tickmarkr 1.90.8 → 1.92.0

package/dist/compile/native.js

@@ -697,10 +697,11 @@ acceptance is required on every task (a nested list of observable outcomes).
   WHAT MAKES A CRITERION REAL:
     - "test:" must name a real test asserting on recorded state, journal lines, or drawn frames, and its
       title must match the criterion string verbatim. It also needs a collectable test path in files[].
-    - A "test:" oracle must name a TOP-LEVEL test case, never one nested under describe(). Vitest prefixes
-      nested cases with every suite title, while the acceptance gate builds an anchored pattern that
-      vitest -t applies against the FULL runner-visible name; the verbatim leaf title then selects ZERO
-      tests and the gate parks even though the suite is green. Measured: two parks in one run.
+    - A "test:" oracle's criterion must be the test's OWN title — the leaf — verbatim. Nesting under
+      describe() is allowed (OBS-511: the gate matches the criterion as the trailing segment of the
+      runner-visible full name), but the leaf title itself must equal the criterion: a shortened,
+      decorated, or paraphrased leaf selects ZERO tests and the gate parks even though the suite is green.
+      Measured before the widening: two parks across two runs, one full attempt lost in each.
     - NO criterion may be satisfiable by an absence, a rename, a source-text grep, or an empty collection.
       "no file references X" is not a criterion — it passes in a repo where the feature was never built.
     - "goal:" is NEVER verification. Prose in the goal enforces nothing: every obligation needs an

package/dist/config/config.d.ts

@@ -16,11 +16,26 @@ declare const ModeEnum: z.ZodEnum<{
 }>;
 export type RoutingMode = z.infer<typeof ModeEnum>;
 export declare const INTEGRITY_FLOOR_SHAPES: readonly ["plan", "spec", "migration", "ui"];
+export declare const PoolSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        any: "any";
+        ordered: "ordered";
+    }>;
+    channels: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type PoolEntry = z.infer<typeof PoolSchema>;
 export declare const MapEntrySchema: z.ZodObject<{
     pin: z.ZodOptional<z.ZodObject<{
         via: z.ZodString;
         model: z.ZodString;
     }, z.core.$strip>>;
+    pool: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            any: "any";
+            ordered: "ordered";
+        }>;
+        channels: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
     tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
     prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     escalate: z.ZodOptional<z.ZodBoolean>;
@@ -139,6 +154,13 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 via: z.ZodString;
                 model: z.ZodString;
             }, z.core.$strip>>;
+            pool: z.ZodOptional<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    any: "any";
+                    ordered: "ordered";
+                }>;
+                channels: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
             tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
             prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
             escalate: z.ZodOptional<z.ZodBoolean>;
@@ -331,7 +353,18 @@ export type FleetEditable = {
 };
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
-export declare function fleetEditableFromConfig(cfg: TickmarkrConfig): FleetEditable;
+/** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
+ * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
+ * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
+ * membership state and must survive a membership write verbatim, never be re-derived away. */
+export declare function universeCovers(universe: {
+    adapter: string;
+    models: string[];
+}[], entry: string): boolean;
+export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: {
+    adapter: string;
+    models: string[];
+}[]): FleetEditable;
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -24,6 +24,13 @@ const ModeEnum = z.enum(ROUTING_MODES, {
 // Integrity set (weak-oracle shapes, OBS-68..70 class): no mode may resolve these below frontier.
 // Only an explicit operator floor line can — and it draws a standing plan lint every load.
 export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
+// v1.92: a pool is a shape's OWN closed candidate set — mode "any" lets the economy engine pick
+// inside it (cost, then tier); mode "ordered" walks the declaration order, first live wins. An
+// exhausted pool fails loud at plan (pin precedent, fail-closed).
+export const PoolSchema = z.object({
+    mode: z.enum(["any", "ordered"]),
+    channels: z.array(z.string().regex(/^[^:\s]+:\S.*$/, "pool channels are adapter:model")).min(1),
+});
 // v1.52 T5: tier is no longer a map-entry band authority — routing.floors is the only tier
 // source left (v1.51 T3 deprecated this field with a promise to remove it here). Only the legacy
 // `tier: null` tombstone still parses (and normalizes to absent); any real value fails config
@@ -32,6 +39,7 @@ export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
 // outright) so a map entry can never carry a real tier value again, structurally.
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
+    pool: PoolSchema.optional(),
     tier: z
         .null({
         error: (iss) => `routing.map entry tier ${JSON.stringify(iss.input)} is no longer a band authority — move this value to routing.floors.<shape> (only "tier: null" tombstones still parse)`,
@@ -272,7 +280,26 @@ export const TickmarkrConfigSchema = z.object({
     routing: z.object({
         // v1.51 T1: preset expanded into floors by loadConfig — absent ⇒ risk-based ⇒ byte-identical routing.
         mode: ModeEnum.optional(),
-        map: z.record(z.string(), MapEntrySchema),
+        // v1.92: pool exclusivity — the record-level superRefine (not MapEntrySchema's) because the
+        // error must name the shape. Fail-closed: both keys present fails config load.
+        map: z.record(z.string(), MapEntrySchema).superRefine((map, ctx) => {
+            for (const [shape, entry] of Object.entries(map)) {
+                if (!entry.pool)
+                    continue;
+                if (entry.pin) {
+                    ctx.addIssue({
+                        code: "custom", path: [shape, "pool"],
+                        message: `routing.map.${shape}: pin and pool are one declaration — a pin is pool {mode: ordered, channels:[one]}; keep one`,
+                    });
+                }
+                if (entry.prefer) {
+                    ctx.addIssue({
+                        code: "custom", path: [shape, "pool"],
+                        message: `routing.map.${shape}: pool already decides the candidate set — prefer is the OPEN bias; keep one`,
+                    });
+                }
+            }
+        }),
         floors: z.record(z.string(), TierEnum),
         learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
         // v1.9 ROUTE-15 — optional overrides for profile.ts HALF_LIFE_RUNS/AVAIL_WEIGHT; absent ⇒ byte-identical defaults.
@@ -529,6 +556,19 @@ function deepMerge(base, over, path = []) {
         return over;
     }
     const out = { ...base };
+    // v1.92: pin/pool/prefer form ONE routing declaration slot per shape — a higher layer that
+    // declares any of them overrides the lower layer's whole slot atomically, so a seed prefer can
+    // never merge beside an overlay pool into a same-shape conflict the author never wrote (the
+    // map-entry exclusivity refine still rejects duplicates written in ONE document). Tombstones
+    // (explicit null) keep their precise per-key semantics via the loop below.
+    if (path.length === 3 && path[0] === "routing" && path[1] === "map") {
+        const declared = over;
+        if (declared.pin != null || declared.pool != null || declared.prefer != null) {
+            delete out.pin;
+            delete out.pool;
+            delete out.prefer;
+        }
+    }
     for (const [k, v] of Object.entries(over)) {
         if (v === null) {
             // T19: null is a declared multi-vendor state only at tiers.<adapter>.vendor. Every other null
@@ -686,13 +726,16 @@ export function configTemplate(overlay) {
 #     implement: { prefer: [cursor-agent, codex] }
 #     migration: { pin: { via: claude-code, model: fable } }
 #     tests: { tier: null }   # tombstone: null removes a legacy map tier (a real tier value now fails config load — move the band to routing.floors.tests)
+#     implement: { pool: { mode: any, channels: [codex:gpt-5.6-luna, kimi:kimi-code/k3] } }
+#                         # pool: the shape's OWN candidate set — any: economy engine picks inside it;
+#                         # ordered: first live entry wins. Exhausted pool fails loud at plan (pin precedent).
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
 #   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
 #   explore: { mode: on, excludeShapes: [], excludeComplexityAtOrAbove: null, cap: 5 }  # optional; absent ⇒ byte-identical
 #   sla: { implement: 15 }  # optional per-shape minutes — advisory plan lint only; absent ⇒ no lint
-#   allow: { adapters: [claude-code, codex] }   # optional fleet allowlist; presence activates even if empty (fail-closed)
+#   allow: { adapters: [claude-code, codex] }   # the FLEET: presence activates fail-closed; the fleet editor writes this form
 #   deny:                                      # optional fleet denylist; deny beats allow on conflict
 #     models:
 #       - pi:zai/glm-5.2  # OBS-57: pi passes run-start probe but hangs at finish without TICKMARKR_RESULT — remove after no-trailer demotion ships (v1.46 provider-outage taxonomy)
@@ -705,6 +748,11 @@ export function configTemplate(overlay) {
 # tiers:                  # model → capability band; extend when new models ship
 #   claude-code: { vendor: anthropic, channel: sub, models: { fable: frontier } }
 #   codex: { models: { gpt-5.2-codex: null } }   # null = tombstone: removes a stale seed id
+# tier evidence: \`tickmarkr doctor --refresh-catalog\` fetches the catalogs behind tier suggestions.
+#   models.dev and LiveBench need no key. The Artificial Analysis leg runs ONLY when the environment
+#   carries ARTIFICIAL_ANALYSIS_API_KEY (free key: artificialanalysis.ai) — unset, AA contributes
+#   nothing and suggestions fall back to LiveBench's agentic-coding rank, then price. Not a config
+#   key: an API credential belongs in the environment, never in a tracked overlay.
 # visibility:
 #   llm: headless         # headless (default): judge/review/consult run silently | pane: visible agents
 #   keepPanes: run        # run (default): ephemeral judge/review/consult panes close when read; a merged task's worker pane closes on done; other worker panes persist until run end | attempt | forever (keep everything for debugging)
@@ -776,7 +824,18 @@ export function readOverlayFile(path) {
         throw new ConfigError(`invalid overlay at ${path}`);
     return raw;
 }
-export function fleetEditableFromConfig(cfg) {
+/** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
+ * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
+ * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
+ * membership state and must survive a membership write verbatim, never be re-derived away. */
+export function universeCovers(universe, entry) {
+    return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
+}
+// v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
+// the EFFECTIVE out-of-fleet complement — anything routing.allow does not admit (fail-closed) UNION
+// routing.deny adapters/models scopes (never workers). Absent universe ⇒ deny arrays verbatim, so
+// non-UI callers stay byte-identical.
+export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
         tiers[adapter] = {};
@@ -784,9 +843,46 @@ export function fleetEditableFromConfig(cfg) {
             tiers[adapter][model] = { tier };
         }
     }
+    let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
+    let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    if (universe !== undefined) {
+        const { allow, deny } = cfg.routing;
+        // Grammar A1 (disallowedBy precedent): entries match adapter id, bare model id, or adapter:model.
+        // Inlined rather than imported — route/preference.ts imports this module.
+        const denyEntries = [...(deny?.adapters ?? []), ...(deny?.models ?? [])];
+        const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
+        const outOfFleet = (adapter, model) => {
+            const matches = (e) => e === adapter || e === model || e === `${adapter}:${model}`;
+            if (denyEntries.some(matches))
+                return true;
+            return allowEntries !== null && !allowEntries.some(matches);
+        };
+        const adaptersOut = [];
+        const modelsOut = [];
+        for (const row of universe) {
+            const out = row.models.filter((m) => outOfFleet(row.adapter, m));
+            if (row.models.length ? out.length === row.models.length : outOfFleet(row.adapter, "")) {
+                adaptersOut.push(row.adapter);
+            }
+            else {
+                modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
+            }
+        }
+        // OBS-517: deny entries the probe universe does not cover (failed/rate-limited probes drop the
+        // channel from discoverChannels) are preserved VERBATIM — deriving membership purely from the
+        // universe silently un-denied them on the next write (fail-open on the operator's own ban list).
+        denyAdapters = [...new Set([
+                ...adaptersOut,
+                ...(deny?.adapters ?? []).filter((e) => !universeCovers(universe, e)),
+            ])].sort();
+        denyModels = [...new Set([
+                ...modelsOut,
+                ...(deny?.models ?? []).filter((e) => !universeCovers(universe, e)),
+            ])].sort();
+    }
     return {
-        denyAdapters: [...(cfg.routing.deny?.adapters ?? [])].sort(),
-        denyModels: [...(cfg.routing.deny?.models ?? [])].sort(),
+        denyAdapters,
+        denyModels,
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import type { FleetEditable, RoutingMode } from "./config.js";
+import { type FleetEditable, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 export type FleetOverlayWrite = {
@@ -19,6 +19,10 @@ export type FleetOverlayWrite = {
             consult?: string[];
         };
     };
+    universe?: {
+        adapter: string;
+        models: string[];
+    }[];
 };
 export type FleetFirstTouch = {
     vendor: string;
@@ -29,7 +33,10 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>): Record<string, unknown>;
+export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: {
+    adapter: string;
+    models: string[];
+}[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;

package/dist/config/fleet-overlay.js

@@ -1,5 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isMap, isScalar, isSeq, parseDocument, stringify } from "yaml";
+import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { universeCovers } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
 function fleetSubset(obj) {
@@ -13,11 +14,49 @@ function fleetSubset(obj) {
 function sortedUnique(xs) {
     return [...new Set(xs)].sort();
 }
+// The minimal routing.allow form for an exclusion-set membership write: whole adapter ids for
+// fully-in adapters, adapter:model keys for partially-in ones, nothing for fully-out ones.
+// `excluded` false ⇔ the whole universe is in fleet ⇒ the allow block is removed, not written.
+function allowFormFromExclusions(universe, edited) {
+    if (!universe.length) {
+        throw new Error("fleet write: universe is empty — no classified models to compute routing.allow from; classify models in `tickmarkr fleet` first");
+    }
+    const denyAdapters = new Set(edited.denyAdapters);
+    const denyModels = new Set(edited.denyModels);
+    const adapters = [];
+    const models = [];
+    let excluded = false;
+    for (const row of universe) {
+        if (denyAdapters.has(row.adapter)) {
+            excluded = true;
+            continue;
+        }
+        const inFleet = row.models.filter((m) => !denyModels.has(`${row.adapter}:${m}`));
+        if (inFleet.length === row.models.length) {
+            adapters.push(row.adapter);
+        }
+        else {
+            excluded = true;
+            models.push(...inFleet.map((m) => `${row.adapter}:${m}`));
+        }
+    }
+    return { adapters: sortedUnique(adapters), models: sortedUnique(models), excluded };
+}
+// OBS-517: deny entries the discovered universe cannot express through the allow form — the probe
+// dropped their channel (failed auth, rate limit, retired sku) so the allow complement never names
+// them. They must be written back into routing.deny verbatim (deny beats allow at routing time),
+// or a transient probe failure permanently erases a deliberate operator exclusion.
+function residualDeny(universe, entries) {
+    return sortedUnique(entries.filter((entry) => !universeCovers(universe, entry)));
+}
 // fleet.ts deliberately remains the sole overlay builder and writer. Its established classification
 // seam copies only `tier` and `note` into FleetEditable, so first-touch entry metadata rides inside a
 // private provenance envelope until this module writes the YAML. The envelope never reaches disk.
 const FIRST_TOUCH_OPEN = "\uE000tickmarkr-fleet-first-touch:";
 const FIRST_TOUCH_CLOSE = "\uE001";
+// OBS-505: marks a scalar-trailing single-line comment for the two-space inline note style at
+// stringify time; applied and consumed inside renderFleetOverlayWrite, never written to disk.
+const INLINE_COMMENT_SENTINEL = "\uE002";
 export function fleetFirstTouchProvenance(note, firstTouch) {
     return `${FIRST_TOUCH_OPEN}${encodeURIComponent(firstTouch.vendor)}:${firstTouch.channel}${FIRST_TOUCH_CLOSE}${note}`;
 }
@@ -103,8 +142,47 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
         || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
     if (denyChanged) {
-        setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
-        setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+        if (write.universe) {
+            // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
+            // so a lower layer can never re-exclude behind the operator's back (workers untouched).
+            const form = allowFormFromExclusions(write.universe, edited);
+            if (form.excluded) {
+                const allowNode = doc.getIn(["routing", "allow"], true);
+                if (allowNode !== undefined && !isMap(allowNode))
+                    doc.deleteIn(["routing", "allow"]);
+                // deleteIn throws on an empty document — only delete keys that exist.
+                if (form.adapters.length) {
+                    setStringSequencePreservingComments(doc, ["routing", "allow", "adapters"], form.adapters);
+                }
+                else if (doc.getIn(["routing", "allow", "adapters"]) !== undefined) {
+                    doc.deleteIn(["routing", "allow", "adapters"]);
+                }
+                if (form.models.length) {
+                    setStringSequencePreservingComments(doc, ["routing", "allow", "models"], form.models);
+                }
+                else if (doc.getIn(["routing", "allow", "models"]) !== undefined) {
+                    doc.deleteIn(["routing", "allow", "models"]);
+                }
+                // Whole fleet out: allow stays present but empty — fail-closed, nothing admitted.
+                if (doc.getIn(["routing", "allow"]) === undefined) {
+                    doc.setIn(["routing", "allow"], doc.createNode({}));
+                }
+            }
+            else if (doc.getIn(["routing", "allow"]) !== undefined) {
+                // Whole fleet in: no restriction to express — the allow block goes away entirely.
+                doc.deleteIn(["routing", "allow"]);
+            }
+            // Residuals stay in deny; covered scopes are tombstoned so a lower layer can never
+            // re-exclude behind the operator's back (workers untouched).
+            const residualAdapters = residualDeny(write.universe, edited.denyAdapters);
+            const residualModels = residualDeny(write.universe, edited.denyModels);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], residualAdapters.length ? residualAdapters : null);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], residualModels.length ? residualModels : null);
+        }
+        else {
+            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+        }
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
@@ -115,9 +193,33 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             else
                 doc.setIn(["routing", "map", shape, "pin"], doc.createNode(after.pin));
         }
+        if (JSON.stringify(before?.pool) !== JSON.stringify(after?.pool)) {
+            const path = ["routing", "map", shape, "pool"];
+            if (after?.pool === undefined) {
+                // pool: null tombstone — masks a lower-layer pool instead of inheriting it again.
+                setStringSequencePreservingComments(doc, path, null);
+            }
+            else {
+                const existing = doc.getIn(path, true);
+                if (existing !== undefined && !isMap(existing))
+                    doc.deleteIn(path);
+                setScalarPreservingComment(doc, [...path, "mode"], after.pool.mode);
+                // Channel order is semantic (ordered walks it; any breaks ties by it) — dedupe, never sort.
+                setStringSequencePreservingComments(doc, [...path, "channels"], [...new Set(after.pool.channels)]);
+            }
+        }
         if (JSON.stringify(before?.prefer) !== JSON.stringify(after?.prefer)) {
-            // Clearing a resolved list must mask the lower layer with [], not delete the key and inherit it again.
-            setStringSequencePreservingComments(doc, ["routing", "map", shape, "prefer"], after?.prefer ?? []);
+            if (after?.prefer === undefined && (after?.pool !== undefined || after?.pin !== undefined)) {
+                // the pin/pool declaration owns the whole slot at merge (deepMerge drops the lower
+                // layer's pin/pool/prefer atomically) — an [] mask here would re-declare prefer BESIDE
+                // the pool in one document and fail the exclusivity refine; delete the key instead
+                doc.deleteIn(["routing", "map", shape, "prefer"]);
+            }
+            else {
+                // Clearing a resolved list with no replacing declaration must mask the lower layer
+                // with [], not delete the key and inherit it again.
+                setStringSequencePreservingComments(doc, ["routing", "map", shape, "prefer"], after?.prefer ?? []);
+            }
         }
         if (before?.escalate !== after?.escalate) {
             if (after?.escalate === undefined)
@@ -189,14 +291,31 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             }
         }
     }
-    // Fleet's established note style uses two spaces before `#`; the Document remains the sole
-    // comment writer while preserving that byte-level convention for old and newly-authored notes.
+    // OBS-505: fleet's two-space note style (`tier: mid  # note`) applies to INLINE comments only.
+    // The previous commentString prefixed " #" onto EVERY comment line, so block comments — the
+    // whole init scaffold at column 0, and indented operator essays — each gained a stray leading
+    // space, turning a one-key write into a whole-file diff on the one confirmation surface an
+    // operator reviews. commentString has no position context, but this writer owns the document:
+    // scalar-trailing single-line comments (the only inline form fleet emits) are marked with a
+    // private-use sentinel (the FIRST_TOUCH envelope precedent above), everything else renders
+    // byte-identical to yaml's own stringifyComment.
+    visit(doc, (_key, node) => {
+        if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
+            node.comment = `${INLINE_COMMENT_SENTINEL}${node.comment}`;
+        }
+    });
     return doc.toString({
-        commentString: (comment) => comment.replace(/^(?!$)(?: $)?/gm, " #"),
+        commentString: (comment) => comment.startsWith(INLINE_COMMENT_SENTINEL)
+            ? ` #${comment.slice(1)}`
+            : comment.replace(/^(?!$)(?: $)?/gm, "#"),
+        // OBS-518: yaml's default pads flow collections (`[kimi]` → `[ kimi ]`), churning untouched
+        // lines on the one confirmation surface an operator reviews. Hand-written overlays use the
+        // unpadded form; emit it.
+        flowCollectionPadding: false,
     });
 }
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}) {
+export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}, universe) {
     if (fleetEditableEquals(initial, edited))
         return {};
     const out = structuredClone(existingRepo);
@@ -205,19 +324,45 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
         || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
     if (denyChanged) {
-        routing.deny = {
-            adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
-            models: edited.denyModels.length ? edited.denyModels : null,
-        };
+        if (universe) {
+            const form = allowFormFromExclusions(universe, edited);
+            if (form.excluded) {
+                routing.allow = {
+                    ...(form.adapters.length ? { adapters: form.adapters } : {}),
+                    ...(form.models.length ? { models: form.models } : {}),
+                };
+            }
+            else
+                delete routing.allow;
+            const residualAdapters = residualDeny(universe, edited.denyAdapters);
+            const residualModels = residualDeny(universe, edited.denyModels);
+            routing.deny = {
+                ...routing.deny,
+                adapters: residualAdapters.length ? residualAdapters : null,
+                models: residualModels.length ? residualModels : null,
+            };
+        }
+        else {
+            routing.deny = {
+                adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
+                models: edited.denyModels.length ? edited.denyModels : null,
+            };
+        }
         routingTouched = true;
     }
+    // pool widened to accept the null tombstone; MapEntry itself never carries null in memory.
     const mapDelta = {};
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape])) {
             const next = { ...edited.map[shape] };
-            if (initial.map[shape]?.prefer !== undefined && edited.map[shape]?.prefer === undefined) {
+            if (initial.map[shape]?.prefer !== undefined && edited.map[shape]?.prefer === undefined
+                && edited.map[shape]?.pool === undefined && edited.map[shape]?.pin === undefined) {
                 next.prefer = [];
             }
+            // pool: null tombstone — a removed pool must mask the lower layer, never inherit it again.
+            if (initial.map[shape]?.pool !== undefined && edited.map[shape]?.pool === undefined) {
+                next.pool = null;
+            }
             mapDelta[shape] = next;
         }
     }

package/dist/gates/acceptance.js

@@ -75,10 +75,17 @@ function escapeRegExp(s) {
     return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 // v1.89 T6: Vitest applies -t to the runner-visible full name (enclosing describe titles and the test
-// title, space-joined). Escaping preserves literal criteria; anchoring makes equality, rather than
-// substring containment, the named-test contract.
+// title, space-joined). Escaping preserves literal criteria; the leaf anchor makes trailing-title
+// equality, rather than substring containment, the named-test contract.
+// OBS-511 (runs 1013+1027, one full attempt lost in EACH): two independent workers nested the verbatim
+// criterion under a describe, the old `^…$` full-name equality matched zero tests, and the gate parked a
+// green suite. `(^| )` accepts any describe prefix while keeping the criterion as the complete trailing
+// segment — equality still matches (empty prefix), and a title merely CONTAINING the criterion still
+// selects zero. ponytail: a leaf title that itself ENDS with " <criterion>" also matches — vitest -t sees
+// only the space-joined full name, so true leaf-boundary precision needs the runner's --list JSON
+// (auditAcceptanceCorpus has it at doctor time); upgrade there if this window is ever exploited.
 export function testFilterPattern(name) {
-    return `^${escapeRegExp(name)}$`;
+    return `(^| )${escapeRegExp(name)}$`;
 }
 // OBS-55: when the base command already contains `--`, append -t after forwarded args — a second `--`
 // makes vitest treat -t as a positional file filter and the name filter is dropped.
@@ -126,8 +133,10 @@ export function auditAcceptanceCorpus(corpusRoot, listedTests) {
                             ? {
                                 namedTest: {
                                     criterion: item.test,
+                                    // OBS-511: mirror the gate's leaf-anchored suffix rule — the audit's denominator
+                                    // must count exactly the tests the -t filter would select, or doctor and gate disagree.
                                     matches: runnerNames
-                                        .filter(({ fullName }) => fullName === item.test)
+                                        .filter(({ fullName }) => fullName === item.test || fullName.endsWith(` ${item.test}`))
                                         .map(({ listed }) => listed),
                                 },
                             }

package/dist/route/preference.d.ts

@@ -27,7 +27,7 @@ export declare function disallowedBy(c: {
     model: string;
 }, routing: TickmarkrConfig["routing"], role?: PreferenceRole): Disallowed | null;
 export interface DenyPreferCollision {
-    kind: "prefer" | "pin";
+    kind: "prefer" | "pin" | "pool";
     shape: string;
     detail: string;
     disallowed: Disallowed;

package/dist/route/preference.js

@@ -113,11 +113,21 @@ export function denyPreferCollisions(cfg, shapes) {
                 disallowed: preferEntryDenied(prefer[0], cfg),
             });
         }
+        const pool = entry.pool;
+        if (pool) {
+            const denied = pool.channels.map((p) => {
+                const i = p.indexOf(":");
+                return disallowedBy({ adapter: p.slice(0, i), model: p.slice(i + 1) }, cfg.routing);
+            });
+            // only a FULLY dead pool collides — a partial deny still leaves live members to route
+            if (denied.every((d) => d !== null)) {
+                out.push({ kind: "pool", shape, detail: pool.channels.join(" > "), disallowed: denied[0] });
+            }
+        }
     }
     return out;
 }
 export function denyPreferCollisionLine({ kind, shape, detail, disallowed }) {
-    const surface = kind === "pin" ? `routing.map.${shape}.pin` : `routing.map.${shape}.prefer`;
     const verb = kind === "pin" ? "is disallowed" : "fully disallowed";
-    return `deny∩prefer: ${surface} ${detail} ${verb} by routing.${disallowed.by} (${disallowed.entry}) — remove the ${disallowed.by} entry or adjust ${kind === "pin" ? "pin" : "prefer"}`;
+    return `deny∩prefer: routing.map.${shape}.${kind} ${detail} ${verb} by routing.${disallowed.by} (${disallowed.entry}) — remove the ${disallowed.by} entry or adjust ${kind}`;
 }

package/dist/route/router.js

@@ -160,9 +160,9 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     const mapPinFloor = taskFloor && (!advisoryFloor || TIER_RANK[taskFloor] >= TIER_RANK[advisoryFloor])
         ? { tier: taskFloor, source: "task" }
         : advisoryFloor ? { tier: advisoryFloor, source: "config" } : undefined;
-    const lintMapPinFloor = (tier) => {
+    const lintMapPinFloor = (tier, what = "pin") => {
         if (mapPinFloor && TIER_RANK[tier] < TIER_RANK[mapPinFloor.tier]) {
-            lints.push(`${task.id} (${task.shape}): map pin routes ${tier}, below ${mapPinFloor.source} floor ${mapPinFloor.tier} — map pins are supreme`);
+            lints.push(`${task.id} (${task.shape}): map ${what} routes ${tier}, below ${mapPinFloor.source} floor ${mapPinFloor.tier} — map ${what}s are supreme`);
         }
     };
     const source = task.routingHints?.source;
@@ -190,6 +190,35 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
+    // map pool: operator-authored closed candidate set (v1.92) — sits between the pin (a
+    // single-channel pool) and the open floor/auto path. Exhaustion stays fail-loud (pin precedent).
+    if (entry?.pool) {
+        const pool = entry.pool;
+        if (prefActive) {
+            for (const p of pool.channels) {
+                const i = p.indexOf(":");
+                const d = disallowedBy({ adapter: p.slice(0, i), model: p.slice(i + 1) }, cfg.routing);
+                if (d) {
+                    throw new RoutingError(`${task.id}: pool entry ${p} is disallowed by routing.${d.by} (${d.entry}) — remove the ${d.by} entry or drop it from the pool`);
+                }
+            }
+        }
+        // live preserves pool declaration order — ordered mode and any-mode stable-sort ties depend on it
+        const live = pool.channels
+            .map((id) => channels.find((c) => channelKey(c) === id))
+            .filter((c) => c !== undefined);
+        if (!live.length) {
+            throw new RoutingError(`${task.id}: routing.map.${task.shape}.pool has no live channel — declared: ${pool.channels.join(", ")}; doctor found: ${channels.map(channelKey).join(", ") || "(nothing)"}`);
+        }
+        // ponytail: no learned/explore/spread inside pools in v1 — a pool pick is fully static; the
+        // upgrade path is feeding the pool-filtered set through the learned path below.
+        const chosen = pool.mode === "ordered"
+            ? live[0]
+            : [...live].sort((a, b) => marginalCostRank(a) - marginalCostRank(b) || TIER_RANK[a.tier] - TIER_RANK[b.tier])[0];
+        lintMapPinFloor(chosen.tier, "pool");
+        maybeSlaLint(lints, task, profile, slaMinutes, chosen);
+        return { assignment: toAssignment(chosen), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pool ${pool.mode} ${channelKey(chosen)} (config routing.map)` };
+    }
     const baseTier = floor ?? "cheap";
     // D-04: a task floor is hard only on floor/auto paths; the map-pin branch above stays supreme.
     const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier;

package/dist/run/daemon.js

@@ -1944,7 +1944,7 @@ export async function runDaemon(repoRoot, opts = {}) {
                     const promptFile = writePrompt(journal.dir, t, attempt, feedback, nonce);
                     // OBS-56: state the non-interactive, one-pass finish contract and the OBS-54 stall budget in every
                     // worker prompt, not only consult retry guidance. Prepended so prompt.ts's completion trailer stays last.
-                    const workerContract = `## Harness contract\n- This harness is non-interactive: make one continuous pass; do not stop for questions or follow-up input.\n- You have a ${taskTimeoutMinutes} minute stall window. Budget the full suite once, then commit and emit the completion trailer before it expires.\n- Each test: acceptance criterion must exist as a vitest test whose title matches the criterion string verbatim.`; // OBS-64
+                    const workerContract = `## Harness contract\n- This harness is non-interactive: make one continuous pass; do not stop for questions or follow-up input.\n- You have a ${taskTimeoutMinutes} minute stall window. Budget the full suite once, then commit and emit the completion trailer before it expires.\n- Each test: acceptance criterion must exist as a vitest test whose OWN title (the leaf, not counting enclosing describe titles) is the criterion string verbatim — never shortened, never decorated. Nesting under describe() is allowed.`; // OBS-64; OBS-511: leaf-title rule stated where the worker reads it
                     // OBS-47: state the worktree layout contract in the worker prompt (cheap-tier workers were
                     // committing/deleting node_modules and tripping the scope gate). The harness re-asserts the link
                     // itself before gates regardless of what the worker does with it.