pi-odd-worktree 1.1.0 → 1.2.0

package/lib/worktree-git.js

@@ -3,8 +3,7 @@
 //
 // Every external process is spawned with a fixed argv array — no shell
 // string is ever built, so branch names and paths cannot inject commands.
-// `listWorktrees` parses `git worktree list --porcelain -z` itself instead
-// of trusting Herdr JSON output.
+// `listWorktrees` parses `git worktree list --porcelain -z` itself.
 
 const { spawnSync } = require('node:child_process');
 const fs = require('node:fs');
@@ -564,193 +563,7 @@ function matchesAnyCheckout(identity, resolved, entries) {
   return false;
 }
 
-// Closed union of herdr operations with a per-operation flag allowlist,
-// mirroring the installed CLI surface (herdr 0.9.4, verified read-only
-// against `herdr worktree list|create|open --help`, `herdr pane list
-// --help` and `herdr agent start|get|list --help`: every flag below
-// exists there with the shape used here). Every value travels as its own
-// argv element because herdr rejects `--flag=value`. Unknown operations
-// or flags throw. `--trust-repository` is deliberately absent everywhere:
-// trusting a repository is a human decision these tools never take.
-// `--focus` stays opt-in for the worktree create/open calls that predate
-// the session tool; the session tool itself only ever passes `--no-focus`.
-const HERDR_ALLOWLIST = {
-  list: ['cwd'],
-  create: ['cwd', 'branch', 'base', 'path', 'label', 'focus'],
-  open: ['cwd', 'path', 'branch', 'noFocus', 'focus'],
-  remove: ['workspace', 'force'],
-  'pane-list': ['workspace'],
-  'agent-start': ['name', 'kind', 'pane', 'timeout', 'agentArgs'],
-  'agent-get': ['target'],
-  'agent-list': [],
-};
-
-const HERDR_FLAG = {
-  cwd: '--cwd',
-  workspace: '--workspace',
-  branch: '--branch',
-  base: '--base',
-  path: '--path',
-  label: '--label',
-  focus: '--focus',
-  noFocus: '--no-focus',
-  force: '--force',
-  kind: '--kind',
-  pane: '--pane',
-  timeout: '--timeout',
-};
 
-// Build the fixed argv for a herdr operation. Worktree operations produce
-// `herdr worktree <op> ...`; the session composition additionally needs
-// `herdr pane list`, `herdr agent start <NAME> ... -- [AGENT_ARG]...`,
-// `herdr agent get <target>` and `herdr agent list`, each with its own
-// fixed shape below so no caller hand-builds herdr argv.
-function herdrArgv(operation, params = {}) {
-  const allowed = HERDR_ALLOWLIST[operation];
-  if (!allowed) throw new Error(`unknown herdr operation: ${operation}`);
-  for (const key of Object.keys(params)) {
-    if (!allowed.includes(key)) throw new Error(`flag not allowed for herdr ${operation}: ${key}`);
-  }
-  // `herdr agent start <NAME> --kind <KIND> --pane <ID> --timeout <MS>
-  // -- [AGENT_ARG]...`: the agent name is positional and always first,
-  // the Pi argv travels after a `--` separator. Fixed order, values as
-  // separate elements, never `--flag=value`.
-  if (operation === 'agent-start') {
-    const { name, kind, pane, timeout, agentArgs } = params;
-    if (typeof name !== 'string' || name === '') throw new Error('invalid value for herdr agent-start name');
-    for (const [key, value] of [['kind', kind], ['pane', pane], ['timeout', timeout]]) {
-      if (typeof value !== 'string' || value === '') throw new Error(`invalid value for herdr agent-start ${key}`);
-    }
-    if (!Array.isArray(agentArgs) || agentArgs.some((entry) => typeof entry !== 'string')) {
-      throw new Error('invalid value for herdr agent-start agentArgs');
-    }
-    return ['agent', 'start', name,
-      '--kind', kind, '--pane', pane, '--timeout', timeout,
-      '--', ...agentArgs];
-  }
-  // `herdr agent get <target>`: the target is positional.
-  if (operation === 'agent-get') {
-    const { target } = params;
-    if (typeof target !== 'string' || target === '') throw new Error('invalid value for herdr agent-get target');
-    return ['agent', 'get', target];
-  }
-  // `herdr agent list` takes no flags.
-  if (operation === 'agent-list') return ['agent', 'list'];
-  // `herdr pane list [--workspace <ID>]`.
-  if (operation === 'pane-list') {
-    const argv = ['pane', 'list'];
-    if (params.workspace !== undefined) {
-      if (typeof params.workspace !== 'string' || params.workspace === '') {
-        throw new Error('invalid value for herdr pane-list workspace');
-      }
-      argv.push('--workspace', params.workspace);
-    }
-    return argv;
-  }
-  const argv = ['worktree', operation];
-  for (const key of Object.keys(params)) {
-    if (!allowed.includes(key)) throw new Error(`flag not allowed for herdr ${operation}: ${key}`);
-    const value = params[key];
-    if (typeof value === 'boolean') {
-      if (value) argv.push(HERDR_FLAG[key]);
-      continue;
-    }
-    if (typeof value !== 'string' || value === '') throw new Error(`invalid value for herdr ${operation} ${key}`);
-    argv.push(HERDR_FLAG[key], value);
-  }
-  return argv;
-}
-
-// Where the herdr binary comes from. Production honors the documented
-// HERDR_BIN_PATH override (tests), else `herdr` on PATH — the same
-// convention lib/gentle-diagnostics.js uses. Production (no harness
-// marker) keeps that historical behavior untouched.
-//
-// The test harness (GENTLE_WORKTREE_LIB_DIR, set only by the test loaders
-// that import the extension copy) is resolved FIRST, before the override is
-// trusted: an exported HERDR_BIN_PATH is inherited by every test process, so
-// honoring it first let a test run spawn the developer's LIVE herdr and
-// create real Herdr workspaces. Under the harness, therefore:
-//
-// - no binary at all still fails closed with the same refusal as before;
-// - a binary is honored only when the path itself proves it cannot be the
-//   live one (`isProvablyNotLiveHerdr`, which decides from the filesystem and
-//   never executes anything);
-// - a possible live herdr is refused unless the CURRENT test opts in with the
-//   dedicated flag below. The flag is the test's own declaration, so it must
-//   be set deliberately rather than inherited along with the path.
-const LIVE_HERDR_OPT_IN = 'GENTLE_WORKTREE_ALLOW_LIVE_HERDR';
-
-function realPathOrNull(target) {
-  try {
-    return fs.realpathSync(target);
-  } catch {
-    return null;
-  }
-}
-
-function isInsideDir(candidate, dir) {
-  if (candidate === dir) return true;
-  return candidate.startsWith(dir.endsWith(path.sep) ? dir : dir + path.sep);
-}
-
-// The scratch locations this repository's tests build their stub binaries in.
-// os.tmpdir() is the convention every fixture follows (`fs.mkdtempSync(
-// path.join(os.tmpdir(), ...))`), and no live Herdr install lives there.
-function testScratchRoots() {
-  const roots = [];
-  for (const candidate of [os.tmpdir(), path.resolve(os.tmpdir())]) {
-    const real = realPathOrNull(candidate) || candidate;
-    if (!roots.includes(real)) roots.push(real);
-  }
-  return roots;
-}
-
-// Can this path be PROVEN not to be a live herdr? Only filesystem facts are
-// used — the binary is never executed and nothing is spawned, so the answer
-// costs one realpath plus one stat and cannot reach a Herdr session.
-//
-// Proven not live: an absolute path that does not exist (a spawn of it fails),
-// that is not a regular file, that is not executable (a spawn of it fails),
-// or whose realpath is inside the test scratch directory. Everything else —
-// a relative or bare value (PATH/cwd resolved) and an existing executable
-// outside scratch — could be the live binary and is left unproven.
-function isProvablyNotLiveHerdr(bin) {
-  if (typeof bin !== 'string' || !path.isAbsolute(bin)) return false;
-  const real = realPathOrNull(bin);
-  if (real === null) return true;
-  let stat;
-  try {
-    stat = fs.statSync(real);
-  } catch {
-    return true;
-  }
-  if (!stat.isFile()) return true;
-  try {
-    fs.accessSync(real, fs.constants.X_OK);
-  } catch {
-    return true;
-  }
-  return testScratchRoots().some((root) => isInsideDir(real, root));
-}
-
-function resolveHerdrBinary(env = {}) {
-  const source = env || {};
-  const bin = source.HERDR_BIN_PATH;
-  const injected = typeof bin === 'string' && bin.length > 0;
-  const harness = source.GENTLE_WORKTREE_LIB_DIR;
-  const inHarness = typeof harness === 'string' && harness.length > 0;
-  if (!inHarness) return injected ? bin : 'herdr';
-  if (source[LIVE_HERDR_OPT_IN] === '1') return injected ? bin : 'herdr';
-  if (!injected) {
-    throw new Error('herdr binary is not injected: set HERDR_BIN_PATH in tests (refusing to run live herdr)');
-  }
-  if (isProvablyNotLiveHerdr(bin)) return bin;
-  throw new Error(
-    `refusing to run live herdr from a test harness: HERDR_BIN_PATH=${bin} can execute a live herdr; `
-    + `inject a scratch stub inside the OS temp directory, or set ${LIVE_HERDR_OPT_IN}=1 in the test that needs a live session`,
-  );
-}
 
 // ---------------------------------------------------------------------
 // Commits ahead of / behind a base branch (warp-popup W1).
@@ -1043,6 +856,4 @@ module.exports = {
   listWorktreesAsync,
   isPathInAnyCheckout,
   isPathInAnyCheckoutAsync,
-  herdrArgv,
-  resolveHerdrBinary,
 };

package/lib/worktree-hooks.js

@@ -8,7 +8,7 @@
 //   (b) dependency install by lockfile-detected stack,
 //   (c) `codegraph init` when the CLI is available.
 //
-// Both `worktree_upsert` (sync runner) and the wizard's gitOnly path (async
+// Both `worktree_upsert` (sync runner) and the panel create path (async
 // twin) reach these hooks, so the link policy is applied by ONE shared
 // implementation in `lib/worktree-symlinks.js` and both creation routes
 // behave identically.
@@ -394,7 +394,7 @@ async function runCreationHooksAsync(opts = {}) {
 
   // (a2) Link git-ignored principal entries: the async twin of the sync
   // step, sharing the one classifier in lib/worktree-symlinks.js so the tool
-  // path and the gitOnly/wizard path cannot disagree. The git reads and the
+  // path and the panel create path cannot disagree. The git reads and the
   // link writes are awaited, so the event loop keeps running.
   //
   // Policy (round-3 S3/L4): `.agents`, `.pi`, `.claude` and `odd` become

package/lib/worktree-session-guard.js

@@ -362,6 +362,14 @@ async function readGentlePresence(options = {}) {
         incarnation: header.incarnation,
         label: header.label,
         heartbeat: header.heartbeat,
+        // Published task counters, validated above and passed through
+        // unchanged: the warp guard reads this session's own workload.
+        counts: {
+          running: header.counts.running,
+          queued: header.counts.queued,
+          waiting: header.counts.waiting,
+          finished: header.counts.finished,
+        },
         recent: now >= header.heartbeat && now - header.heartbeat <= PRESENCE_FRESH_MS,
         workspace,
         unknown: workspace === null,

package/lib/worktree-warp-busy.js

@@ -0,0 +1,119 @@
+'use strict';
+// S4: a warp waits for THIS session's own background work.
+//
+// Gentle Shell publishes one presence header per live Pi session, carrying that
+// session's agent-task counters (`counts.{running,queued,waiting,finished}`) and
+// a heartbeat. This module reads that store through the SAME bounded reader the
+// checkout-deletion guard uses, hashes this session's id with the same sha256,
+// and keeps only ITS freshest header. Nothing else is read: no transcript, no
+// prompt, no activity payload.
+//
+// WHAT IT DOES NOT COVER. Background jobs (`bash_background`, `monitor`) live in
+// gentle-shell's in-memory job registry (lib/background-jobs.ts) and leave no
+// durable, session-attributable state on disk, and the Pi host exposes no API
+// for them. This module therefore never claims to see a job: the refusal text
+// names agent tasks only.
+//
+// FAILURE MODE. Best effort, like the close guard: an absent or unreadable
+// store answers `unavailable` and blocks nothing. Only a fresh header that
+// reports running or queued work makes a session busy.
+
+const { readGentlePresence, hashSessionId, PRESENCE_FRESH_MS } = require('./worktree-session-guard.js');
+
+// How long the command front waits for the published counters to drain before
+// it refuses, and how often it re-reads. Overridable so a session can shorten
+// or lengthen its own wait; the default keeps a warp from stalling a turn.
+const DEFAULT_WAIT_MS = 60000;
+const POLL_MS = 2000;
+const MAX_WAIT_MS = 600000;
+
+const isCount = (value) => Number.isSafeInteger(value) && value >= 0;
+
+function waitBudgetMs(env) {
+  const source = env && typeof env === 'object' ? env : {};
+  const raw = source.ODD_WORKTREE_WARP_BUSY_WAIT_MS;
+  if (raw === undefined || raw === null || raw === '') return DEFAULT_WAIT_MS;
+  const parsed = Number.parseInt(String(raw), 10);
+  if (!Number.isSafeInteger(parsed) || parsed < 0) return DEFAULT_WAIT_MS;
+  return Math.min(parsed, MAX_WAIT_MS);
+}
+
+function idleActivity(status) {
+  return { status, running: 0, queued: 0, waiting: 0, label: null, heartbeat: null, busy: false };
+}
+
+// This session's own counters, or an idle/unavailable answer. Never rejects.
+async function sessionActivity(options = {}) {
+  const opts = options && typeof options === 'object' ? options : {};
+  const hash = hashSessionId(opts.sessionId);
+  if (hash === null) return idleActivity('unknown');
+  let read;
+  try {
+    read = await readGentlePresence({ env: opts.env, now: opts.now });
+  } catch {
+    return idleActivity('unavailable');
+  }
+  if (!read || read.status !== 'ok') return idleActivity(read && read.status === 'unavailable' ? 'unavailable' : 'unknown');
+  let freshest = null;
+  for (const entry of Array.isArray(read.entries) ? read.entries : []) {
+    if (!entry || entry.sessionHash !== hash || entry.recent !== true) continue;
+    if (!entry.counts || !isCount(entry.counts.running) || !isCount(entry.counts.queued) || !isCount(entry.counts.waiting)) continue;
+    if (freshest === null || entry.heartbeat > freshest.heartbeat) freshest = entry;
+  }
+  if (freshest === null) return idleActivity('ok');
+  const running = freshest.counts.running;
+  const queued = freshest.counts.queued;
+  return {
+    status: 'ok',
+    running,
+    queued,
+    waiting: freshest.counts.waiting,
+    label: typeof freshest.label === 'string' ? freshest.label : null,
+    heartbeat: freshest.heartbeat,
+    busy: running > 0 || queued > 0,
+  };
+}
+
+// The one sentence both fronts use. It names the counters it actually read and
+// says plainly that background jobs are not visible to it.
+function busyText(activity) {
+  const running = activity && isCount(activity.running) ? activity.running : 0;
+  const queued = activity && isCount(activity.queued) ? activity.queued : 0;
+  const parts = [];
+  if (running > 0) parts.push(`${running} running`);
+  if (queued > 0) parts.push(`${queued} queued`);
+  const workload = parts.length > 0 ? parts.join(' and ') : 'no';
+  const label = activity && typeof activity.label === 'string' && activity.label.length > 0
+    ? ` on "${activity.label}"`
+    : '';
+  return `this session still has ${workload} agent task(s)${label}: the warp waits for them to finish (as of the last published heartbeat); background jobs are not visible here, so confirm they finished too`;
+}
+
+// Poll until this session has no running or queued agent task, or the budget
+// runs out. `read` and `sleep` are injected so a test never waits for real.
+async function waitForSessionActivity(options = {}) {
+  const opts = options && typeof options === 'object' ? options : {};
+  const read = typeof opts.read === 'function' ? opts.read : () => sessionActivity({ sessionId: opts.sessionId, env: opts.env });
+  const sleep = typeof opts.sleep === 'function' ? opts.sleep : (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+  const budget = isCount(opts.waitMs) ? opts.waitMs : waitBudgetMs(opts.env);
+  const poll = isCount(opts.pollMs) && opts.pollMs > 0 ? opts.pollMs : POLL_MS;
+  let activity = await read();
+  let waited = 0;
+  while (activity && activity.busy === true && waited < budget) {
+    const step = Math.min(poll, budget - waited);
+    if (step <= 0) break;
+    await sleep(step);
+    waited += step;
+    activity = await read();
+  }
+  return { activity, waited, waitedOut: !!(activity && activity.busy === true) };
+}
+
+module.exports = {
+  DEFAULT_WAIT_MS,
+  MAX_WAIT_MS,
+  busyText,
+  sessionActivity,
+  waitBudgetMs,
+  waitForSessionActivity,
+};

package/lib/worktree-warp-sessions.js

@@ -158,6 +158,33 @@ function sessionPoint(entries, leafId) {
   return { tipId, count };
 }
 
+// Does the ACTIVE branch carry a CONVERSATION? The host's own notion of
+// content is a `message` entry whose role is user or assistant
+// (SessionManager._persist only flushes a session file once an assistant
+// message exists), and everything the warp appends — the transition marker,
+// the confirmation notice, the session-worktree registration, a rename — is
+// bookkeeping, so a session that holds only those is still an empty one: it
+// has nothing to carry and therefore changes PATH instead of forking. The
+// branch is the same filtered walk `sessionPoint` uses, so an abandoned leg
+// never counts. The role is read from the persisted `entry.message.role` and
+// from a bare `entry.role` alike, because reading an entry as content must
+// not depend on one spelling. A read that throws answers `true`: an
+// unreadable session keeps the ordinary move (fork) instead of silently
+// dropping context it may hold.
+function hasConversation(entries, leafId) {
+  try {
+    for (const entry of activeBranch(entries, leafId)) {
+      if (!entry || isWarpBookkeepingEntry(entry) || entry.type !== 'message') continue;
+      const role = typeof entry.role === 'string' ? entry.role
+        : entry.message && typeof entry.message === 'object' ? entry.message.role : null;
+      if (role === 'user' || role === 'assistant') return true;
+    }
+    return false;
+  } catch {
+    return true;
+  }
+}
+
 // Point evidence for the R3 fork-vs-resume rule: the source session's
 // FILTERED position (S23 sessionPoint) when the record was written. Older
 // records carry {leafId, entryCount} from the raw-leaf comparison; they
@@ -559,6 +586,7 @@ module.exports = {
   recordWarpSession,
   isWarpBookkeepingEntry,
   sessionPoint,
+  hasConversation,
   samePoint,
   asPoint,
   pointOfSessionFile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-odd-worktree",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Pi package for odd-worktree: the Agent Worktree tools (create, list, close, warp), the /warp worktree panel, the /odd-list ODD viewer, and the /issues GitHub issue reader. Works in Pi alone; Herdr is optional.",
   "keywords": [
     "pi-package",

package/tools/herdr-free-create.test.js

@@ -0,0 +1,161 @@
+'use strict';
+// S1/S2: no creation path reaches a Herdr binary.
+//
+// The package no longer resolves or builds Herdr argv at all, so this suite pins
+// the claim two ways: a `herdr` sentinel FIRST on PATH records any argv it is
+// given (an empty log is the assertion), and a source scan proves no file
+// outside the git seam builds Herdr argv or resolves the binary. Both creation
+// fronts are exercised because they share one creation helper.
+const { test, describe, before, after } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { loadExtension, SRC, LIB_DIR } = require('./fixtures/load-extension.js');
+
+const savedEnv = { ...process.env };
+const scratch = [];
+const track = (entry) => { scratch.push(entry); return entry; };
+after(() => {
+  for (const key of Object.keys(process.env)) if (!(key in savedEnv)) delete process.env[key];
+  for (const [key, value] of Object.entries(savedEnv)) process.env[key] = value;
+  for (const dir of scratch) { try { fs.rmSync(dir, { recursive: true, force: true }); } catch {} }
+});
+
+const BIN = track(fs.mkdtempSync(path.join(os.tmpdir(), 'no-herdr-bin-')));
+const HERDR_LOG = path.join(BIN, 'calls.log');
+fs.writeFileSync(
+  path.join(BIN, 'herdr'),
+  '#!/bin/sh\nprintf "%s\\n" "$*" >> "$HERDR_LOG"\nexit 1\n',
+  { mode: 0o755 },
+);
+fs.writeFileSync(path.join(BIN, 'codegraph'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
+
+function herdrCalls() {
+  try {
+    return fs.readFileSync(HERDR_LOG, 'utf8').trim();
+  } catch {
+    return '';
+  }
+}
+const resetHerdr = () => fs.writeFileSync(HERDR_LOG, '');
+
+function git(cwd, args) {
+  const out = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  if (out.status !== 0) throw new Error(`git ${args.join(' ')}: ${out.stderr}`);
+  return out.stdout.trim();
+}
+
+function makeRepo() {
+  const dir = track(fs.mkdtempSync(path.join(os.tmpdir(), 'no-herdr-repo-')));
+  git(dir, ['init', '-b', 'main']);
+  git(dir, ['config', 'user.email', 'no-herdr@example.test']);
+  git(dir, ['config', 'user.name', 'No Herdr']);
+  fs.writeFileSync(path.join(dir, 'README.md'), '# fixture\n');
+  git(dir, ['add', 'README.md']);
+  git(dir, ['commit', '-m', 'init']);
+  return fs.realpathSync(dir);
+}
+
+const resultText = (result) => (result.content || []).map((part) => (part && part.text) || '').join('\n');
+
+function ctxFor(repo, notes, ui) {
+  return {
+    cwd: repo,
+    hasUI: true,
+    mode: 'tui',
+    sessionManager: { getSessionId: () => 'no-herdr-session' },
+    ui: { confirm: async () => true, notify: (text, level) => notes.push([level, text]), ...(ui || {}) },
+  };
+}
+
+// `/warp` create: the selector's create action, the create panel's answer, then
+// the closing selector. Only those answers are scripted.
+function warpCreateUi(panelAnswer) {
+  let call = 0;
+  return {
+    custom: async () => {
+      call += 1;
+      if (call === 1) return { create: true };
+      if (call === 2) return panelAnswer;
+      return undefined;
+    },
+  };
+}
+
+let tools;
+let commands;
+before(async () => {
+  process.env.PATH = `${BIN}${path.delimiter}${savedEnv.PATH || ''}`;
+  process.env.GENTLE_WORKTREE_THREAD = 'no-herdr-session';
+  ({ tools, commands } = await loadExtension({}));
+});
+
+describe('no creation path invokes Herdr', () => {
+  for (const existing of [false, true]) {
+    const kind = existing ? 'an existing' : 'a new';
+
+    test(`worktree_create never invokes Herdr for ${kind} branch`, async () => {
+      resetHerdr();
+      const repo = makeRepo();
+      const branch = existing ? 'feat/adopted' : 'feat/fresh';
+      if (existing) git(repo, ['branch', branch]);
+      const result = await tools.get('worktree_create').execute(
+        'no-herdr-tool',
+        { branch, changes: 'none' },
+        undefined,
+        undefined,
+        ctxFor(repo, []),
+      );
+      assert.notEqual(result.isError, true, resultText(result));
+      assert.equal(result.details.branchCreated, !existing);
+      assert.equal(herdrCalls(), '', `Herdr was invoked: ${herdrCalls()}`);
+      assert.doesNotMatch(resultText(result), /herdr (workspace|association)/i, 'no Herdr workspace is reported');
+    });
+
+    test(`/warp create never invokes Herdr for ${kind} branch`, async () => {
+      resetHerdr();
+      const repo = makeRepo();
+      const name = existing ? 'adopted' : 'fresh';
+      if (existing) git(repo, ['branch', `feat/${name}`]);
+      const notes = [];
+      await commands.get('warp').handler('', ctxFor(repo, notes, warpCreateUi({ ok: true, type: 'feat', name })));
+      const target = path.join(path.dirname(repo), `${path.basename(repo)}-worktrees`, `feat-${name}`);
+      assert.ok(fs.existsSync(target), `the /warp create made no checkout (notifications: ${JSON.stringify(notes)})`);
+      assert.equal(herdrCalls(), '', `Herdr was invoked: ${herdrCalls()}`);
+      for (const [, text] of notes) assert.doesNotMatch(text, /herdr (workspace|association)/i, `Herdr reported: ${text}`);
+    });
+  }
+
+  test('a refused create writes nothing and never invokes Herdr', async () => {
+    resetHerdr();
+    const repo = makeRepo();
+    const before = git(repo, ['branch', '--format=%(refname:short)']);
+    const result = await tools.get('worktree_create').execute(
+      'no-herdr-bad',
+      { branch: 'bad..name', changes: 'none' },
+      undefined,
+      undefined,
+      ctxFor(repo, []),
+    );
+    assert.equal(result.isError, true);
+    assert.match(resultText(result), /^invalid branch name/);
+    assert.equal(git(repo, ['branch', '--format=%(refname:short)']), before);
+    assert.equal(herdrCalls(), '', `Herdr was invoked: ${herdrCalls()}`);
+  });
+
+  // S1 is an AUDIT claim: no source file outside the git seam reaches a Herdr
+  // binary. Pinned as text so a reintroduced call cannot hide in a helper.
+  test('no source file outside lib/worktree-git.js calls a Herdr binary', () => {
+    const files = [
+      SRC,
+      ...fs.readdirSync(LIB_DIR).filter((name) => name.endsWith('.js')).map((name) => path.join(LIB_DIR, name)),
+    ].filter((file) => !file.endsWith(`${path.sep}worktree-git.js`));
+    for (const file of files) {
+      const source = fs.readFileSync(file, 'utf8');
+      assert.doesNotMatch(source, /herdrArgv\s*\(/, `${file} builds Herdr argv`);
+      assert.doesNotMatch(source, /resolveHerdrBinary\s*\(/, `${file} resolves the Herdr binary`);
+    }
+  });
+});