tickmarkr 1.91.0 → 1.92.1

package/dist/config/config.d.ts

@@ -16,11 +16,26 @@ declare const ModeEnum: z.ZodEnum<{
 }>;
 export type RoutingMode = z.infer<typeof ModeEnum>;
 export declare const INTEGRITY_FLOOR_SHAPES: readonly ["plan", "spec", "migration", "ui"];
+export declare const PoolSchema: z.ZodObject<{
+    mode: z.ZodEnum<{
+        any: "any";
+        ordered: "ordered";
+    }>;
+    channels: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type PoolEntry = z.infer<typeof PoolSchema>;
 export declare const MapEntrySchema: z.ZodObject<{
     pin: z.ZodOptional<z.ZodObject<{
         via: z.ZodString;
         model: z.ZodString;
     }, z.core.$strip>>;
+    pool: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            any: "any";
+            ordered: "ordered";
+        }>;
+        channels: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
     tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
     prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
     escalate: z.ZodOptional<z.ZodBoolean>;
@@ -139,6 +154,13 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
                 via: z.ZodString;
                 model: z.ZodString;
             }, z.core.$strip>>;
+            pool: z.ZodOptional<z.ZodObject<{
+                mode: z.ZodEnum<{
+                    any: "any";
+                    ordered: "ordered";
+                }>;
+                channels: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
             tier: z.ZodOptional<z.ZodPipe<z.ZodOptional<z.ZodNull>, z.ZodTransform<undefined, null | undefined>>>;
             prefer: z.ZodOptional<z.ZodArray<z.ZodString>>;
             escalate: z.ZodOptional<z.ZodBoolean>;
@@ -331,7 +353,18 @@ export type FleetEditable = {
 };
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
-export declare function fleetEditableFromConfig(cfg: TickmarkrConfig): FleetEditable;
+/** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
+ * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
+ * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
+ * membership state and must survive a membership write verbatim, never be re-derived away. */
+export declare function universeCovers(universe: {
+    adapter: string;
+    models: string[];
+}[], entry: string): boolean;
+export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: {
+    adapter: string;
+    models: string[];
+}[]): FleetEditable;
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -24,6 +24,13 @@ const ModeEnum = z.enum(ROUTING_MODES, {
 // Integrity set (weak-oracle shapes, OBS-68..70 class): no mode may resolve these below frontier.
 // Only an explicit operator floor line can — and it draws a standing plan lint every load.
 export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
+// v1.92: a pool is a shape's OWN closed candidate set — mode "any" lets the economy engine pick
+// inside it (cost, then tier); mode "ordered" walks the declaration order, first live wins. An
+// exhausted pool fails loud at plan (pin precedent, fail-closed).
+export const PoolSchema = z.object({
+    mode: z.enum(["any", "ordered"]),
+    channels: z.array(z.string().regex(/^[^:\s]+:\S.*$/, "pool channels are adapter:model")).min(1),
+});
 // v1.52 T5: tier is no longer a map-entry band authority — routing.floors is the only tier
 // source left (v1.51 T3 deprecated this field with a promise to remove it here). Only the legacy
 // `tier: null` tombstone still parses (and normalizes to absent); any real value fails config
@@ -32,6 +39,7 @@ export const INTEGRITY_FLOOR_SHAPES = ["plan", "spec", "migration", "ui"];
 // outright) so a map entry can never carry a real tier value again, structurally.
 export const MapEntrySchema = z.object({
     pin: z.object({ via: z.string(), model: z.string() }).optional(),
+    pool: PoolSchema.optional(),
     tier: z
         .null({
         error: (iss) => `routing.map entry tier ${JSON.stringify(iss.input)} is no longer a band authority — move this value to routing.floors.<shape> (only "tier: null" tombstones still parse)`,
@@ -272,7 +280,26 @@ export const TickmarkrConfigSchema = z.object({
     routing: z.object({
         // v1.51 T1: preset expanded into floors by loadConfig — absent ⇒ risk-based ⇒ byte-identical routing.
         mode: ModeEnum.optional(),
-        map: z.record(z.string(), MapEntrySchema),
+        // v1.92: pool exclusivity — the record-level superRefine (not MapEntrySchema's) because the
+        // error must name the shape. Fail-closed: both keys present fails config load.
+        map: z.record(z.string(), MapEntrySchema).superRefine((map, ctx) => {
+            for (const [shape, entry] of Object.entries(map)) {
+                if (!entry.pool)
+                    continue;
+                if (entry.pin) {
+                    ctx.addIssue({
+                        code: "custom", path: [shape, "pool"],
+                        message: `routing.map.${shape}: pin and pool are one declaration — a pin is pool {mode: ordered, channels:[one]}; keep one`,
+                    });
+                }
+                if (entry.prefer) {
+                    ctx.addIssue({
+                        code: "custom", path: [shape, "pool"],
+                        message: `routing.map.${shape}: pool already decides the candidate set — prefer is the OPEN bias; keep one`,
+                    });
+                }
+            }
+        }),
         floors: z.record(z.string(), TierEnum),
         learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
         // v1.9 ROUTE-15 — optional overrides for profile.ts HALF_LIFE_RUNS/AVAIL_WEIGHT; absent ⇒ byte-identical defaults.
@@ -529,6 +556,19 @@ function deepMerge(base, over, path = []) {
         return over;
     }
     const out = { ...base };
+    // v1.92: pin/pool/prefer form ONE routing declaration slot per shape — a higher layer that
+    // declares any of them overrides the lower layer's whole slot atomically, so a seed prefer can
+    // never merge beside an overlay pool into a same-shape conflict the author never wrote (the
+    // map-entry exclusivity refine still rejects duplicates written in ONE document). Tombstones
+    // (explicit null) keep their precise per-key semantics via the loop below.
+    if (path.length === 3 && path[0] === "routing" && path[1] === "map") {
+        const declared = over;
+        if (declared.pin != null || declared.pool != null || declared.prefer != null) {
+            delete out.pin;
+            delete out.pool;
+            delete out.prefer;
+        }
+    }
     for (const [k, v] of Object.entries(over)) {
         if (v === null) {
             // T19: null is a declared multi-vendor state only at tiers.<adapter>.vendor. Every other null
@@ -686,13 +726,16 @@ export function configTemplate(overlay) {
 #     implement: { prefer: [cursor-agent, codex] }
 #     migration: { pin: { via: claude-code, model: fable } }
 #     tests: { tier: null }   # tombstone: null removes a legacy map tier (a real tier value now fails config load — move the band to routing.floors.tests)
+#     implement: { pool: { mode: any, channels: [codex:gpt-5.6-luna, kimi:kimi-code/k3] } }
+#                         # pool: the shape's OWN candidate set — any: economy engine picks inside it;
+#                         # ordered: first live entry wins. Exhausted pool fails loud at plan (pin precedent).
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
 #   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
 #   explore: { mode: on, excludeShapes: [], excludeComplexityAtOrAbove: null, cap: 5 }  # optional; absent ⇒ byte-identical
 #   sla: { implement: 15 }  # optional per-shape minutes — advisory plan lint only; absent ⇒ no lint
-#   allow: { adapters: [claude-code, codex] }   # optional fleet allowlist; presence activates even if empty (fail-closed)
+#   allow: { adapters: [claude-code, codex] }   # the FLEET: presence activates fail-closed; the fleet editor writes this form
 #   deny:                                      # optional fleet denylist; deny beats allow on conflict
 #     models:
 #       - pi:zai/glm-5.2  # OBS-57: pi passes run-start probe but hangs at finish without TICKMARKR_RESULT — remove after no-trailer demotion ships (v1.46 provider-outage taxonomy)
@@ -781,7 +824,18 @@ export function readOverlayFile(path) {
         throw new ConfigError(`invalid overlay at ${path}`);
     return raw;
 }
-export function fleetEditableFromConfig(cfg) {
+/** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
+ * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
+ * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
+ * membership state and must survive a membership write verbatim, never be re-derived away. */
+export function universeCovers(universe, entry) {
+    return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
+}
+// v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
+// the EFFECTIVE out-of-fleet complement — anything routing.allow does not admit (fail-closed) UNION
+// routing.deny adapters/models scopes (never workers). Absent universe ⇒ deny arrays verbatim, so
+// non-UI callers stay byte-identical.
+export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
         tiers[adapter] = {};
@@ -789,9 +843,46 @@ export function fleetEditableFromConfig(cfg) {
             tiers[adapter][model] = { tier };
         }
     }
+    let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
+    let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    if (universe !== undefined) {
+        const { allow, deny } = cfg.routing;
+        // Grammar A1 (disallowedBy precedent): entries match adapter id, bare model id, or adapter:model.
+        // Inlined rather than imported — route/preference.ts imports this module.
+        const denyEntries = [...(deny?.adapters ?? []), ...(deny?.models ?? [])];
+        const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
+        const outOfFleet = (adapter, model) => {
+            const matches = (e) => e === adapter || e === model || e === `${adapter}:${model}`;
+            if (denyEntries.some(matches))
+                return true;
+            return allowEntries !== null && !allowEntries.some(matches);
+        };
+        const adaptersOut = [];
+        const modelsOut = [];
+        for (const row of universe) {
+            const out = row.models.filter((m) => outOfFleet(row.adapter, m));
+            if (row.models.length ? out.length === row.models.length : outOfFleet(row.adapter, "")) {
+                adaptersOut.push(row.adapter);
+            }
+            else {
+                modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
+            }
+        }
+        // OBS-517: deny entries the probe universe does not cover (failed/rate-limited probes drop the
+        // channel from discoverChannels) are preserved VERBATIM — deriving membership purely from the
+        // universe silently un-denied them on the next write (fail-open on the operator's own ban list).
+        denyAdapters = [...new Set([
+                ...adaptersOut,
+                ...(deny?.adapters ?? []).filter((e) => !universeCovers(universe, e)),
+            ])].sort();
+        denyModels = [...new Set([
+                ...modelsOut,
+                ...(deny?.models ?? []).filter((e) => !universeCovers(universe, e)),
+            ])].sort();
+    }
     return {
-        denyAdapters: [...(cfg.routing.deny?.adapters ?? [])].sort(),
-        denyModels: [...(cfg.routing.deny?.models ?? [])].sort(),
+        denyAdapters,
+        denyModels,
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import type { FleetEditable, RoutingMode } from "./config.js";
+import { type FleetEditable, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 export type FleetOverlayWrite = {
@@ -19,6 +19,10 @@ export type FleetOverlayWrite = {
             consult?: string[];
         };
     };
+    universe?: {
+        adapter: string;
+        models: string[];
+    }[];
 };
 export type FleetFirstTouch = {
     vendor: string;
@@ -29,7 +33,10 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>): Record<string, unknown>;
+export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: {
+    adapter: string;
+    models: string[];
+}[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;

package/dist/config/fleet-overlay.js

@@ -1,5 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
 import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { universeCovers } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
 function fleetSubset(obj) {
@@ -13,6 +14,41 @@ function fleetSubset(obj) {
 function sortedUnique(xs) {
     return [...new Set(xs)].sort();
 }
+// The minimal routing.allow form for an exclusion-set membership write: whole adapter ids for
+// fully-in adapters, adapter:model keys for partially-in ones, nothing for fully-out ones.
+// `excluded` false ⇔ the whole universe is in fleet ⇒ the allow block is removed, not written.
+function allowFormFromExclusions(universe, edited) {
+    if (!universe.length) {
+        throw new Error("fleet write: universe is empty — no classified models to compute routing.allow from; classify models in `tickmarkr fleet` first");
+    }
+    const denyAdapters = new Set(edited.denyAdapters);
+    const denyModels = new Set(edited.denyModels);
+    const adapters = [];
+    const models = [];
+    let excluded = false;
+    for (const row of universe) {
+        if (denyAdapters.has(row.adapter)) {
+            excluded = true;
+            continue;
+        }
+        const inFleet = row.models.filter((m) => !denyModels.has(`${row.adapter}:${m}`));
+        if (inFleet.length === row.models.length) {
+            adapters.push(row.adapter);
+        }
+        else {
+            excluded = true;
+            models.push(...inFleet.map((m) => `${row.adapter}:${m}`));
+        }
+    }
+    return { adapters: sortedUnique(adapters), models: sortedUnique(models), excluded };
+}
+// OBS-517: deny entries the discovered universe cannot express through the allow form — the probe
+// dropped their channel (failed auth, rate limit, retired sku) so the allow complement never names
+// them. They must be written back into routing.deny verbatim (deny beats allow at routing time),
+// or a transient probe failure permanently erases a deliberate operator exclusion.
+function residualDeny(universe, entries) {
+    return sortedUnique(entries.filter((entry) => !universeCovers(universe, entry)));
+}
 // fleet.ts deliberately remains the sole overlay builder and writer. Its established classification
 // seam copies only `tier` and `note` into FleetEditable, so first-touch entry metadata rides inside a
 // private provenance envelope until this module writes the YAML. The envelope never reaches disk.
@@ -52,7 +88,7 @@ function setScalarPreservingComment(doc, path, value, authoredComment) {
     if (isScalar(existing))
         existing.value = value;
     else
-        doc.setIn(path, doc.createNode(value));
+        setAt(doc, path, doc.createNode(value));
     if (authoredComment !== undefined) {
         const written = doc.getIn(path, true);
         if (isScalar(written))
@@ -76,11 +112,11 @@ function setStringSequencePreservingComments(doc, path, values) {
             if (comments.length)
                 tombstone.comment = comments.join("\n");
         }
-        doc.setIn(path, tombstone);
+        setAt(doc, path, tombstone);
         return;
     }
     if (!isSeq(existing)) {
-        doc.setIn(path, doc.createNode(values));
+        setAt(doc, path, doc.createNode(values));
         return;
     }
     const available = [...existing.items];
@@ -91,6 +127,34 @@ function setStringSequencePreservingComments(doc, path, values) {
         return doc.createNode(value);
     });
 }
+// OBS-533: yaml's setIn/deleteIn throw on any non-collection intermediate ("Expected YAML
+// collection at spec. Remaining path: pin"), and a v1.1 null tombstone (`spec:` under
+// routing.map) is exactly that scalar — deepMerge prunes it before schema validation, so the
+// overlay loads clean and the first fleet write under the tombstoned key crashed the TUI.
+// Total forms: a delete treats the masked subtree as absent (the operator's tombstone already
+// denies it, and survives untouched); a set clears the scalar and rebuilds what fleet owns —
+// the routing.allow precedent below.
+function deleteAt(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        if (!isMap(doc.getIn(path.slice(0, depth), true)))
+            return;
+    }
+    // deleteIn throws on an empty document — only delete keys that exist.
+    if (doc.getIn(path) !== undefined)
+        doc.deleteIn(path);
+}
+function setAt(doc, path, value) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (node === undefined)
+            break;
+        if (!isMap(node)) {
+            doc.deleteIn(path.slice(0, depth));
+            break;
+        }
+    }
+    doc.setIn(path, value);
+}
 function deleteEmptyMap(doc, path) {
     const node = doc.getIn(path, true);
     if (isMap(node) && node.items.length === 0)
@@ -106,25 +170,84 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
         || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
     if (denyChanged) {
-        setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
-        setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+        if (write.universe) {
+            // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
+            // so a lower layer can never re-exclude behind the operator's back (workers untouched).
+            const form = allowFormFromExclusions(write.universe, edited);
+            if (form.excluded) {
+                const allowNode = doc.getIn(["routing", "allow"], true);
+                if (allowNode !== undefined && !isMap(allowNode))
+                    doc.deleteIn(["routing", "allow"]);
+                if (form.adapters.length) {
+                    setStringSequencePreservingComments(doc, ["routing", "allow", "adapters"], form.adapters);
+                }
+                else {
+                    deleteAt(doc, ["routing", "allow", "adapters"]);
+                }
+                if (form.models.length) {
+                    setStringSequencePreservingComments(doc, ["routing", "allow", "models"], form.models);
+                }
+                else {
+                    deleteAt(doc, ["routing", "allow", "models"]);
+                }
+                // Whole fleet out: allow stays present but empty — fail-closed, nothing admitted.
+                if (doc.getIn(["routing", "allow"]) === undefined) {
+                    setAt(doc, ["routing", "allow"], doc.createNode({}));
+                }
+            }
+            else {
+                // Whole fleet in: no restriction to express — the allow block goes away entirely.
+                deleteAt(doc, ["routing", "allow"]);
+            }
+            // Residuals stay in deny; covered scopes are tombstoned so a lower layer can never
+            // re-exclude behind the operator's back (workers untouched).
+            const residualAdapters = residualDeny(write.universe, edited.denyAdapters);
+            const residualModels = residualDeny(write.universe, edited.denyModels);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], residualAdapters.length ? residualAdapters : null);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], residualModels.length ? residualModels : null);
+        }
+        else {
+            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
+            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+        }
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
         const after = edited.map[shape];
         if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
             if (after?.pin === undefined)
-                doc.deleteIn(["routing", "map", shape, "pin"]);
+                deleteAt(doc, ["routing", "map", shape, "pin"]);
             else
-                doc.setIn(["routing", "map", shape, "pin"], doc.createNode(after.pin));
+                setAt(doc, ["routing", "map", shape, "pin"], doc.createNode(after.pin));
+        }
+        if (JSON.stringify(before?.pool) !== JSON.stringify(after?.pool)) {
+            const path = ["routing", "map", shape, "pool"];
+            if (after?.pool === undefined) {
+                // pool: null tombstone — masks a lower-layer pool instead of inheriting it again.
+                setStringSequencePreservingComments(doc, path, null);
+            }
+            else {
+                setScalarPreservingComment(doc, [...path, "mode"], after.pool.mode);
+                // Channel order is semantic (ordered walks it; any breaks ties by it) — dedupe, never sort.
+                setStringSequencePreservingComments(doc, [...path, "channels"], [...new Set(after.pool.channels)]);
+            }
         }
         if (JSON.stringify(before?.prefer) !== JSON.stringify(after?.prefer)) {
-            // Clearing a resolved list must mask the lower layer with [], not delete the key and inherit it again.
-            setStringSequencePreservingComments(doc, ["routing", "map", shape, "prefer"], after?.prefer ?? []);
+            if (after?.prefer === undefined && (after?.pool !== undefined || after?.pin !== undefined)) {
+                // the pin/pool declaration owns the whole slot at merge (deepMerge drops the lower
+                // layer's pin/pool/prefer atomically) — an [] mask here would re-declare prefer BESIDE
+                // the pool in one document and fail the exclusivity refine; delete the key instead
+                deleteAt(doc, ["routing", "map", shape, "prefer"]);
+            }
+            else {
+                // Clearing a resolved list with no replacing declaration must mask the lower layer
+                // with [], not delete the key and inherit it again.
+                setStringSequencePreservingComments(doc, ["routing", "map", shape, "prefer"], after?.prefer ?? []);
+            }
         }
         if (before?.escalate !== after?.escalate) {
             if (after?.escalate === undefined)
-                doc.deleteIn(["routing", "map", shape, "escalate"]);
+                deleteAt(doc, ["routing", "map", shape, "escalate"]);
             else
                 setScalarPreservingComment(doc, ["routing", "map", shape, "escalate"], after.escalate);
         }
@@ -134,7 +257,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             continue;
         const tier = edited.floors[shape];
         if (tier === undefined)
-            doc.deleteIn(["routing", "floors", shape]);
+            deleteAt(doc, ["routing", "floors", shape]);
         else
             setScalarPreservingComment(doc, ["routing", "floors", shape], tier);
     }
@@ -184,7 +307,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             if (JSON.stringify(before) === JSON.stringify(after))
                 continue;
             if (after === undefined) {
-                doc.deleteIn([key, "prefer"]);
+                deleteAt(doc, [key, "prefer"]);
                 deleteEmptyMap(doc, [key]);
             }
             else {
@@ -192,6 +315,11 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             }
         }
     }
+    // Every mutation no-oped against an empty or comment-only overlay (contents stays null;
+    // deleteAt never creates content): return the prior bytes verbatim — stringifying a null
+    // document would write a literal `null` line into the file.
+    if (doc.contents === null)
+        return priorBytes;
     // OBS-505: fleet's two-space note style (`tier: mid  # note`) applies to INLINE comments only.
     // The previous commentString prefixed " #" onto EVERY comment line, so block comments — the
     // whole init scaffold at column 0, and indented operator essays — each gained a stray leading
@@ -209,10 +337,14 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         commentString: (comment) => comment.startsWith(INLINE_COMMENT_SENTINEL)
             ? ` #${comment.slice(1)}`
             : comment.replace(/^(?!$)(?: $)?/gm, "#"),
+        // OBS-518: yaml's default pads flow collections (`[kimi]` → `[ kimi ]`), churning untouched
+        // lines on the one confirmation surface an operator reviews. Hand-written overlays use the
+        // unpadded form; emit it.
+        flowCollectionPadding: false,
     });
 }
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}) {
+export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}, universe) {
     if (fleetEditableEquals(initial, edited))
         return {};
     const out = structuredClone(existingRepo);
@@ -221,19 +353,45 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
         || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
     if (denyChanged) {
-        routing.deny = {
-            adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
-            models: edited.denyModels.length ? edited.denyModels : null,
-        };
+        if (universe) {
+            const form = allowFormFromExclusions(universe, edited);
+            if (form.excluded) {
+                routing.allow = {
+                    ...(form.adapters.length ? { adapters: form.adapters } : {}),
+                    ...(form.models.length ? { models: form.models } : {}),
+                };
+            }
+            else
+                delete routing.allow;
+            const residualAdapters = residualDeny(universe, edited.denyAdapters);
+            const residualModels = residualDeny(universe, edited.denyModels);
+            routing.deny = {
+                ...routing.deny,
+                adapters: residualAdapters.length ? residualAdapters : null,
+                models: residualModels.length ? residualModels : null,
+            };
+        }
+        else {
+            routing.deny = {
+                adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
+                models: edited.denyModels.length ? edited.denyModels : null,
+            };
+        }
         routingTouched = true;
     }
+    // pool widened to accept the null tombstone; MapEntry itself never carries null in memory.
     const mapDelta = {};
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         if (JSON.stringify(initial.map[shape]) !== JSON.stringify(edited.map[shape])) {
             const next = { ...edited.map[shape] };
-            if (initial.map[shape]?.prefer !== undefined && edited.map[shape]?.prefer === undefined) {
+            if (initial.map[shape]?.prefer !== undefined && edited.map[shape]?.prefer === undefined
+                && edited.map[shape]?.pool === undefined && edited.map[shape]?.pin === undefined) {
                 next.prefer = [];
             }
+            // pool: null tombstone — a removed pool must mask the lower layer, never inherit it again.
+            if (initial.map[shape]?.pool !== undefined && edited.map[shape]?.pool === undefined) {
+                next.pool = null;
+            }
             mapDelta[shape] = next;
         }
     }

package/dist/route/preference.d.ts

@@ -27,7 +27,7 @@ export declare function disallowedBy(c: {
     model: string;
 }, routing: TickmarkrConfig["routing"], role?: PreferenceRole): Disallowed | null;
 export interface DenyPreferCollision {
-    kind: "prefer" | "pin";
+    kind: "prefer" | "pin" | "pool";
     shape: string;
     detail: string;
     disallowed: Disallowed;

package/dist/route/preference.js

@@ -113,11 +113,21 @@ export function denyPreferCollisions(cfg, shapes) {
                 disallowed: preferEntryDenied(prefer[0], cfg),
             });
         }
+        const pool = entry.pool;
+        if (pool) {
+            const denied = pool.channels.map((p) => {
+                const i = p.indexOf(":");
+                return disallowedBy({ adapter: p.slice(0, i), model: p.slice(i + 1) }, cfg.routing);
+            });
+            // only a FULLY dead pool collides — a partial deny still leaves live members to route
+            if (denied.every((d) => d !== null)) {
+                out.push({ kind: "pool", shape, detail: pool.channels.join(" > "), disallowed: denied[0] });
+            }
+        }
     }
     return out;
 }
 export function denyPreferCollisionLine({ kind, shape, detail, disallowed }) {
-    const surface = kind === "pin" ? `routing.map.${shape}.pin` : `routing.map.${shape}.prefer`;
     const verb = kind === "pin" ? "is disallowed" : "fully disallowed";
-    return `deny∩prefer: ${surface} ${detail} ${verb} by routing.${disallowed.by} (${disallowed.entry}) — remove the ${disallowed.by} entry or adjust ${kind === "pin" ? "pin" : "prefer"}`;
+    return `deny∩prefer: routing.map.${shape}.${kind} ${detail} ${verb} by routing.${disallowed.by} (${disallowed.entry}) — remove the ${disallowed.by} entry or adjust ${kind}`;
 }

package/dist/route/router.js

@@ -160,9 +160,9 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
     const mapPinFloor = taskFloor && (!advisoryFloor || TIER_RANK[taskFloor] >= TIER_RANK[advisoryFloor])
         ? { tier: taskFloor, source: "task" }
         : advisoryFloor ? { tier: advisoryFloor, source: "config" } : undefined;
-    const lintMapPinFloor = (tier) => {
+    const lintMapPinFloor = (tier, what = "pin") => {
         if (mapPinFloor && TIER_RANK[tier] < TIER_RANK[mapPinFloor.tier]) {
-            lints.push(`${task.id} (${task.shape}): map pin routes ${tier}, below ${mapPinFloor.source} floor ${mapPinFloor.tier} — map pins are supreme`);
+            lints.push(`${task.id} (${task.shape}): map ${what} routes ${tier}, below ${mapPinFloor.source} floor ${mapPinFloor.tier} — map ${what}s are supreme`);
         }
     };
     const source = task.routingHints?.source;
@@ -190,6 +190,35 @@ export function route(task, cfg, channels, profile, preferCtx, exclude, exploreC
         maybeSlaLint(lints, task, profile, slaMinutes, c);
         return { assignment: toAssignment(c), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pin ${entry.pin.via}:${entry.pin.model} (config routing.map)` };
     }
+    // map pool: operator-authored closed candidate set (v1.92) — sits between the pin (a
+    // single-channel pool) and the open floor/auto path. Exhaustion stays fail-loud (pin precedent).
+    if (entry?.pool) {
+        const pool = entry.pool;
+        if (prefActive) {
+            for (const p of pool.channels) {
+                const i = p.indexOf(":");
+                const d = disallowedBy({ adapter: p.slice(0, i), model: p.slice(i + 1) }, cfg.routing);
+                if (d) {
+                    throw new RoutingError(`${task.id}: pool entry ${p} is disallowed by routing.${d.by} (${d.entry}) — remove the ${d.by} entry or drop it from the pool`);
+                }
+            }
+        }
+        // live preserves pool declaration order — ordered mode and any-mode stable-sort ties depend on it
+        const live = pool.channels
+            .map((id) => channels.find((c) => channelKey(c) === id))
+            .filter((c) => c !== undefined);
+        if (!live.length) {
+            throw new RoutingError(`${task.id}: routing.map.${task.shape}.pool has no live channel — declared: ${pool.channels.join(", ")}; doctor found: ${channels.map(channelKey).join(", ") || "(nothing)"}`);
+        }
+        // ponytail: no learned/explore/spread inside pools in v1 — a pool pick is fully static; the
+        // upgrade path is feeding the pool-filtered set through the learned path below.
+        const chosen = pool.mode === "ordered"
+            ? live[0]
+            : [...live].sort((a, b) => marginalCostRank(a) - marginalCostRank(b) || TIER_RANK[a.tier] - TIER_RANK[b.tier])[0];
+        lintMapPinFloor(chosen.tier, "pool");
+        maybeSlaLint(lints, task, profile, slaMinutes, chosen);
+        return { assignment: toAssignment(chosen), ladder: ladderFor(task, entry), lints, provenance: `${degraded}pool ${pool.mode} ${channelKey(chosen)} (config routing.map)` };
+    }
     const baseTier = floor ?? "cheap";
     // D-04: a task floor is hard only on floor/auto paths; the map-pin branch above stays supreme.
     const minTier = taskFloor && TIER_RANK[taskFloor] > TIER_RANK[baseTier] ? taskFloor : baseTier;