tickmarkr 2.5.3 → 2.5.5

package/dist/compile/collateral.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { extname, join, relative } from "node:path";
+import { extname, join, posix, relative } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { criticalPathHits, DEFAULT_CONFIG, DEFAULT_REVIEW_CRITICAL_PATHS, effectiveReviewPolicy, loadConfig, } from "../config/config.js";
 import { renderAcceptanceItem } from "../graph/schema.js";
@@ -156,20 +156,61 @@ export function classifyScopeOffenders(taskId, hard, predicted) {
     const missed = hard.filter((f) => !named.has(f));
     return { authoring: hard.length > 0 && missed.length === 0, predicted: hit, missed, repair: filesRepair(taskId, hit) };
 }
+const moduleKey = (path) => path.replace(/\\/g, "/").replace(/\.(?:[cm]?[jt]sx?)$/, "");
+function directImportSpecifiers(text) {
+    // Comments cannot create an edge. Keep strings intact because they are the import target.
+    const source = text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
+    const specifiers = new Set();
+    for (const match of source.matchAll(/\bimport\s+(?:type\s+)?(?:[\w$*{},\s]+?\s+from\s+)?["']([^"']+)["']/g)) {
+        specifiers.add(match[1]);
+    }
+    for (const match of source.matchAll(/\bimport\s*\(\s*["']([^"']+)["']\s*\)/g)) {
+        specifiers.add(match[1]);
+    }
+    return [...specifiers];
+}
+function directlyImports(testPath, testText, sourcePath) {
+    const target = moduleKey(sourcePath);
+    const testDir = posix.dirname(testPath.replace(/\\/g, "/"));
+    return directImportSpecifiers(testText).some((specifier) => {
+        const imported = specifier.startsWith(".")
+            ? posix.normalize(posix.join(testDir, specifier))
+            : specifier.startsWith("src/") ? specifier : "";
+        return imported !== "" && moduleKey(imported) === target;
+    });
+}
 /**
  * Return human-readable scope-lint lines for plan output (no `!` prefix — plan owns that).
  * Each line names the task id and at least one missing collateral test path.
+ * OBS-971: uncapped — every predicted path is listed, with direct importers of an owned source
+ * sorted first, followed by the total count. The runtime map (collateralHits) remains unchanged.
  */
 export function collateralLints(tasks, repoRoot) {
     const lines = [];
-    for (const [id, hits] of collateralHits(tasks, repoRoot)) {
-        const listed = hits.slice(0, MAX_HITS_PER_TASK).join(", ");
-        // OBS-547: the cap hides names, never predictions. Say so, and say where the hidden ones surface —
-        // a count with no route is exactly what left one run's victim unreadable.
-        const tail = hits.length > MAX_HITS_PER_TASK
-            ? ` (${hits.length} total; ${MAX_HITS_PER_TASK} shown, ${hits.length - MAX_HITS_PER_TASK} capped out of view`
-                + ` but RETAINED for the scope gate — a matching scope red prints the hidden path with its files[] repair)`
-            : "";
+    const hitsMap = collateralHits(tasks, repoRoot);
+    const read = makeReader(repoRoot);
+    const tasksById = new Map(tasks.map((t) => [t.id, t]));
+    for (const [id, hits] of hitsMap) {
+        const t = tasksById.get(id);
+        const files = (t?.files ?? []).map((f) => f.replace(/^\.\//, ""));
+        const ownedSources = files.filter(isSrcPath);
+        const direct = [];
+        const indirect = [];
+        for (const h of hits) {
+            const text = read(h) ?? "";
+            const isDirect = ownedSources.some((src) => directlyImports(h, text, src));
+            if (isDirect) {
+                direct.push(h);
+            }
+            else {
+                indirect.push(h);
+            }
+        }
+        direct.sort((a, b) => a.localeCompare(b));
+        indirect.sort((a, b) => a.localeCompare(b));
+        const ordered = [...direct, ...indirect];
+        const listed = ordered.join(", ");
+        const tail = hits.length > MAX_HITS_PER_TASK ? ` (${hits.length} total)` : "";
         lines.push(`${id}: likely collateral tests not in files[]: ${listed}${tail}`);
     }
     return lines;

package/dist/compile/ownership.d.ts

@@ -31,6 +31,13 @@ export type OwnershipFinding = {
     ownerTaskId: string;
     path: string;
     detail: string;
+} | {
+    code: "unowned-source-of-owned-test";
+    taskId: string;
+    test: string;
+    source: string;
+    corroboration?: OwnershipCorroboration;
+    detail: string;
 };
 export declare const SHAPE_ORACLES: readonly ["tests/run/narration.test.ts", "tests/cli/brand-surfaces.test.ts", "tests/run/notify-identity.test.ts", "tests/run/outcome-projections.test.ts", "tests/cockpit/setup.test.ts"];
 export declare const SHAPE_ORACLE_SOURCES: readonly ["src/run/daemon.ts", "src/cli/commands/run.ts"];

package/dist/compile/ownership.js

@@ -1,4 +1,4 @@
-import { readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { basename, extname, join, posix } from "node:path";
 import { filesGlob } from "../graph/files-glob.js";
 import { collateralHits } from "./collateral.js";
@@ -17,21 +17,24 @@ export const SHAPE_ORACLE_MAP = {
     "src/run/daemon.ts": SHAPE_ORACLES,
     "src/cli/commands/run.ts": SHAPE_ORACLES,
 };
-// Anchored-glob only: a files[] entry touches a mapped source when it names the source (or its
-// extensionless stem) exactly, or when its glob's literal head — everything before the first
-// wildcard — is the stem plus a literal dot, i.e. the wildcard only ever spans the extension
-// ("src/run/daemon.*"). A broad multi-file glob like "src/**" that merely happens to cover the
-// source is an unrelated task casting a wide net, not one touching daemon narration — that
-// distinction is what broke every fixture using tests/fixtures/sample.prd.md's files: src/** task.
-function touchesSource(files, source) {
+// A files[] entry touches a mapped shape-oracle source when it names it literally or by stem, or when
+// the entry's glob — anchored or broad — matches the source AND the source exists in the repository
+// being compiled: "src/run/**" owning this repository's daemon owns the five oracles, while the
+// shipped sample PRD's "src/**" task in a repository holding no mapped source compiles clean.
+// Anchored globs like "src/run/daemon.*" target the source specifically and touch it regardless.
+function touchesSource(files, source, repoRoot) {
     const stem = source.replace(/\.(?:[cm]?[jt]sx?)$/, "");
     return files.some((entry) => {
         if (entry === source || entry === stem)
             return true;
         const special = entry.search(/[*?{[]/);
-        // Leg-2 v2.5.3: the anchored head is necessary, not sufficient — the pattern must also MATCH the
-        // source under the shared matcher, or "src/run/daemon.{js,jsx}" (never daemon.ts) would count as a touch.
-        return special !== -1 && entry.slice(0, special) === `${stem}.` && filesGlob([entry])(source);
+        if (special === -1)
+            return false;
+        if (!filesGlob([entry])(source))
+            return false;
+        if (entry.slice(0, special) === `${stem}.`)
+            return true;
+        return repoRoot !== undefined && existsSync(join(repoRoot, source));
     });
 }
 const normalize = (path) => path.replace(/^\.\//, "").split("\\").join("/");
@@ -133,20 +136,24 @@ function mentionsCommandEntry(text) {
     return /(?:^|\/)src\/cli\/index\.(?:ts|js)\b/.test(text)
         || /["'`]src["'`]\s*,\s*["'`]cli["'`]\s*,\s*["'`]index\.(?:ts|js)["'`]/.test(text);
 }
-function corroboration(test, matches) {
-    // A .test.ts-shaped collateral fixture is not by itself a dedicated test. Requiring a runner leaf
-    // keeps import-only scan fixtures advisory while every executable subject in the measured union stays.
+function corroborateSource(test, sourcePath) {
     const executable = test.text.replace(/\/\*[\s\S]*?\*\//g, "").replace(/^\s*\/\/.*$/gm, "");
     if (!/\b(?:test|it)(?:\.(?:concurrent|each|fails|only|skip|todo))*\s*\(/.test(executable))
         return undefined;
-    for (const match of matches) {
-        if (directlyImports(test, match.source))
-            return { kind: "direct-import", source: match.source };
-    }
+    if (directlyImports(test, sourcePath))
+        return { kind: "direct-import", source: sourcePath };
     if (invokesChildProcessSpawn(test.text) && mentionsCommandEntry(test.text)) {
-        const command = matches.find(({ source }) => /^src\/cli\/commands\/[^/]+\.(?:[cm]?[jt]sx?)$/.test(source));
-        if (command)
-            return { kind: "command-entry-spawn", source: command.source, entry: "src/cli/index.ts" };
+        if (/^src\/cli\/commands\/[^/]+\.(?:[cm]?[jt]sx?)$/.test(sourcePath)) {
+            return { kind: "command-entry-spawn", source: sourcePath, entry: "src/cli/index.ts" };
+        }
+    }
+    return undefined;
+}
+function corroboration(test, matches) {
+    for (const match of matches) {
+        const evidence = corroborateSource(test, match.source);
+        if (evidence)
+            return evidence;
     }
     return undefined;
 }
@@ -239,7 +246,7 @@ export function ownershipFindings(tasks, repoRoot) {
     }
     for (const entry of indexed) {
         for (const [source, oracles] of Object.entries(SHAPE_ORACLE_MAP)) {
-            if (!touchesSource(entry.files, source))
+            if (!touchesSource(entry.files, source, repoRoot))
                 continue;
             for (const oracle of oracles) {
                 if (!entry.owns(oracle)) {
@@ -254,6 +261,35 @@ export function ownershipFindings(tasks, repoRoot) {
             }
         }
     }
+    for (const test of sources) {
+        const testOwners = owners(test.path);
+        if (testOwners.length === 0)
+            continue;
+        const testStem = basename(test.path).replace(/\.test\.ts$/, "");
+        for (const sourcePath of allSources) {
+            if (owners(sourcePath).length > 0)
+                continue;
+            const sourceStem = basename(sourcePath, extname(sourcePath));
+            if (testStem !== sourceStem && !testStem.startsWith(`${sourceStem}-`))
+                continue;
+            const evidence = corroborateSource(test, sourcePath);
+            if (!evidence)
+                continue;
+            for (const owner of testOwners) {
+                findings.push({
+                    code: "unowned-source-of-owned-test",
+                    taskId: owner.task.id,
+                    test: test.path,
+                    source: sourcePath,
+                    corroboration: evidence,
+                    detail: `${test.path} owned by ${owner.task.id} is a dedicated test of ${sourcePath} but no task owns ${sourcePath}`
+                        + (evidence.kind === "direct-import" ? `; it imports ${evidence.source} directly`
+                            : evidence.kind === "command-entry-spawn"
+                                ? `; it spawns ${evidence.entry} to exercise ${evidence.source}` : ""),
+                });
+            }
+        }
+    }
     for (const source of sources) {
         for (const owner of owners(source.path)) {
             for (const path of repositoryPaths(source.text)) {
@@ -290,6 +326,7 @@ export function ownershipFindings(tasks, repoRoot) {
             case "unowned-shape-oracle": return f.oracle;
             case "test-path-outside-allowlist": return f.test;
             case "unordered-context-write": return f.path;
+            case "unowned-source-of-owned-test": return f.test;
         }
     };
     return findings.sort((a, b) => {

package/dist/config/config.d.ts

@@ -175,6 +175,10 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             on: "on";
             off: "off";
         }>;
+        escalateTier: z.ZodDefault<z.ZodEnum<{
+            on: "on";
+            off: "off";
+        }>>;
         learnedTuning: z.ZodOptional<z.ZodObject<{
             halfLifeRuns: z.ZodOptional<z.ZodNumber>;
             availWeight: z.ZodOptional<z.ZodNumber>;
@@ -275,6 +279,11 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
             "judge-only": "judge-only";
         }>>;
         criticalPaths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        floor: z.ZodDefault<z.ZodUnion<readonly [z.ZodLiteral<"worker">, z.ZodEnum<{
+            cheap: "cheap";
+            mid: "mid";
+            frontier: "frontier";
+        }>]>>;
     }, z.core.$strip>;
     consult: z.ZodObject<{
         adapter: z.ZodString;
@@ -355,24 +364,30 @@ export type FleetTierAssignment = {
 export type FleetEditable = {
     denyAdapters: string[];
     denyModels: string[];
+    denyWorkersAdapters?: string[];
+    denyWorkersModels?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;
 };
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
+/** A discovered fleet universe row: the served models of one adapter and, per model, the resolved
+ * identity doctor recorded for a floating alias (LEG2-T3 round 2 finding 3). */
+export type FleetUniverseRow = {
+    adapter: string;
+    models: string[];
+    identities?: Record<string, string>;
+};
+/** Does a deny/allow entry name this universe channel? Grammar A1 (adapter id, bare model id,
+ * adapter:model) plus the recorded identity (bare or adapter:identity) — the collector's authority. */
+export declare function universeEntryMatches(row: FleetUniverseRow, model: string, entry: string): boolean;
 /** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
  * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
  * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
  * membership state and must survive a membership write verbatim, never be re-derived away. */
-export declare function universeCovers(universe: {
-    adapter: string;
-    models: string[];
-}[], entry: string): boolean;
-export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: {
-    adapter: string;
-    models: string[];
-}[]): FleetEditable;
+export declare function universeCovers(universe: FleetUniverseRow[], entry: string): boolean;
+export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: FleetUniverseRow[]): FleetEditable;
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -302,6 +302,8 @@ export const TickmarkrConfigSchema = z.object({
         }),
         floors: z.record(z.string(), TierEnum),
         learned: z.enum(["on", "off"]), // v1.6 ROUTE-09 kill switch; a typo (offf) fails loud via safeParse
+        // OBS-986 (ES-1): climb one tier on request when untried channels exist in higher tiers.
+        escalateTier: z.enum(["on", "off"]).default("on"),
         // v1.9 ROUTE-15 — optional overrides for profile.ts HALF_LIFE_RUNS/AVAIL_WEIGHT; absent ⇒ byte-identical defaults.
         // SIBLING of learned (not nested): routing.learned is the on/off enum switch.
         learnedTuning: z.object({
@@ -366,6 +368,11 @@ export const TickmarkrConfigSchema = z.object({
         // R3: globs no task may skip review on (input/demux/lifecycle, gates/run/drivers/adapters, anything
         // reaching a shell). A judge-only task intersecting one of these fails COMPILE, never silently skips.
         criticalPaths: z.array(z.string()).optional(),
+        // RF-1 (OBS-922 add.2/3): review.floor — `worker` (default) names no tier and leaves the seat
+        // ranking to the author's routed seat; a tier is folded in as max(task floor, this) by reviewGate
+        // and its retry — it can raise a seat and never lower one. Not in the template: the cockpit
+        // fixture pins the fresh-install bytes (see d0e89a9a).
+        floor: z.union([z.literal("worker"), TierEnum]).default("worker"),
     }),
     // v1.54 T1: prefer — ranked consult seat failover. Entries MUST be adapter:model (unlike
     // review.prefer's adapter|adapter:model grammar): a consult seat has no channel to inherit a
@@ -445,6 +452,7 @@ export const DEFAULT_CONFIG = {
         // a workspace that has accumulated ≥MIN_SAMPLES warm telemetry per cell. Preview any workspace's effect
         // first with `tickmarkr plan` / `tickmarkr report`; flip to "off" to pin exact static routing (the kill switch stands).
         learned: "on",
+        escalateTier: "on",
         allowUnverifiedModels: false,
     },
     // Seed table (spec §13). New models = edit this (or your config.yaml), never code.
@@ -590,7 +598,7 @@ export const DEFAULT_CONFIG = {
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
-    review: { complexityThreshold: 7, timeoutMs: 900_000, required: true, criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
+    review: { complexityThreshold: 7, timeoutMs: 900_000, required: true, floor: "worker", criticalPaths: [...DEFAULT_REVIEW_CRITICAL_PATHS] },
     consult: { adapter: "claude-code", model: "fable", stallMinutes: 15 },
     // v1.4: gate LLM calls (judge/review/consult) run headless by default; pane opts back into visible agents.
     // v1.2: workers are the real agent TUI in the pane; "print" restores the -p-rendered-in-pane path.
@@ -784,6 +792,7 @@ export function configTemplate(overlay) {
 #   floors:               # tier authority — advisory minimum bands; 'tickmarkr plan' lints violations
 #     migration: frontier
 #   learned: on            # default ON (ROUTE-14); cold profile = exact v1.5 static routing, warms per workspace. Set 'off' to pin static routing; preview with 'tickmarkr plan'
+#   escalateTier: on       # on | off (default on): climb one tier on request when untried channels exist in higher tiers
 #   learnedTuning: { halfLifeRuns: 5, availWeight: 0.05 }  # optional; defaults byte-identical
 #   explore: { mode: on, excludeShapes: [], excludeComplexityAtOrAbove: null, cap: 5 }  # optional; absent ⇒ byte-identical
 #   sla: { implement: 15 }  # optional per-shape minutes — advisory plan lint only; absent ⇒ no lint
@@ -817,7 +826,9 @@ export function configTemplate(overlay) {
 #   test: npm test
 #   byShape:
 #     docs: { acceptance: false, review: false }  # baseline, evidence, and scope are mandatory
-# review: { complexityThreshold: 7, timeoutMs: 900000, required: true, prefer: [codex:gpt-5.6-sol, kimi] }
+# review: { complexityThreshold: 7, timeoutMs: 900000, required: true, floor: worker, prefer: [codex:gpt-5.6-sol, kimi] }
+#                         # floor: worker (default) | cheap | mid | frontier — the reviewer seats at or above
+#                         # max(author tier, task floor, this tier, prior reviewer); a tier here only raises it
 #                         # prefer: ordered reviewer seat preference (adapter | adapter:model); ranks
 #                         # diversity-eligible channels only — never admits a same-vendor/same-model reviewer
 # consult: { adapter: claude-code, model: fable, stallMinutes: 15, prefer: [codex:gpt-5.6-sol, kimi:kimi-code/k3] }
@@ -876,6 +887,14 @@ export function readOverlayFile(path) {
         throw new ConfigError(`invalid overlay at ${path}`);
     return raw;
 }
+/** Does a deny/allow entry name this universe channel? Grammar A1 (adapter id, bare model id,
+ * adapter:model) plus the recorded identity (bare or adapter:identity) — the collector's authority. */
+export function universeEntryMatches(row, model, entry) {
+    if (entry === row.adapter || entry === model || entry === `${row.adapter}:${model}`)
+        return true;
+    const identity = row.identities?.[model];
+    return identity !== undefined && (entry === identity || entry === `${row.adapter}:${identity}`);
+}
 /** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
  * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
  * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
@@ -884,9 +903,11 @@ export function universeCovers(universe, entry) {
     return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
 }
 // v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
-// the EFFECTIVE out-of-fleet complement — anything routing.allow does not admit (fail-closed) UNION
-// routing.deny adapters/models scopes (never workers). Absent universe ⇒ deny arrays verbatim, so
-// non-UI callers stay byte-identical.
+// the EFFECTIVE out-of-fleet set — the routing.allow complement (fail-closed) as adapter ids and
+// adapter:model keys, UNION every authored routing.deny adapters/models entry VERBATIM in its own list
+// (never workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership
+// key, so one Space press clears one reason; finding 3: allow admission honours recorded identity.
+// Absent universe ⇒ deny arrays verbatim, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
@@ -898,43 +919,32 @@ export function fleetEditableFromConfig(cfg, universe) {
     let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
     let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
     if (universe !== undefined) {
-        const { allow, deny } = cfg.routing;
-        // Grammar A1 (disallowedBy precedent): entries match adapter id, bare model id, or adapter:model.
-        // Inlined rather than imported — route/preference.ts imports this module.
-        const denyEntries = [...(deny?.adapters ?? []), ...(deny?.models ?? [])];
+        const { allow } = cfg.routing;
         const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
-        const outOfFleet = (adapter, model) => {
-            const matches = (e) => e === adapter || e === model || e === `${adapter}:${model}`;
-            if (denyEntries.some(matches))
-                return true;
-            return allowEntries !== null && !allowEntries.some(matches);
-        };
+        const notAdmitted = (row, model) => allowEntries !== null && !allowEntries.some((entry) => universeEntryMatches(row, model, entry));
         const adaptersOut = [];
         const modelsOut = [];
         for (const row of universe) {
-            const out = row.models.filter((m) => outOfFleet(row.adapter, m));
-            if (row.models.length ? out.length === row.models.length : outOfFleet(row.adapter, "")) {
+            const out = row.models.filter((m) => notAdmitted(row, m));
+            if (row.models.length ? out.length === row.models.length : notAdmitted(row, "")) {
                 adaptersOut.push(row.adapter);
             }
             else {
                 modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
             }
         }
-        // OBS-517: deny entries the probe universe does not cover (failed/rate-limited probes drop the
-        // channel from discoverChannels) are preserved VERBATIM — deriving membership purely from the
-        // universe silently un-denied them on the next write (fail-open on the operator's own ban list).
-        denyAdapters = [...new Set([
-                ...adaptersOut,
-                ...(deny?.adapters ?? []).filter((e) => !universeCovers(universe, e)),
-            ])].sort();
-        denyModels = [...new Set([
-                ...modelsOut,
-                ...(deny?.models ?? []).filter((e) => !universeCovers(universe, e)),
-            ])].sort();
+        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim, so a
+        // transient probe failure can never un-deny one on the next write (fail-open on the ban list).
+        denyAdapters = [...new Set([...adaptersOut, ...denyAdapters])].sort();
+        denyModels = [...new Set([...modelsOut, ...denyModels])].sort();
     }
     return {
         denyAdapters,
         denyModels,
+        // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
+        // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
+        denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),
+        denyWorkersModels: [...(cfg.routing.deny?.workers?.models ?? [])].sort(),
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
@@ -977,6 +987,10 @@ export function formatFleetPrint(repoRoot, opts = {}) {
         annotate(["routing", "deny", "adapters"]);
     if (effective.routing.deny?.models !== undefined)
         annotate(["routing", "deny", "models"]);
+    if (effective.routing.deny?.workers?.adapters !== undefined)
+        annotate(["routing", "deny", "workers", "adapters"]);
+    if (effective.routing.deny?.workers?.models !== undefined)
+        annotate(["routing", "deny", "workers", "models"]);
     for (const shape of Object.keys(effective.routing.map))
         annotate(["routing", "map", shape]);
     annotate(["routing", "floors"]);

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import { type FleetEditable, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 export type FleetOverlayWrite = {
@@ -19,10 +19,7 @@ export type FleetOverlayWrite = {
             consult?: string[];
         };
     };
-    universe?: {
-        adapter: string;
-        models: string[];
-    }[];
+    universe?: FleetUniverseRow[];
 };
 export type FleetFirstTouch = {
     vendor: string;
@@ -33,10 +30,7 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: {
-    adapter: string;
-    models: string[];
-}[]): Record<string, unknown>;
+export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: FleetUniverseRow[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;

package/dist/config/fleet-overlay.js

@@ -1,6 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
 import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
-import { universeCovers } from "./config.js";
+import { universeCovers, universeEntryMatches } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
 function fleetSubset(obj) {
@@ -21,17 +21,18 @@ function allowFormFromExclusions(universe, edited) {
     if (!universe.length) {
         throw new Error("fleet write: universe is empty — no classified models to compute routing.allow from; classify models in `tickmarkr fleet` first");
     }
-    const denyAdapters = new Set(edited.denyAdapters);
-    const denyModels = new Set(edited.denyModels);
+    // LEG2-T3 round 2 finding 1: every staged entry excludes what it NAMES — a bare model id every
+    // adapter serving it, an identity its alias — never only an adapter id or an adapter:model key.
+    const entries = [...edited.denyAdapters, ...edited.denyModels];
     const adapters = [];
     const models = [];
     let excluded = false;
     for (const row of universe) {
-        if (denyAdapters.has(row.adapter)) {
+        if (entries.includes(row.adapter)) {
             excluded = true;
             continue;
         }
-        const inFleet = row.models.filter((m) => !denyModels.has(`${row.adapter}:${m}`));
+        const inFleet = row.models.filter((m) => !entries.some((entry) => universeEntryMatches(row, m, entry)));
         if (inFleet.length === row.models.length) {
             adapters.push(row.adapter);
         }
@@ -49,6 +50,21 @@ function allowFormFromExclusions(universe, edited) {
 function residualDeny(universe, entries) {
     return sortedUnique(entries.filter((entry) => !universeCovers(universe, entry)));
 }
+// LEG2-T3 round 2 finding 2: the flat deny list a membership write leaves behind. Every entry the
+// repo overlay authored in THIS list that is still staged stays verbatim, in its authored order and
+// with its comments — one cleared reason never takes an independent one with it, and an untouched
+// list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
+// probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
+// session added ride the allow form alone.
+function flatDenyAfterWrite(doc, path, after, universe) {
+    const node = doc.getIn(path, true);
+    const authored = isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    const canonical = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => entry === `${row.adapter}:${m}`));
+    const kept = authored.filter((entry) => after.includes(entry));
+    const verbatim = sortedUnique(after.filter((entry) => !kept.includes(entry)
+        && (!universeCovers(universe, entry) || !canonical(entry))));
+    return [...new Set([...kept, ...verbatim])];
+}
 // fleet.ts deliberately remains the sole overlay builder and writer. Its established classification
 // seam copies only `tier` and `note` into FleetEditable, so first-touch entry metadata rides inside a
 // private provenance envelope until this module writes the YAML. The envelope never reaches disk.
@@ -199,18 +215,35 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 // Whole fleet in: no restriction to express — the allow block goes away entirely.
                 deleteAt(doc, ["routing", "allow"]);
             }
-            // Residuals stay in deny; covered scopes are tombstoned so a lower layer can never
-            // re-exclude behind the operator's back (workers untouched).
-            const residualAdapters = residualDeny(write.universe, edited.denyAdapters);
-            const residualModels = residualDeny(write.universe, edited.denyModels);
-            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], residualAdapters.length ? residualAdapters : null);
-            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], residualModels.length ? residualModels : null);
+            // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2); a
+            // list left with nothing is tombstoned so a lower layer can never re-exclude behind the
+            // operator's back (workers untouched).
+            for (const [scope, after] of [["adapters", edited.denyAdapters], ["models", edited.denyModels]]) {
+                const path = ["routing", "deny", scope];
+                const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
+                setStringSequencePreservingComments(doc, path, remaining.length ? remaining : null);
+            }
         }
         else {
             setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
             setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
         }
     }
+    // OBS-994/FL-1: routing.deny.workers is a literal deny list, never a universe-derived
+    // membership scope — it never routes through the allow-complement dance above, in either
+    // branch. Same tombstone/comment-preserving rules as the flat scopes.
+    const initialWorkersAdapters = initial.denyWorkersAdapters ?? [];
+    const editedWorkersAdapters = edited.denyWorkersAdapters ?? [];
+    const initialWorkersModels = initial.denyWorkersModels ?? [];
+    const editedWorkersModels = edited.denyWorkersModels ?? [];
+    // Each sub-path mutates independently — an untouched sibling must not be rewritten (a `null`
+    // tombstone over an absent/untouched sibling would mask a lower layer's own workers scope).
+    if (sortedUnique(initialWorkersAdapters).join() !== sortedUnique(editedWorkersAdapters).join()) {
+        setStringSequencePreservingComments(doc, ["routing", "deny", "workers", "adapters"], editedWorkersAdapters.length ? sortedUnique(editedWorkersAdapters) : null);
+    }
+    if (sortedUnique(initialWorkersModels).join() !== sortedUnique(editedWorkersModels).join()) {
+        setStringSequencePreservingComments(doc, ["routing", "deny", "workers", "models"], editedWorkersModels.length ? sortedUnique(editedWorkersModels) : null);
+    }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
         const after = edited.map[shape];
@@ -379,6 +412,30 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
         }
         routingTouched = true;
     }
+    // OBS-994/FL-1: workers deny is a literal list, independent of the universe/allow dance above.
+    // Each sub-path is included only when it actually changed — an untouched sibling must not be
+    // rewritten as a `null` tombstone over whatever the existing repo overlay already held.
+    const initialWorkersAdapters = initial.denyWorkersAdapters ?? [];
+    const editedWorkersAdapters = edited.denyWorkersAdapters ?? [];
+    const initialWorkersModels = initial.denyWorkersModels ?? [];
+    const editedWorkersModels = edited.denyWorkersModels ?? [];
+    const workersAdaptersChanged = sortedUnique(initialWorkersAdapters).join() !== sortedUnique(editedWorkersAdapters).join();
+    const workersModelsChanged = sortedUnique(initialWorkersModels).join() !== sortedUnique(editedWorkersModels).join();
+    if (workersAdaptersChanged || workersModelsChanged) {
+        routing.deny = {
+            ...routing.deny,
+            workers: {
+                ...(routing.deny?.workers),
+                ...(workersAdaptersChanged
+                    ? { adapters: editedWorkersAdapters.length ? editedWorkersAdapters : null }
+                    : {}),
+                ...(workersModelsChanged
+                    ? { models: editedWorkersModels.length ? editedWorkersModels : null }
+                    : {}),
+            },
+        };
+        routingTouched = true;
+    }
     // pool widened to accept the null tombstone; MapEntry itself never carries null in memory.
     const mapDelta = {};
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {

package/dist/config/fleet-why.d.ts

@@ -21,3 +21,10 @@ export type FleetWhyOptions = {
 export declare function projectFleetWhy<Id extends string>(values: readonly FleetWhyValue<Id>[], options: FleetWhyOptions): FleetWhyRow<Id>[];
 /** Plain line-mode twin of the Shapes rows; labels are projected, never reconstructed here. */
 export declare function renderFleetWhy(rows: readonly FleetWhyRow[]): string;
+/** LEG2-T3: one exclusion-collector scope as the reason a fleet row shows — its config path, then
+ * the entry that matched (a deny) or the fact the allowlist does not admit the channel. */
+export declare function exclusionReason(scope: {
+    by: "deny" | "allow";
+    configPath: string;
+    entry: string;
+}): string;

package/dist/config/fleet-why.js

@@ -40,3 +40,8 @@ export function projectFleetWhy(values, options) {
 export function renderFleetWhy(rows) {
     return ["tickmarkr fleet --why — effective shape routing", ...rows.map((row) => row.label)].join("\n");
 }
+/** LEG2-T3: one exclusion-collector scope as the reason a fleet row shows — its config path, then
+ * the entry that matched (a deny) or the fact the allowlist does not admit the channel. */
+export function exclusionReason(scope) {
+    return scope.by === "allow" ? `${scope.configPath} (not admitted)` : `${scope.configPath} (${scope.entry})`;
+}

package/dist/drivers/herdr.d.ts

@@ -128,6 +128,11 @@ export declare class HerdrDriver implements ExecutorDriver {
     close(slot: Slot): Promise<void>;
     private closeGrouped;
     private watchPanes;
+    /** WB-1 (OBS-988): the daemon proved this run's own board lost. Forget the cached slot FIRST — even a
+     *  retire that fails must never let the narrator answer with the ghost again — then take the pane
+     *  back on ownership alone: the dead UI can never acknowledge, so the stop request is left for a
+     *  merely stuck one to find. Serialized with the narrator so no split races the close. */
+    retireLostWatch(slot: Slot): Promise<void>;
     /** Name collisions never confer repository ownership. Unknown boards stay protected. */
     private retireWatch;
     focus(target: FocusTarget): Promise<FocusResult>;