it holds a control character, bounded. */
+function shownPath(p) {
+  return quotedText(p).slice(0, SCAN_DETAIL);
+}
+
+/** Records one scan line once; past the per-kind cap it only counts toward the capped note. */
+function emit(ctx, kind, line, note = false) {
+  if (ctx.seen.has(line)) return;
+  ctx.seen.add(line);
+  const count = ctx.counts.get(kind) ?? 0;
+  if (count >= SCAN_CAP) {
+    ctx.capped++;
+    return;
+  }
+  ctx.counts.set(kind, count + 1);
+  (note ? ctx.notes : ctx.failures).push(line);
+}
+
+/** Whether tree containment ignores case: the default macOS file system does, so a case-variant
+ * path names the same file and must not read as outside the tree. */
+const FOLD_CASE = process.platform === "darwin";
+
+/** `real` relative to `tree` in `real`'s own case, "" for the tree itself, or null outside it.
+ * Both are normalized, so a prefix test places it as path.relative would, at string cost; with
+ * `fold` the prefix compares lower-cased. */
+export function treeRelative(real, tree, fold = FOLD_CASE) {
+  const root = tree.endsWith(path.sep) ? tree : tree + path.sep;
+  const same = fold ? (a, b) => a.length === b.length && a.toLowerCase() === b.toLowerCase() : (a, b) => a === b;
+  if (same(real, tree)) return "";
+  return real.length > root.length && same(real.slice(0, root.length), root) ? real.slice(root.length) : null;
+}
+
+/** The spellings of directory `dir` a transcript may print: as given, its real path and, on
+ * macOS, the real path without `/private`, since `/tmp` and `/var` link into it. A fixed lookup
+ * per root, so a target path is placed by its text alone. */
+function spellings(dir) {
+  const out = new Set([path.resolve(dir)]);
+  try {
+    const real = fs.realpathSync(dir);
+    out.add(real);
+    if (real.startsWith("/private/")) out.add(real.slice("/private".length));
+  } catch {
+    // A missing root is placed as written.
+  }
+  return [...out];
+}
+
+/** `abs` relative to the first of `roots` it lies under ("" for a root itself), or null. */
+function under(abs, roots) {
+  for (const root of roots) {
+    const rel = treeRelative(abs, root);
+    if (rel !== null) return rel;
+  }
+  return null;
+}
+
+/** `rel` as a posix path, or null for no path, the root itself or a path under `.freeharness/`. */
+function writable(rel) {
+  const p = rel === null || rel === "" ? null : rel.split(path.sep).join("/");
+  return p === null || p === ".freeharness" || p.startsWith(".freeharness/") ? null : p;
+}
+
+/** The change workspace `report` sits in: `{ roots, report, shown }`, the directory's spellings,
+ * the report's name in it and the directory as printed from the main root; null when the report
+ * is not under `.freeharness/sdd/<change>/`. The name is null unless the report is a regular file
+ * with one link, since a symlink or a hard link there would spare the trusted file it shares. */
+function changeWorkspace(report) {
+  const abs = path.resolve(report);
+  let dir = path.dirname(abs);
+  const roots = spellings(dir);
+  try {
+    dir = fs.realpathSync(dir);
+  } catch {
+    // A missing workspace is placed as written.
+  }
+  const sdd = path.dirname(dir);
+  const fold = (s) => (FOLD_CASE ? s.toLowerCase() : s);
+  if (fold(path.basename(sdd)) !== "sdd" || fold(path.basename(path.dirname(sdd))) !== ".freeharness") return null;
+  let plain = false;
+  try {
+    const st = fs.lstatSync(path.join(dir, path.basename(abs)), { throwIfNoEntry: false });
+    plain = st !== undefined && st.isFile() && st.nlink === 1;
+  } catch {
+    // An unreadable leaf spares nothing.
+  }
+  return { roots, report: plain ? path.basename(abs) : null, shown: path.relative(path.dirname(path.dirname(sdd)), dir).split(path.sep).join("/") };
+}
+
+/** `rel` inside the change workspace as printed from the main root. */
+function workspacePath(ws, rel) {
+  return shownPath(rel === "" ? ws.shown : `${ws.shown}/${rel.split(path.sep).join("/")}`);
+}
+
+/** `word` with one pair of surrounding quotes dropped. */
+function unquote(word) {
+  return word.length >= 2 && (word[0] === "'" || word[0] === '"') && word[word.length - 1] === word[0] ? word.slice(1, -1) : word;
+}
+
+/** `word` as an absolute path from `here`, or null when it is no literal path: an expansion, a
+ * glob, an option, a device, a URL, or a relative path from an unknown directory. */
+function literalPath(word, here) {
+  const p = unquote(word);
+  if (p === "" || p === "-" || p.length > SCAN_PATH_MAX || p[0] === "-" || p[0] === "~" || /[$`*?()<>]/.test(p)) return null;
+  if (p.startsWith("/dev/") || p.includes("://") || (here === null && !path.isAbsolute(p))) return null;
+  const abs = path.resolve(here ?? path.sep, p);
+  return abs.length > SCAN_PATH_MAX ? null : abs;
+}
+
+/** The words of one command segment that name a written path: redirect targets, the operands of
+ * `tee`, `rm`, `touch`, `mv` and `sed -i` (past the script and the `-e` or `-f` values), and
+ * the last operand or `-t` directory of `cp`, `install` and `ln`, whose sources are only named.
+ * An fd duplication such as `2>&1` writes no file. */
+function writeWords(words) {
+  const out = [];
+  for (let k = 0; k < words.length; k++) {
+    const m = REDIRECT_RE.exec(words[k]);
+    if (!m || (m[1] === "&" && /^(?:\d+|-)?$/.test(m[2]))) continue;
+    if (m[2] !== "") out.push(m[2]);
+    else if (k + 1 < words.length) out.push(words[++k]);
+  }
+  // The command word: past assignments and bare wrapper words, so `git rm` is no removal.
+  let k = 0;
+  while (k < words.length && (/^[A-Za-z_]\w*=/.test(words[k]) || WRAPPER_WORDS.has(words[k]))) k++;
+  if (k < words.length) {
+    const name = path.posix.basename(words[k]);
+    const sed = name === "sed" && words.slice(k + 1).some((w) => /^(?:-[A-Za-z]*i|--in-place)/.test(w));
+    if (!WRITE_WORDS.has(name) && !sed) return out;
+    let ops = [];
+    let target = null;
+    let script = false;
+    for (let j = k + 1; j < words.length; j++) {
+      const w = words[j];
+      const r = REDIRECT_RE.exec(w);
+      if (r || w[0] === "<") {
+        if ((r ? r[2] : w.replace(/^\d*<+-?/, "")) === "") j++;
+      } else if (w[0] !== "-") ops.push(w);
+      else if (sed && w === "-i" && (words[j + 1] === "''" || words[j + 1] === '""')) j++;
+      else if (sed && /^(?:-e|-f|--expression|--file)$/.test(w)) {
+        script = true;
+        j++;
+      } else if (sed && /^(?:-e|-f|--expression=|--file=)/.test(w)) script = true;
+      else if (COPY_WORDS.has(name) && w === "-t") target = words[++j] ?? null;
+      else if (COPY_WORDS.has(name) && w.startsWith("--target-directory=")) target = w.slice("--target-directory=".length);
+      else if (name === "install" && /^-[mog]$/.test(w)) j++;
+    }
+    // Without -e or -f the first operand is the sed script, no path.
+    if (sed && !script) ops.shift();
+    // An mv removes its sources, so each is a written path; cp, install and ln only read theirs.
+    if (COPY_WORDS.has(name) && target !== null) ops = name === "mv" ? [...ops, target] : [target];
+    else if (COPY_WORDS.has(name) && name !== "mv") ops = ops.slice(-1);
+    out.push(...ops);
+  }
+  return out;
+}
+
+/** Notes `bash-path` for a path a Bash command names: any path in the change workspace or, in a
+ * tree run, in the main root outside the tree, its admin dir and its `.freeharness/`; and a `write` target in
+ * the tree outside the write scope and `.freeharness/`, or outside the tree. A note, never a
+ * failure: the diff guards and the lead's diff read decide. */
+function bashPath(abs, write, ctx) {
+  const inWs = ctx.ws ? under(abs, ctx.ws.roots) : null;
+  if (inWs !== null) return emit(ctx, "bash-path", `bash-path ${workspacePath(ctx.ws, inWs)}`, true);
+  const rel = under(abs, ctx.tree);
+  if (rel !== null) {
+    const p = writable(rel);
+    if (write && p !== null && !ctx.scope.some((s) => scopeMatches(s, p))) emit(ctx, "bash-path", `bash-path ${shownPath(p)}`, true);
+    return;
+  }
+  const inMain = ctx.main ? under(abs, ctx.main) : null;
+  if (inMain !== null) {
+    const p = writable(inMain);
+    // The tree's admin dir belongs to the tree: like a tree path, only a write there is noted.
+    const own = !write && adminDir(ctx) !== null && under(abs, ctx.admin) !== null;
+    if (p !== null && !own) emit(ctx, "bash-path", `bash-path ${shownPath(p)}`, true);
+  } else if (write) emit(ctx, "bash-path", `bash-path ${shownPath(abs)}`, true);
+}
+
+/** The spellings of the tree's git admin dir, looked up once per scan; null when git names none. */
+function adminDir(ctx) {
+  if (ctx.admin === undefined) {
+    const info = treeInfo(ctx.mainDir, ctx.treeDir);
+    ctx.admin = info.ok ? spellings(info.gitDir) : null;
+  }
+  return ctx.admin;
+}
+
+/** Fails `index-write` for a git command that writes the index or HEAD when its effective
+ * directory lies in the working tree or its admin dir, and `tree-leak` when it lies elsewhere in
+ * the main root; a temporary repository stays free. `--git-dir`, `--work-tree` and the `GIT_DIR`,
+ * `GIT_WORK_TREE` and `GIT_INDEX_FILE` assignments before `git` are judged too, since they move the
+ * index a command writes away from its directory. `git` counts only as the command word: every
+ * word before it is an assignment, a wrapper word, an option after a wrapper or that option's
+ * value, so `sudo -u me git` counts while `echo remember to git add` does not. */
+function gitIndexWrite(words, here, text, ctx) {
+  let g = 0;
+  let wrapped = false;
+  while (g < words.length && words[g] !== "git" && !words[g].endsWith("/git")) {
+    const w = words[g];
+    const value = wrapped && g > 0 && words[g - 1][0] === "-" && w[0] !== "-";
+    if (WRAPPER_WORDS.has(w)) wrapped = true;
+    else if (!/^[A-Za-z_]\w*=/.test(w) && !(wrapped && w[0] === "-") && !value) return;
+    g++;
+  }
+  if (g >= words.length) return;
+  let dir = here;
+  // Values git resolves only after every -C, as it does.
+  const repo = [];
+  for (const w of words.slice(0, g)) {
+    const m = /^GIT_(?:DIR|WORK_TREE|INDEX_FILE)=/.exec(w);
+    if (m) repo.push(w.slice(m[0].length));
+  }
+  let k = g + 1;
+  while (k < words.length && words[k].startsWith("-")) {
+    const t = words[k];
+    const eq = /^--(?:git-dir|work-tree)=/.exec(t);
+    if (t === "-C") {
+      dir = words[k + 1] === undefined ? null : literalPath(words[k + 1], dir);
+      k += 2;
+    } else if (eq) {
+      repo.push(t.slice(eq[0].length));
+      k++;
+    } else if (t === "--git-dir" || t === "--work-tree") {
+      if (words[k + 1] !== undefined) repo.push(words[k + 1]);
+      k += 2;
+    } else k += GIT_VALUED.has(t) ? 2 : 1;
+  }
+  if (k >= words.length) return;
+  const sub = words[k];
+  const rest = words.slice(k + 1);
+  const writes =
+    INDEX_SUBCOMMANDS.has(sub) ||
+    (sub === "stash" && rest[0] !== "list" && rest[0] !== "show") ||
+    (sub === "restore" && rest.some((a) => a === "--staged" || /^-[A-Za-z]*S/.test(a))) ||
+    (sub === "checkout" && rest.includes("--")) ||
+    (sub === "apply" && rest.some((a) => a === "--index" || a === "--cached"));
+  if (!writes) return;
+  const dirs = dir === null ? [] : [dir];
+  for (const v of repo) {
+    const abs = literalPath(v, dir);
+    if (abs !== null) dirs.push(abs);
+  }
+  const admin = ctx.main ? adminDir(ctx) : null;
+  // Only git reads the admin dir as the tree's index; a file write there stays a leak.
+  const own = (d) => under(d, ctx.tree) !== null || (admin !== null && under(d, admin) !== null);
+  if (dirs.some(own)) emit(ctx, "index-write", `index-write ${scanDetail(text)}`);
+  if (ctx.main && dirs.some((d) => !own(d) && under(d, ctx.main) !== null)) emit(ctx, "tree-leak", `tree-leak ${scanDetail(text)}`);
+}
+
+/** Applies the literal checks to one Bash command run from `here`. The command splits on the
+ * separators alone and each segment on whitespace; a leading `cd` or `pushd` moves `here` for
+ * the segments after it, and an expanded directory leaves it unknown. */
+function scanBash(command, here, ctx) {
+  let cwdNoted = false;
+  for (const segment of command.split(SEPARATOR_RE)) {
+    const words = segment.trim().split(/\s+/).filter((w) => w !== "");
+    if (words.length === 0) continue;
+    if (words[0] === "cd" || words[0] === "pushd") {
+      const arg = words.slice(1).find((w) => !/^-[A-Za-z@]+$/.test(w));
+      here = arg === undefined ? null : literalPath(arg, here);
+      continue;
+    }
+    if (ctx.main && !cwdNoted && here !== null && under(here, ctx.tree) === null) {
+      cwdNoted = true;
+      emit(ctx, "tree-cwd", `tree-cwd ${scanDetail(command)}`, true);
+    }
+    gitIndexWrite(words, here, segment, ctx);
+    const written = writeWords(words);
+    const named = words.filter((w) => !written.includes(w) && unquote(w).includes("/"));
+    for (const [list, write] of [[written, true], [named, false]]) {
+      for (const w of list) {
+        const abs = literalPath(w, here);
+        if (abs !== null) bashPath(abs, write, ctx);
+      }
+    }
+  }
+  if (ctx.suite !== "" && command.replace(/\s+/g, " ").includes(ctx.suite)) emit(ctx, "suite-run", "suite-run");
+}
+
+/** Judges one Edit, MultiEdit, Write or NotebookEdit path: in a tree run a path under the main
+ * root outside the tree and its `.freeharness/` fails `tree-leak`; a path in the change workspace
+ * other than a spared report fails `tree-leak` in a tree run, else `workspace-write`. An edit
+ * inside the tree is the diff guards' to judge. */
+function toolWrite(abs, ctx) {
+  if (ctx.main && under(abs, ctx.tree) === null) {
+    const p = writable(under(abs, ctx.main));
+    if (p !== null) emit(ctx, "tree-leak", `tree-leak ${shownPath(p)}`);
+  }
+  const rel = ctx.ws ? under(abs, ctx.ws.roots) : null;
+  if (rel === null || rel === ctx.ws.report) return;
+  const kind = ctx.main ? "tree-leak" : "workspace-write";
+  emit(ctx, kind, `${kind} ${workspacePath(ctx.ws, rel)}`);
+}
+
+/** Checks every tool call a worker transcript records (at most `SCAN_BOUND` bytes of it) by
+ * literal rules: Bash commands for index writes, a run of the brief's `Suite:` command and the
+ * paths they name, and tool writes for a tree leak or a planted change workspace. The working
+ * tree is the git top-level of `cwd`, or `cwd` itself with a `transcript-tree-unresolved <git's
+ * first error line>` note when git names none. Malformed lines are skipped. Returns
+ * `{ failures, notes, truncated }`: the FAIL and NOTE line bodies in scan order and whether the
+ * bound cut the transcript, which the caller notes with the agent id; an unreadable transcript
+ * gives no failures and the one note `transcript-unavailable unreadable`. With `mainRoot`, `cwd`
+ * is a task's tree: an index write or a tool write under the main root outside the tree fails
+ * `tree-leak`, and a command run outside the tree is noted `tree-cwd`. With `report`, the path
+ * of the review package in `<root>/.freeharness/sdd/<change>/`, a tool write in that directory
+ * other than to the report fails too, since the guard trusts the ledger and round copies there. */
+export function scanTranscript(file, brief, cwd, mainRoot, report) {
+  const read = readBoundedNoFollow(file, SCAN_BOUND, false);
+  if (read === null) return { failures: [], notes: ["transcript-unavailable unreadable"] };
+  const notes = [];
+  let tree;
+  try {
+    tree = fs.realpathSync(runGit(["rev-parse", "--show-toplevel"], cwd).trim());
+  } catch (err) {
+    tree = path.resolve(cwd);
+    notes.push(`transcript-tree-unresolved ${scanDetail(String(err instanceof Error ? err.message : err).split("\n")[0])}`);
+  }
+  const suite = brief && brief.header && typeof brief.header.Suite === "string" ? brief.header.Suite.replace(/\s+/g, " ").trim() : "";
+  const scope = brief && Array.isArray(brief.scope) ? brief.scope : [];
+  const ctx = { tree: spellings(tree), treeDir: tree, suite, scope, failures: [], notes, seen: new Set(), counts: new Map(), capped: 0 };
+  if (mainRoot !== undefined) {
+    ctx.main = spellings(mainRoot);
+    ctx.mainDir = mainRoot;
+  }
+  if (report !== undefined) ctx.ws = changeWorkspace(report);
+  const text = read.cut ? read.text.slice(0, read.text.lastIndexOf("\n") + 1) : read.text;
+  for (const raw of text.split("\n")) {
+    let rec;
+    try {
+      rec = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    const content = rec && rec.type === "assistant" && rec.message ? rec.message.content : null;
+    if (!Array.isArray(content)) continue;
+    const dir = typeof rec.cwd === "string" && path.isAbsolute(rec.cwd) ? path.resolve(rec.cwd) : tree;
+    const here = dir.length > SCAN_PATH_MAX ? null : dir;
+    for (const part of content) {
+      if (!part || part.type !== "tool_use" || !part.input) continue;
+      if (part.name === "Bash" && typeof part.input.command === "string") scanBash(part.input.command, here, ctx);
+      const target = part.name === "NotebookEdit" ? (part.input.notebook_path ?? part.input.file_path) : part.input.file_path;
+      if ((ctx.main || ctx.ws) && ["Edit", "MultiEdit", "Write", "NotebookEdit"].includes(part.name) && typeof target === "string" && target.length <= SCAN_PATH_MAX) {
+        if (path.isAbsolute(target) || here !== null) toolWrite(path.resolve(here ?? path.sep, target), ctx);
+      }
+    }
+  }
+  if (ctx.capped > 0) ctx.notes.push(`scan-capped ${ctx.capped}`);
+  return { failures: ctx.failures, notes: ctx.notes, truncated: read.cut };
+}
+
+/** Usage text: one line per subcommand with its arguments, in order. `commit` runs the repo's
+ * hooks (no --no-verify); a commit they fail leaves the paths its add staged staged. */
+const USAGE = [
+  "usage: validate-handoff.mjs <subcommand> [args]",
+  "  brief-init <change> <task>",
+  "  briefs <dir|file...> [--band small|medium|large]",
+  "  handoff <file> [--base <sha>] [--brief <brief.md>] [--in-flight <brief.md>]... [--lead <path>]... [--agent <agent_id>] [--tree <path>]",
+  "  budget <ledger.jsonl> <task> [--ceiling <n>]",
+  "  ledger <change-dir>",
+  "  recover <transcript.jsonl> <report> [--force]",
+  "  name <dispatch-name>",
+  "  gate <findings.md>",
+  "  route <brief.md> [--round <n>] [--p0] [--security]",
+  "  route <brief.md> --review --base <sha> [--round <n>] [--p0] [--final-spec] [--probed]",
+  "  round-base <brief.md> <n> [--tree <path>] [--p0] [--security]",
+  "  round-diff <brief.md> <n> [--tree <path>]",
+  "  state <report> <state.md>",
+  "  tree <brief.md>",
+  "  commit <report> [<report>...] -F <message-file> [--lead <path>]... [--tree <path> --base <sha> [--tree-only]]",
+].join("\n");
+
+/** Splits a runner's options out of its arguments: `--name value` pairs of `allowed`, every
+ * repeated value kept, `valueless` switches recorded as `true`. A trailing valued option
+ * yields `undefined`; an unlisted option is the one `unknown option` error every subcommand
+ * prints. */
+function parseFlags(rest, allowed, valueless = []) {
+  const values = {};
+  for (let i = 0; i < rest.length; i++) {
+    const flag = rest[i];
+    if (!values[flag]) values[flag] = [];
+    if (valueless.includes(flag)) {
+      values[flag].push(true);
+      continue;
+    }
+    if (!allowed.includes(flag)) return { values, error: `unknown option ${JSON.stringify(flag)}` };
+    values[flag].push(rest[i + 1]);
+    i++;
+  }
+  return { values, error: null };
+}
+
+/** The last value given for an option; undefined when absent. */
+function lastValue(values, flag) {
+  const list = values[flag];
+  return list ? list[list.length - 1] : undefined;
+}
+
+/** Prints one `FAIL` per problem, or `OK <label>`; returns the exit code. */
+function report(errors, label) {
+  for (const e of errors) console.error(`FAIL ${e}`);
+  if (errors.length === 0) console.log(`OK ${label}`);
+  return errors.length === 0 ? 0 : 1;
+}
+
+/** Every checkbox line of tasks.md with its id (null when the first token names none) and the
+ * annotation lines under it. One pass with no backtracking regex on the id, since a task line
+ * may run to thousands of characters. */
+export function parseTasksFile(text) {
+  const tasks = [];
+  let current = null;
+  for (const raw of text.split("\n")) {
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    const t = TASK_LINE.exec(line);
+    if (t) {
+      const token = /^\S*/.exec(t[2])[0];
+      let end = token.length;
+      while (end > 0 && ".:)".includes(token[end - 1])) end--;
+      const id = token.slice(0, end);
+      current = { id: BRIEF_TASK_RE.test(id) ? id : null, line, annotations: [] };
+      tasks.push(current);
+    } else if (current && TASK_ANNOTATION_RE.test(line)) current.annotations.push(line);
+    else current = null;
+  }
+  return tasks;
+}
+
+/** The project's full-suite command for a skeleton's `Suite:`; null unless a valid rules file names one. */
+export function suiteFor(root) {
+  const lint = readBriefLint(root);
+  return "error" in lint ? null : lint.suite;
+}
+
+/** The project rules file is data the project owner writes and a task tree may carry: capped like
+ * a ledger, never followed through a link, so it cannot stall or redirect the validator. */
+const BRIEF_LINT_FILE = path.join(".freeharness", "brief-lint.json");
+const BRIEF_LINT_BOUND = 64 * 1024;
+const BRIEF_LINT_LEAD_BOUND = 300;
+const BRIEF_LINT_TOP = new Set(["suite", "rules"]);
+const BRIEF_LINT_RULE = new Set(["when", "verify", "setup", "guarded", "lead"]);
+
+const isPlainObject = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+const nonEmptyString = (v) => typeof v === "string" && v !== "";
+
+/** The schema problem of one rule, or null; the reason names the field so the owner can find it. */
+function briefLintRuleError(rule, i) {
+  const at = `rules[${i}]`;
+  if (!isPlainObject(rule)) return `${at} must be an object`;
+  const extra = Object.keys(rule).find((k) => !BRIEF_LINT_RULE.has(k));
+  if (extra !== undefined) return `${at} unknown key ${quoted(JSON.stringify(extra))}`;
+  const { when, verify, setup, guarded, lead } = rule;
+  if (!Array.isArray(when) || when.length === 0 || !when.every(nonEmptyString)) return `${at}.when must be a non-empty array of non-empty strings`;
+  if (when.some((g) => g.startsWith("/") || g.split("/").includes(".."))) return `${at}.when must stay inside the project (no leading / or .. segment)`;
+  if (verify !== undefined && !(Array.isArray(verify) && verify.every(nonEmptyString))) return `${at}.verify must be an array of non-empty strings`;
+  if (setup !== undefined && !nonEmptyString(setup)) return `${at}.setup must be a non-empty string`;
+  if (guarded !== undefined && typeof guarded !== "boolean") return `${at}.guarded must be a boolean`;
+  if (lead !== undefined && !(nonEmptyString(lead) && lead.length <= BRIEF_LINT_LEAD_BOUND)) return `${at}.lead must be a non-empty string of at most ${BRIEF_LINT_LEAD_BOUND} characters`;
+  return null;
+}
+
+/** The project's brief-lint rules: `{suite, rules}` (no suite and no rules when the file is
+ * absent), or `{error}` when the file cannot be trusted, in which case no rule applies. */
+export function readBriefLint(root) {
+  const file = path.join(root, BRIEF_LINT_FILE);
+  let st;
+  try {
+    st = fs.lstatSync(file);
+  } catch (err) {
+    if (err.code === "ENOENT" || err.code === "ENOTDIR") return { suite: null, rules: [] };
+    return { error: `unreadable (${quoted(String(err.code ?? err))})` };
+  }
+  if (st.isSymbolicLink()) return { error: "a symlink, not followed" };
+  if (!st.isFile()) return { error: "not a regular file" };
+  const read = readBoundedNoFollow(file, BRIEF_LINT_BOUND, false);
+  if (read === null) return { error: "unreadable" };
+  if (read.cut) return { error: `over ${BRIEF_LINT_BOUND} bytes` };
+  let data;
+  try {
+    data = JSON.parse(read.text);
+  } catch {
+    return { error: "invalid JSON" };
+  }
+  if (!isPlainObject(data)) return { error: "top level must be an object" };
+  const extra = Object.keys(data).find((k) => !BRIEF_LINT_TOP.has(k));
+  if (extra !== undefined) return { error: `unknown key ${quoted(JSON.stringify(extra))}` };
+  if (data.suite !== undefined && !nonEmptyString(data.suite)) return { error: "suite must be a non-empty string" };
+  if (data.rules !== undefined && !Array.isArray(data.rules)) return { error: "rules must be an array" };
+  const rules = data.rules ?? [];
+  for (let i = 0; i < rules.length; i++) {
+    const error = briefLintRuleError(rules[i], i);
+    if (error !== null) return { error };
+  }
+  return { suite: data.suite ?? null, rules };
+}
+
+/** The verdicts of the project rules for one brief: `errors` (without the brief name) and `notes`
+ * (without `NOTE `). A directory or glob entry is judged by its literal prefix, the one path the
+ * lead committed to, so a rule never fires on files the entry merely could reach. */
+export function lintErrors(brief, lint) {
+  const errors = [];
+  const notes = [];
+  if (!lint || "error" in lint) return { errors, notes };
+  const tree = brief.header.Tree !== undefined && !/^none\s+-\s*\S/i.test(brief.header.Tree);
+  const verify = brief.verify ?? [];
+  const setupLine = brief.header.Setup ?? "";
+  (lint.rules ?? []).forEach((rule, i) => {
+    for (const e of briefEntries(brief)) {
+      const literal = e.path.split(/[*?]/)[0];
+      if (!rule.when.some((g) => scopeMatches(g, literal))) continue;
+      const shown = quoted(entryText(e));
+      for (const s of rule.verify ?? []) if (!verify.some((l) => l.includes(s))) errors.push(`lint-verify ${i} ${shown} ${quoted(s)}`);
+      if (rule.setup !== undefined && tree && !setupLine.includes(rule.setup)) errors.push(`lint-setup ${i} ${shown}`);
+      if (rule.guarded === true) notes.push(`lint-guarded ${shown}`);
+      if (rule.lead !== undefined) notes.push(`lint-lead-run ${i} ${quoted(rule.lead)}`);
+    }
+  });
+  return { errors, notes };
+}
+
+/** Template sections a skeleton copies as they stand: they bind every worker the same way. */
+const COPIED_SECTIONS = new Set(["Run rules", "Handoff"]);
+
+/** Lines of the first markdown fence of the brief template; null when the file or fence is absent. */
+function briefTemplate(file) {
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch {
+    return null;
+  }
+  const lines = text.split(/\r?\n/);
+  const start = lines.findIndex((l) => /^```markdown\s*$/.test(l));
+  const end = start < 0 ? -1 : lines.findIndex((l, i) => i > start && /^```\s*$/.test(l));
+  return end < 0 ? null : lines.slice(start + 1, end);
+}
+
+/** `value` without one wrapping `<...>` pair, so a placeholder's hint never nests a second pair. */
+function unwrapAngle(value) {
+  if (!value.startsWith("<") || !value.endsWith(">")) return value;
+  let depth = 0;
+  for (let i = 0; i < value.length; i++) {
+    depth += value[i] === "<" ? 1 : value[i] === ">" ? -1 : 0;
+    if (depth === 0) return i === value.length - 1 ? value.slice(1, -1) : value;
+  }
+  return value;
+}
+
+/** The skeleton text: known header values set, the task copied, every judgment part a placeholder. */
+function briefSkeleton(template, entry, known) {
+  const fill = (what) => `<fill: ${what}>`;
+  const out = [];
+  let section = null;
+  for (const line of template) {
+    const bare = line.trim();
+    if (bare.startsWith("<!--") && bare.endsWith("-->")) continue;
+    if (line.startsWith("## ")) {
+      section = line.slice(3).trim();
+      out.push(line);
+      if (section === "Task") out.push(entry.line, ...entry.annotations);
+      else if (!COPIED_SECTIONS.has(section)) out.push(fill(section.toLowerCase()));
+      continue;
+    }
+    if (section !== null) {
+      if (COPIED_SECTIONS.has(section) || bare === "") out.push(line);
+      continue;
+    }
+    const h = /^([A-Z][\w ]*):\s*(.*)$/.exec(line);
+    if (line.startsWith("# ")) out.push(`# Brief ${entry.id}: ${fill("title")}`);
+    else if (h) out.push(`${h[1]}: ${known.get(h[1]) ?? fill(unwrapAngle(h[2].trim()))}`);
+    else out.push(line);
+  }
+  return `${out.join("\n").replace(/\n+$/, "")}\n`;
+}
+
+/** True when the nearest existing ancestor of `dir` resolves outside `root`. */
+function leavesRoot(root, dir) {
+  let p = dir;
+  while (!fs.existsSync(p) && path.dirname(p) !== p) p = path.dirname(p);
+  const rel = path.relative(fs.realpathSync(root), fs.realpathSync(p));
+  return rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel);
+}
+
+/** The main worktree of the checkout at `top`, by its common git directory; `{ error }` when no
+ * main tree holds that directory. */
+function mainWorktree(top) {
+  let gitDir;
+  let commonDir;
+  try {
+    [gitDir, commonDir] = runGit(["rev-parse", "--git-dir", "--git-common-dir"], top)
+      .split("\n")
+      .slice(0, 2)
+      .map((p) => fs.realpathSync(path.resolve(top, p.trim())));
+  } catch (err) {
+    return { error: `common git directory unresolved (${quoted(String(err instanceof Error ? err.message : err).split("\n")[0])})` };
+  }
+  if (gitDir === commonDir) return { root: top };
+  const main = path.dirname(commonDir);
+  const info = treeInfo(main, fs.realpathSync(top));
+  return info.ok ? { root: main } : { error: `no main worktree holds ${quoted(commonDir)} (${quoted(info.reason)})` };
+}
+
+/** Runs `brief-init`: the skeleton of one task's brief, never written over an existing brief. */
+function runBriefInit(rest) {
+  if (rest.length !== 2) return null;
+  const [change, task] = rest;
+  const fail = (e) => report([e], "brief-init");
+  if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(change)) return fail(`task-shape change ${quoted(change)} is not kebab-case`);
+  if (!BRIEF_TASK_RE.test(task)) return fail(`task-shape task ${quoted(task)} is not a dotted task id or final`);
+  // The lead and hooks read the main tree's workspace; Base stays this checkout's HEAD.
+  let here = process.cwd();
+  let root = here;
+  let top = null;
+  try {
+    top = git(["rev-parse", "--show-toplevel"], here);
+  } catch {
+    // outside a repository the current directory is the project root
+  }
+  if (top !== null) {
+    const main = mainWorktree(top);
+    if (main.error) return fail(`tree-path ${quoted(top)}: ${main.error}`);
+    here = top;
+    root = main.root;
+  }
+  const tasksFile = path.join(root, "openspec", "changes", change, "tasks.md");
+  let tasks;
+  try {
+    tasks = fs.readFileSync(tasksFile, "utf8");
+  } catch {
+    return fail(`tasks-missing ${quoted(tasksFile)}`);
+  }
+  const entry = parseTasksFile(tasks).find((t) => t.id === task);
+  if (!entry) return fail(`task-unknown ${task}`);
+  const templateFile = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "reference", "brief.md");
+  const template = briefTemplate(templateFile);
+  if (!template) return fail(`template-missing ${quoted(templateFile)}`);
+  let base = null;
+  try {
+    base = git(["rev-parse", "HEAD"], here);
+  } catch {
+    // no commit yet: Base stays a placeholder
+  }
+  const known = new Map([["Change", change], ["Spec", change], ["Task", task], ["Base", base], ["Report", `.freeharness/sdd/${change}/${task}.review.md`], ["Suite", suiteFor(root)]]);
+  const dir = path.join(root, ".freeharness", "sdd", change);
+  const file = path.join(dir, `${task}.brief.md`);
+  try {
+    if (leavesRoot(root, dir)) return fail(`workspace-escape ${quoted(dir)}`);
+    fs.mkdirSync(dir, { recursive: true });
+    if (leavesRoot(root, dir)) return fail(`workspace-escape ${quoted(dir)}`);
+  } catch (err) {
+    return fail(`workspace-escape ${quoted(dir)} (${quoted(err.code ?? String(err))})`);
+  }
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | (fs.constants.O_NOFOLLOW || 0), 0o644);
+  } catch (err) {
+    return fail(`${err.code === "EEXIST" ? "brief-exists" : "brief-unwritable"} ${quoted(file)}`);
+  }
+  try {
+    fs.writeSync(fd, briefSkeleton(template, entry, known));
+  } finally {
+    fs.closeSync(fd);
+  }
+  console.log(`OK brief-init ${quoted(file)}`);
+  return 0;
+}
+
+/** Runs `briefs`: a directory also holds landed briefs, so only named files get the set checks.
+ * Null, the usage, without a path or with an unknown band. */
+function runBriefs(rest) {
+  const caps = { small: 4, medium: 8, large: 12 };
+  const args = [];
+  let band = "small";
+  for (let i = 0; i < rest.length; i++) {
+    if (rest[i] === "--band") band = rest[++i];
+    else args.push(rest[i]);
+  }
+  if (!Object.hasOwn(caps, band ?? "")) {
+    console.error(`FAIL --band must be small|medium|large; got ${quoted(String(band ?? "none"))}`);
+    return null;
+  }
+  if (args.length < 1) return null;
+  const { files, fromDir } = collectBriefs(args);
+  if (fromDir) console.log(`NOTE briefs-dir ${files.length}`);
+  return report(validateBriefs(files.map(readBrief), fromDir ? { kind: "dir" } : { kind: "set", cap: caps[band] }), args.join(" "));
+}
+
+/** Runs `handoff`: the schema, with `--brief` the probe citations and the checkpoint, with
+ * `--base` the git guards, with `--agent` the worker transcript scan, whose notes never change
+ * the exit status. `--tree` runs the git reads and the scan in the task's tree and adds the leak
+ * checks, since the one way a tree worker still harms a peer is writing the main copy. */
+function runHandoff(rest) {
+  if (rest.length < 1) return null;
+  const file = rest[0];
+  const { values, error } = parseFlags(rest.slice(1), ["--base", "--brief", "--in-flight", "--lead", "--agent", "--tree"]);
+  if (error) {
+    console.error(`FAIL ${error}`);
+    return 1;
+  }
+  for (const [flag, list] of Object.entries(values)) {
+    if (list.some((v) => v === undefined)) {
+      console.error(`FAIL ${flag} requires a value`);
+      return 1;
+    }
+  }
+  const base = lastValue(values, "--base");
+  const briefFile = lastValue(values, "--brief");
+  const inFlight = values["--in-flight"] ?? [];
+  const leadPaths = values["--lead"] ?? [];
+  if (base !== undefined && base.startsWith("-")) {
+    console.error(`FAIL --base must not start with '-'; got ${JSON.stringify(base)}`);
+    return 1;
+  }
+  for (const l of leadPaths) {
+    if (l.startsWith("-")) {
+      console.error(`FAIL --lead must not start with '-'; got ${JSON.stringify(l)}`);
+      return 1;
+    }
+  }
+  const normalizedLeadPaths = leadPaths.map((l) => path.posix.normalize(l));
+  const treeArg = lastValue(values, "--tree");
+  let main = null;
+  let work = process.cwd();
+  let reportDir = path.dirname(path.resolve(file));
+  if (treeArg !== undefined) {
+    const t = briefFile === undefined ? { error: `tree-path ${quoted(treeArg)}: --tree needs --brief <brief.md>` } : roundContext(briefFile, null, treeArg);
+    if (t.error) {
+      console.error(`FAIL ${t.error.startsWith("tree-path ") ? t.error : `tree-path ${quoted(briefFile)}: ${t.error}`}`);
+      return 1;
+    }
+    // A report the tree holds would let the worker pick the ledger, hence the transcript scanned.
+    let real = null;
+    try {
+      real = fs.realpathSync(reportDir);
+    } catch {
+      // Refused below.
+    }
+    if (real !== t.changeDir) {
+      console.error(`FAIL tree-path ${quoted(file)}: the report must sit in ${quoted(t.changeDir)}`);
+      return 1;
+    }
+    ({ root: main, work, changeDir: reportDir } = t);
+  }
+  let handoffObj = null;
+  let errors;
+  try {
+    handoffObj = readHandoff(file);
+    errors = validateHandoff(handoffObj);
+  } catch (err) {
+    errors = [err instanceof Error ? err.message : String(err)];
+  }
+  // The brief is read once for the probe citations and the diff guards; an unreadable brief is
+  // its own failure and skips the guards, as it did when only they read it.
+  let briefInfo = null;
+  if (handoffObj && briefFile !== undefined) {
+    try {
+      briefInfo = readBrief(briefFile);
+      errors = errors.concat(missingProbes(handoffObj, briefInfo.probes));
+    } catch (err) {
+      errors.push(err instanceof Error ? err.message : String(err));
+    }
+  }
+  // A markdown report carries the checkpoint the next round starts from, whatever its status; a
+  // `.json` handoff has no report body to carry one.
+  if (briefFile !== undefined && !file.endsWith(".json")) {
+    let text = null;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch {
+      // Already reported by the schema read above.
+    }
+    if (text !== null) errors = errors.concat(checkpointOf(text).errors);
+  }
+  // A foreign base skips the diff guards: they would compare against unrelated history.
+  if (handoffObj && base !== undefined && (briefFile === undefined || briefInfo !== null)) {
+    try {
+      for (const p of stagedPaths(work)) errors.push(`staged ${quoted(p)}`);
+      if (!isAncestor(base, work)) throw new Error(`base-not-ancestor ${base}`);
+      const changed = changedPaths(base, work);
+      const scope = briefInfo ? briefInfo.scope : null;
+      const peerScope = inFlight.flatMap((f) => readBrief(f).scope);
+      errors = errors.concat(guardHandoff(handoffObj, changed, scope, peerScope, normalizedLeadPaths));
+      // A peer's or the lead's file is not this worker's to trim.
+      const own = changed.filter((p) => !peerScope.some((s) => scopeMatches(s, p)) && !normalizedLeadPaths.some((l) => scopeMatches(l, p)) && !isHarnessPath(p));
+      const share = commentShareChecks(base, own, work);
+      for (const n of share.notes) console.log(`NOTE ${n}`);
+      errors = errors.concat(share.errors);
+      const claimed = Array.isArray(handoffObj.files_changed) ? handoffObj.files_changed.filter((p) => typeof p === "string") : [];
+      const needles = briefInfo ? needlesFromBrief(briefInfo) : null;
+      errors = errors.concat(scanAddedLines(base, claimed, needles, work));
+      // An append entry may rewrite only the base file's last 5 lines, where a closing `]` sits.
+      for (const p of new Set((briefInfo ? briefInfo.entries : []).filter((e) => e.append).map((e) => e.path))) {
+        let old;
+        try {
+          old = runGit(["cat-file", "blob", `${base}:${p}`], work, { maxBuffer: ROUND_DIFF_MAX_BUFFER });
+        } catch (err) {
+          if (err.status === 128) continue;
+          throw err;
+        }
+        const keep = old.split("\n").length - (old.endsWith("\n") ? 1 : 0) - 5;
+        const diff = runGit(["--literal-pathspecs", "diff", "--no-color", "--no-ext-diff", "--no-textconv", "--text", "-U0", base, "--", p], work, { maxBuffer: ROUND_DIFF_MAX_BUFFER });
+        // A pure insertion (old count 0) starts after its old line, so one after line `keep` is in the tail.
+        if ([...diff.matchAll(/^@@ -(\d+)(?:,(\d+))? \+/gm)].some((m) => Number(m[1]) < keep + (m[2] === "0" ? 0 : 1))) errors.push(`append-only ${quoted(p)}`);
+      }
+    } catch (err) {
+      errors.push(err instanceof Error ? err.message : String(err));
+    }
+  }
+  // Only this brief's scope: the main tree always carries lead edits that are no leak.
+  if (main !== null && briefInfo !== null) {
+    try {
+      for (const p of changedPaths("HEAD", main)) {
+        if (briefInfo.scope.some((s) => scopeMatches(s, p)) && !normalizedLeadPaths.some((l) => scopeMatches(l, p)) && !isHarnessPath(p)) errors.push(`tree-leak ${quoted(p)}`);
+      }
+    } catch (err) {
+      errors.push(err instanceof Error ? err.message : String(err));
+    }
+  }
+  const agent = lastValue(values, "--agent");
+  if (agent !== undefined) {
+    // The report sits in the change workspace, beside the ledger that names the transcript.
+    const found = transcriptFor(agent, reportDir);
+    const notes = found.notes.map((n) => `transcript-unavailable ${n}`);
+    const failures = new Set();
+    for (const p of found.paths) {
+      const scan = scanTranscript(p, briefInfo, work, main ?? undefined, file);
+      notes.push(...scan.notes);
+      if (scan.truncated) notes.push(`transcript-truncated ${quoted(agent)}`);
+      for (const f of scan.failures) failures.add(f);
+    }
+    // The scan quotes what it shows; this pass keeps every transcript-derived line safe whatever
+    // a future scan line forgets to quote.
+    for (const n of notes) console.log(`NOTE ${escapeControls(n)}`);
+    errors = errors.concat([...failures].map(escapeControls));
+  }
+  return report(errors, file);
+}
+
+/** Whether a `Task:` header declares the task: exact match, a batch id token, or a `b` task
+ * matching the batch's first token (else `2.10` wrongly matches `2.1`). Mirrors the cost
+ * tracker's rule, so the budget and the ledger attribute a dispatch to the same brief. */
+function matchesTaskHeader(headerValue, task) {
+  const raw = headerValue.trim();
+  if (raw === task) return true;
+  const ids = raw
+    .split(/[,\s]+/)
+    .map((s) => s.trim())
+    .filter((s) => LEDGER_TASK_RE.test(s));
+  if (ids.includes(task)) return true;
+  if (task.endsWith("b") && ids[0] === task.slice(0, -1)) return true;
+  return false;
+}
+
+/** Byte cap on one brief read by `budget`, or one findings ledger read by `gate`. */
+const MAX_BRIEF_BYTES = 1024 * 1024;
+
+/** A brief's text and mtime through one fd opened without following a symlink leaf or blocking
+ * on a FIFO, so the checked file is the one read; `reason` says why nothing was read. The buffer
+ * is sized from the fstat and grows toward the cap only while the file grows, so memory tracks
+ * the brief's size rather than the cap. */
+function readBriefContained(file) {
+  let fd;
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+  } catch (e) {
+    return { text: null, reason: e && typeof e === "object" && "code" in e ? String(e.code) : "open failed" };
+  }
+  try {
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) return { text: null, reason: "not a regular file" };
+    if (st.size > MAX_BRIEF_BYTES) return { text: null, reason: "over the 1 MiB cap" };
+    let buf = Buffer.allocUnsafe(st.size + 1);
+    let total = 0;
+    for (;;) {
+      if (total === buf.length) {
+        if (total > MAX_BRIEF_BYTES) return { text: null, reason: "over the 1 MiB cap" };
+        const grown = Buffer.allocUnsafe(Math.min(buf.length * 2, MAX_BRIEF_BYTES + 1));
+        buf.copy(grown, 0, 0, total);
+        buf = grown;
+      }
+      const n = fs.readSync(fd, buf, total, buf.length - total, total);
+      if (n === 0) break;
+      total += n;
+    }
+    return { text: buf.toString("utf8", 0, total), mtimeMs: st.mtimeMs, reason: null };
+  } catch (e) {
+    return { text: null, reason: e && typeof e === "object" && "code" in e ? String(e.code) : "read failed" };
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** Every parsed `*.brief.md` in `dir` whose `Task:` header declares `task`, in name order;
+ * empty when `dir` is unreadable. A brief that cannot be read is skipped with a stderr warning. */
+function briefsForTask(dir, task) {
+  let names;
+  try {
+    names = fs.readdirSync(dir).filter((f) => f.endsWith(".brief.md")).sort();
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const name of names) {
+    const file = path.join(dir, name);
+    const read = readBriefContained(file);
+    if (read.text === null) {
+      console.error(`WARN ${file}: brief unreadable (${read.reason})`);
+      continue;
+    }
+    const info = parseBrief(file, read.text);
+    if (info.header.Task && matchesTaskHeader(info.header.Task, task)) found.push(info);
+  }
+  return found;
+}
+
+/** The owner-approved `## Run authorization` of `<root>/openspec/changes/<change>/proposal.md`:
+ * `{ceilings, rounds}` holding only what it sets (`rounds` null when unset), or `{error}` naming
+ * the root-relative path and line. The owner approves the numbers with the proposal, so a
+ * malformed one fails closed rather than quietly running on the defaults; the archive is never
+ * read, since an archived change no longer runs. Parsed on every call, never cached. */
+export function readAuthorization(root, change) {
+  const rel = path.posix.join("openspec", "changes", change, "proposal.md");
+  const fail = (line, reason) => ({ error: `${rel}:${line}: ${reason}` });
+  const read = readBriefContained(path.join(root, ...rel.split("/")));
+  if (read.text === null && read.reason === "ENOENT") return { ceilings: {}, rounds: null };
+  if (read.text === null) return fail(1, read.reason === "over the 1 MiB cap" ? "proposal-too-large (over 1 MiB)" : `proposal-unreadable (${read.reason})`);
+  const ceilings = {};
+  let rounds = null;
+  let heading = 0;
+  let inSection = false;
+  const firstAt = new Map();
+  const lines = read.text.split("\n").map((l) => (l.endsWith("\r") ? l.slice(0, -1) : l));
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const no = i + 1;
+    if (line.trimEnd() === AUTH_HEADING) {
+      if (heading) return fail(no, `duplicate-section (first at line ${heading})`);
+      heading = no;
+      inSection = true;
+      continue;
+    }
+    if (/^##\s+run\s+authorization\b/i.test(line)) return fail(no, `near-miss-heading ${JSON.stringify(line)}`);
+    if (line.startsWith("## ")) inSection = false;
+    if (!inSection || line.trim() === "") continue;
+    const m = AUTH_LINE_RE.exec(line);
+    if (!m) return fail(no, `unknown-line ${JSON.stringify(line)}`);
+    const [, cls, value] = m;
+    const key = cls ? `Ceiling ${cls}` : "Rounds";
+    if (firstAt.has(key)) return fail(no, `duplicate-key ${key} (first at line ${firstAt.get(key)})`);
+    firstAt.set(key, no);
+    if (cls && !CEILING_RE.test(value)) return fail(no, `bad-value ${key} must be a positive integer without sign or leading zero; got ${JSON.stringify(value)}`);
+    if (!cls && !AUTH_ROUNDS_RE.test(value)) return fail(no, `bad-value Rounds must be 1 to 9; got ${JSON.stringify(value)}`);
+    if (cls) ceilings[cls] = Number(value);
+    else rounds = Number(value);
+  }
+  return { ceilings, rounds };
+}
+
+/** The one place a class ceiling is resolved, `{ceiling, source}` or `{error}`, so the run
+ * authorization of the change that owns `dir` (a `.freeharness/sdd/<change>/` workspace) can
+ * replace a default without touching `budget`, `briefs` or `ledger`; any other directory has
+ * no change, so its defaults stand. */
+function classCeiling(dir, cls) {
+  const home = briefHome(dir, true);
+  const auth = home ? readAuthorization(home.root, home.change) : { ceilings: {} };
+  if ("error" in auth) return { error: auth.error };
+  if (Object.hasOwn(auth.ceilings, cls)) return { ceiling: auth.ceilings[cls], source: `class ${cls} authorized` };
+  return { ceiling: CLASS_CEILINGS[cls], source: `class ${cls} default` };
+}
+
+/** One brief's own class: `final` for Task: final, its `Class:` when security or complex (any
+ * case), else other. */
+function briefClass(info) {
+  if ((info.header.Task ?? "").trim() === "final") return "final";
+  const cls = (info.header.Class ?? "").trim().toLowerCase();
+  return cls === "security" || cls === "complex" ? cls : "other";
+}
+
+/** A task's class from its declaring `briefs`: the class with the higher ceiling wins, so a fix
+ * brief of another class never lowers the task's ceiling. */
+function classOf(dir, task, briefs) {
+  if (task === "final") return "final";
+  let best = "other";
+  for (const info of briefs) {
+    const cls = briefClass(info);
+    if (cls === "final" || cls === "other") continue;
+    if (best === "other" || classCeiling(dir, cls).ceiling > classCeiling(dir, best).ceiling) best = cls;
+  }
+  return best;
+}
+
+/** The refusal of a `Ceiling:` header above its class ceiling, one wording for `budget` and
+ * `briefs`: the header may only lower the owner's limit, never raise it. */
+function overClassCeiling(name, ceiling, cls, limit) {
+  return `${name}: Ceiling ${ceiling} over class ${cls} ceiling ${limit}`;
+}
+
+/** A task's `{ceiling, source}` from the briefs in `dir`: the highest `Ceiling:` among the
+ * declaring briefs, so a fix brief without the header never lowers the cap and the answer is
+ * order-independent; the class ceiling when none declares one. One invalid value, or one above
+ * the class ceiling, refuses the whole answer, since another brief's value would hide it; so
+ * does a malformed run authorization, which never falls back to a default. */
+export function ceilingForTask(dir, task) {
+  const briefs = briefsForTask(dir, task);
+  const cls = classOf(dir, task, briefs);
+  const limit = classCeiling(dir, cls);
+  if ("error" in limit) return { error: limit.error };
+  let best = null;
+  for (const info of briefs) {
+    const name = path.basename(info.file);
+    if (Number.isNaN(info.ceiling)) return { error: `${name}: Ceiling must be a positive integer; got ${info.header.Ceiling}` };
+    if (info.ceiling === null) continue;
+    if (info.ceiling > limit.ceiling) return { error: overClassCeiling(name, info.ceiling, cls, limit.ceiling) };
+    if (best === null || info.ceiling > best.ceiling) best = { ceiling: info.ceiling, source: `brief ${name}` };
+  }
+  return best ?? limit;
+}
+
+/** Runs `budget`: a task's spend against the ceiling (`--ceiling`, else `ceilingForTask`),
+ * printed with its source; null without both arguments. The flag replaces only the value: a
+ * malformed run authorization still fails. */
+function runBudget(rest) {
+  if (rest.length < 2) return null;
+  const [file, task, ...opts] = rest;
+  let ceiling;
+  let source;
+  const { values, error } = parseFlags(opts, ["--ceiling"]);
+  if (error) {
+    console.error(`FAIL ${error}`);
+    return 1;
+  }
+  if (values["--ceiling"]) {
+    const value = lastValue(values, "--ceiling");
+    if (!CEILING_RE.test(value ?? "")) {
+      console.error(`FAIL --ceiling must be a positive integer; got ${JSON.stringify(value ?? null)}`);
+      return 1;
+    }
+    const auth = classCeiling(path.dirname(file), "other");
+    if ("error" in auth) {
+      console.error(`FAIL ${auth.error}`);
+      return 1;
+    }
+    ceiling = Number(value);
+    source = "flag";
+  } else {
+    const declared = ceilingForTask(path.dirname(file), task);
+    if ("error" in declared) {
+      console.error(`FAIL ${declared.error}`);
+      return 1;
+    }
+    ({ ceiling, source } = declared);
+  }
+  if (!fs.existsSync(file)) {
+    console.log(`NOTICE ledger ${file} absent; nothing to check`);
+    return 0;
+  }
+  const { lines, warnings } = readLedger(file);
+  for (const w of warnings) console.error(`WARN ${w}`);
+  const b = budget(lines, task, ceiling);
+  console.log(`task ${task}: dispatches ${b.dispatches}, total ${b.total}, reserve ${b.reserve}, ceiling ${ceiling} (${source}), remaining ${b.remaining}`);
+  console.log(b.over ? "FAIL ceiling reached" : "OK under ceiling");
+  return b.over ? 1 : 0;
+}
+
+/** Runs `ledger`: the per-task and totals summary, each task's handoff outcomes under its line
+ * and the change's stop totals; null without a directory. Handoff counts still print without a
+ * cost ledger, since the stop gate reads them alone. */
+function runLedger(rest) {
+  if (rest.length < 1) return null;
+  const dir = rest[0];
+  const file = path.join(dir, "ledger.jsonl");
+  const ledgerAbsent = !fs.existsSync(file);
+  if (ledgerAbsent) console.log(`NOTICE ledger ${file} absent; no dispatch cost to summarize`);
+  const { tasks, totals, warnings, percentiles, handoffs } = ledgerSummary(dir);
+  const stopsText = (stops) =>
+    [...STOP_TOKENS]
+      .filter((s) => stops[s] > 0)
+      .map((s) => `${s} ${stops[s]}`)
+      .join(", ") || "none";
+  for (const w of warnings) console.error(`WARN ${w}`);
+  for (const id of [...new Set([...Object.keys(tasks), ...Object.keys(handoffs.tasks)])].sort(compareTaskIds)) {
+    const t = tasks[id];
+    if (t) {
+      console.log(
+        `task ${id}: impl ${t.impl}, review ${t.review}, fix ${t.fix}, other ${t.other}, resumed ${t.resumed}, cache_read ${t.cache_read}, max reviewers per round ${t.max_reviewers_per_round}, why-digest P0 ${t.why_digest_p0}`,
+      );
+    }
+    const h = handoffs.tasks[id];
+    if (h) console.log(`task ${id}: handoffs completed ${h.completed}, partial ${h.partial}, blocked ${h.blocked}, unreadable ${h.unreadable}; stops ${stopsText(h.stops)}`);
+  }
+  if (!ledgerAbsent) {
+    console.log(
+      `totals: dispatches ${totals.dispatches}, cache_read ${totals.cache_read}, max reviewers per round ${totals.max_reviewers_per_round}, why-digest P0 ${totals.why_digest_p0}`,
+    );
+  }
+  if (handoffs.state === "unreadable") console.log("NOTE handoffs unreadable");
+  if (handoffs.truncated > 0) console.log(`NOTICE handoffs-truncated ${handoffs.truncated}`);
+  if (handoffs.state === "read") console.log(`change: stops ${stopsText(handoffs.stops)}`);
+  if (handoffs.skipped > 0) console.log(`NOTE skipped ${handoffs.skipped} handoff lines`);
+  if (ledgerAbsent) return 0;
+  const atOrOver = percentiles.atOrOver.length ? percentiles.atOrOver.join(", ") : "none";
+  console.log(
+    `percentiles: p50 ${percentiles.p50}, p75 ${percentiles.p75}, p90 ${percentiles.p90} (total plus reserve per task); at or over class ceiling: ${atOrOver}`,
+  );
+  return 0;
+}
+
+/** Reason a name fails `DISPATCH_NAME_RE` case-insensitively: the first of `role`, `dot`,
+ * `task`, `round` or `slug` to disagree with the accepted form, case differences included so a
+ * mismatch is never misattributed to `charset` (already ruled out by `parseDispatchName`'s gate). */
+function diagnoseDispatchName(raw) {
+  const hyphenIdx = raw.indexOf("-");
+  const roleSeg = hyphenIdx === -1 ? raw : raw.slice(0, hyphenIdx);
+  if (!["impl", "review", "fix"].includes(roleSeg.toLowerCase())) return "role";
+  if (roleSeg !== roleSeg.toLowerCase()) return "role";
+  const rest = hyphenIdx === -1 ? "" : raw.slice(hyphenIdx + 1);
+  const tokens = rest.split("-");
+  const taskTok = tokens[0] ?? "";
+  if (taskTok.includes(".")) return "dot";
+  if (!/^(\d+(?:_\d+)*b?|final)$/i.test(taskTok)) return "task";
+  if (taskTok !== taskTok.toLowerCase()) return "task";
+  let idx = 1;
+  if (tokens[idx] !== undefined && /^r/i.test(tokens[idx])) {
+    if (!/^r\d+$/i.test(tokens[idx])) return "round";
+    if (tokens[idx] !== tokens[idx].toLowerCase()) return "round";
+    idx++;
+  }
+  if (idx < tokens.length) {
+    const slugTok = tokens.slice(idx).join("-");
+    if (!/^[a-z0-9-]+$/i.test(slugTok)) return "slug";
+    if (slugTok !== slugTok.toLowerCase()) return "slug";
+  }
+  return "charset";
+}
+
+/** Parses a dispatch name against `<role>-<task>[-r<round>][-<slug>]`; `corrected` carries the
+ * dots-to-underscore, lowercased form when that form itself parses, else `null`. */
+export function parseDispatchName(raw) {
+  if (typeof raw !== "string" || raw === "" || /\s/.test(raw) || !DISPATCH_NAME_CHARSET_RE.test(raw)) {
+    return { ok: false, reason: "charset", corrected: null };
+  }
+  const direct = DISPATCH_NAME_RE.exec(raw);
+  if (direct) {
+    return {
+      ok: true,
+      role: direct[1],
+      task: direct[2].replace(/_/g, "."),
+      round: direct[3] !== undefined ? Number(direct[3]) : null,
+      slug: direct[4] ?? null,
+    };
+  }
+  const corrected = raw.replace(/\./g, "_").toLowerCase();
+  const correctedOk = corrected !== raw && DISPATCH_NAME_RE.test(corrected);
+  return { ok: false, reason: diagnoseDispatchName(raw), corrected: correctedOk ? corrected : null };
+}
+
+/** Runs `recover`, naming the replaced block so no overwrite is silent. */
+function runRecover(rest) {
+  if (rest.length < 2) return null;
+  const [transcript, reportPath, ...opts] = rest;
+  const { values, error } = parseFlags(opts, [], ["--force"]);
+  if (error) {
+    console.error(`FAIL ${error}`);
+    return 1;
+  }
+  const force = Boolean(values["--force"]);
+  const { written, errors, replaced } = recover(transcript, reportPath, force);
+  if (!written || errors.length > 0) {
+    for (const e of errors) console.error(`FAIL ${e}`);
+    return 1;
+  }
+  console.log(replaced ? `recovered ${reportPath} (replaced task ${replaced.task}, status ${replaced.status})` : `recovered ${reportPath}`);
+  return 0;
+}
+
+/** Runs `name`: reports a dispatch name's validity; never refuses a dispatch itself. */
+function runName(rest) {
+  if (rest.length < 1) return null;
+  const result = parseDispatchName(rest[0]);
+  if (result.ok) {
+    console.log(`OK role=${result.role} task=${result.task} round=${result.round === null ? "none" : result.round} slug=${result.slug === null ? "none" : result.slug}`);
+    return 0;
+  }
+  console.error(`FAIL ${result.reason}`);
+  if (result.corrected) console.log(`use ${result.corrected}`);
+  return 1;
+}
+
+/** A findings-ledger line: id, status, round, then the reviewer contract line. A status off this
+ * list makes the line stray, so a typo never closes a finding. */
+const FINDING_LINE_RE = /^F(\d+) (open|fixed|rejected|follow-up) r(\d+): (.*)$/;
+/** Finding types of the reviewer contract line; none is a prefix of another. */
+const CONTRACT_TYPES = ["defect", "hardening", "refactor", "test-gap", "docs", "design"];
+
+/** The reviewer contract line `<path>:<line>: P<0-2> <type>[ [base]]: <text>` split into its
+ * fields, or null. The path ends at the first `:<digits>: ` whose tail completes the form, so a
+ * path may hold a colon. Each candidate costs a fixed check past its digits, and the digit runs
+ * after distinct colons never overlap, so a hostile line costs one pass. */
+function parseContract(s) {
+  if (LINE_TERMINATOR_RE.test(s)) return null;
+  for (let j = s.indexOf(":", 1); j >= 0; j = s.indexOf(":", j + 1)) {
+    let d = j + 1;
+    while (d < s.length && s[d] >= "0" && s[d] <= "9") d++;
+    if (d === j + 1 || !s.startsWith(": P", d)) continue;
+    const severity = s[d + 3];
+    if ((severity !== "0" && severity !== "1" && severity !== "2") || s[d + 4] !== " ") continue;
+    const type = CONTRACT_TYPES.find((w) => s.startsWith(w, d + 5));
+    if (type === undefined) continue;
+    let t = d + 5 + type.length;
+    const base = s.startsWith(" [base]: ", t);
+    if (base) t += " [base]".length;
+    if (!s.startsWith(": ", t) || t + 2 >= s.length) continue;
+    return { path: s.slice(0, j), line: Number(s.slice(j + 1, d)), severity: `P${severity}`, type, base, text: s.slice(t + 2) };
+  }
+  return null;
+}
+
+/** Fields of one findings-ledger line, or null when the line or its contract part is off the form. */
+export function parseFindingLine(line) {
+  if (typeof line !== "string") return null;
+  const m = FINDING_LINE_RE.exec(line.trim());
+  if (!m) return null;
+  const c = parseContract(m[4]);
+  if (!c) return null;
+  return { id: `F${m[1]}`, status: m[2], round: Number(m[3]), ...c };
+}
+
+/** Whether a finding opens a fix round: any P0, or a P1 defect the diff introduced (no `[base]`).
+ * Status is the caller's filter; the reason names severity, type and tag for the lead's record. */
+export function classifyFinding(f) {
+  const label = `${f.severity} ${f.type}${f.base ? " [base]" : ""}`;
+  if (f.severity === "P0") return { blocking: true, reason: `${label} (a P0 always blocks)` };
+  if (f.severity === "P1" && f.type === "defect") {
+    return f.base ? { blocking: false, reason: `${label} (reproduces at the base)` } : { blocking: true, reason: `${label} (introduced by the diff)` };
+  }
+  if (f.severity === "P1") return { blocking: false, reason: `${label} (not a defect)` };
+  return { blocking: false, reason: `${label} (a P2 never blocks)` };
+}
+
+/** The gate's output lines over a ledger's text and its blocking count. Closed lines are read
+ * only for form; anything else that is not blank, a heading or a comment line prints as blocking,
+ * so a malformed ledger never drops a finding. A stray line has no id and is named by number. */
+function gateLedger(text) {
+  const out = [];
+  let blocking = 0;
+  let followUp = 0;
+  text.split("\n").forEach((raw, i) => {
+    const line = raw.trim();
+    if (line === "" || line.startsWith("#") || line.startsWith("<!--")) return;
+    const head = FINDING_LINE_RE.exec(line);
+    if (head && head[2] !== "open") return;
+    const f = head ? parseFindingLine(line) : null;
+    const verdict = f ? classifyFinding(f) : { blocking: true, reason: `unparseable: ${escapeControls(line)}` };
+    out.push(`${head ? `F${head[1]}` : `line ${i + 1}`} ${verdict.blocking ? "blocking" : "follow-up"}: ${verdict.reason}`);
+    if (verdict.blocking) blocking++;
+    else followUp++;
+  });
+  out.push(`gate: ${blocking} blocking, ${followUp} follow-up`);
+  return { out, blocking };
+}
+
+/** Runs `gate`: one verdict per open finding, exit 1 on any blocking one; the ledger is read like
+ * a brief (no symlink leaf, 1 MiB cap), and exit 2 when it cannot be. */
+function runGate(rest) {
+  if (rest.length !== 1) return null;
+  const file = rest[0];
+  const read = readBriefContained(file);
+  if (read.text === null) {
+    console.error(`FAIL ${file}: findings ledger unreadable (${read.reason})`);
+    return 2;
+  }
+  const { out, blocking } = gateLedger(read.text);
+  for (const l of out) console.log(l);
+  return blocking > 0 ? 1 : 0;
+}
+
+/** Directory names a directory or glob write-scope entry never descends into: VCS data, installed
+ * dependencies and the harness workspace, which holds the round copies themselves. */
+const ROUND_SKIP_DIRS = new Set([".git", "node_modules", ".freeharness"]);
+/** The round copy's list of write-scope files that did not exist when it was taken. */
+const ABSENT_FILE = "absent.txt";
+/** Where a brief must sit, so its round copies land in its own change directory. */
+const BRIEF_HOME = ".freeharness/sdd/<change>/<file>.brief.md";
+/** Why a write-scope path was left out of a round copy or a round diff, by `pathKind`. */
+const SKIP_REASONS = { outside: "resolves outside the project root", symlink: "symlink", other: "not a regular file" };
+/** Cap on one file's diff output; a generated file can exceed the spawn default. */
+const ROUND_DIFF_MAX_BUFFER = 64 * 1024 * 1024;
+
+/** The project root, change directory and change name of a brief at `BRIEF_HOME`, or with
+ * `isChangeDir` of that change directory itself; null anywhere else. One rule for both, so the
+ * run authorization `budget` reads is the one `round-base` reads for the same change. */
+function briefHome(file, isChangeDir = false) {
+  const abs = path.resolve(file);
+  const changeDir = isChangeDir ? abs : path.dirname(abs);
+  const harnessDir = path.dirname(path.dirname(changeDir));
+  if (!isChangeDir && !path.basename(abs).endsWith(".brief.md")) return null;
+  if (path.basename(path.dirname(changeDir)) !== "sdd" || path.basename(harnessDir) !== ".freeharness") return null;
+  return { root: path.dirname(harnessDir), changeDir, change: path.basename(changeDir) };
+}
+
+/** The parsed brief, project root and round copy directory, or the refusal: a bad round number,
+ * a brief outside `BRIEF_HOME` or unreadable, or a `Task:` that is not one task id, since the
+ * task becomes a path segment. A null `n` skips the round. With `tree`, `work` is the real path of
+ * the brief's own `<root>/.worktrees/<change>/<task>`, a linked worktree whose commondir names the
+ * root, so neither a shell in the tree nor a sibling tree passes; else a `tree-path` error,
+ * decided by file reads alone. */
+function roundContext(file, n, tree) {
+  if (n !== null && !CEILING_RE.test(String(n))) return { error: `round must be a positive integer; got ${JSON.stringify(String(n))}` };
+  const home = briefHome(file);
+  if (!home) return { error: `brief must sit at ${BRIEF_HOME} under the project root` };
+  const read = readBriefContained(file);
+  if (read.text === null) return { error: `brief unreadable (${read.reason})` };
+  const brief = parseBrief(file, read.text);
+  const task = brief.header.Task;
+  if (!task || !BRIEF_TASK_RE.test(task)) return { error: `Task must name one task id; got ${task ?? "none"}` };
+  const ctx = { brief, root: home.root, dir: n === null ? null : path.join(home.changeDir, "rounds", `${task}-r${n}`), work: home.root };
+  if (tree === undefined) return ctx;
+  const refuse = (why) => ({ error: `tree-path ${quoted(String(tree))}: ${why}` });
+  let work;
+  let root;
+  try {
+    work = fs.realpathSync(path.resolve(String(tree)));
+    root = fs.realpathSync(home.root);
+  } catch {
+    return refuse("not a directory");
+  }
+  let reason = `not under <root>/.worktrees/`;
+  for (let d = path.dirname(work); d !== path.dirname(d); d = path.dirname(d)) {
+    if (path.basename(d) !== ".worktrees") continue;
+    const info = treeInfo(path.dirname(d), work);
+    if (!info.ok) {
+      reason = `not a linked worktree of ${quoted(path.dirname(d))} (${quoted(info.reason)})`;
+      continue;
+    }
+    const main = path.dirname(info.commonDir);
+    const under = relInside(path.join(main, ".worktrees"), work);
+    if (under === null || under === "") return refuse(`not under ${quoted(main)}/.worktrees/`);
+    if (main !== root) return refuse(`a tree of ${quoted(main)}, but the brief's workspace root is ${quoted(root)}`);
+    if (under !== `${home.change}${path.sep}${task}`) return refuse(`not the tree of task ${task}; expected ${quoted(path.join(main, ".worktrees", home.change, task))}`);
+    return { ...ctx, root: main, work, changeDir: path.join(main, path.relative(home.root, home.changeDir)) };
+  }
+  return refuse(reason);
+}
+
+/** Absolute round copy directory of `briefFile` for round `n`; throws naming the brief and the
+ * rule when the brief or `n` is refused. */
+export function roundDir(briefFile, n) {
+  const ctx = roundContext(briefFile, n);
+  if (ctx.error) throw new Error(`${briefFile}: ${ctx.error}`);
+  return ctx.dir;
+}
+
+/** The first existing path from `root` down to `abs` that is a symlink; null when none is. */
+function firstSymlink(root, abs) {
+  let current = root;
+  for (const part of path.relative(root, abs).split(path.sep)) {
+    current = path.join(current, part);
+    let st;
+    try {
+      st = fs.lstatSync(current);
+    } catch {
+      return null;
+    }
+    if (st.isSymbolicLink()) return current;
+  }
+  return null;
+}
+
+/** What a project-relative path is, no symlink followed on the way: `outside`, `symlink`,
+ * `missing`, `dir`, `file` or `other`. */
+function pathKind(root, rel) {
+  const parts = rel.split("/").filter((s) => s !== "" && s !== ".");
+  if (parts.length === 0 || path.isAbsolute(rel) || parts.includes("..")) return "outside";
+  let current = root;
+  let st = null;
+  for (const part of parts) {
+    current = path.join(current, part);
+    try {
+      st = fs.lstatSync(current);
+    } catch {
+      return "missing";
+    }
+    if (st.isSymbolicLink()) return "symlink";
+  }
+  return st.isDirectory() ? "dir" : st.isFile() ? "file" : "other";
+}
+
+/** The literal directory a directory or glob entry is rooted at, so the walk starts there rather
+ * than at the project root. */
+function literalDir(entry) {
+  const parts = entry.split("/");
+  parts.pop();
+  const glob = parts.findIndex((s) => /[*?]/.test(s));
+  return (glob === -1 ? parts : parts.slice(0, glob)).filter((s) => s !== "" && s !== ".").join("/");
+}
+
+/** Adds to `out` the regular files under `startRel` that `pattern` matches; a matching symlink is
+ * skipped, never followed. */
+function walkScope(root, startRel, pattern, out) {
+  if (startRel !== "") {
+    const kind = pathKind(root, startRel);
+    if (kind === "outside" || kind === "symlink") out.skipped.set(startRel, SKIP_REASONS[kind]);
+    if (kind !== "dir") return;
+  }
+  const visit = (rel) => {
+    let dirents;
+    try {
+      dirents = fs.readdirSync(path.join(root, ...rel.split("/").filter((s) => s !== "")), { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const d of dirents) {
+      const child = rel === "" ? d.name : `${rel}/${d.name}`;
+      if (d.isDirectory()) {
+        if (!ROUND_SKIP_DIRS.has(d.name)) visit(child);
+      } else if (scopeMatches(pattern, child)) {
+        if (d.isSymbolicLink()) out.skipped.set(child, SKIP_REASONS.symlink);
+        else if (d.isFile()) out.files.add(child);
+      }
+    }
+  };
+  visit(startRel);
+}
+
+/** Write-scope entries as their scope patterns; a bare existing directory reads as `dir/`. */
+function scopePatterns(root, entries) {
+  return [...new Set(entries.map((e) => e.path))].map((p) =>
+    p.endsWith("/") || /[*?]/.test(p) || pathKind(root, p) !== "dir" ? p : `${p}/`,
+  );
+}
+
+/** The write scope on disk now: regular `files`, exact entries that are `absent`, and the
+ * `skipped` paths with their reason (outside the root, a symlink, not a regular file). */
+function expandScope(root, patterns) {
+  const out = { files: new Set(), absent: [], skipped: new Map() };
+  for (const p of patterns) {
+    const kind = pathKind(root, p);
+    if (kind === "outside") out.skipped.set(p, SKIP_REASONS.outside);
+    else if (p.endsWith("/") || /[*?]/.test(p)) walkScope(root, literalDir(p), p, out);
+    else if (kind === "file") out.files.add(p);
+    else if (kind === "missing") out.absent.push(p);
+    else out.skipped.set(p, SKIP_REASONS[kind] ?? SKIP_REASONS.other);
+  }
+  for (const p of out.skipped.keys()) out.files.delete(p);
+  return out;
+}
+
+/** Copies one regular file read through a no-follow fd, keeping its mode so an unchanged
+ * executable diffs as unchanged; returns why nothing was copied, or null. */
+function copyContained(src, dest) {
+  const unreadable = (e) => (e && typeof e === "object" && e.code ? `unreadable ${e.code}` : "unreadable");
+  let fd;
+  try {
+    fd = fs.openSync(src, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+  } catch (e) {
+    return e && typeof e === "object" && "code" in e && e.code === "ELOOP" ? SKIP_REASONS.symlink : unreadable(e);
+  }
+  let buf;
+  let mode;
+  try {
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) return SKIP_REASONS.other;
+    mode = st.mode & 0o777;
+    buf = fs.readFileSync(fd);
+  } catch (e) {
+    return unreadable(e);
+  } finally {
+    fs.closeSync(fd);
+  }
+  try {
+    fs.mkdirSync(path.dirname(dest), { recursive: true });
+    const out = fs.openSync(dest, "wx", mode);
+    try {
+      fs.writeFileSync(out, buf);
+      fs.fchmodSync(out, mode);
+    } finally {
+      fs.closeSync(out);
+    }
+  } catch (e) {
+    return `copy failed (${e && typeof e === "object" && "code" in e ? String(e.code) : "write"})`;
+  }
+  return null;
+}
+
+/** The checked context of a `round-base` or `round-diff` call, or the exit code it ends with:
+ * null (usage) without both arguments, 2 with the usage for a bad round number, 1 for a refused
+ * brief or a symlink on the round copy's path. Every refusal names the brief and the rule. */
+function roundArgs(rest) {
+  if (rest.length !== 2) return { code: null };
+  const [file, n] = rest;
+  const ctx = roundContext(file, n);
+  if (ctx.error) {
+    console.error(`FAIL ${file}: ${ctx.error}`);
+    if (!CEILING_RE.test(n)) console.error(USAGE);
+    return { code: CEILING_RE.test(n) ? 1 : 2 };
+  }
+  const link = firstSymlink(ctx.root, ctx.dir);
+  if (link) {
+    console.error(`FAIL ${file}: ${link} is a symlink; a round copy path never goes through one`);
+    return { code: 1 };
+  }
+  return { ctx: { ...ctx, file } };
+}
+
+/** A round command's positional args and `--tree` value; null (usage) for a bare `--tree`. */
+function treeRoundArgs(rest) {
+  const at = rest.indexOf("--tree");
+  if (at < 0) return { args: rest, tree: undefined };
+  if (at + 1 >= rest.length) return null;
+  return { args: rest.filter((_, i) => i !== at && i !== at + 1), tree: rest[at + 1] };
+}
+
+/** Lines of a regular file read without following a symlink; 0 for anything else, so an
+ * untracked link or FIFO never blocks or leaves the tree; 0 when the first 8 KiB hold a NUL
+ * byte, as numstat counts a binary file. */
+function untrackedLines(abs) {
+  let fd;
+  try {
+    fd = fs.openSync(abs, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+  } catch {
+    return 0;
+  }
+  try {
+    if (!fs.fstatSync(fd).isFile()) return 0;
+    const buf = Buffer.allocUnsafe(64 * 1024);
+    let n = 0;
+    let seen = 0;
+    let last = 0x0a;
+    for (let got; (got = fs.readSync(fd, buf, 0, buf.length, null)) > 0; last = buf[got - 1]) {
+      const sniff = Math.min(got, Math.max(0, BINARY_SNIFF_BYTES - seen));
+      if (sniff > 0 && buf.subarray(0, sniff).includes(0)) return 0;
+      seen += got;
+      for (let i = 0; i < got; i++) if (buf[i] === 0x0a) n++;
+    }
+    return last === 0x0a ? n : n + 1;
+  } catch {
+    return 0;
+  } finally {
+    fs.closeSync(fd);
+  }
+}
+
+/** `{ path, lines }` per file changed since `base` in the work tree at `cwd`, untracked files
+ * counted by their line count, in path order; a binary file counts 0 lines. Throws the
+ * `route-base` reason outside a work tree or for a base that names no commit. */
+function diffStat(base, cwd) {
+  let top;
+  try {
+    top = git(["rev-parse", "--show-toplevel"], cwd);
+  } catch (e) {
+    const first = String((e && e.stderr) || (e instanceof Error ? e.message : e)).trim().split("\n")[0];
+    throw new Error(`not a git work tree (${quoted(first)})`);
+  }
+  // A leading dash would reach git as an option.
+  if (base.startsWith("-")) throw new Error(`unknown base ${quoted(base)}`);
+  try {
+    git(["rev-parse", "--verify", "--quiet", `${base}^{commit}`], top);
+  } catch {
+    throw new Error(`unknown base ${quoted(base)}`);
+  }
+  const stat = new Map();
+  for (const rec of runGit(["diff", "--numstat", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", base, "--"], top).split("\0")) {
+    const m = /^(\d+|-)\t(\d+|-)\t([\s\S]+)$/.exec(rec);
+    if (m) stat.set(m[3], (m[1] === "-" ? 0 : Number(m[1])) + (m[2] === "-" ? 0 : Number(m[2])));
+  }
+  for (const p of untrackedPaths(runGit(["status", "--porcelain", "-z", "--untracked-files=all"], top))) {
+    if (!stat.has(p)) stat.set(p, untrackedLines(path.join(top, ...p.split("/"))));
+  }
+  return [...stat].sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)).map(([p, lines]) => ({ path: p, lines }));
+}
+
+/** Runs `route`: prints the next dispatch's tier and effort, or with `--review --base` the review
+ * tier line; null (usage) for an unknown or misplaced flag or a round that is not a positive integer. */
+function runRoute(rest) {
+  const [file, ...flags] = rest;
+  if (file === undefined || file.startsWith("--")) return null;
+  const { values, error } = parseFlags(flags, ["--round", "--base"], ["--p0", "--security", "--review", "--final-spec", "--probed"]);
+  if (error) return null;
+  const has = (f) => values[f] !== undefined;
+  const roundText = lastValue(values, "--round");
+  if (has("--round") && (roundText === undefined || !CEILING_RE.test(roundText))) return null;
+  const review = has("--review");
+  const base = lastValue(values, "--base");
+  if (review ? base === undefined || has("--security") : has("--base") || has("--final-spec") || has("--probed")) return null;
+  const read = readBriefContained(file);
+  if (read.text === null) {
+    console.error(`FAIL ${file}: brief unreadable (${read.reason})`);
+    return 1;
+  }
+  const brief = parseBrief(file, read.text);
+  const opts = { round: roundText === undefined ? 1 : Number(roundText), p0: has("--p0"), security: has("--security"), finalSpec: has("--final-spec"), probed: has("--probed") };
+  if (!review) {
+    const need = routeFor(brief, opts);
+    console.log(`Tier: ${need.tier ?? "none"}\nEffort: ${need.effort}`);
+    return 0;
+  }
+  let diff;
+  try {
+    diff = diffStat(base, projectRoot(file));
+  } catch (e) {
+    console.error(`FAIL route-base ${e instanceof Error ? e.message : String(e)}`);
+    return 1;
+  }
+  const r = reviewTierFor(brief, diff, opts);
+  console.log(`Review tier: ${r.tier} - ${r.criterion} ${r.reason}`);
+  return 0;
+}
+
+/** Runs `round-base`: copies the write-scope files once per round and prints the copy directory;
+ * a second call for the same round is refused, so the first copy stands. A regular file that
+ * fails to copy fails the call and removes the partial copy, since `round-diff` would read the
+ * missing file as new; the base is then taken again once the file reads. `--tree` copies from
+ * the task's tree into the main workspace's round directory. The round cap (the run
+ * authorization's `Rounds:`, else `DEFAULT_ROUNDS`) is checked here because every fix round
+ * starts with this command, and before the round directory exists, so a refusal writes nothing.
+ * The tier climb (`routeFor` under `--p0` and `--security`) is checked at the same point, so a fix
+ * round never runs on a brief below the tier or effort it needs. */
+function runRoundBase(rest) {
+  const parsed = treeRoundArgs(rest);
+  if (!parsed) return null;
+  const { tree } = parsed;
+  const args = parsed.args.filter((a) => a !== "--p0" && a !== "--security");
+  const climb = { p0: parsed.args.includes("--p0"), security: parsed.args.includes("--security") };
+  const { code, ctx } = roundArgs(args);
+  if (!ctx) return code;
+  const { file, dir, brief } = ctx;
+  const home = briefHome(file);
+  const auth = readAuthorization(home.root, home.change);
+  if ("error" in auth) {
+    console.error(`FAIL ${auth.error}`);
+    return 1;
+  }
+  const cap = auth.rounds ?? DEFAULT_ROUNDS;
+  if (Number(args[1]) > cap) {
+    console.error(`FAIL round-cap ${args[1]} over ${cap}`);
+    return 1;
+  }
+  const need = routeFor(brief, { round: Number(args[1]), ...climb });
+  if (belowRoute(brief, need)) {
+    console.error(`FAIL route-climb ${need.tier}/${need.effort}`);
+    return 1;
+  }
+  const t = tree === undefined ? ctx : roundContext(args[0], args[1], tree);
+  if (t.error) {
+    console.error(`FAIL ${t.error}`);
+    return 1;
+  }
+  const root = t.work;
+  try {
+    fs.mkdirSync(path.dirname(dir), { recursive: true });
+    fs.mkdirSync(dir);
+  } catch (e) {
+    const codeName = e && typeof e === "object" && "code" in e ? String(e.code) : "mkdir failed";
+    if (codeName === "EEXIST") console.error(`FAIL ${file}: round base ${dir} already exists; a round base is written once per round and the first copy stands`);
+    else console.error(`FAIL ${file}: round base ${dir} not created (${codeName})`);
+    return 1;
+  }
+  const scope = expandScope(root, scopePatterns(root, briefEntries(brief)));
+  fs.writeFileSync(path.join(dir, ABSENT_FILE), scope.absent.sort().map((p) => `${p}\n`).join(""), { flag: "wx" });
+  const failed = [];
+  for (const rel of [...scope.files].sort()) {
+    const why = copyContained(path.join(root, ...rel.split("/")), path.join(dir, ...rel.split("/")));
+    if (why === SKIP_REASONS.symlink || why === SKIP_REASONS.other) scope.skipped.set(rel, why);
+    else if (why) failed.push([rel, why]);
+  }
+  if (failed.length > 0) {
+    for (const [p, why] of failed) console.error(`FAIL ${p}: ${why}`);
+    try {
+      fs.rmSync(dir, { recursive: true, force: true });
+    } catch (e) {
+      console.error(`FAIL ${file}: partial round base ${dir} not removed (${e && typeof e === "object" && "code" in e ? String(e.code) : "rm failed"})`);
+    }
+    return 1;
+  }
+  for (const [p, why] of [...scope.skipped].sort()) console.error(`skipped ${p}: ${why}`);
+  console.log(dir);
+  return 0;
+}
+
+/** Project-relative paths of the regular files in a round copy, its absent list excluded. */
+function copiedFiles(dir) {
+  const out = [];
+  const visit = (abs, rel) => {
+    for (const d of fs.readdirSync(abs, { withFileTypes: true })) {
+      const child = rel === "" ? d.name : `${rel}/${d.name}`;
+      if (d.isDirectory()) visit(path.join(abs, d.name), child);
+      else if (d.isFile() && child !== ABSENT_FILE) out.push(child);
+    }
+  };
+  visit(dir, "");
+  return out;
+}
+
+/** Runs `round-diff`: one `git diff --no-index` per write-scope path that changed since the round
+ * copy, a path absent at the copy diffed as new and one gone since as deleted. Exit 0 whether or
+ * not anything differs; only the copy and the scope's paths are ever read. `--tree` reads the
+ * scope's paths in the task's tree. */
+function runRoundDiff(rest) {
+  const parsed = treeRoundArgs(rest);
+  if (!parsed) return null;
+  const { args, tree } = parsed;
+  const { code, ctx } = roundArgs(args);
+  if (!ctx) return code;
+  const { file, dir, brief } = ctx;
+  const t = tree === undefined ? ctx : roundContext(args[0], args[1], tree);
+  if (t.error) {
+    console.error(`FAIL ${t.error}`);
+    return 1;
+  }
+  const root = t.work;
+  let st;
+  try {
+    st = fs.lstatSync(dir);
+  } catch {
+    console.error(`FAIL ${file}: round base ${dir} missing; take it with round-base before the round`);
     return 1;
   }
-  for (const [flag, list] of Object.entries(values)) {
-    if (list.some((v) => v === undefined)) {
-      console.error(`FAIL ${flag} requires a value`);
-      return 1;
-    }
+  if (!st.isDirectory()) {
+    console.error(`FAIL ${file}: round base ${dir} is not a directory`);
+    return 1;
   }
-  const base = lastValue(values, "--base");
-  const briefFile = lastValue(values, "--brief");
-  const inFlight = values["--in-flight"] ?? [];
-  const leadPaths = values["--lead"] ?? [];
-  if (base !== undefined && base.startsWith("-")) {
-    console.error(`FAIL --base must not start with '-'; got ${JSON.stringify(base)}`);
+  const patterns = scopePatterns(root, briefEntries(brief));
+  const inScope = (p) => patterns.some((s) => scopeMatches(s, p));
+  const copied = new Set(copiedFiles(dir).filter(inScope));
+  const absentRead = readBriefContained(path.join(dir, ABSENT_FILE));
+  const absentAtBase = (absentRead.text ?? "").split("\n").filter((p) => p !== "" && inScope(p));
+  const now = expandScope(root, patterns);
+  const all = new Set([...copied, ...absentAtBase, ...now.files, ...now.absent]);
+  if (!resolveGit()) {
+    console.error(`FAIL ${file}: round-diff needs git on an absolute PATH entry`);
     return 1;
   }
-  for (const l of leadPaths) {
-    if (l.startsWith("-")) {
-      console.error(`FAIL --lead must not start with '-'; got ${JSON.stringify(l)}`);
-      return 1;
+  for (const rel of [...all].sort()) {
+    if (now.skipped.has(rel)) continue;
+    const kind = pathKind(root, rel);
+    if (kind !== "file" && kind !== "missing") {
+      now.skipped.set(rel, SKIP_REASONS[kind] ?? SKIP_REASONS.other);
+      continue;
     }
-  }
-  const normalizedLeadPaths = leadPaths.map((l) => path.posix.normalize(l));
-  let handoffObj = null;
-  let errors;
-  try {
-    handoffObj = readHandoff(file);
-    errors = validateHandoff(handoffObj);
-  } catch (err) {
-    errors = [err instanceof Error ? err.message : String(err)];
-  }
-  if (handoffObj && base !== undefined) {
+    const inBase = copied.has(rel);
+    if (!inBase && kind === "missing") continue;
+    const before = inBase ? path.relative(root, path.join(dir, ...rel.split("/"))).split(path.sep).join("/") : "/dev/null";
+    const after = kind === "file" ? rel : "/dev/null";
+    const args = ["diff", "--no-index", "--no-color", "--no-ext-diff", "--no-textconv", "--", before, after];
     try {
-      const changed = changedPaths(base, process.cwd());
-      const scope = briefFile !== undefined ? readBrief(briefFile).scope : null;
-      const peerScope = inFlight.flatMap((f) => readBrief(f).scope);
-      errors = errors.concat(guardHandoff(handoffObj, changed, scope, peerScope, normalizedLeadPaths));
+      process.stdout.write(runGit(args, root, { okExits: [0, 1], maxBuffer: ROUND_DIFF_MAX_BUFFER }));
     } catch (err) {
-      errors.push(err instanceof Error ? err.message : String(err));
+      console.error(`FAIL ${file}: git diff of ${rel} failed (${(err.stderr || err.message).trim()})`);
+      return 1;
     }
   }
-  return report(errors, file);
+  for (const [p, why] of [...now.skipped].sort()) console.error(`skipped ${p}: ${why}`);
+  return 0;
 }
 
-/** Runs `budget`: a task's spend against the ceiling; null without both. */
-function runBudget(rest) {
-  if (rest.length < 2) return null;
-  const [file, task, ...opts] = rest;
-  let ceiling = DEFAULT_CEILING;
-  const { values, error } = parseFlags(opts, ["--ceiling"]);
-  if (error) {
-    console.error(`FAIL ${error}`);
+/** Runs `state`: writes the report's checkpoint whole as the task's working state, through a
+ * temporary file and a rename, so the previous state is replaced, never appended to, and no
+ * reader sees a partial write. The state path must sit in the report's directory and be neither
+ * a symlink nor the report itself; an invalid checkpoint prints the `handoff` FAIL line and
+ * leaves any existing state untouched. */
+function runState(rest) {
+  if (rest.length !== 2) return null;
+  const [reportFile, stateFile] = rest;
+  const read = readBriefContained(reportFile);
+  if (read.text === null) {
+    console.error(`FAIL ${reportFile}: report unreadable (${read.reason})`);
     return 1;
   }
-  if (values["--ceiling"]) {
-    const value = lastValue(values, "--ceiling");
-    if (!CEILING_RE.test(value ?? "")) {
-      console.error(`FAIL --ceiling must be a positive integer; got ${JSON.stringify(value ?? null)}`);
-      return 1;
-    }
-    ceiling = Number(value);
+  let dir = null;
+  try {
+    const reportDir = fs.realpathSync(path.dirname(path.resolve(reportFile)));
+    const stateDir = fs.realpathSync(path.dirname(path.resolve(stateFile)));
+    if (stateDir === reportDir) dir = stateDir;
+  } catch {
+    // An unresolvable directory is refused below like a foreign one.
   }
-  if (!fs.existsSync(file)) {
-    console.log(`NOTICE ledger ${file} absent; nothing to check`);
-    return 0;
+  if (dir === null) {
+    console.error(`FAIL ${stateFile}: a state file sits in the report's directory`);
+    return 1;
   }
-  const { lines, warnings } = readLedger(file);
-  for (const w of warnings) console.error(`WARN ${w}`);
-  const b = budget(lines, task, ceiling);
-  console.log(`task ${task}: dispatches ${b.dispatches}, total ${b.total}, reserve ${b.reserve}, ceiling ${ceiling}, remaining ${b.remaining}`);
-  console.log(b.over ? "FAIL ceiling reached" : "OK under ceiling");
-  return b.over ? 1 : 0;
+  const target = path.join(dir, path.basename(path.resolve(stateFile)));
+  let st = null;
+  try {
+    st = fs.lstatSync(target);
+  } catch {
+    // Absent: the first state of the task.
+  }
+  if (st && st.isSymbolicLink()) {
+    console.error(`FAIL ${stateFile}: state file is a symlink; a state is never written through one`);
+    return 1;
+  }
+  if (st && !st.isFile()) {
+    console.error(`FAIL ${stateFile}: state file is not a regular file`);
+    return 1;
+  }
+  const reportSt = fs.statSync(reportFile);
+  if (st && st.ino === reportSt.ino && st.dev === reportSt.dev) {
+    console.error(`FAIL ${stateFile}: state file is the report itself`);
+    return 1;
+  }
+  const cp = checkpointOf(read.text);
+  if (cp.errors.length > 0) {
+    for (const e of cp.errors) console.error(`FAIL ${e}`);
+    return 1;
+  }
+  const tmp = path.join(dir, `.${path.basename(target)}.${process.pid}.${Math.random().toString(16).slice(2)}.tmp`);
+  try {
+    const fd = fs.openSync(tmp, "wx");
+    try {
+      fs.writeFileSync(fd, cp.text);
+    } finally {
+      fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, target);
+  } catch (e) {
+    try {
+      fs.unlinkSync(tmp);
+    } catch {
+      // Never created, or already renamed.
+    }
+    console.error(`FAIL ${stateFile}: state not written (${e && typeof e === "object" && "code" in e ? String(e.code) : "write failed"})`);
+    return 1;
+  }
+  console.log(`state ${stateFile} written (${cp.size} chars)`);
+  return 0;
 }
 
-/** Runs `ledger`: the per-task and totals summary; null without a directory. */
-function runLedger(rest) {
-  if (rest.length < 1) return null;
-  const dir = rest[0];
-  const file = path.join(dir, "ledger.jsonl");
-  if (!fs.existsSync(file)) {
-    console.log(`NOTICE ledger ${file} absent; nothing to summarize`);
-    return 0;
+/** Whether `treePath` is a linked worktree of the repository at `mainRoot`, by file reads alone,
+ * so no git runs inside a path before it is known to be ours. */
+export function treeInfo(mainRoot, treePath) {
+  const no = (reason) => ({ ok: false, reason });
+  const real = (p) => {
+    try {
+      return fs.realpathSync(p);
+    } catch {
+      return null;
+    }
+  };
+  const oneLine = (file) => {
+    let fd;
+    try {
+      fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | (fs.constants.O_NONBLOCK || 0));
+    } catch {
+      return null;
+    }
+    try {
+      if (!fs.fstatSync(fd).isFile()) return null;
+      const buf = Buffer.alloc(4097);
+      let total = 0;
+      for (let n = 1; n > 0 && total < buf.length; total += n) n = fs.readSync(fd, buf, total, buf.length - total, total);
+      const m = total > 4096 ? null : /^([^\r\n]+)\r?\n?$/.exec(buf.toString("utf8", 0, total));
+      return m ? m[1] : null;
+    } catch {
+      return null;
+    } finally {
+      fs.closeSync(fd);
+    }
+  };
+  const mainGit = real(path.join(mainRoot, ".git"));
+  if (!mainGit) return no(`no .git at ${mainRoot}`);
+  let st = null;
+  try {
+    st = fs.lstatSync(treePath);
+  } catch {
+    // absent
   }
-  const { tasks, totals, warnings, percentiles } = ledgerSummary(dir);
-  for (const w of warnings) console.error(`WARN ${w}`);
-  for (const id of Object.keys(tasks).sort(compareTaskIds)) {
-    const t = tasks[id];
-    console.log(
-      `task ${id}: impl ${t.impl}, review ${t.review}, fix ${t.fix}, other ${t.other}, resumed ${t.resumed}, cache_read ${t.cache_read}, max reviewers per round ${t.max_reviewers_per_round}, why-digest P0 ${t.why_digest_p0}`,
-    );
+  if (!st || !st.isDirectory()) return no("not a directory");
+  const dotGit = path.join(treePath, ".git");
+  try {
+    if (!fs.lstatSync(dotGit).isFile()) return no(".git is not a regular file");
+  } catch {
+    return no("no .git file");
   }
-  console.log(
-    `totals: dispatches ${totals.dispatches}, cache_read ${totals.cache_read}, max reviewers per round ${totals.max_reviewers_per_round}, why-digest P0 ${totals.why_digest_p0}`,
-  );
-  const atOrOver = percentiles.atOrOver.length ? percentiles.atOrOver.join(", ") : "none";
-  console.log(
-    `percentiles: p50 ${percentiles.p50}, p75 ${percentiles.p75}, p90 ${percentiles.p90} (total plus reserve per task); at or over ${DEFAULT_CEILING}: ${atOrOver}`,
-  );
-  return 0;
+  const line = /^gitdir: (.+)$/.exec(oneLine(dotGit) ?? "");
+  if (!line) return no(".git holds no single gitdir line");
+  const gitDir = real(path.resolve(treePath, line[1]));
+  if (!gitDir || path.dirname(gitDir) !== path.join(mainGit, "worktrees")) return no(`gitdir ${gitDir ?? "missing"} is not under ${mainGit}/worktrees`);
+  // The admin dir must link back here, or a planted .git borrows a sibling's tree.
+  const back = oneLine(path.join(gitDir, "gitdir"));
+  if (!back || real(path.resolve(gitDir, back)) !== real(dotGit)) return no(`gitdir ${gitDir} belongs to another tree`);
+  const common = oneLine(path.join(gitDir, "commondir"));
+  if (!common) return no("gitdir holds no commondir");
+  const commonDir = real(path.resolve(gitDir, common));
+  if (commonDir !== mainGit) return no(`commondir names ${commonDir ?? "nothing"}, not ${mainGit}`);
+  return { ok: true, gitDir, commonDir };
 }
 
-/** Reason a name fails `DISPATCH_NAME_RE` case-insensitively: the first of `role`, `dot`,
- * `task`, `round` or `slug` to disagree with the accepted form, case differences included so a
- * mismatch is never misattributed to `charset` (already ruled out by `parseDispatchName`'s gate). */
-function diagnoseDispatchName(raw) {
-  const hyphenIdx = raw.indexOf("-");
-  const roleSeg = hyphenIdx === -1 ? raw : raw.slice(0, hyphenIdx);
-  if (!["impl", "review", "fix"].includes(roleSeg.toLowerCase())) return "role";
-  if (roleSeg !== roleSeg.toLowerCase()) return "role";
-  const rest = hyphenIdx === -1 ? "" : raw.slice(hyphenIdx + 1);
-  const tokens = rest.split("-");
-  const taskTok = tokens[0] ?? "";
-  if (taskTok.includes(".")) return "dot";
-  if (!/^(\d+(?:_\d+)*b?|final)$/i.test(taskTok)) return "task";
-  if (taskTok !== taskTok.toLowerCase()) return "task";
-  let idx = 1;
-  if (tokens[idx] !== undefined && /^r/i.test(tokens[idx])) {
-    if (!/^r\d+$/i.test(tokens[idx])) return "round";
-    if (tokens[idx] !== tokens[idx].toLowerCase()) return "round";
-    idx++;
+/** Runs `tree`: node spawns git itself with hooks off, so no shell guard or checkout hook stands
+ * between the lead and the task's tree; every refusal is decided before the add. */
+function runTree(rest) {
+  if (rest.length !== 1) {
+    console.error(USAGE);
+    return 1;
   }
-  if (idx < tokens.length) {
-    const slugTok = tokens.slice(idx).join("-");
-    if (!/^[a-z0-9-]+$/i.test(slugTok)) return "slug";
-    if (slugTok !== slugTok.toLowerCase()) return "slug";
+  const file = rest[0];
+  const fail = (line) => {
+    console.error(`FAIL ${line}`);
+    return 1;
+  };
+  const home = briefHome(file);
+  if (!home) return fail(`${file}: brief must sit at ${BRIEF_HOME} under the project root`);
+  const read = readBriefContained(file);
+  if (read.text === null) return fail(`${file}: brief unreadable (${read.reason})`);
+  const { header } = parseBrief(file, read.text);
+  const change = header.Change ?? "";
+  const task = header.Task ?? "";
+  if (!/^[A-Za-z0-9][\w.-]*$/.test(change)) return fail(`tree-path ${file}: Change must be one path segment; got ${quoted(change || "none")}`);
+  if (!BRIEF_TASK_RE.test(task)) return fail(`tree-path ${file}: Task must name one task id; got ${quoted(task || "none")}`);
+  let root;
+  try {
+    root = fs.realpathSync(home.root);
+  } catch (e) {
+    return fail(`${file}: project root unreadable (${e && typeof e === "object" && "code" in e ? String(e.code) : "realpath failed"})`);
+  }
+  const tree = path.join(root, ".worktrees", change, task);
+  // Ancestors by real path, the leaf as named: a symlinked /tmp compares equal, a symlink leaf does not.
+  const realish = (p) => {
+    const dir = path.dirname(p);
+    if (dir === p) return p;
+    try {
+      return path.join(fs.realpathSync(dir), path.basename(p));
+    } catch {
+      return path.join(realish(dir), path.basename(p));
+    }
+  };
+  const want = header.Tree ?? "";
+  if (!path.isAbsolute(want) || realish(path.resolve(want)) !== tree) return fail(`tree-path ${file}: Tree must be ${quoted(tree)}; got ${quoted(want || "none")}`);
+  try {
+    try {
+      runGit(["check-ignore", "-q", ".worktrees/"], root);
+    } catch (e) {
+      if (e.status === 1) return fail(`tree-unignored ${quoted(root)}: .worktrees/ is not ignored; add it to .gitignore`);
+      throw e;
+    }
+    if (git(["ls-tree", "-r", "--name-only", "HEAD", "--", `openspec/changes/${change}/`], root) === "") {
+      return fail(`change-untracked openspec/changes/${change}/ holds no tracked file at HEAD; commit the change first`);
+    }
+    let exists = true;
+    try {
+      fs.lstatSync(tree);
+    } catch (e) {
+      exists = !(e && e.code === "ENOENT");
+    }
+    if (exists) {
+      const info = treeInfo(root, tree);
+      if (!info.ok) return fail(`tree-exists ${quoted(tree)}: not a linked worktree of ${quoted(root)} (${quoted(info.reason)})`);
+      console.log(`OK tree reused ${quoted(tree)} ${git(["rev-parse", "HEAD"], tree)}`);
+      return 0;
+    }
+    const listed = git(["worktree", "list", "--porcelain"], root).split("\n").filter((l) => l.startsWith("worktree ")).map((l) => l.slice(9));
+    if (listed.some((p) => realish(p) === tree)) {
+      return fail(`tree-stale ${quoted(tree)}: git still registers a worktree here and its directory is gone; run git worktree prune in ${quoted(root)}, then tree again`);
+    }
+    runGit(["worktree", "add", "--detach", tree, "HEAD"], root);
+    console.log(`OK tree ${quoted(tree)} ${git(["rev-parse", "HEAD"], tree)}`);
+    return 0;
+  } catch (err) {
+    return fail(`git-failed ${String(err instanceof Error ? err.message : err).split("\n")[0]}`);
   }
-  return "charset";
 }
 
-/** Parses a dispatch name against `<role>-<task>[-r<round>][-<slug>]`; `corrected` carries the
- * dots-to-underscore, lowercased form when that form itself parses, else `null`. */
-export function parseDispatchName(raw) {
-  if (typeof raw !== "string" || raw === "" || /\s/.test(raw) || !DISPATCH_NAME_CHARSET_RE.test(raw)) {
-    return { ok: false, reason: "charset", corrected: null };
+/** The real top level of `cwd` when it is a task tree, a linked worktree under `<main>/.worktrees/`
+ * with main taken from its commondir; null elsewhere. A plain commit there lands on the tree's
+ * detached HEAD and still prints OK, so the caller refuses it. */
+function enclosingTaskTree(cwd) {
+  let top;
+  try {
+    top = fs.realpathSync(git(["rev-parse", "--show-toplevel"], cwd));
+  } catch {
+    return null;
   }
-  const direct = DISPATCH_NAME_RE.exec(raw);
-  if (direct) {
-    return {
-      ok: true,
-      role: direct[1],
-      task: direct[2].replace(/_/g, "."),
-      round: direct[3] !== undefined ? Number(direct[3]) : null,
-      slug: direct[4] ?? null,
-    };
+  for (let d = path.dirname(top); d !== path.dirname(d); d = path.dirname(d)) {
+    if (path.basename(d) !== ".worktrees") continue;
+    const info = treeInfo(path.dirname(d), top);
+    const under = info.ok ? relInside(path.join(path.dirname(info.commonDir), ".worktrees"), top) : null;
+    if (under !== null && under !== "") return top;
   }
-  const corrected = raw.replace(/\./g, "_").toLowerCase();
-  const correctedOk = corrected !== raw && DISPATCH_NAME_RE.test(corrected);
-  return { ok: false, reason: diagnoseDispatchName(raw), corrected: correctedOk ? corrected : null };
+  return null;
 }
 
-/** Runs `recover`, naming the replaced block so no overwrite is silent. */
-function runRecover(rest) {
-  if (rest.length < 2) return null;
-  const [transcript, reportPath, ...opts] = rest;
-  const { values, error } = parseFlags(opts, [], ["--force"]);
-  if (error) {
-    console.error(`FAIL ${error}`);
+/** Runs `commit`: a commit after a plain `git add` takes the whole index, so a peer's staged
+ * entry rides along; `git commit --only` takes just the named paths and leaves every other
+ * staged entry staged. Every refusal is decided before the first git write. Hooks run as on any
+ * lead commit (no `--no-verify`): a commit they fail exits 1 with git's message, and the paths
+ * the add staged stay staged. With `--tree` the claimed paths are judged in the task's tree, and a
+ * path the branch moved since `--base` is refused up front, since its cherry-pick would leave
+ * conflicted entries only a reset clears. */
+export function runCommit(rest) {
+  if (rest.length < 1) {
+    console.error(USAGE);
     return 1;
   }
-  const force = Boolean(values["--force"]);
-  const { written, errors, replaced } = recover(transcript, reportPath, force);
-  if (!written || errors.length > 0) {
+  // The first argument is always a report, even when dash-led; an unknown option ends the list and fails as one.
+  const firstFlag = rest.findIndex((a, i) => i > 0 && a.startsWith("-"));
+  const reports = firstFlag === -1 ? rest : rest.slice(0, firstFlag);
+  const { values, error } = parseFlags(rest.slice(reports.length), ["-F", "--lead", "--tree", "--base"], ["--tree-only"]);
+  const missingValue = Object.keys(values).find((flag) => values[flag].includes(undefined));
+  const treeArg = lastValue(values, "--tree");
+  const base = lastValue(values, "--base");
+  const treeOnly = values["--tree-only"] !== undefined;
+  const stray = treeArg === undefined ? ["--base", "--tree-only"].find((f) => values[f]) : undefined;
+  if (error || missingValue || stray) {
+    console.error(`FAIL ${error ?? (missingValue ? `${missingValue} requires a value` : `${stray} requires --tree <path>`)}`);
+    return 1;
+  }
+  const norm = (p) => path.posix.normalize(p);
+  const errors = [];
+  let tree = null;
+  if (treeArg !== undefined) {
+    if (base === undefined) errors.push("--base <sha> is required with --tree");
+    else if (base.startsWith("-")) errors.push(`--base must not start with '-'; got ${JSON.stringify(base)}`);
+    let real = null;
+    try {
+      real = fs.realpathSync(path.resolve(treeArg));
+    } catch {
+      // Refused below.
+    }
+    const parts = real === null ? [] : real.split(path.sep);
+    const at = parts.lastIndexOf(".worktrees");
+    const shaped = at >= 1 && parts.length === at + 3;
+    const [change, task] = parts.slice(at + 1);
+    // The brief of the tree's own task, so the main root comes from the tree and never the cwd.
+    const mainRoot = shaped ? parts.slice(0, at).join(path.sep) || path.sep : null;
+    const treeBrief = shaped ? path.join(mainRoot, ".freeharness", "sdd", change, `${task}.brief.md`) : null;
+    const t = shaped ? roundContext(treeBrief, null, treeArg) : { error: `tree-path ${quoted(treeArg)}: not at <root>/.worktrees/<change>/<task>` };
+    const reportDir = (report) => {
+      try {
+        return fs.realpathSync(path.dirname(path.resolve(report)));
+      } catch {
+        return null;
+      }
+    };
+    const strays = t.error ? [] : reports.filter((report) => reportDir(report) !== t.changeDir);
+    if (t.error) errors.push(t.error.startsWith("tree-path ") ? t.error : `tree-path ${quoted(treeArg)}: ${t.error}`);
+    else if (t.brief.header.Change !== change || t.brief.header.Task !== task) errors.push(`tree-path ${quoted(treeArg)}: the brief of ${change}/${task} names another task`);
+    else if (strays.length > 0) for (const report of [...new Set(strays)]) errors.push(`tree-path ${quoted(report)}: the report must sit in ${quoted(t.changeDir)}`);
+    else tree = { root: t.root, work: t.work };
+  }
+  const handoffs = [];
+  let last = null;
+  for (const [i, report] of reports.entries()) {
+    // One report prints the bare reason; with several, the reason names its report.
+    const invalid = (reason) => errors.push(reports.length === 1 ? `handoff-invalid ${reason}` : `handoff-invalid ${quoted(report)} ${reason.startsWith(`${report}: `) ? reason.slice(report.length + 2) : reason}`);
+    try {
+      const h = readHandoff(report);
+      const problems = validateHandoff(h);
+      for (const e of problems) invalid(e);
+      if (problems.length === 0) handoffs.push(h);
+      if (problems.length === 0 && i === reports.length - 1) last = h;
+    } catch (err) {
+      invalid(err instanceof Error ? err.message : String(err));
+    }
+  }
+  const tasks = [...new Set(handoffs.map((h) => h.task))];
+  if (tasks.length > 1) errors.push(`task-mismatch ${quoted(tasks[0])} ${quoted(tasks[1])}`);
+  // Earlier rounds may have stopped partial or blocked; only the accepted round must be complete.
+  if (last && last.status !== "completed") errors.push(`not-completed ${last.status}`);
+  // Every round's edits sit in the same tree, so a fix round claiming fewer files drops none.
+  const claimed = [...new Set(handoffs.flatMap((h) => h.files_changed))];
+  const msgArg = lastValue(values, "-F");
+  let text = null;
+  if (msgArg === undefined) errors.push("message-missing -F <message-file> is required");
+  else {
+    try {
+      text = fs.readFileSync(msgArg, "utf8");
+    } catch {
+      errors.push(`message-missing ${msgArg}`);
+    }
+    if (text !== null && text.trim() === "") errors.push(`message-empty ${msgArg}`);
+  }
+  const paths = [...new Set([...claimed, ...(values["--lead"] ?? [])])].sort();
+  let safe = [];
+  for (const p of paths) {
+    const segments = p.split(/[\\/]/);
+    const why =
+      p === "" ? "empty"
+      : path.isAbsolute(p) || /^[\\/]/.test(p) ? "absolute"
+      : p.startsWith("-") ? "starts with '-'"
+      : segments.includes("..") ? "holds a .. segment"
+      : segments.some((s) => s.toLowerCase() === ".git") ? "lies under .git/"
+      : null;
+    if (why) errors.push(`unsafe-path ${quoted(p)}: ${why}`);
+    else safe.push(p);
+  }
+  let top = null;
+  // Literal pathspecs: a claimed `:name` or `*` is a file name, never pathspec magic or a glob.
+  const lit = (args, opts, cwd = top) => runGit(["--literal-pathspecs", ...args], cwd, opts);
+  const list = (raw) => new Set(raw.split("\0").filter((x) => x !== ""));
+  /** The path refusals of `files` in the working tree at `root`; what the add may stage. */
+  const judge = (root, files) => {
+    const onDisk = new Set();
+    const inHead = files.length ? list(lit(["ls-tree", "-r", "-z", "--name-only", "HEAD", "--", ...files], undefined, root)) : new Set();
+    // `-v` tags a skip-worktree entry `S` (`s` when also assume-unchanged); git add skips it.
+    const tagged = files.length ? [...list(lit(["ls-files", "-z", "-v", "--cached", "--", ...files], undefined, root))] : [];
+    const inIndex = new Set(tagged.map((e) => e.slice(2)));
+    const skipped = new Set(tagged.filter((e) => /^[Ss] /.test(e)).map((e) => e.slice(2)));
+    const differ = files.length ? list(lit(["diff", "--name-only", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", "HEAD", "--", ...files], undefined, root)) : new Set();
+    const others = files.length ? list(lit(["ls-files", "-z", "--others", "--", ...files], undefined, root)) : new Set();
+    for (const p of others) differ.add(p);
+    for (const p of files) {
+      const parents = p.split("/").slice(0, -1);
+      let cur = root;
+      let viaLink = false;
+      for (const s of parents) {
+        cur = path.join(cur, s);
+        try {
+          viaLink = fs.lstatSync(cur).isSymbolicLink();
+        } catch {
+          break;
+        }
+        if (viaLink) break;
+      }
+      let st = null;
+      try {
+        st = fs.lstatSync(path.join(root, p));
+      } catch {
+        // Absent from the working tree: a deletion when HEAD holds it.
+      }
+      if (skipped.has(norm(p))) errors.push(`skip-worktree ${quoted(p)}`);
+      if (viaLink) errors.push(`symlink ${quoted(p)}`);
+      else if (st && st.isDirectory()) errors.push(`directory ${quoted(p)}`);
+      else if (!st && !inHead.has(norm(p))) {
+        if (transient.has(norm(p))) gone.add(p);
+        else errors.push(`missing ${quoted(p)}`);
+      }
+      // A case-insensitive filesystem opens `A.txt` for a tracked `a.txt`; the add takes it, the commit's pathspec does not.
+      else if (st && ![inHead, inIndex, others].some((s) => s.has(norm(p)))) errors.push(`unknown ${quoted(p)}`);
+      else {
+        if (st) onDisk.add(p);
+        // `./` keeps a leading `:` from reading as pathspec magic; check-ignore refuses the literal flag.
+        if (runGit(["check-ignore", "--", `./${p}`], root, { okExits: [0, 1] }).trim() !== "") errors.push(`ignored ${quoted(p)}`);
+      }
+    }
+    return { differ, add: files.filter((p) => !gone.has(p) && (onDisk.has(p) || inIndex.has(norm(p)))) };
+  };
+  const claimedSet = new Set(claimed.map(norm));
+  const leadSet = new Set((values["--lead"] ?? []).map(norm));
+  // Absent from disk and HEAD, an earlier round's path was created and removed by the task.
+  const lastSet = new Set((last?.files_changed ?? []).map(norm));
+  const transient = new Set(last ? [...claimedSet].filter((p) => !lastSet.has(p) && !leadSet.has(p)) : []);
+  const gone = new Set();
+  let mine = tree ? safe.filter((p) => claimedSet.has(norm(p))) : safe;
+  const theirs = tree ? safe.filter((p) => !claimedSet.has(norm(p))) : [];
+  let toAdd = [];
+  let leadAdd = [];
+  const insideTree = treeArg === undefined ? enclosingTaskTree(process.cwd()) : null;
+  if (insideTree !== null) errors.push(`tree-path ${quoted(insideTree)}: run from a task tree; pass --tree <path> --base <sha>`);
+  if ((safe.length > 0 || errors.length === 0) && (treeArg === undefined || tree !== null) && insideTree === null) {
+    try {
+      top = tree ? tree.root : git(["rev-parse", "--show-toplevel"], process.cwd());
+      for (const [dir, label] of tree ? [[top, ""], [tree.work, " in the tree"]] : [[process.cwd(), ""]]) {
+        const gitDir = git(["rev-parse", "--absolute-git-dir"], dir);
+        for (const ref of ["MERGE_HEAD", "CHERRY_PICK_HEAD", "REVERT_HEAD"]) {
+          if (fs.existsSync(path.join(gitDir, ref))) errors.push(`in-progress ${ref}${label}: git refuses a partial commit then`);
+        }
+        for (const d of ["rebase-merge", "rebase-apply"]) {
+          if (fs.existsSync(path.join(gitDir, d))) errors.push(`in-progress rebase${label}: ${d}/ in the git directory`);
+        }
+      }
+      let noIdentity = false;
+      for (const dir of tree ? [top, tree.work] : [top]) {
+        for (const ident of ["GIT_COMMITTER_IDENT", "GIT_AUTHOR_IDENT"]) {
+          try {
+            runGit(["var", ident], dir);
+          } catch (err) {
+            if (typeof err.status !== "number") throw err;
+            noIdentity = true;
+          }
+        }
+      }
+      if (noIdentity) errors.push(`identity-missing git resolves no committer or author identity: set user.name and user.email`);
+      // Stricter than the `-F` cleanup on purpose: a message of comment lines only is refused.
+      if (text !== null && text.trim() !== "" && runGit(["stripspace", "--strip-comments"], top, { input: text }).trim() === "") errors.push(`message-empty ${msgArg}`);
+      const judged = judge(tree ? tree.work : top, mine);
+      [safe, mine] = [safe, mine].map((list) => list.filter((p) => !gone.has(p)));
+      toAdd = judged.add;
+      leadAdd = judge(top, theirs).add;
+      if (!tree && !safe.some((p) => judged.differ.has(norm(p)))) errors.push("unchanged no path differs from HEAD");
+      if (tree) {
+        if (!mine.some((p) => judged.differ.has(norm(p)))) errors.push("unchanged no claimed path differs from the tree's HEAD");
+        for (const p of mine) if (leadSet.has(norm(p))) errors.push(`lead-claimed ${quoted(p)}`);
+        for (const p of stagedPaths(top)) errors.push(`staged ${quoted(p)}`);
+        const dirty = new Set(changedPaths("HEAD", top));
+        const big = { maxBuffer: 256 * 1024 * 1024 };
+        const prefixes = (p) => p.split("/").map((_, i, a) => a.slice(0, i + 1).join("/"));
+        // `-t` lists directories too, so a case-folded ancestor counts.
+        const entries = runGit(["ls-tree", "-r", "-t", "-z", "HEAD"], top, big).split("\0").filter((e) => e !== "");
+        const headFiles = new Set(entries.filter((e) => !/^\d+ tree /.test(e)).map((e) => e.slice(e.indexOf("\t") + 1)));
+        let byFold = null;
+        try {
+          const [lower, upper] = [".git", ".GIT"].map((n) => fs.lstatSync(path.join(top, n)));
+          if (lower.ino === upper.ino && lower.dev === upper.dev) byFold = new Map();
+        } catch {
+          // Case-sensitive: `.GIT` is absent.
+        }
+        for (const e of byFold ? entries : []) {
+          const h = e.slice(e.indexOf("\t") + 1);
+          byFold.set(h.toLowerCase(), [...(byFold.get(h.toLowerCase()) ?? []), h]);
+        }
+        /** Whether landing `p` would overwrite main-tree bytes: an ignored file is in no diff. */
+        const leaks = (p) => {
+          if (dirty.has(p)) return true;
+          if (byFold && prefixes(p).some((q) => (byFold.get(q.toLowerCase()) ?? []).some((h) => h !== q))) return true;
+          if (headFiles.has(p)) return false;
+          for (const q of prefixes(p)) {
+            let st;
+            try {
+              st = fs.lstatSync(path.join(top, q));
+            } catch {
+              return false;
+            }
+            if (q === p || !st.isDirectory()) return true;
+          }
+          return false;
+        };
+        // Only a landing writes the main tree.
+        for (const p of treeOnly ? [] : mine) if (!leadSet.has(norm(p)) && leaks(norm(p))) errors.push(`tree-leak ${quoted(p)}`);
+        if (base !== undefined && !base.startsWith("-")) {
+          let known = false;
+          try {
+            known = isAncestor(base, top);
+            if (!known) errors.push(`base-not-ancestor ${base}`);
+          } catch (err) {
+            if (!String(err.message).startsWith("base-not-ancestor ")) throw err;
+            errors.push(err.message);
+          }
+          const baseSha = runGit(["rev-parse", "--verify", "-q", `${base}^{commit}`], top, { okExits: [0, 1] }).trim();
+          const treeHead = git(["rev-parse", "HEAD"], tree.work);
+          if (baseSha !== "" && treeHead !== baseSha) errors.push(`tree-moved ${treeHead}: the tree's HEAD is not --base ${base}`);
+          if (known && !treeOnly && mine.length) {
+            // No pathspec: a change under a claimed path or at an ancestor of one conflicts too.
+            const moved = list(runGit(["diff", "--name-only", "-z", "--no-renames", "--no-ext-diff", "--no-textconv", base, "HEAD", "--"], top, big));
+            const under = new Set([...moved].flatMap(prefixes));
+            for (const p of mine) if (under.has(norm(p)) || prefixes(norm(p)).some((q) => moved.has(q))) errors.push(`land-conflict ${quoted(p)}`);
+          }
+        }
+      }
+    } catch (err) {
+      errors.push(`git-failed ${String(err instanceof Error ? err.message : err).split("\n")[0]}`);
+    }
+  }
+  if (errors.length > 0) {
     for (const e of errors) console.error(`FAIL ${e}`);
     return 1;
   }
-  console.log(replaced ? `recovered ${reportPath} (replaced task ${replaced.task}, status ${replaced.status})` : `recovered ${reportPath}`);
+  let treeSha = null;
+  /** Nothing past the tree commit is undone, so the lead learns what to recover. */
+  const recover = () => {
+    console.error(`NOTE tree-commit ${treeSha}\nNOTE tree-head-moved ${treeSha}`);
+    try {
+      const raw = runGit(["status", "--porcelain", "-z", "--no-renames", "--untracked-files=no"], top);
+      for (const e of raw.split("\0")) if (e.length > 3 && !" ?!".includes(e[0])) console.error(`NOTE main-entry ${e.slice(0, 2)} ${quoted(e.slice(3))}`);
+    } catch {
+      // A courtesy only.
+    }
+  };
+  if (tree) {
+    const landed = landTree(tree, { msg: path.resolve(msgArg), claimed: mine, add: toAdd, lead: leadAdd, treeOnly });
+    treeSha = landed.sha ?? null;
+    if (landed.error) {
+      console.error(`FAIL ${landed.error}`);
+      if (treeSha) recover();
+      return 1;
+    }
+    if (treeOnly) {
+      console.log(`OK tree-commit ${landed.sha}`);
+      return 0;
+    }
+    // Landed and staged already: the main commit below adds nothing more.
+    toAdd = [];
+  }
+  for (const [step, args] of [
+    ["add", ["add", "-A", "--", ...toAdd]],
+    ["commit", ["commit", "--only", "-F", path.resolve(msgArg), "--", ...safe]],
+  ]) {
+    if (step === "add" && toAdd.length === 0) continue;
+    try {
+      lit(args, { hooks: true });
+    } catch (err) {
+      let staged = "";
+      try {
+        staged = `; staged: ${stagedPaths(top).map(quoted).join(" ")}`;
+      } catch {
+        // The listing is a courtesy; the refusal stands without it.
+      }
+      const said = String(err.stderr || err.message);
+      const lines = said.split("\n").filter((l) => l.trim() !== "");
+      const exited = `git ${step} exited ${err.status ?? "abnormally"}`;
+      const own = lines.find((l) => /^(?:fatal|error):/.test(l)) ?? lines[0] ?? exited;
+      // git's own failures exit 128; a hook prints what it likes, so its output never decides.
+      const hooked = () => {
+        try {
+          // The last value is runGit's own /dev/null; the one before it is what the commit used.
+          const set = runGit(["config", "--type=path", "-z", "--get-all", "core.hooksPath"], top, { okExits: [0, 1] }).split("\0").slice(0, -1);
+          const dir = path.resolve(top, set.length > 1 ? set[set.length - 2] : path.join(runGit(["rev-parse", "--git-common-dir"], top).trim(), "hooks"));
+          return ["pre-commit", "prepare-commit-msg", "commit-msg"].some((h) => {
+            try {
+              fs.accessSync(path.join(dir, h), fs.constants.X_OK);
+              return fs.statSync(path.join(dir, h)).isFile();
+            } catch {
+              return false;
+            }
+          });
+        } catch {
+          return false;
+        }
+      };
+      console.error(!tree ? `FAIL ${step}-failed ${exited}` : err.status !== 128 && hooked() ? `FAIL commit-hook ${exited}${staged}` : `FAIL main-commit-failed ${quoted(own.trim())}${staged}`);
+      for (const line of said.split("\n")) if (line.trim() !== "") console.error(`  ${line}`);
+      if (treeSha) recover();
+      return 1;
+    }
+  }
+  console.log(`OK commit ${git(["rev-parse", "HEAD"], top)}`);
+  for (const p of safe) console.log(`  ${quoted(p)}`);
+  if (tree) {
+    try {
+      runGit(["worktree", "remove", tree.work], top);
+    } catch (err) {
+      const why = String(err.stderr || err.message).split("\n").find((l) => l.trim() !== "") ?? "";
+      console.log(`NOTE tree-kept ${quoted(tree.work)} ${quoted(why.replace(/^fatal: /, "").trim())}`);
+    }
+  }
   return 0;
 }
 
-/** Runs `name`: reports a dispatch name's validity; never refuses a dispatch itself. */
-function runName(rest) {
-  if (rest.length < 1) return null;
-  const result = parseDispatchName(rest[0]);
-  if (result.ok) {
-    console.log(`OK role=${result.role} task=${result.task} round=${result.round === null ? "none" : result.round} slug=${result.slug === null ? "none" : result.slug}`);
-    return 0;
-  }
-  console.error(`FAIL ${result.reason}`);
-  if (result.corrected) console.log(`use ${result.corrected}`);
-  return 1;
+/** The tree commit runs with hooks off: it is an intermediate object, and the main commit runs
+ * the hooks on the same content. `cherry-pick -n` writes no CHERRY_PICK_HEAD, so the main commit
+ * stays a plain commit. */
+function landTree({ root, work }, { msg, claimed, add, lead, treeOnly }) {
+  const step = (name, args, cwd) => {
+    try {
+      runGit(["--literal-pathspecs", ...args], cwd);
+      return null;
+    } catch (err) {
+      const lines = String(err.stderr || err.message).split("\n").filter((l) => l.trim() !== "");
+      return `${name}-failed ${quoted((lines.find((l) => /^(?:fatal|error):/.test(l)) ?? lines[0] ?? `exited ${err.status}`).trim())}`;
+    }
+  };
+  const failed = (add.length ? step("tree-add", ["add", "-A", "--", ...add], work) : null) ?? step("tree-commit", ["commit", "--only", "-F", msg, "--", ...claimed], work);
+  if (failed) return { error: failed };
+  const sha = git(["rev-parse", "HEAD"], work);
+  if (treeOnly) return { sha };
+  // Rename detection would move a new file under a renamed directory, or conflict on its location.
+  const error = step("cherry-pick", ["cherry-pick", "-n", "-X", "no-renames", sha], root) ?? (lead.length ? step("lead-add", ["add", "-A", "--", ...lead], root) : null);
+  return error ? { error, sha } : { sha };
 }
 
 /** Handlers in usage order; a `Map`, so an `Object.prototype` name resolves to none. */
 const SUBCOMMANDS = new Map([
+  ["brief-init", runBriefInit],
   ["briefs", runBriefs],
   ["handoff", runHandoff],
   ["budget", runBudget],
   ["ledger", runLedger],
   ["recover", runRecover],
   ["name", runName],
+  ["gate", runGate],
+  ["route", runRoute],
+  ["round-base", runRoundBase],
+  ["round-diff", runRoundDiff],
+  ["state", runState],
+  ["tree", runTree],
+  ["commit", runCommit],
 ]);
 
 /** CLI entry over `argv` after the script name; returns the exit code. */
@@ -845,6 +4540,19 @@ export function main(argv) {
   return 1;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === new URL(import.meta.url).pathname) {
-  process.exit(main(process.argv.slice(2)));
+/** Canonical form of `file` for the main-module check: realpath, or the resolved path when it throws. */
+function canonicalPath(file) {
+  try {
+    return fs.realpathSync(file);
+  } catch {
+    return path.resolve(file);
+  }
+}
+
+// Realpath on both sides: a symlinked invocation path (macOS /var -> /private/var) would
+// otherwise skip main and exit 0 silently.
+if (process.argv[1] && canonicalPath(process.argv[1]) === canonicalPath(fileURLToPath(import.meta.url))) {
+  // An exit code rather than process.exit: a pipe to stdout is asynchronous on darwin, and an
+  // explicit exit drops what is still queued past 64 KiB, such as the gate's closing tally.
+  process.exitCode = main(process.argv.slice(2));
 }