harness-dispatch 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -4,7 +4,1078 @@ Notable changes per release. Format follows [Keep a Changelog](https://keepachan
 this project uses [semantic versioning](https://semver.org/spec/v2.0.0.html) and is
 pre-1.0, so minor versions can carry behaviour changes.
 
-## [Unreleased]
+## [0.10.0] — 2026-09-06
+
+### Added
+
+- **`doctor` says whether jobs will actually run detached.** A missing
+  `dist/job-runner.js` is not an error — it is the signal to run jobs
+  in-process, which is right for an unbuilt checkout and wrong everywhere
+  else, because the concurrency cap is enforced by the supervisor pool. So the
+  bound that exists because of a measured out-of-memory crash silently stopped
+  applying, with one line on stderr at dispatch time and nothing checking it.
+  This check FAILS rather than warns, so `doctor` now exits 1 in an unbuilt
+  checkout where it previously exited 0.
+
+- **Locks left by a process that is gone are swept before each job starts.**
+  Such a lock was always reclaimable, but only when something contended for
+  that same directory — and nothing contends for a path you dispatched against
+  once and moved on from, so its file stayed indefinitely. An unreadable lock
+  is given the same grace the acquire path gives it, rather than being deleted
+  on sight: `wx` creation leaves a real empty-file window, and losing that race
+  would delete a live holder's lock.
+
+- **Empty supervisor spawn logs are cleaned up.** Keeping a crash log is
+  deliberate — a supervisor that died is the one that left a stale heartbeat,
+  and its output is the only explanation. An empty one explains nothing, and
+  the liveness check reads that directory on every drain. Measured before this:
+  129 files over three weeks, six bytes each.
+
+### Fixed
+
+- **`usage` with no routes explained itself.** It printed a bare header, which
+  reads as a broken command — the one thing it does not mean. It now says
+  there are no routes and names both ways to get one.
+
+- **`--json` is honoured when a command fails, not only when it succeeds.** A
+  bad `--config` made `doctor --json` print a sentence, so anything parsing the
+  output got a parse error instead of the reason. Four shapes bypassed the
+  envelope entirely — an unknown command, `auth` with no subcommand, `dispatch`
+  with no prompt, and the `--json=true` spelling — and the first printed the
+  help block to stdout, so `harness-dispatch frobnicate --json | jq` was fed
+  usage text. Errors stay on stderr; without `--json` the plain line is
+  unchanged.
+
+- **README:** the quick start told a new user to run `doctor --live` as step
+  three of installing without saying it contacts providers and spends quota.
+  The `configure` section was one 180-word block covering four separate
+  concerns; it is split under headings, and `configure` is now described as
+  optional where someone deciding whether to run it will see it.
+
+### Fixed
+
+- The "already applied" answer is given from one place. Both branches that
+  can reach it built the message separately and had to say the same thing by
+  hand — and it is the message a caller reads to decide whether their work
+  landed, so the two drifting apart is the exact confusion the second branch
+  was added to fix.
+
+- Five deeply nested blocks were flattened into named helpers: a rule
+  dispatch table written as a switch inside a loop, the stdout line
+  reassembly, two JSON-shape readers, an SSE frame reader, and the
+  steal-a-stale-lock path with its two nested try/catch blocks. Each is
+  behaviour-preserving and each removes a level that had nothing to do with
+  the logic underneath it.
+
+- Housekeeping the audit listed and nothing had got to: CI built the whole
+  project twice on every leg of every run (the explicit step plus the one
+  inside `npm test`); `doctor` ran its state-directory probe twice, creating
+  and deleting a file each time, to fill two fields from the same answer; an
+  alias renamed a function to itself; and 28 blank lines left behind by
+  earlier extractions are gone.
+
+- Four assertions that could not fail for the reason their test claimed.
+  `job_status` on an unknown job asserted only that *something* threw, which
+  a schema rejection also satisfies — so "a well-formed id for a job that is
+  gone" was untested. The traversal and near-miss-action refusals had the
+  same hole: both passed on "No such job", which every id in that file
+  produces, leaving the thing under test unchecked. And a parser test
+  asserted only that a normal OpenAI body did not throw, which is equally
+  true of a parser that dropped the request on the floor; it now checks the
+  request survived.
+
+- The endpoint dispatcher's two request paths share one prologue. The URL,
+  headers, timeout timer, abort wiring and fetch-error mapping were written
+  out twice and kept in step by hand — which is not a theoretical risk here:
+  the credential leak fixed in the entry above existed in both copies, and
+  the file's own header records the same shape happening before. What stays
+  a parameter is the one thing that genuinely differs, the `stream` flag and
+  its Accept header, now pinned by tests asserting what each path puts on
+  the wire. Collapsing that too is what "just drain the stream" would do,
+  and it would change every buffered endpoint request against a third-party
+  gateway.
+
+- **SECURITY, structural: configured credentials are removed where text leaves
+  the process, instead of at each place a message is built.** Six consecutive
+  reviews found the same defect — a credential reaching a caller, a log file or
+  an agent's context — and six fixes closed the path that reviewer had found.
+  Each fix was correct and each was incomplete: four of the six were "the fix
+  landed in one branch and the sibling beside it kept leaking", twice inside a
+  single file, and one round shipped a comment asserting every branch was
+  covered while one was not.
+
+  Sites were the wrong unit. There is no bounded list of places a string can be
+  built, and ordinary feature work adds more without their author having any
+  reason to think about credentials. The set of ways text LEAVES is bounded:
+  JSON for a tool result or an HTTP response, the dispatch log, job files on
+  disk, and the terminal. Those are now the places redaction happens, and the
+  secrets are derived from the loaded config rather than named per call site —
+  including the `api_keys:` block, whose entries are keyed by route name and so
+  matched no credential-looking key name, and a credential embedded in a
+  `base_url` path, which host redaction preserves by design.
+
+  Also fixed with it: `configure --print` emitted `base_url` in full while
+  redacting the api_key two lines below and printing a note implying the whole
+  preview was sanitised.
+
+  The guarantee is pinned two ways, because one of them does not reach far
+  enough and saying otherwise was itself an overclaim. Four sinks are proven
+  behaviourally: a credential of every shape a config can hold is planted, the
+  sink is driven for real, and removing its redaction fails that sink's case
+  and no other. The remaining eight have no reachable input that carries a
+  credential today — something upstream already removed it — so a behavioural
+  case for them could not fail, and inventing one would be a test passing for
+  the wrong reason. They are covered instead by an inventory that fails if the
+  redaction call disappears, which is the real risk for a guard.
+
+  An earlier version of this entry claimed all of them were proven
+  behaviourally. A verification pass sabotaged all nine call sites one at a
+  time and found five shipped green.
+
+  The first version of that test did not do this. It called the redactor on the
+  rendered output before asserting, so it proved the redactor works on a string
+  — never in doubt — and could not fail for a sink that forgot to call it. An
+  acceptance pass established that by reading, and found an unredacted
+  server-sent-event path shipping under a green suite in the same breath. The
+  streamed and buffered forms of one request behaved differently: the same
+  credential was removed from the buffered response and returned verbatim in
+  the stream.
+
+- **The redaction registry no longer treats every `${VAR}` as a credential.**
+  It was keyed off the record of resolved environment references, which covers
+  every `${VAR}` in the file — and `${VAR}` is documented as legal in any
+  string value. So `model: ${MY_MODEL}` made that model name a process-wide
+  redaction target, and `status` reported `model=<redacted>`. A harness answer
+  mentioning it would have been mangled the same way, silently, which is worse
+  than the disclosure being guarded against: wrong work product delivered as if
+  it were right. Collection now reads the fields that hold credentials.
+
+  For the same reason, a long segment in a `base_url` path is no longer assumed
+  to be a secret — that guess made an Azure deployment name
+  (`.../deployments/gpt-4-turbo-preview`) a redaction target. A path segment
+  cannot be told from a credential by inspection, so the config now says so and
+  names the route, and the user moves it to `api_key:` where it is removable by
+  value.
+
+- **SECURITY: a CLI harness quoting its own api key had it passed through to
+  the caller and into `logs/dispatches.jsonl`.** A CLI route is handed its
+  credential in an environment variable, and a harness reporting an auth
+  failure can print it back; nothing removed it. Reproduced end to end with a
+  stub harness writing `auth error: rejected key <key>` to stderr — it arrived
+  verbatim in the terminal and in the log.
+
+  Reaching it needs `api_key:` on a CLI route, which reclassifies the route as
+  metered and is then blocked by billing policy until the user explicitly opts
+  in — so it is narrower than the endpoint leaks beside it, and it is the same
+  disclosure once opted in.
+
+  The scrub wraps the dispatcher's whole event stream rather than each result
+  site. That is the point of it: this class has now been found five times, and
+  four were a fix landing in one branch while the sibling beside it kept
+  leaking. `#runStream` has five result sites plus the chunk events, and a
+  sixth added later would silently miss a per-site scrub. Chunks are scrubbed
+  too, since they become `partialOutput` and `stdout.log` on disk. A route with
+  no key — every subscription CLI — is untouched and pays nothing.
+
+- **SECURITY: an endpoint that echoed your API key back in its error body
+  had it passed straight through to the caller and into
+  `logs/dispatches.jsonl`.** Both request paths build `HTTP <status>:
+  <message>` from the response body and neither scrubbed it, while the
+  network-error paths beside them always had. So a key in the base URL's
+  query string — a documented way to configure an endpoint, and how Gemini's
+  is written — came back verbatim whenever the endpoint quoted the request
+  URL in its own 4xx body. Found by writing the test the audit said was
+  missing: scrubbing had been proven at the unit and never once from the
+  dispatcher, which is the only place it can actually leak.
+
+  It took three attempts to close, and the first two both shipped a claim
+  wider than their code. The `HTTP <status>` pair was fixed first and
+  declared the class closed; the two `describeUnusableBody` paths beside it
+  — a 200 carrying an HTML error page, which is what a gateway returns —
+  still quoted 300 raw characters of the body back. Fixing those came with
+  an assertion that every branch was covered; the mid-stream SSE `error`
+  event was not, and that is the likeliest shape of all of them, because a
+  200 with `text/event-stream` carrying an error object is how these
+  endpoints report an auth failure once the stream is open, and jobs only
+  ever stream.
+
+  Separately, the scrubber only ever removed credential-bearing parts of the
+  base URL. Every endpoint in this project's own config authenticates with an
+  `Authorization` or `x-api-key` header, so the configured key was not in the
+  URL at all and survived on every path, including the two fixed first.
+
+  All seven branches that can return an endpoint's own text now scrub, each
+  is pinned by its own test, and the code comment enumerates them rather than
+  asserting completeness — an enumeration can be checked against the file and
+  a claim of completeness is what failed twice here.
+
+- **The CLI dispatcher is now tested against a real process, not only
+  through a mock — and production no longer contains the mock detector.**
+  `stream-subprocess.ts` carried a branch in PRODUCTION that detected a
+  vitest mock on `runSubprocess` and synthesised one stdout chunk from a
+  buffered result, under a comment claiming this still exercised the
+  streaming path. It exercised it nowhere: every dispatcher suite mocked
+  `runSubprocess`, so every dispatcher suite ran the adapter. Four behaviours
+  had no test at all: a JSONL event split across two reads, a timeout that
+  really kills the child, an abort reaching a running process, and stdout
+  arriving as events during the run rather than one lump at the end. All four
+  now run against `node -e`.
+
+  The adapter has since moved into the test suite, where a suite that wants
+  it opts in by mocking the function the dispatchers actually call. Nothing
+  in `src/` now branches on being under test.
+
+- **`doctor` names a route that has never once succeeded.** The circuit
+  breaker is about RECENT failure and forgets after its cooldown, so a route
+  that is simply dead — a host that no longer resolves, a revoked key — keeps
+  being selected, keeps failing, and keeps falling back, indefinitely. On the
+  maintainer's own machine a local endpoint sat at 8 calls and 0 successes
+  while being the preferred route for `review`, so every review dispatch paid
+  for one doomed attempt first. The counts were in `usage` all along, and
+  nobody reads `usage` when things merely feel slow. Advisory, never a
+  failure: a route needs at least five calls before it is judged, because a
+  laptop that was asleep is not a broken endpoint.
+
+- Three of the six MCP tools were asserted to exist and never invoked.
+  `cancel_job`, `retry_job` and `workspace` had tests for the functions
+  underneath but nothing exercising the layer that parses a caller's
+  arguments and shapes the reply — where a schema change or a renamed field
+  breaks an orchestrator without failing anything. Now driven through the
+  real tool path, including the refusals that matter: a traversal attempt in
+  a job id, and a near-miss `action` on the one verb that is irreversible.
+
+- The workspace lock's heartbeat guard is pinned. A holder that freezes past
+  the stale window is legitimately stolen from, and its heartbeat must stop
+  writing — otherwise it destroys the new owner's claim and, worse, convinces
+  its own `release()` that it still holds the lock, deleting it out from
+  under whoever now owns it. The guard was there and uncovered; removing it
+  now fails a test that names exactly that.
+
+- **`max_concurrent_runs: 0` lifts the cap without also removing the
+  supervisor pool.** It used to short-circuit the slot queue and the pool
+  entirely, so every job got its own detached runner — measured under load at
+  8 concurrent dispatches becoming 8 runner processes at ~76 MB each, which
+  is the per-job wrapper cost the pool exists to remove, on the memory-bound
+  machine the cap exists for in the first place. Uncapped now means uncapped
+  *jobs*, with the process count still bounded by the pool. The cap is
+  represented as `null` rather than `0` or `Infinity`, because both of those
+  were wrong somewhere: `0` read as "bypass everything", and `Infinity` broke
+  pool sizing, which divides by the limit and so asked for zero supervisors.
+
+  The README and the source comment went on describing the old behaviour for
+  a further nine commits, steering users away from the setting for a reason
+  that had stopped being true. Both now say what the code does.
+
+- The contract every shipped harness owes — a missing CLI, a non-zero exit, a
+  model override, a timeout, id and availability — is asserted once per
+  harness from one table instead of being written out in four per-harness
+  files. There is no per-harness dispatcher class to begin with: each built-in
+  harness is the generic CLI dispatcher driven by a protocol block in
+  `config.default.yaml`, so those were never really four different questions.
+  They had already drifted apart, which is the argument for the table: three
+  of the four checked that nothing was even resolved before the failure, one
+  did not. A preset added to the shipped config with no row now fails a
+  completeness check. What stays per harness is what genuinely differs —
+  Codex's JSONL extraction and `--cd` handling, Cursor's workspace default and
+  Retry-After parsing, Antigravity's live streaming and safety-flag mapping,
+  Claude Code's raw-stdout fallback.
+
+- **The job store is five modules instead of one 1,600-line file**, and two
+  runtime imports that existed to dodge an import cycle are gone. The cycle
+  was real but avoidable: `config-hot-reload.ts` imported
+  `setJobRetentionDays` from the `jobs.ts` barrel rather than from
+  `jobs/store.ts`, where it is defined. Pointing it at the definition removed
+  the cycle, and the second dynamic import was guarding a cycle that never
+  existed. `jobs.ts` is now a 32-line barrel, so every consumer keeps its
+  import path.
+
+  The move surfaced a defect worth naming: `resolveRunnerPath()` resolves
+  against its own module's location, so moving it one directory deeper made
+  both its candidates miss. Returning nothing is not an error there — it is
+  the signal to run the job **in-process**, so every dispatch quietly stopped
+  being detached and the concurrency cap stopped applying, with nothing
+  failing until the job-concurrency tests ran. Fixed, with the trap written
+  down at the function.
+
+- **The tests are typechecked, and the gate enforces it.** Clearing the 125
+  errors that surfaced turned up two things a reader would have taken at face
+  value. `RetryOutcome` never declared `droppedModel` — a field `retry_job`
+  sets and the MCP tool description documents, invisible to any typed caller
+  because the object is built with a conditional spread, which TypeScript
+  does not excess-property check. And five router fixtures scored a route
+  whose billing surface was `"vendor_cli"`, a value in no union and no
+  config: they were measuring a shape that cannot occur. A test helper also
+  returned `Record<string, never>`, which made every assertion against a
+  config file it had just written unable to fail.
+
+- **The test suite's `implements Dispatcher` claims are true now, and there
+  is a way to check them.** `tsconfig.json` sets `rootDir: src` so it can
+  emit, which means a test file cannot be in the same program — so the tests
+  were never typechecked, and four stub classes declared they implemented an
+  interface while omitting a required method. That is not academic: it has
+  now cost two runtime failures that a compiler would have caught instantly,
+  one of them a stub that would have crashed the moment the router stopped
+  preferring the buffered path. The stubs implement it, with a body that
+  throws — stronger than absence, because a buffered entry point that
+  accidentally streams now fails loudly instead of passing quietly. A new
+  `tsconfig.test.json` typechecks tests against src; `npm run typecheck:tests`
+  runs it. It reported 52 remaining pre-existing errors when it landed and was
+  deliberately kept out of `npm run check` until they were cleared — which
+  happened later in this same release, so as shipped the gate runs it and it
+  is clean. An acceptance pass caught this paragraph still describing the
+  interim state, two entries above one saying the opposite.
+
+- **"A shipped harness preset" now has a module.** It was a protocol block
+  in YAML, loaded and parsed inside `config.ts`, interpreted by the generic
+  CLI dispatcher, read again by the dispatcher factory, and asserted by four
+  per-harness test files — so every change to a built-in harness touched all
+  of them. A co-change check over 300 commits reported exactly that: ten
+  files moving together across six directories, one concept with nowhere to
+  live. `src/harness-presets.ts` is where it lives now, and every importer
+  names it. `config.ts` is 184 lines smaller and no longer parses the
+  shipped file it also consumes.
+
+- **The leaderboard fetch stopped introducing itself as version 0.4.** Its
+  `User-Agent` was a hardcoded string, still saying 0.4 at 0.9 — so the one
+  host this tool ever contacts had been told a version that was wrong for
+  five releases. It is built from `VERSION` now. The reason it survived is
+  worth recording: a test asserted the literal `"harness-dispatch/0.4 …"`,
+  so the suite was holding the stale claim in place rather than catching it.
+  That assertion now compares against the real version.
+
+- A note returned to the CALLER carried a git commit hash
+  (`… this was per-process until 304a1b5`), which means nothing to anyone
+  reading a dispatch response. Removed, along with a second hash in a
+  comment and a reference to a line number in a file the symbol had since
+  moved out of.
+
+- The HTTP surface's context-file limit is imported from the MCP surface
+  rather than copied. It was a second `= 64` under a comment reading
+  "mirrors MAX_CONTEXT_FILES in mcp/tools.ts — the two surfaces must
+  agree": the constant does not live in that file, and a comment cannot
+  make two numbers agree. The module was already importing its sibling
+  constant from the right place.
+
+- `explicitOptsFromHints` is gone. It was exported for nobody: it existed
+  because the HTTP fanout path built dispatch options by naming fields
+  inline and dropped two, and that path now enforces route policy earlier
+  and passes hints wholesale — which is what the deleted function's own
+  docblock argued for.
+
+- **The landing page no longer describes a different product.** It listed
+  three MCP tools where six are registered and one resource where there are
+  two; its setup block ran `configure` without `--yes`, which writes
+  nothing, and then showed `doctor --live` output using three strings the
+  tool has never printed; its MCP snippet omitted `--config`, the form the
+  tool itself warns silently falls back to shipped defaults and ignores your
+  config file; it claimed "the one outbound call is a public leaderboard
+  GET" when that fetch is opt-in and off by default; and its worked example
+  showed a job id the API cannot produce. The sample output is now copied
+  from a real run.
+
+- `package.json`'s `homepage` pointed at a GitHub Pages URL that returns
+  404 — the deploy workflow is manual-only and has never been run — so the
+  link npm shows on the package page was broken. It now points at the
+  README. The site's own spec records that the page is not live and what to
+  do about it.
+
+- **An abandoned job no longer blames the wrong process.** Its error read
+  "The dispatch server that started this job exited before the run finished",
+  and a load test produced that message verbatim while the server was up and
+  still serving requests — one supervisor had been killed. The status file
+  this is derived from records a heartbeat and nothing about who was holding
+  it, so naming a culprit was always a guess, and it sent anyone debugging to
+  the wrong process. It now says what is known: the job stopped reporting,
+  the process running it is gone, the partial output is on disk, and
+  `retry_job` re-runs the same task.
+
+- `max_concurrent_runs: 0` is documented as what it is. README said it
+  "removes the bound"; measured under load, it also takes the supervisor
+  pool out of the path, so every job gets its own runner process at ~76 MB —
+  the per-job cost the pool exists to remove, on the memory-bound machine
+  the cap exists for. Routing the unbounded case through the pool would be
+  better and is not done here: the pool sizes itself by dividing the limit,
+  so an infinite one provisions zero supervisors, and getting that right
+  needs its own load run rather than a guess.
+
+- **The shipped harness defaults are read through the same field table as
+  everything else**, closing a silent drop that was already live. Route
+  settings resolve through one shared table so that a key works on `clis:`,
+  `endpoints:` and the legacy `services:` at once — but the parser for the
+  shipped defaults still hand-wrote its own list, and had drifted:
+  `thinking_level` on a built-in harness entry was parsed by nobody, while
+  the table reads that very field as the fallback for every user route of
+  that harness. Exactly the silent-drop shape the table exists to retire,
+  one layer underneath it. A row added to the table now reaches the defaults
+  layer too, instead of needing to be remembered in a fourth place.
+
+- **The two workspace policies no longer keep separate copies of the guards
+  that protect a recursive delete**, and those guards are now tested on
+  Windows, where the attack they exist for was originally measured. `copy`
+  and `git_worktree` each had their own prune function and their own
+  create-and-verify sequence, ~55 and ~30 lines, identical but for a git
+  root. That duplication is why the symlink class took four releases to
+  close: each fix landed in one copy, shipped as done, and the next review
+  found the other still exploitable. The comment left behind said "whenever
+  one of these gets a guard, check the other in the same edit" — a process
+  rule standing in for a shared function, which now exists.
+
+  The tests that cover those guards were skipped on Windows because an
+  unprivileged `symlink(..., "dir")` fails there. A junction does not, and
+  `lstat` reports one as a symbolic link, so the code under test sees what
+  it sees on POSIX. Two of the six skips are gone.
+
+  Three deliberate breakages that the suite previously did NOT catch — the
+  sweep's name check removed, the verify-before-prune ordering reversed, and
+  the symlink refusal removed — now each fail their own test. The gap was
+  that the destructive path only runs past the 24-hour retention window and
+  no test aged anything, so the delete never happened and the guards were
+  never asked. Two new tests age a directory on purpose.
+
+- **A patch-building path no input could reach has been removed, along with
+  the ~800-line test suite guarding it.** When a `copy` job had no recorded
+  changed-file list, the patch was built by diffing the whole original
+  directory against the whole workspace — a comparison that reports every
+  excluded directory as deleted, so ~170 lines of path normalisation and
+  section filtering existed to make its output safe to apply. The field it
+  falls back from has been recorded since 2026-07-13 and an isolated
+  workspace is pruned after a day, so no run reaching this code could still
+  exist; its own comment still described the copy as living inside the
+  project, which stopped being true in 0.7.0. Such a job is now refused with
+  the path to its workspace, matching what the `git_worktree` branch beside
+  it already did. Two tests that had been passing only because their fixture
+  omitted the field now run against the current path, and one of them turns
+  out to pin something real: discard refuses to destroy unapplied work, a
+  guard the old fixture never triggered.
+
+- **Dead imports and locals can no longer accumulate unnoticed.** The
+  compiler was not asked about them, and 38 had built up across twelve
+  files: three whole import declarations nothing read, a function nobody
+  called, a parameter threaded through a signature after the code that used
+  it was fixed, and two catch blocks computing a message they discarded.
+  Individually harmless; in bulk they are what makes a reader unable to tell
+  what is load-bearing. All 38 removed, and `noUnusedLocals` /
+  `noUnusedParameters` are now on, so the next one fails the build rather
+  than joining the pile.
+
+- **The router had two implementations of every dispatch path, and its own
+  header said otherwise.** `route()`/`routeTo()` and `stream()`/`streamTo()`
+  were separate selection-and-fallback loops, with a second copy of the
+  workspace-policy wrapper beside them — about 250 lines that had to stay in
+  step and did not. The file's header claimed the buffered methods were
+  "reimplemented on top of the streaming primitives", which is what made the
+  drift invisible: the timeout rule ended up written four times, and only the
+  `route()` copy was covered by a test, while background jobs and every HTTP
+  request run on the streaming pair. The buffered methods now drain the same
+  loop. One thing is still chosen per entry point, and only one: whether the
+  dispatcher is asked through `dispatch()` or `stream()` — an endpoint route
+  keeps its non-streaming request, which sets `stream: false` on the wire, so
+  no live traffic changes shape. Behaviour is otherwise unchanged; 123 lines
+  are gone.
+
+- **An empty `HARNESS_DISPATCH_STATE_DIR` sent every state path to the
+  current directory.** The lookup used `??`, which treats an empty string as
+  a real value — and an empty value is what a launcher or shell produces
+  when it forwards a variable that is not set. The state root became `""`,
+  so config, jobs, breaker state, quota counters and logs all resolved
+  against wherever the process happened to start: the cwd-dependent bug this
+  module's own comment says was fixed. A relative value is now anchored too,
+  so a job runner spawned with a different working directory cannot read a
+  different state root than the server that spawned it.
+
+- **`doctor` no longer reports a Codex that is installed but not logged in
+  as logged in** when its CLI prints usage text and exits 0, which is what a
+  build without the `login status` subcommand does. Exit code and output
+  must now agree. Also, the login probe's synchronous spawn-failure path
+  bypassed its own settled guard.
+
+- `doctor`'s `config` line now distinguishes a file that defines no routes
+  from one that defines routes AND asks for detection with `detect: true`.
+  It reported the former for both, which reads as though the file were being
+  ignored.
+
+- **The plugin's `/setup` command no longer walks users into a config that
+  removes every CLI harness.** It told them to write `disabled:`,
+  `overrides:` and `endpoints:` together — and a config carrying
+  `endpoints:` is authoritative, so detection switches off, the two tuning
+  keys apply to nothing, and Claude Code, Codex, Cursor and Antigravity all
+  vanish from the route table. That is not hypothetical: the maintainer's
+  own config had this shape, and no dispatch on that machine could reach a
+  CLI harness for four days after 0.9.0 shipped the authoritative rule. The
+  command now states the rule up front, points at `configure --yes` first,
+  offers two valid shapes (`detect: true` plus `endpoints:`, or a fully
+  explicit `clis:`), and ends by reading the two `doctor` lines that report
+  the mistake. Also corrected in the plugin: the "not yet published" note
+  (0.9.0 is on npm), the config-resolution order (it omitted `./config.yaml`
+  and the state-dir variable), the claim that `hints.model` is unvalidated,
+  and the command list, which omitted `/setup`.
+- **Two rules that a user depends on were passing while broken.** An audit
+  broke fifteen guards on purpose to see which the suite would catch; these
+  are the two that got through. First, "a per-call `timeoutMs` beats the
+  service's configured default" is written out four times in `router.ts`,
+  once per entry point, and only the `route()` copy was tested — while
+  background jobs and every HTTP request go through `stream()`/`streamTo()`,
+  so the copies that carry real traffic were unpinned. Second, the HTTP
+  bearer check was only ever tested with the header MISSING: a server that
+  accepted any `Bearer` value at all passed every test in its own file, and
+  token rotation on a running server was never exercised. Both now have
+  table-driven tests covering every entry point and every authenticated
+  route, including a wrong token of the same length, an empty one, and one
+  without the scheme. No behaviour changed; the tests are what changed.
+
+- README corrected in nine places found by an audit against the code: the
+  Configure section described a verification step and an interactive
+  choice of harnesses, model priority and safety profile that do not exist;
+  Claude Code billing was still described as date-aware when the code
+  classifies it as plan usage unconditionally; the CLI list omitted the
+  public `dispatch` command while calling `route` the hidden one (it is the
+  alias); the endpoint-mode example used the legacy `services:` format
+  without saying so, which silently drops `clis:` routes when pasted into a
+  modern config; two different default timeouts were stated (60 minutes is
+  right for every MCP and HTTP dispatch); `job_status` with no id was said
+  to return every job (it returns the twenty newest); `configure`'s target
+  omitted that a `./config.yaml` still wins; `usage listModels` was said to
+  fetch live when a declared list is returned as-is; and a duplicated
+  endpoint line.
+
+- **`configure` no longer regenerates away a comment you put above its
+  header, and no longer counts a stripped final newline as an edit.** The
+  unedited check accepted any comment lines above the fingerprint, so a
+  `# note to self` at the top of the file was overwritten without a word;
+  meanwhile an editor that drops the trailing newline made the file count
+  as edited and forced `--force`. Only the exact header may sit above the
+  fingerprint now, and trailing whitespace is ignored when fingerprinting.
+  (Twenty-fifth acceptance pass, finding 4.)
+
+- **`doctor` names a harness on PATH that an authoritative config leaves
+  out.** A config listing its own routes is authoritative, so a harness
+  installed afterwards is simply absent — and `routes` said "1 ready
+  route(s)" with a second CLI installed and no hint; the PATH hint only
+  appeared at zero routes. It now adds "Installed but not in this config:
+  claude — add `detect: true` to <file> to merge them, or a clis: entry".
+  (Finding 5.)
+
+- **`--config` at the boundary.** A directory produced a raw `EISDIR` that
+  named no path; it now says which path is a directory. `--config=` (empty)
+  silently auto-detected and reported the routes as loaded "from" the
+  current directory; it is now the same usage error as a missing value. An
+  empty or routes-free config file was reported as the source of routes
+  that detection had found; doctor's `config` line now says they were
+  auto-detected and that the file defines no routes of its own. (Finding 3;
+  its remaining half — a load failure printing text under `--json` — is fixed
+  further down this same release.)
+
+## [0.9.0] — 2026-09-02
+
+### Changed (breaking)
+
+- **A config file that defines routes is now authoritative about them.**
+  Auto-detection used to run unconditionally, so a file with `clis:` or
+  `endpoints:` entries ADDED to the installed harnesses rather than replacing
+  them, and only `disabled:` — naming every route, including ones you might
+  not know existed — subtracted.
+
+  That default caught three acceptance passes in a row despite explicit
+  warnings, and caught this project's own test suite: one test dispatched to
+  the real Claude Code CLI on every `npm test` and every CI run, under a
+  comment asserting it could not reach a route. It also decayed — adding
+  support for a new harness would auto-add it to every existing config, so a
+  `disabled:` list written today quietly stopped isolating tomorrow.
+
+  The legacy `services:` format has always behaved this way, so the two shapes
+  now agree rather than this being a new rule.
+
+  **What changes for you.** A config that has a `clis:` or `endpoints:` key
+  gets exactly the routes listed under it — including `clis: []`, which means
+  no CLI routes. Add `detect: true` to keep the old behaviour. A config
+  mentioning NEITHER key — one carrying only `overrides:`, `disabled:` or
+  settings — still auto-detects, because a file cannot be authoritative about
+  routes it does not describe; it now says so in a warning. `detect: false`
+  turns detection off outright.
+
+  Note that `disabled:` and `overrides:` tune AUTO-DETECTION, so they do
+  nothing in a config that lists its own routes — remove the entry instead.
+  The config the README tells you to copy said the opposite of this until it
+  was corrected in the same release; check yours if you wrote it from that.
+
+### Fixed
+
+- **Re-running `configure` after installing a harness no longer needs
+  `--force`.** The natural first-run order — install this tool, configure,
+  find out a harness is needed, install one, configure again — was refused
+  at the last step: "already exists ... --force". And had the first run found
+  anything, the re-run would have loaded that file as authoritative and not
+  detected the new harness at all. `configure` now stamps what it writes
+  with a fingerprint; a re-run that finds its own unedited output regenerates
+  it from a fresh detection, and says so. A file that has been edited, or
+  that configure did not write, is still loaded (so its settings migrate)
+  and still refused without `--force` — and since such a file lists its own
+  routes, `--force` regenerates it from the file, not from a detection. It
+  used to print "Detected N harness routes" there anyway; an acceptance pass
+  measured that line with a second harness on PATH that never appeared. It
+  now says detection did not run and how to merge (`detect: true`). The
+  non-interactive hint at the end of `configure --yes` also told the user to
+  pass `--yes`, which they just had; it now names `connect`. Seen on the
+  cold-install walk.
+
+- **`connect` now registers with a Claude Code that has never been opened.**
+  A client counted as installed only if its config file existed, and Claude
+  Code writes `~/.claude.json` on its first interactive launch — so a user who
+  installed Claude Code and this tool together was told "No MCP clients found
+  on this machine" with `claude` on PATH, handed JSON to paste by hand, and
+  `claude mcp list` stayed empty. A client whose command is on PATH now counts
+  as installed; when its file is missing, `connect` creates it holding only
+  our entry (0600), which Claude Code accepts as a user-scope registration.
+  Doctor's `mcp-clients` line names the installed-but-unregistered client
+  instead of a generic "not registered". Seen on the cold-install walk.
+
+- **`configure` writes its config where every later command can find it.**
+  It wrote `./config.yaml` into whatever directory it was run from, and
+  lookup stopped at the current directory, so a config written from `~` was
+  invisible to `doctor` or `dispatch` run inside a project — "0 configured
+  route(s)", no hint why — while the MCP client, handed the absolute path,
+  saw it fine. The default target is now the state directory
+  (`~/.harness-dispatch/config.yaml`, or under `HARNESS_DISPATCH_STATE_DIR`),
+  lookup falls back to that file after `./config.yaml` (a per-project file
+  still wins), `connect` looks in the same place, and doctor's `config` line
+  names the file it loaded. `--config` and `HARNESS_DISPATCH_CONFIG` are
+  unchanged. Seen on the cold-install walk, where a run from `/` produced
+  `/config.yaml`.
+
+- **`doctor` now notices a Codex that is installed but not logged in.** A
+  ready route meant "the CLI is on PATH", so a never-logged-in Codex passed
+  routes, billing and safety, and the first dispatch failed with a raw OpenAI
+  `401 Unauthorized ... Missing bearer` that never mentioned `codex login`.
+  A new `harness-login` check asks `codex login status` and fails with the
+  command to run when it answers "Not logged in". The CLI is asked rather
+  than its credential file read, because Codex accepts a ChatGPT login or an
+  API key and honours its own home directory, and only its own answer is
+  right in every case. Any answer other than a definite "Not logged in" —
+  an older Codex without the subcommand, a spawn failure — is reported as
+  undetermined and does not fail the install. Codex only: the other
+  harnesses have no equivalent subcommand this tool has verified.
+
+- **The installed command did nothing on Linux and macOS.** `npm install -g`
+  puts `harness-dispatch` on PATH as a symlink to `dist/bin.js`, and node
+  hands that unresolved link path to the program, so a run-if-entrypoint guard
+  that only looked for a filename ending in `bin.js` decided it was being
+  imported, ran nothing, and exited 0. Every documented command — `configure`,
+  `doctor`, `connect`, `dispatch`, even `--help` — printed nothing and reported
+  success on every non-Windows `npm install -g` or `npx` since the first
+  release. Windows was unaffected only because npm's `.cmd` shim passes the
+  real file path. The guard now also accepts an invoked path that resolves to
+  this file. Found by walking the README's three install steps in a clean
+  container, which nothing before had done: every prior walk ran `node
+  dist/bin.js` on this Windows machine.
+
+- **SECURITY: workspace paths are now built and verified rather than checked
+  and trusted.** Four consecutive releases patched a guard that inspected a
+  path STRING and then let every later write re-resolve it, and each patch was
+  found incomplete by the next review: it followed the link it was checking,
+  then covered one of the two isolation policies, then only the last path
+  segment, then stopped one directory short of the one the release notes named
+  — and was silently inert altogether if the workspaces setting had a trailing
+  slash or a `..` in it. Validating once also left the rest of the dispatch
+  trusting the result, so swapping a directory for a link mid-copy redirected
+  it.
+
+  Every directory from the anchor down is now created by this tool with a
+  non-recursive `mkdir`, which cannot traverse a link it did not make, and the
+  verified path is returned and used instead of being re-derived. Destructive
+  operations re-verify immediately before acting. The symlink refusal now
+  applies on Windows too, where junctions need no privileges and were being
+  followed.
+
+  Verified as two separate users on Linux across every shape reported: a link
+  at the workspace root, at the base, at the base's parent, and with the
+  setting spelled with a trailing slash or `..` — all refused, with nothing
+  written into the attacker's directory. Legitimate use is unaffected,
+  including a symlinked temp directory, which is normal on macOS.
+
+- **A delegated "run the tests" task no longer blocks its own route.** The
+  rate-limit phrase check ran against the whole transcript with no filter, so
+  this project's own test output — which names rate limits in test titles —
+  flagged as a real limiter, tripping the breaker for 300 seconds and
+  recording a rate limit that never happened. It is now checked per line and
+  past the same filter the numeric check uses.
+
+- **Real limiter messages that were being missed now register**, including
+  Anthropic's `rate_limit_error` and OpenAI's "You exceeded your current
+  quota" wording. A missed limit is the worse direction: the router keeps
+  hammering a route that has already said stop.
+
+- A metered route that declares it cannot bill you is no longer told to allow
+  paid usage. The previous release put that advice in a branch such a route
+  never reaches, so it worked for local routes only.
+
+- The claims checker now also scans MCP resource descriptions, every
+  route-refusal message, the rendered status body and the CLI's own help text
+  — surfaces a user or agent reads that it could not see.
+
+- **SECURITY: the workspace symlink guard covered one of the two isolation
+  policies.** The previous release applied the `lstat` refusal, the
+  guard-before-prune ordering and the sweep's name check to `copy` only.
+  `git_worktree` kept all three defects, so the identical attack still
+  destroyed data — reproduced as two real users: `copy` refused, `git_worktree`
+  deleted the victim's directory and raised the guard's error afterwards. The
+  entry claiming the class was closed was true for one policy and false for the
+  other. The test shipped with it passed `policy: "copy"` only, so the suite
+  stayed green over a live vulnerability; it now runs against both.
+
+- **The same guard only checked the last path segment.** `<tmp>/harness-dispatch`
+  and `<tmp>/harness-dispatch/workspaces` are fixed names under a
+  world-writable directory and were never examined, so a link planted one or
+  two levels up redirected the whole copy into an attacker's tree. Every
+  segment from the workspaces base down is now checked for links and ownership.
+
+- **A rate-limit regression from the previous release.** The filter added to
+  stop false positives discarded any line containing "should", which threw away
+  real limiter messages — a missed 429 means the router keeps hammering an
+  exhausted route. Two other patterns in that filter could never match at all.
+
+- **A free local route is no longer told it can bill you, with a fix that does
+  nothing.** A route with a declared kind and `paid_usage_possible: false` is
+  blocked when its `billing_confidence` is `unknown` — deliberate — but was
+  shown "route can incur paid usage" beside `paid=no` and advised to set a
+  field it already had. It now names the real cause and a remedy that works.
+
+- The `usage` tool description and README told agents that `service` and
+  `models` are unvalidated. Both throw on an unknown route id. The same wrong
+  sentence was corrected in the plugin skill one release earlier and missed
+  here — `scripts/check-claims.mjs` could not see tool descriptions at all, and
+  now does.
+
+- `scripts/fetch_benchmarks.py` no longer replaces good benchmark data with its
+  bundled fallback when the network fails. It swallowed every exception,
+  returned an empty set, wrote it out and exited 0 — turning a transient outage
+  into a permanent downgrade of the file that ships in the package.
+
+- An env-var reference embedded in a larger value (`base_url:
+  https://${HOST}/v1`) is now stripped from spawned CLI environments. The
+  sanitizer anchored to whole-string matches, so a key inside a longer string
+  stayed visible — the exact leak it was written to close, one string shape
+  over.
+
+- `OPERATIONS.md` described streamed fanout wrongly (its arms DO create jobs,
+  and are not aborted on disconnect), `safety.ts` claimed every shipped harness
+  defines all three safety profiles (`cursor_cli` declares one),
+  `ux-walkthrough.md` called `discard` the only destructive operation (the
+  retention sweep is the one that deleted files), and two module headers said
+  three tools where six are registered.
+
+- **SECURITY: a `copy` dispatch could delete files outside its workspace.**
+  The ownership guard used `stat`, which follows symlinks, so it compared the
+  uid of whatever a link POINTED AT rather than the link's own — and on a
+  shared machine the workspace path is predictable, so another local user can
+  plant one. Worse, the retention sweep that deletes aged workspaces ran
+  BEFORE the guard and had no ownership, marker or name check of its own.
+  Reproduced end to end in a container: a victim's directory chmod'd, the
+  project copied into it, and their files removed. All three now fixed —
+  `lstat` with symlinks refused outright, the guard runs before anything
+  destructive, and the sweep only deletes directories matching the name shape
+  this tool generates. The previous release's entry claiming a foreign-owned
+  root was "refused outright" was false against exactly this attack.
+
+- **Non-ASCII output was being corrupted.** Every stdout chunk was decoded on
+  its own, so a character split across two reads became replacement
+  characters — accented text, CJK, emoji, box-drawing. This is the path every
+  job uses, so it reached partial output, saved logs and delivered results,
+  and was invisible to anyone working in English.
+
+- **An aborted streaming request now stops the run.** Nothing connected the
+  client disconnect to the dispatch, so an abandoned stream ran to completion,
+  spending quota — and being the one path with no job record, it could not be
+  cancelled either. On a CLI route that meant an agent still editing files for
+  a caller that had gone.
+
+- **HTTP fanout with no eligible route now refuses** instead of answering 200
+  with an empty list. CI and cron read 200 as success; the MCP surface already
+  refused the identical request by name.
+
+- A configured `timeout_ms` now covers reading an endpoint's response body,
+  not just its headers — the same defect as the leaderboard timeout fixed last
+  release, in the path the router uses for its primary route.
+
+- Endpoint credentials can no longer leak through streaming error text: undici
+  embeds the request URL, and this branch returned it unscrubbed while its
+  sibling scrubbed it deliberately.
+
+- A rate-limit false positive no longer trips the breaker on text ABOUT a 429
+  — a line number, or a test assertion the delegate ran. One flag blocks a
+  route for 300 seconds and records a limit that never happened.
+
+- Config hot-reload now notices a config whose timestamp moves BACKWARDS
+  (restored from a backup, `cp -p`, extracted from an archive), and documents
+  the two cases where it does nothing at all.
+
+- The MCP snippet `configure` prints is now the entry `connect` actually
+  writes. Pasting the documented snippet then running `connect` was answered
+  "has an entry we did not write" — the tool called its own output
+  hand-edited and refused to update or remove it.
+
+- The chained-context omission notice named the wrong jobs when a job id
+  repeated, listing ones whose output was directly above it.
+
+- **An existing `copy` workspace directory is now actually secured.** The
+  previous release set 0700 with `mkdir`'s `mode` option, which applies only to
+  directories it CREATES — so everyone who had used `copy` before kept a
+  world-readable root holding a full copy of their source, and the entry
+  claiming otherwise was wrong. Measured on Linux: 0755 before, 0755 after. An
+  explicit chmod fixes them. A root owned by ANOTHER user is now refused
+  outright rather than copied into: the path is deterministic inside a shared
+  temp directory, so on the multi-user machine this guard exists for, someone
+  else can create it first.
+
+- **A half-dead leaderboard endpoint no longer hangs every dispatch.** The 8s
+  timeout was cancelled as soon as response headers arrived, leaving the body
+  read unbounded — measured still pending after 15s. Quality scores are awaited
+  per routing candidate, so this stalled routing indefinitely. Off by default,
+  which is why it was not worse.
+
+- **The HTTP server no longer leaks an MCP server per rejected request.** A
+  request carrying an unknown session id is answered 400 without initialising,
+  so nothing ever closed the server built for it in advance — five such
+  requests left five alive until shutdown. Sessions are also expired after 30
+  minutes idle: nothing removed them before except an explicit HTTP DELETE,
+  which the standard client never sends, so a clean shutdown left its session
+  resident forever.
+
+- **`retry_job` on an abandoned job no longer races the original.** Its guard
+  read the derived status while the claim path reads the raw status file, so a
+  supervisor could pick up the original while the retry ran — the exact outcome
+  the command's own error text says it prevents. The original is now marked
+  cancelled.
+
+- **Chained context says what it left out.** Jobs past the character budget
+  were dropped with no header and no note, contradicting the contract stated in
+  the same file. The docblock also claimed oldest entries truncate first, which
+  was never true — the last ones go.
+
+- The `copy` size refusal named the parent of your project rather than the
+  workspace holding the work, and the `force` flag's description still promised
+  an uncommitted-changes refusal that only exists inside a git repository.
+
+- **`configure` no longer deletes `detect: false`.** That key is the only
+  setting that isolates a machine from its installed paid CLIs, and it had no
+  field on the internal config object, so regenerating a file silently dropped
+  it. Measured: `detect: false` plus `max_concurrent_runs: 2` came back as the
+  latter alone, and reloading it with all four harness CLIs present produced
+  four routes on real subscriptions — under a "Wrote" message. A bare
+  `detect: false` regenerated as an empty document, where even the
+  "this config defines no routes" warning is suppressed, because its trigger
+  requires a non-empty file. `detect` now round-trips, and is written only when
+  the file stated it — carrying the resolved value would stamp `detect: true`
+  into every config that merely omitted it.
+
+- **`connect --remove` now removes the entry.** Without `--clients` it printed
+  "our entry is here — will be removed", exited 0, and left the file
+  byte-identical. The chooser filtered out plans whose entry already matches —
+  correct when registering, and exactly backwards when removing, where a
+  matching entry is the one being removed. `--clients` bypassed that function
+  and always worked; the broken form is the one documented in README and
+  OPERATIONS.md. A hand-edited entry is still refused without `--force`, and
+  now exits non-zero rather than reporting success for work it did not do.
+  This command had no test coverage at all; it does now.
+
+- **The test suite can no longer reach a real route.** Test setup already
+  sandboxed the log, state and jobs directories — where the suite WRITES — but
+  not config, which is what it DISCOVERS. A test that loaded config without
+  naming a file or stubbing detection picked up whatever the developer's
+  machine offers. Measured while closing this: on the maintainer's machine
+  that is the repo's own `config.yaml`, yielding four API routes with real
+  keys; on a machine with the CLIs installed it is the harness fleet, on real
+  subscriptions. One boundary test really did dispatch to Claude Code on every
+  CI run once. Setup now pins `HARNESS_DISPATCH_CONFIG` at a `detect: false`
+  sandbox, so an un-stubbed load gets an empty route table; a test wanting
+  routes passes its own path, which still wins.
+
+- **An orphaned job can be cancelled again — when it is still able to run.**
+  There are two kinds: one written to disk when the server exits before a
+  queued job starts (genuinely terminal), and one DERIVED from a stale
+  heartbeat while the file still says `queued`. The second is not inert — a
+  supervisor reclaims it once the dead owner's claim ages out — and `cancel`
+  answered "had already finished; nothing to cancel" about work that could
+  still start, leaving no way to stop it. It now settles the status itself,
+  since an orphaned job has no runner to notice a marker. The written kind
+  still reports nothing to cancel.
+
+- **A `copy` workspace of many files can no longer build an unbounded patch.**
+  The per-file diff was already bounded; the concatenation of those files was
+  not, so files each under the limit still summed past it. Both limits now
+  explain themselves — the worktree path used to surface the cap as
+  `stdout maxBuffer length exceeded`, which says nothing about patches or
+  about the work still being safe on disk.
+
+- **Isolated workspaces are created 0700**, like the state and job
+  directories. A `copy` workspace holds a full copy of your source and the
+  default base is in the shared temp directory, so on a multi-user POSIX
+  machine it was readable by everyone. No effect on Windows.
+
+- **Chained context says which project it came from.** `contextJobs` inlines
+  any job from the machine-wide store with no working-directory scoping, so a
+  job from one project could be pulled into a dispatch for another with
+  nothing indicating it. Disclosed rather than blocked: chaining across
+  projects is legitimate and the caller passes the id explicitly — what was
+  missing is that nobody could see it happen.
+
+- **Dead supervisor heartbeats are swept.** A killed supervisor's file stopped
+  being counted but stayed forever, and the liveness check reads every file on
+  every drain. The sweep is limited to heartbeats: the crash log beside them
+  exists to explain the very supervisor that died.
+
+- `workspace apply`'s description no longer claims a refusal it cannot always
+  make: the uncommitted-changes check needs a git repository. Outside one,
+  only the per-file check applies — a file the patch touches is still
+  refused, unrelated edits cannot be seen.
+
+- A `timeout_ms` or token-cap warning no longer claims routing reads the
+  field. Routing does not; the range branch was fixed for this and the
+  not-a-number branch beside it was not.
+
+- **Usage counters are no longer silently lost when two dispatches finish at
+  once.** `withFileLock` runs its critical section unlocked after a 2s
+  timeout — deliberate, and still right for the circuit breaker, which has
+  nothing to fall back on. It was wrong for the quota counters, which keep a
+  pending delta and clear it only on success: an unserialised write landed,
+  the delta was cleared as though serialised, and the process actually holding
+  the lock then overwrote the file with a value computed before that write
+  existed. Reproduced against the built artifact: five recorded calls gone,
+  no error. The counters now defer instead, and the delta lands on the next
+  result. A busy moment is no longer reported as "counters not reaching
+  disk" — they are delayed, not lost, and saying otherwise makes a working
+  system look broken.
+
+- **A route knocked out by a 429 no longer reports `tripped: true,
+  failures: 0`.** `trip()` set the cooldown without counting the failure, so
+  `usage` — the surface an orchestrator is told to consult before delegating
+  — showed a contradiction that reads as a bookkeeping bug rather than a real
+  trip.
+
+- **Discarding a workspace whose directory is already gone now clears the
+  registration git is still holding.** The early return skipped the block that
+  removes a worktree through git, so a workspace pruned by retention or
+  deleted by hand left `.git/worktrees/<name>` in the user's repo
+  permanently — the exact outcome `discardWorkspace`'s own documentation says
+  it exists to prevent. Reproduced: `git worktree list` still showing the path
+  as `prunable` after discard reported success.
+
+- **An orphaned or cancelled job now hands back its partial work through the
+  tool an orchestrator actually calls.** The progress was on disk and
+  `getAsyncJob` read it, but `job_status` answered `output: ""`: orphaned and
+  cancelled count as terminal, and the poll response attached `partialOutput`
+  only on the NOT-terminal branch. So a commit titled "an orphaned job hands
+  back its progress" was correct in the module it edited and had no effect at
+  the surface a caller touches — verified at the function, not at the tool.
+  The crash path (a `failed` status with no result) was losing its output the
+  same way. The HTTP surface already salvaged this; MCP now matches it, and
+  the answer says the output is PARTIAL so salvage is not read as a result.
+
+- **A gitignored file the agent wrote is no longer reported as applied while
+  being left behind.** Under `git_worktree`, the patch came from `git add -A
+  -N`, which obeys `.gitignore`, while the changed-file list came from a
+  filesystem fingerprint, which does not. A job that wrote a `.env` or any
+  ignored file got `applied: true` naming it, with the file absent from the
+  patch and from the project. It compounded: the already-applied guard needs
+  every recorded change present, so it never fired, and the next apply refused
+  with "changed since dispatch" — blaming the caller for the first apply's own
+  writes, the misleading refusal an earlier fix had removed. The paths already
+  recorded as changed are now force-added, which also makes `git_worktree`
+  agree with `copy`, whose per-file patch always carried them.
+
+- **`clis: []` now isolates a config, which is what the previous release said
+  it did.** Authoritativeness keyed off a NON-EMPTY list, so the most explicit
+  way to write "no CLI routes" still loaded every harness on the machine —
+  the exact failure the change was written for, described in its own comment
+  in the past tense while remaining true. Presence of `clis:`/`endpoints:` is
+  now what makes a config authoritative, empty or not. A config that mentions
+  neither still auto-detects, unchanged.
+
+- **An infinite or NaN route field is no longer accepted, and the warning
+  about it is no longer false.** The new range check covered negative values
+  but not `.inf`, `.nan`, or `1e999` (which YAML types as a string, and
+  `Number()` overflows to `Infinity`). Two paths were wrong: `1e999` produced
+  no warning at all, and `tier: -.inf, weight: .inf` loaded as
+  `-Infinity`/`Infinity` — ahead of every tier, above every score —
+  underneath a warning reading "IGNORED, and the built-in default applies
+  instead". A message asserting the opposite of what happened is worse than
+  the silence it replaced. Warnings also now name the value the operator
+  actually wrote (`JSON.stringify(Infinity)` is `null`, so they reported
+  `tier is null` for a file saying `-.inf`), and explain the right mechanism
+  per field rather than describing routing for `timeout_ms`.
+
+- **`configure` no longer generates a config that fails its own `doctor`.**
+  It carried `disabled:` forward alongside the `clis:` it generates; in an
+  authoritative config that control does nothing, so `doctor` reported it had
+  no effect and exited 1. The disabled route is already absent from the
+  generated list, so the name was saying nothing. It is still emitted for a
+  generated config that lists no routes, where it does the work.
+
+- **A `clis:` or `endpoints:` written as a mapping instead of a list now
+  says so.** The entries vanished, the config counted as defining no routes,
+  detection ran, and someone trying to name their own routes silently got
+  every installed paid harness instead — under a warning claiming their
+  config defined no routes, which contradicted the file in front of them.
+
+- Legacy `services:` configs now get the same top-level key warnings as the
+  modern shape. That path returned before the check ran, so `policy: copy`
+  warned twice in one format and not at all in the other.
+
+- **A negative `tier`, `weight` or `cli_capability` no longer hands a route
+  every dispatch.** These were type-checked but never range-checked, and
+  routing multiplies `weight` and `cli_capability` into the score while
+  ordering `tier` ascending — so a negative pair does not demote a route, it
+  promotes it past every legitimate one. An acceptance pass measured
+  `tier: -5, weight: -100, cli_capability: -3` scoring 299.8 against a normal
+  route's 0.88, from a tier sorting ahead of them all, with no warning
+  anywhere. Out-of-range values are now reported and ignored, so the built-in
+  default applies — the same outcome an unreadable value already got. Upper
+  bounds were deliberately not added: `cli_capability: 1.1` ships in this
+  repo's own default config as real tuning, and the defect is sign, not
+  magnitude.
+
+- Top-level `policy:` and `workspace_policy:` now say they have no effect.
+  Both were allow-listed and read nowhere — and both ARE valid per-route keys,
+  which is what makes the top-level spelling easy to write: it looks like a
+  global default for the per-route setting, and there is no such default. An
+  isolation control that silently does nothing is the failure the config
+  validator exists to prevent. The per-route keys are unaffected.
+
+- An `execute` task can no longer be routed to an HTTP endpoint. An endpoint
+  has no agent loop, no file access and no shell — PRODUCT.md states this as
+  design rather than gap — but an undeclared capability defaults to 1.0 and no
+  endpoint example declares any, so endpoints scored PERFECT for execute. An
+  acceptance pass measured a `--task-type execute` dispatch routed to an
+  endpoint, returning prose with exit 0: execution reported as succeeded when
+  none happened. It surfaced exactly when the CLI routes were busy or tripped,
+  which is the case a caller is least able to check.
+
+  Refused outright rather than scored low, on both counts deliberately: a score
+  of 0 still leaves a route selectable when it is the only candidate — the
+  failing case itself — and a declared capability must not override it, the
+  same rule as the safety-flag check. Endpoints remain full members of the mix
+  for plan, review and second opinions.
+
+- An orphaned job now hands back the progress it saved. When a supervisor dies
+  there is no result, but its output is on disk in `stdout.partial.log` — and
+  the orphan branch returned above the code that reads it, so the response was
+  empty while the trail sat there. Chaining had the same gap, reporting "no
+  result available" for a job whose partial output was recoverable; it now
+  carries that output, labelled INCOMPLETE. PRODUCT.md names losing this trail
+  as the defining failure: "a wasted attempt with no trail".
+
+- HTTP fanout arms are now job-backed, like the MCP surface has always been.
+  They called `routeTo` directly, so an arm's work existed only inside the
+  request — no job directory, no manifest, no partial log. Killing the client
+  or the server mid-fanout lost every arm's output with nothing on disk to
+  salvage, which is the failure PRODUCT.md names as defining, on one of two
+  surfaces.
+
+  The response shape is unchanged: arms are awaited and the same rows are
+  returned, so an OpenAI-compatible client sees exactly what it saw before.
+  Each row additionally carries the arm's `jobId`, which is what makes salvage
+  possible. This was briefly recorded here as deferred "because it changes what
+  a client receives" — that was wrong, and re-reading the MCP path showed why:
+  durability and the response contract are independent.
 
 ## [0.8.0] — 2026-08-31
 
@@ -1444,7 +2515,8 @@ the MCP surface to three tools: `dispatch`, `job_status`, `usage`.
 Known issues in this release, fixed in 0.5.0: `configure` writes resolved API keys into
 its output, and `configure --yes --force` can delete user-added harnesses.
 
-[Unreleased]: https://github.com/fstubner/harness-dispatch/compare/v0.8.0...HEAD
+[Unreleased]: https://github.com/fstubner/harness-dispatch/compare/v0.9.0...HEAD
+[0.9.0]: https://github.com/fstubner/harness-dispatch/compare/v0.8.0...v0.9.0
 [0.8.0]: https://github.com/fstubner/harness-dispatch/compare/v0.7.9...v0.8.0
 [0.7.9]: https://github.com/fstubner/harness-dispatch/compare/v0.7.8...v0.7.9
 [0.7.8]: https://github.com/fstubner/harness-dispatch/compare/v0.7.7...v0.7.8