spexcode 0.2.1 → 0.2.3

package/spec-cli/src/layout.ts

@@ -27,14 +27,12 @@ type Config = {
   }
   sessions?: {
     maxActive?: number             // concurrency cap: max agents AUTONOMOUSLY PROGRESSING at once (default 8; see sessions.ts maxActive)
-    claudeCmd?: string             // the UNNAMED default worker launcher for Claude (default 'claude --dangerously-skip-permissions'); env SPEXCODE_CLAUDE_CMD overrides. A host-specific ABS path belongs in the gitignored spexcode.local.json, not here.
-    codexCmd?: string              // the UNNAMED default worker launcher for Codex (default 'codex --yolo'); env SPEXCODE_CODEX_CMD overrides. Same host-path rule.
     // named launcher profiles: a session picks ONE by name at create time ([[launcher-select]]), fixing both
     // its harness AND its exact launch command; the chosen NAME is persisted on the record so resume reuses the
     // same auth. `harness` defaults to 'claude'. Host-specific `cmd`s (abs wrapper paths) belong in the
     // gitignored spexcode.local.json — the name is portable, the cmd is a machine fact.
     launchers?: { [name: string]: { harness?: 'claude' | 'codex'; cmd: string } }
-    defaultLauncher?: string       // the launcher a create with no explicit --launcher/dropdown pick uses (else the unnamed claudeCmd/codexCmd path)
+    defaultLauncher?: string       // the launcher a create with no explicit --launcher/dropdown pick uses; required for no-choice creates
   }
   serve?: {
     // public-exposure config for `spex serve --public` (resolved gateway-side; see [[public-mode]] / gateway.ts).
@@ -78,7 +76,7 @@ export function readJsonConfig(p: string): any {
 // committed `spexcode.json` with an OPTIONAL machine-local `spexcode.local.json` layered on top (gitignored).
 // The local layer is the durable home for HOST-SPECIFIC values that must never be committed — e.g. an
 // absolute worker-launcher path (the host-path leak the repo otherwise warns against). Precedence per field:
-// local over committed; an env var (e.g. SPEXCODE_CLAUDE_CMD) still overrides both at its read site.
+// local over committed; a targeted env override (e.g. SPEXCODE_CODEX_SERVER_CMD) still wins at its read site.
 export function readConfig(root: string): Config {
   const committed = readJsonConfig(join(root, 'spexcode.json'))
   const local = readJsonConfig(join(root, 'spexcode.local.json'))
@@ -161,7 +159,7 @@ export type RawRecord = {
   node: string | null; title: string | null; name: string | null; parent?: string | null
   status: string; proposal: string | null; merges: number; note: string | null
   sortkey: number | null; createdAt: number; harness?: string; harness_session_id?: string
-  launcher?: string   // the named launcher profile this session was created under ([[launcher-select]]); absent/empty → the unnamed global default
+  launcher?: string   // the launcher profile this session was created under ([[launcher-select]]); absent/empty only on old records predating launchers
   launch_cmd?: string // the RESOLVED base launcher command PINNED at creation, so a resume replays the EXACT launcher (and its config-dir env) that made the conversation, never a since-changed default ([[launcher-select]] resume-launcher-pin); absent → old record, fall back to the launcher name / ambient
 }
 // the agent's OWN session id from the environment — the only locator now that the record left the worktree.

package/spec-cli/src/lint.ts

@@ -32,9 +32,34 @@ export function loadConfig(root: string): LintConfig {
   // Absent spexcode.json → tuned defaults; a MALFORMED one throws LOUD (readJsonConfig) rather than
   // silently reverting the author's budgets to defaults and green-washing the very warnings they tuned.
   const c = readJsonConfig(join(root, 'spexcode.json'))?.lint ?? {}
-  return { ...DEFAULT_CONFIG, ...c, altitude: { ...DEFAULT_CONFIG.altitude, ...(c.altitude ?? {}) } }
+  const merged = { ...DEFAULT_CONFIG, ...c, altitude: { ...DEFAULT_CONFIG.altitude, ...(c.altitude ?? {}) } }
+  return normalizeConfig(merged)
 }
 
+// canonicalize two adopter-input footguns that would otherwise SILENTLY match ZERO files (the same failure
+// class as an unset governedRoots — a green board that governs nothing). Both are natural mistakes a non-web
+// adopter makes reading the prose, so we accept-what-they-meant rather than reject:
+//  - a LEADING DOT on an extension: the matcher is `\.(ext)$`, so a literal ".ts" becomes `\..ts$` and never
+//    matches. Strip leading dots → ["ts"] and [".ts"] both work (prose historically showed ".ts").
+//  - a testGlob with NO "/": globs anchor to the full repo-relative path, so a bare "*.test.ts" matches only
+//    ROOT-level files and leaks every nested test into coverage. A slash-less glob is a basename intent →
+//    prepend "**/" so it matches that basename at any depth (the default "**/*.test.*" already does).
+export function normalizeConfig(cfg: LintConfig): LintConfig {
+  const dedot = (xs: string[]) => xs.map((x) => x.replace(/^\.+/, ''))
+  return {
+    ...cfg,
+    sourceExtensions: dedot(cfg.sourceExtensions),
+    identifierExtensions: dedot(cfg.identifierExtensions),
+    testGlobs: cfg.testGlobs.map((g) => (g.includes('/') ? g : `**/${g}`)),
+  }
+}
+
+// the source-file matcher, built from the configurable `sourceExtensions` knob. Coverage uses it to decide
+// which tracked files must be governed; yatsu's `yatsu-uncovered` reuses THE SAME knob so ONE setting
+// defines "source" for both coverage axes — a non-web project (Rust/Go/Python .rs/.go/.py) sets it once and
+// both the coverage warning and the loss-signal blind-spot check follow, with no second web-only allowlist.
+export const sourceExtRe = (extensions: string[]) => new RegExp(`\\.(${extensions.join('|')})$`)
+
 // a minimal glob → RegExp anchored to the full repo-relative path: `**` = any dirs, `*` = within a segment.
 function globToRe(glob: string): RegExp {
   const body = glob.split(/(\*\*\/|\*\*|\*|\?)/).map((seg) => {
@@ -103,7 +128,7 @@ export async function specLint(): Promise<Finding[]> {
   const root = repoRoot()
   const cfg = loadConfig(root)
   const ident = identRe(cfg.identifierExtensions)
-  const srcRe = new RegExp(`\\.(${cfg.sourceExtensions.join('|')})$`)
+  const srcRe = sourceExtRe(cfg.sourceExtensions)
   const specs = await loadSpecs()
   const out: Finding[] = []
 
@@ -159,10 +184,14 @@ export async function specLint(): Promise<Finding[]> {
 
   // coverage: every governed source file must be claimed by at least one spec.
   const governed = trackedSourceFiles(root, cfg.governedRoots, srcRe, cfg.testGlobs)
-  // no governed source found at all → the defaults name this repo's own dirs, so an adopter who never set
-  // lint.governedRoots would otherwise see a falsely-clean board. Make it loud and point at the knob.
+  // no governed source found at all → make it a SELF-EXPLANATORY repair entrypoint, not a dead end. The two
+  // knobs governing this are BOTH web-tuned by default (extensions ts/tsx/js/jsx; roots this repo's own dirs),
+  // so a non-web adopter (Rust/Go/Python) hits zero source two ways: right dir but wrong extension, or an
+  // unset root. Naming BOTH knobs, echoing their CURRENT values (so the mismatch is visible — "searching .ts
+  // in a .py tree"), and stating the `lint`-key nesting (a top-level key silently no-ops) turns the warning
+  // into the fix. Concrete non-web extension examples so the repair is copy-pasteable, not a schema hunt.
   if (governed.length === 0)
-    out.push({ level: 'warn', rule: 'coverage', msg: `governing NOTHING — no source files under governedRoots [${cfg.governedRoots.join(', ')}]. Set lint.governedRoots in spexcode.json to your project's source dirs.` })
+    out.push({ level: 'warn', rule: 'coverage', msg: `governing NOTHING — 0 source files matched extensions [${cfg.sourceExtensions.join(', ')}] under governedRoots [${cfg.governedRoots.join(', ')}]. Both knobs live under the "lint" key in spexcode.json (a top-level key is ignored): set governedRoots to your source dir(s) (e.g. ["src"]) AND sourceExtensions to your language (e.g. ["rs"] / ["go"] / ["py"]).` })
   for (const f of governed)
     if (!claimed.has(f)) out.push({ level: 'warn', rule: 'coverage', file: f, msg: `no spec governs: ${f}` })
 

package/spec-cli/src/localIssues.ts

@@ -2,7 +2,7 @@
 // [[mentions]]). A thread IS an Issue whose `store` is 'local' — membership implied by WHERE the file lives,
 // never written into it. One thread = one PLAIN markdown file at <main>/.spec/.issues/<id>.md; there is
 // deliberately no content-kind taxonomy (a change suggestion, an annotation, a Q&A are the same mechanism —
-// the prose says what it is). Others sign/reply/discuss like an async chatroom; a supervisor drains it via
+// the prose says what it is). Others reply/discuss like an async chatroom; a supervisor drains it via
 // `spex issues` (reading is the port's job, issues.ts — this module owns only the store + its write verbs).
 // Because a thread file is NOT named spec.md, the spec walk never nodes it and isSpecMd ignores it —
 // invisible to lint / drift / deriveStatus / board with ZERO exemption. The store lives on the TRUNK, not
@@ -87,10 +87,9 @@ const currentSession = (): string => envSessionId() || 'unknown'
 const sleep = (ms: number) => Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms)
 
 // ── file format ──────────────────────────────────────────────────────────────────────────────────────
-// frontmatter (concern/by/status/nodes/evidence/signers/created) + a prose body, then any replies — each
+// frontmatter (concern/by/status/nodes/evidence/created) + a prose body, then any replies — each
 // preceded by a `<!-- reply: <by> @ <iso> -->` sentinel: invisible in rendered markdown, unambiguous to
-// parse. Only the store writes these files, so a fixed shape is safe. Lists are `key: a, b` scalars so a
-// +1 sign is a one-line change.
+// parse. Only the store writes these files, so a fixed shape is safe.
 //
 // A REMARK ([[remark-substrate]]) is a reply carrying extra state, appended to the SAME sentinel as a
 // ` :: <space-joined k=v attrs>` tail (a plain reply has no tail → parses unchanged, backward compatible):
@@ -120,9 +119,8 @@ function parse(id: string, text: string): Issue {
     store: 'local',
     concern: fm.concern || id,
     by: fm.by || 'unknown',
-    status: fm.status || 'open',
+    status: fm.status === 'landed' ? 'landed' : 'open',
     nodes: list(fm.nodes),
-    signers: list(fm.signers),
     created: fm.created || '',
     body: body.join('\n').trim(),
     replies: replies.map((r) => ({ ...r, body: r.body.trim() })),
@@ -165,7 +163,6 @@ function serialize(p: Issue): string {
     `status: ${safeScalar(p.status)}`,
     p.nodes.length ? `nodes: ${p.nodes.join(', ')}` : '',
     p.evidence.length ? `evidence: ${p.evidence.join(', ')}` : '',
-    p.signers.length ? `signers: ${p.signers.join(', ')}` : '',
     `created: ${p.created}`,
   ].filter(Boolean)
   let out = `---\n${fm.join('\n')}\n---\n\n${safeBody(p.body)}\n`
@@ -259,7 +256,7 @@ function ensureStoreMigrated(): void {
 // structurally invisible to spec-lint, and the commit is provably store-only (one .spec/.issues/ path), so the
 // pre-commit gate would only pass anyway — running it just burns seconds (tsx cold-start) holding the lock.
 // A NO-CHANGE write is idempotent SUCCESS, never a failure: when the serialized bytes already equal the
-// stored state (a duplicate resolve/sign — the store IS the requested state), `git commit` would exit 1
+// stored state (a duplicate close — the store IS the requested state), `git commit` would exit 1
 // 'nothing to commit', so we detect the no-op after `add` (the staged path equals HEAD → status is silent)
 // and skip the commit. Returns whether the store actually changed, so a caller can say 'already <state>'.
 // MUST run while holding withStoreLock — it is the write half of a locked read-modify-write; its callers
@@ -286,7 +283,7 @@ function writeStoreFile(p: Issue, message: string): boolean {
 }
 
 // prepare (a FRESH read-modify or a new thread) + write + commit a single store file, all under the store
-// lock so the read-modify-write is atomic. prepare() runs INSIDE the lock, so a reply/sign/resolve reads the
+// lock so the read-modify-write is atomic. prepare() runs INSIDE the lock, so a reply/close reads the
 // current thread, never a stale copy. A pre-rename store migrates first (before the lock — ensure takes it).
 // `changed: false` = the store already held exactly this state (see writeStoreFile) — success, nothing committed.
 function commitStore(message: string, prepare: () => Issue): { issue: Issue; changed: boolean } {
@@ -312,7 +309,6 @@ export function openIssue(concern: string, opts: { nodes?: string[]; body?: stri
     by: opts.author || currentSession(),
     status: 'open',
     nodes,
-    signers: [],
     created: new Date().toISOString(),
     body: (opts.body || `(no detail given — ${concern})`).trim(),
     replies: [],
@@ -395,25 +391,13 @@ export async function postLocalIssue(
   return { thread, outcomes }
 }
 
-export function sign(id: string): string[] {
-  const by = currentSession()
-  return commitStore(`issue(${id}): signed by ${by}`, () => {
+export function closeLocalIssue(id: string): { status: 'landed'; already: boolean } {
+  const { changed } = commitStore(`issue(${id}): close`, () => {
     const p = loadOne(id)
-    if (!p.signers.includes(by)) p.signers.push(by)
-    return p
-  }).issue.signers
-}
-
-const RESOLUTIONS = new Set(['accepted', 'rejected', 'landed'])
-// `already` = the thread was in that state before this call — an idempotent success, nothing committed.
-export function resolve(id: string, as: string): { as: string; already: boolean } {
-  if (!RESOLUTIONS.has(as)) throw new Error(`resolution must be one of: ${[...RESOLUTIONS].join(' | ')}`)
-  const { changed } = commitStore(`issue(${id}): resolve ${as}`, () => {
-    const p = loadOne(id)
-    p.status = as
+    p.status = 'landed'
     return p
   })
-  return { as, already: !changed }
+  return { status: 'landed', already: !changed }
 }
 
 // ── remarks ([[remark-substrate]]) ──────────────────────────────────────────────────────────────────
@@ -439,7 +423,7 @@ function findOrCreateEvalThread(node: string, scenario: string, author: string):
     if (existing) return existing
     const p: Issue = {
       id: uniqueId(concern), store: 'local', concern, by: author, status: 'open',
-      nodes: [node], signers: [], created: new Date().toISOString(),
+      nodes: [node], created: new Date().toISOString(),
       body: `Remarks on the \`${scenario}\` eval of [[${node}]].`, replies: [], evidence: [],
     }
     writeStoreFile(p, `issue: ${concern}`)
@@ -479,16 +463,18 @@ function parseRemarkRef(ref: string): { id: string; rid: string } {
   return { id: ref.slice(0, i), rid: ref.slice(i + 1) }
 }
 
-// resolve a remark (R3): a DELIBERATE call, agent-only (the dashboard's `human` is rejected — a human
-// RETRACTS their own, resolve is a second party's judgment), NEVER the author (no self-resolve), and
-// MONOTONIC (no un-resolve — a regression is a NEW remark). `by` is the resolving party.
+// resolve a remark (R3): a DELIBERATE call by a SECOND PARTY — never the author (no self-resolve: an
+// identity comparison, so the dashboard's `human` cannot resolve a human-authored remark either), and
+// MONOTONIC (no un-resolve — a regression is a NEW remark). The resolver's identity is derived by the
+// SURFACE ([[remark-substrate]] LAW L): a governed session id from the CLI, the `human` sentinel from the
+// dashboard — both are real second parties, so the same rule runs on both. `by` is the resolving party.
 export function resolveRemark(ref: string, by: string): { thread: Issue; rid: string } {
   const { id, rid } = parseRemarkRef(ref)
   const { issue: thread } = commitStore(`remark(${id}#${rid}): resolved by ${by}`, () => {
     const p = loadOne(id)
     const r = p.replies.find((x) => x.rid === rid)
     if (!r) throw new Error(`no remark '${ref}' in that thread`)
-    if (!by || by === 'human' || by === 'unknown') throw new Error(`resolve is agent-only (needs a real session identity, got '${by || 'none'}'): a human withdraws their own remark with \`spex retract\`, not resolve`)
+    if (!by || by === 'unknown') throw new Error(`resolve needs a real identity (got '${by || 'none'}'): run it under a governed session, or from the dashboard (its actor is 'human')`)
     if (r.resolved) throw new Error(`remark '${ref}' is already resolved — monotonic: a regression is a NEW remark, never an un-resolve`)
     if (r.by === by) throw new Error(`refusing to self-resolve '${ref}': the author (${by}) may not resolve their own remark — resolve is a second party's deliberate judgment`)
     r.resolved = true; r.resolvedBy = by; r.resolvedAt = new Date().toISOString()
@@ -525,16 +511,16 @@ export function nudge(node: string): string {
     '── issues ─────────────────────────────────────────────────────────',
     `Your work (${node || 'this node'}) just landed. Two issue checks before you close:`,
     '',
-    '1. CLOSE what you finished. An issue whose work just landed is resolved, not',
+    '1. CLOSE what you finished. An issue whose work just landed is closed, not',
     '   left open — the open set is the OUTSTANDING work, so a stale open reads as a',
-    '   lie:  spex issues --store local     then   spex issues resolve <id> --as landed',
+    '   lie:  spex issues --store local     then   spex issues close <id>',
     '',
     '2. RECORD only what OUTLIVES this task — a concern you are NOT acting on now:',
     '   an off-mainline smell / awkward boundary / wish, or a trivial-but-must-not-',
     "   forget to-do that doesn't earn a spec node. NOT a bug tracker (that is the",
     '   spec graph + the forge), NOT your assigned task or a fix you are about to',
     '   make — those need no issue. Only the taste that would otherwise evaporate:',
-    '     spex issues                              # read first — sign/reply if already raised',
+    '     spex issues                              # read first — reply if already raised',
     '     spex issues open "<concern>" [--node <id>]   # else open one',
     'A supervisor drains the store later. (Advisory — skip if nothing is owed.)',
     '───────────────────────────────────────────────────────────────────',
@@ -547,7 +533,7 @@ export function nudge(node: string): string {
 // still-open local threads THIS session touched (authored or replied; eval `eval: <node> · <scenario>`
 // containers excluded — they host remarks and outlive every session by design) and prints NOTHING when the
 // session owes nothing, when the feature is OFF, or when there is no session identity. Some issues rightly
-// outlive their session (a taste concern waiting for the drain), so the ask is resolve OR say why it stays
+// outlive their session (a taste concern waiting for the drain), so the ask is close OR say why it stays
 // open — never a forced close.
 export function closeoutNudge(sessionId: string | null | undefined): string {
   if (!sessionId || sessionId === 'unknown' || !issuesEnabled()) return ''
@@ -555,7 +541,7 @@ export function closeoutNudge(sessionId: string | null | undefined): string {
     t.status === 'open' && !EVAL_CONCERN_RE.test(t.concern) &&
     (t.by === sessionId || t.replies.some((r) => r.by === sessionId)))
   if (!mine.length) return ''
-  return `\n\nIssue closeout — ${mine.length} still-open local issue(s) you touched (opened or replied): ${mine.map((t) => t.id).join(', ')}. For each, resolve it now if its work is finished (\`spex issues resolve <id> --as landed|rejected|accepted\`), or reply why it should stay open past this session (\`spex issues reply <id> --body "<why>"\`). Some issues rightly outlive their session — this is a reminder to sweep, not a gate.`
+  return `\n\nIssue closeout — ${mine.length} still-open local issue(s) you touched (opened or replied): ${mine.map((t) => t.id).join(', ')}. For each, close it now if its work is finished (\`spex issues close <id>\`), or reply why it should stay open past this session (\`spex issues reply <id> --body "<why>"\`). Some issues rightly outlive their session — this is a reminder to sweep, not a gate.`
 }
 
 // ───────────────────────── CLI ─────────────────────────
@@ -563,7 +549,7 @@ const fl = (args: string[], name: string): string | undefined => {
   const i = args.indexOf(`--${name}`)
   return i >= 0 ? args[i + 1] : undefined
 }
-const VALUE_FLAGS = new Set(['--node', '--body', '--as', '--evidence', '--scenario', '--code-sha'])
+const VALUE_FLAGS = new Set(['--node', '--body', '--evidence', '--scenario', '--code-sha', '--store'])
 // bare positionals, skipping flags + their values.
 function bare(args: string[]): string[] {
   const out: string[] = []
@@ -585,9 +571,10 @@ const repeated = (args: string[], name: string): string[] =>
   args.flatMap((a, i) => (a === `--${name}` ? [args[i + 1]] : [])).filter(Boolean) as string[]
 
 // the local-issue WRITE verbs, folded into the one issues surface (`spex issues <sub>` — the read routes
-// here when its first positional is a write sub): open "<concern>" [--node id…] [--evidence hash…]
-// [--body -|text], the id-based reply | sign | resolve, and the feature toggle on | off | status. `nudge`
-// is internal (the post-merge hook's caller). Store is a property of the issue, never a second command.
+// here when its first positional is a write sub): open "<concern>" [--store local|<host>] [--node id…]
+// [--evidence hash…] [--body -|text], the id-based reply, and the feature toggle
+// on | off | status. `nudge` is internal (the post-merge hook's caller). Store is a property of the issue,
+// never a second command — open and reply route by it (issues.ts createIssue/replyIssue).
 export async function runIssueWrite(args: string[]): Promise<number> {
   const sub = args[0]
   try {
@@ -611,35 +598,32 @@ export async function runIssueWrite(args: string[]): Promise<number> {
       if (s) console.log(`  ${s}`)
       return 0
     }
-    if (sub === 'sign') {
-      const id = bare(args.slice(1))[0]
-      if (!id) { console.error('usage: spex issues sign <issue-id>'); return 2 }
-      console.log(`signed '${id}' — signers: ${sign(id).join(', ')}`)
-      return 0
-    }
-    if (sub === 'resolve') {
-      const id = bare(args.slice(1))[0]
-      const as = fl(args, 'as')
-      if (!id || !as) { console.error('usage: spex issues resolve <issue-id> --as accepted|rejected|landed'); return 2 }
-      const r = resolve(id, as)
-      console.log(r.already ? `'${id}' already ${r.as} — store unchanged` : `resolved '${id}' → ${r.as}`)
-      return 0
-    }
     if (sub === 'nudge') {
       // internal: the post-merge hook calls this to print the (toggle-aware) nudge for a merged node.
       const text = nudge(bare(args.slice(1))[0] || '')
       if (text) console.log(text)
       return 0
     }
-    // `open`: start a new local issue. The concern is the bare positional(s) after the sub.
+    // `open`: start a new issue — STORE-ROUTED through the one creation port ([[issues]] createIssue, the
+    // same routine POST /api/issues runs): default local commits to the trunk store; `--store <host>`
+    // creates the real forge issue through that store's driver (no promote round-trip when the concern is
+    // born forge-visible). The concern is the bare positional(s) after the sub.
     const concern = sub === 'open' ? bare(args.slice(1)).join(' ').trim() : ''
     if (!concern) {
-      console.error('usage: spex issues open "<concern>" [--node <id>…] [--evidence <hash>…] [--body -|<text>]\n       spex issues reply|sign|resolve <issue-id> …  |  on|off|status')
+      console.error('usage: spex issues open "<concern>" [--store local|<host>] [--node <id>…] [--evidence <hash>…] [--body -|<text>]\n       spex issues reply|close|promote <issue-id> …  |  on|off|status')
       return 2
     }
-    const p = openIssue(concern, { nodes: repeated(args, 'node'), body: readBody(args), evidence: repeated(args, 'evidence') })
-    console.log(`opened '${p.id}'${p.nodes.length ? ` (re: ${p.nodes.join(', ')})` : ''} — committed to the local issue store; read it with \`spex issues\``)
-    const s = summarize(await dispatchMentions(p.body || concern, { threadId: p.id, node: p.nodes[0] || null, author: p.by, status: p.status }))
+    const r = await (await import('./issues.js')).createIssue(concern, {
+      store: fl(args, 'store'),
+      nodes: repeated(args, 'node'),
+      body: readBody(args),
+      evidence: repeated(args, 'evidence'),
+    })
+    const re = r.nodes.length ? ` (re: ${r.nodes.join(', ')})` : ''
+    console.log(r.store === 'local'
+      ? `opened '${r.id}'${re} — committed to the local issue store; read it with \`spex issues\``
+      : `opened '${r.id}' on ${r.store}${re} — ${r.url}`)
+    const s = summarize(r.outcomes)
     if (s) console.log(`  ${s}`)
     return 0
   } catch (e) {
@@ -650,7 +634,7 @@ export async function runIssueWrite(args: string[]): Promise<number> {
 
 // the first positionals runIssueWrite handles — the issues command routes these to it, everything else is
 // the read. Exported so the router and the runner can never drift.
-export const ISSUE_WRITE_SUBS = new Set(['open', 'reply', 'sign', 'resolve', 'on', 'off', 'status', 'nudge'])
+export const ISSUE_WRITE_SUBS = new Set(['open', 'reply', 'on', 'off', 'status', 'nudge'])
 
 // ── remark CLI ([[remark-substrate]]) — CLI-first: the whole author→resolve→retract loop, no server needed ──
 // `spex remark <host> --body -|<text> [--code-sha <sha>] [--scenario <name>] [--evidence <hash>…]`

package/spec-cli/src/materialize.ts

@@ -9,7 +9,6 @@ import { git } from './git.js'
 import { runtimeRoot, mainCheckout, readConfig } from './layout.js'
 import { resolveHarnessTargets, partitionHarnesses } from './harness-select.js'
 import { emitPlugin, cleanPlugin, pluginBundleDir, pluginVersion } from './plugin-harness.js'
-import { tsxBin } from './tsx-bin.js'
 
 // @@@ materialize - the "pay-per-change" node step (≈0.85s) the cheap shell gate invokes ONLY when the
 // .config content-hash moved. It renders the spec tree's surface nodes into the flat artifacts each
@@ -26,7 +25,10 @@ import { tsxBin } from './tsx-bin.js'
 
 const PKG = fileURLToPath(new URL('..', import.meta.url))                 // installed spec-cli root
 const DISPATCH = join(PKG, 'hooks', 'dispatch.sh')
-const SPEX = `${tsxBin(PKG)} ${join(PKG, 'src', 'cli.ts')}`
+// the ONE spex entry: the launcher (bin/spex.mjs), never a raw `tsx cli.ts` pair — the launcher owns tsx
+// resolution AND the mid-merge guard (a conflicted source tree degrades to one line + exit 75, not an
+// esbuild stacktrace), so every hook-baked callback inherits both.
+const SPEX = join(PKG, 'bin', 'spex.mjs')
 // the manifest + content-hash marker render into the GLOBAL per-project store (layout.runtimeRoot), NOT the
 // worktree — the worktree keeps zero SpexCode-rendered runtime; only the harness-discovered contract files +
 // shims (which the harness must find in-tree) are written under proj below.

package/spec-cli/src/mentions.ts

@@ -13,6 +13,18 @@ const NODE_RE = /\[\[([^\]\s]+)\]\]/g
 
 const uniq = (xs: string[]): string[] => [...new Set(xs)]
 
+// ── CLI sigil tolerance ───────────────────────────────────────────────────────────────────────────────
+// In FREE TEXT the sigils are required — they are what marks a reference apart from prose. In a CLI
+// ARGUMENT the whole token IS the reference, so the sigil is optional: `spex review @graph` ≡
+// `spex review graph`, `spex yatsu eval [[cli-surface]]` ≡ `spex yatsu eval cli-surface`. One shared strip,
+// applied by the session-selector matcher and every node-arg read site, so the habit a user learns in the
+// dashboard's input boxes works verbatim on the CLI — never a second grammar to learn.
+export function stripRefSigil(token: string): string {
+  const wrapped = /^\[\[(.*)\]\]$/.exec(token)
+  if (wrapped) return wrapped[1]
+  return token.startsWith('@') ? token.slice(1) : token
+}
+
 export function parseMentions(text: string): { actors: string[]; nodes: string[] } {
   const actors: string[] = []
   const nodes: string[] = []
@@ -47,6 +59,15 @@ export function resolveActors(tokens: string[], sessions: ActorSession[]): Resol
   })
 }
 
+// Any spawn's parent = its originator ([[session-nesting]]): the `@new` worker nests under the session that
+// wrote the mention — but ONLY when the author IS a real board session id. A dashboard 'human', a CLI
+// 'unknown', or a forge login resolves to no session → null → a top-level worker, never a phantom nest.
+// Exact id match only (lineage is provenance, not addressing — no prefix/name resolution), any liveness:
+// a parent that later closes is auto-promoted at read time by the derived tree.
+export function spawnParent(author: string, sessions: { id: string }[]): string | null {
+  return sessions.some((s) => s.id === author) ? author : null
+}
+
 // ── dispatch (integration) ─────────────────────────────────────────────────────────────────────────────
 export type DispatchOutcome = { token: string; result: 'sent' | 'spawned' | 'offline' | 'unresolved' | 'failed'; detail?: string; note?: string }
 
@@ -92,7 +113,7 @@ export async function dispatchMentions(
       // deliberate audit/re-measure), but the worker prompt carries the status and the outcome line warns.
       const settled = ctx.status && ctx.status !== 'open' ? ctx.status : undefined
       try {
-        const s = await newSession(ctx.node, newWorkerPrompt(ctx.threadId, ctx.node, ctx.author, text, ctx.status))
+        const s = await newSession(ctx.node, newWorkerPrompt(ctx.threadId, ctx.node, ctx.author, text, ctx.status), spawnParent(ctx.author, sessions))
         out.push({ token: r.token, result: 'spawned', detail: s.id, ...(settled ? { note: `thread ${settled}` } : {}) })
       } catch (e) { out.push({ token: r.token, result: 'failed', detail: e instanceof Error ? e.message : String(e) }) }
       continue

package/spec-cli/src/pty-bridge.ts

@@ -17,6 +17,11 @@ type Pending = (lines: Buffer[]) => void
 type Bridge = {
   id: string; pty: IPty; cols: number; rows: number; prewarmed: boolean
   repaintToken: number
+  // the size VOTE: whether this client currently asserts window size. Only a bridge some viewer has SIZED
+  // (visible connect / resize — never a hidden board-load connect) votes; all others carry tmux's
+  // ignore-size client flag and are size-NEUTRAL, so a foreign backend instance sharing the socket can
+  // never move a window a human is watching (see setVote).
+  voting: boolean
   // control-mode parser state: an incomplete-line BYTE buffer, the in-flight command block (%begin..%end) with
   // its command number, a FIFO of one resolver per command sent (tmux answers in order), and the last
   // %layout-change size so a repaint knows the pane already converged and needn't wait for the event.
@@ -269,10 +274,15 @@ function ensureBridge(id: string, prewarm = false): Bridge | null {
       env: { ...process.env, LANG: process.env.LANG || 'en_US.UTF-8' } as Record<string, string>,
     })
   } catch { return null }
-  b = { id, pty: p, cols, rows, prewarmed: prewarm, repaintToken: 0, buf: Buffer.alloc(0), block: null, blockNum: '', cmdQ: [], needsFull: true }
+  b = { id, pty: p, cols, rows, prewarmed: prewarm, repaintToken: 0, voting: false, buf: Buffer.alloc(0), block: null, blockNum: '', cmdQ: [], needsFull: true }
   bridges.set(id, b)
   const bx = b
   p.onData((d) => feed(bx, d as unknown as Buffer))   // encoding:null → d is a Buffer (typings say string)
+  // every client starts size-NEUTRAL: flag it before any refresh-client -C can enter the FIFO (a bare
+  // attach asserts nothing — measured: only -C moves a window — so there is no pre-flag race). Sent as a
+  // stream command, not an attach-time `-f`, so a pre-3.2 tmux degrades to a harmless in-stream %error
+  // (old size-fight behaviour) instead of a client that cannot attach at all.
+  void command(b, 'refresh-client -f ignore-size')
   // attach-session exited (session died or we detached): drop the bridge, unblock any awaiting command AND any
   // %layout-change waiter (no timer backs it now, so a bridge that dies mid-convergence MUST resolve its
   // waiter or the awaiting repaint hangs), and if viewers remain kick a reconcile to re-bind fast.
@@ -285,6 +295,19 @@ function ensureBridge(id: string, prewarm = false): Bridge | null {
   return b
 }
 
+// flip this client's size vote — the arbitration that makes ANY number of backend instances share one tmux
+// socket without size-fights. tmux's `ignore-size` client flag means "yield while any unflagged client is
+// attached" (server-wide, and void when ALL clients are flagged — then everyone counts again, which is what
+// keeps the single-backend warm hold working). So: a bridge votes (unflags) from the moment a viewer SIZES
+// it, and goes neutral again when its last viewer leaves. A suppressed refresh-client -C still receives its
+// one %layout-change (measured — announcing the window's real size), so the deterministic resize wait and
+// the accept-any-announced-size rule need no change on either side of the flag.
+function setVote(b: Bridge, on: boolean): void {
+  if (b.voting === on) return
+  b.voting = on
+  void command(b, `refresh-client -f ${on ? '!' : ''}ignore-size`)
+}
+
 function killBridge(id: string): void {
   const b = bridges.get(id)
   if (!b) return
@@ -312,6 +335,7 @@ export function attachViewer(id: string, v: Viewer, initialSize?: { cols: number
   if (!b) return false   // spawn failed → caller closes the socket → detachViewer prunes this subscriber
   b.needsFull = true     // a (re)connecting viewer's xterm is blank / just reset → its first frame must be FULL
   if (initialSize && initialSize.cols > 0 && initialSize.rows > 0) {
+    setVote(b, true)                                   // a sized viewer → this client asserts window size
     applySize(b, initialSize.cols, initialSize.rows)   // resize-then-repaint at the client's true size
   }
   // else HIDDEN connect (0×0, no size): paint nothing now — the first frame is driven purely by the client's
@@ -455,6 +479,7 @@ export function detachViewer(id: string, v: Viewer): void {
   subscribers.delete(id)
   const b = bridges.get(id)
   if (b && !b.prewarmed) killBridge(id)
+  else if (b) setVote(b, false)   // kept warm → back to size-neutral: an unwatched client must not out-vote a watched one
 }
 // a viewer fitted xterm → record the size as the last-known fit (even with no bridge yet, for pre-warm)
 // and resize the shared client. Repaints even on an unchanged size (a reconnect needs the frame). `full` (a
@@ -464,7 +489,7 @@ export function resizeBridge(id: string, cols: number, rows: number, full = fals
   if (!(cols > 0 && rows > 0)) return
   lastFit.set(id, { cols, rows }); lastFitAny = { cols, rows }
   const b = bridges.get(id)
-  if (b) { if (full) b.needsFull = true; applySize(b, cols, rows) }
+  if (b) { if (full) b.needsFull = true; setVote(b, true); applySize(b, cols, rows) }
 }
 // resize the client + repaint WITHOUT recording a viewer fit — the primitive both a real resize and the
 // supervisor's pre-sizing share, so the supervisor can't clobber lastFit/lastFitAny with a stale value.
@@ -482,12 +507,22 @@ async function reconcileOnce(): Promise<void> {
     if (!(await alive(s.id))) continue
     live.add(s.id)
     // already ours → keep warm and resize a stale warm bridge to the last-known viewer size off-screen,
-    // so a first open finds the pane already at its size. The size-diff guard makes a converged bridge a no-op.
+    // so a first open finds the pane already at its size. TWO staleness guards, by vote state: a NEUTRAL
+    // client's hold is suppressed while any sized viewer votes on the socket, so its own client size would
+    // read "converged" after one suppressed attempt and wedge the hold forever — compare against the
+    // WINDOW's real size (lastLayout) instead, retrying each tick (one suppressed no-op command) until the
+    // first tick after the socket goes quiet: deferred, not lost. A VOTING client keeps the client-size
+    // guard: its -C lands, and when two voting instances watch ONE session the window is genuinely
+    // contended — latest assert wins and STOPS (a window-truth guard would re-assert every tick and turn
+    // that contention into a visible size ping-pong war).
     const existing = bridges.get(s.id)
     if (existing) {
       existing.prewarmed = true
       const want = prewarmSize(s.id)
-      if (want.cols !== existing.cols || want.rows !== existing.rows) applySize(existing, want.cols, want.rows)
+      const stale = existing.voting
+        ? want.cols !== existing.cols || want.rows !== existing.rows
+        : existing.lastLayout !== `${want.cols}x${want.rows}`
+      if (stale) applySize(existing, want.cols, want.rows)
       continue
     }
     // no bridge for a live session: viewers waiting → re-bind and repaint (nothing else re-arms an idle

package/spec-cli/src/ranker.ts

@@ -10,7 +10,9 @@ const W_BODY = 1
 
 // a tiny stoplist of question scaffolding + length-1 tokens, dropped so "how does the … is it …" can't drown
 // the content words. Deliberately small and general — NOT tuned to any benchmark; just the function words a
-// natural-language query carries that match nothing meaningful.
+// natural-language query carries that match nothing meaningful. Quantifiers (many, several, same, too…) are
+// NOT stopped: in this corpus they are load-bearing ("too many owners" IS the multi-ownership concept —
+// dropping them measurably breaks that reach).
 const STOP = new Set([
   'the', 'a', 'an', 'and', 'or', 'of', 'to', 'in', 'on', 'is', 'it', 'its', 'as', 'at', 'by', 'for',
   'how', 'does', 'do', 'what', 'which', 'that', 'this', 'these', 'those', 'with', 'from', 'into', 'are',
@@ -32,11 +34,24 @@ function words(text: string): string[] {
   return text.toLowerCase().split(/[^a-z0-9]+/).filter(Boolean)
 }
 
-// name match is forward-only (a chosen short field — reverse would let a plural query light up every `spec-*`
-// name); desc/body match bidirectionally so a singular/plural mismatch still hits, reverse gated to words ≥3
-// chars so a stray short word can't swallow a longer term (IDF neutralises the generic words it pulls in).
-function nameMatch(term: string, w: string): boolean { return w.startsWith(term) }
-function textMatch(term: string, w: string): boolean { return w.startsWith(term) || (w.length >= 3 && term.startsWith(w)) }
+// light query-side stem for prefix matching: drop a trailing plural 's' (len≥4, not 'ss') then a mute 'e'
+// (len≥5) — so `sessions` prefix-reaches `session`, `merge`→`merg` reaches `merging`, `declare`→`declar`
+// reaches `declaration`. Without the e-drop the spec's promised merge↔merging reach silently never worked
+// (`'merging'.startsWith('merge')` is false). Query-side only; IDF self-neutralises the extra reach (a
+// looser term matches more docs → bigger df → smaller idf), so no flood.
+function stem(t: string): string {
+  let s = t
+  if (s.length >= 4 && s.endsWith('s') && !s.endsWith('ss')) s = s.slice(0, -1)
+  if (s.length >= 5 && s.endsWith('e')) s = s.slice(0, -1)
+  return s
+}
+
+// name match is forward-only (a chosen short field — reverse would let a stray short word swallow it);
+// desc/body match bidirectionally so a longer doc word still reaches a shorter query term, reverse gated to
+// words ≥3 chars so a stray short word can't swallow a longer term (IDF neutralises the generic words it
+// pulls in).
+function nameMatch(term: string, w: string): boolean { return w.startsWith(stem(term)) }
+function textMatch(term: string, w: string): boolean { return w.startsWith(stem(term)) || (w.length >= 3 && term.startsWith(w)) }
 
 // classic BM25 tf: frequency with saturation (K1 sets how fast it saturates) and length-normalisation (B),
 // both in a wide insensitive plateau. tf=0 → 0.
@@ -51,13 +66,16 @@ function bm25tf(tf: number, len: number, avgLen: number): number {
 type Fields<T> = { ref: T; name: string; nameWords: string[]; desc: string; descWords: string[]; bodyWords: string[]; snippetText: string }
 
 // the pre-IDF weight a term earns against one doc, picking its single best tier (three fields): a name
-// word-prefix beats a name substring beats a desc hit beats a body hit. Name and desc are short, chosen
-// fields → binary presence; the body carries the BM25-saturated, length-normalised frequency that
-// discriminates the long ties.
-function tierWeight<T>(term: string, n: Fields<T>, avgBodyLen: number): number {
+// word-prefix beats a name substring beats a desc hit beats a body hit. Name is a short, chosen field →
+// binary presence. Desc is presence too (a curated one-liner — repetition there is stuffing, not evidence)
+// but LENGTH-NORMALISED: it was flat-binary until descs drifted long and a bloated desc became a cheat code
+// (one 60-word desc catches every query term a curated one-liner can't). bm25tf(1, avgLen, avgLen) = 1, so
+// a hit in an average-length desc scores exactly the old binary W_DESC — the normalisation only bites
+// outliers. The body keeps the full BM25-saturated term-frequency that discriminates the long ties.
+function tierWeight<T>(term: string, n: Fields<T>, avgBodyLen: number, avgDescLen: number): number {
   if (n.nameWords.some((w) => nameMatch(term, w))) return W_NAME_PREFIX
   if (n.name.includes(term)) return W_NAME_SUBSTR
-  if (n.descWords.some((w) => textMatch(term, w))) return W_DESC
+  if (n.descWords.some((w) => textMatch(term, w))) return W_DESC * bm25tf(1, n.descWords.length, avgDescLen)
   const tf = n.bodyWords.reduce((c, w) => c + (textMatch(term, w) ? 1 : 0), 0)
   return W_BODY * bm25tf(tf, n.bodyWords.length, avgBodyLen)
 }
@@ -108,6 +126,7 @@ export function rankDocs<T>(query: string, inputs: RankInput<T>[], opts: { limit
   // a rare one carries the rank. Read from the corpus, not hand-set.
   const N = docs.length
   const avgBodyLen = docs.reduce((a, n) => a + n.bodyWords.length, 0) / (N || 1)
+  const avgDescLen = docs.reduce((a, n) => a + n.descWords.length, 0) / (N || 1)
   const idf: Record<string, number> = {}
   for (const t of qterms) {
     let df = 0
@@ -120,7 +139,7 @@ export function rankDocs<T>(query: string, inputs: RankInput<T>[], opts: { limit
   const scored: Ranked<T>[] = []
   for (const n of docs) {
     let score = 0
-    for (const t of qterms) score += tierWeight(t, n, avgBodyLen) * idf[t]
+    for (const t of qterms) score += tierWeight(t, n, avgBodyLen, avgDescLen) * idf[t]
     if (score <= 0) continue
     scored.push({ ref: n.ref, score: Math.round(score * 100) / 100, snippet: snippetFor(n.snippetText, n.desc, qterms) })
   }