tickmarkr 2.5.4 → 2.5.5

package/dist/cli/commands/init.js

@@ -1,6 +1,6 @@
 import { execFileSync } from "node:child_process";
-import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { appendFileSync, cpSync, existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createInterface } from "node:readline/promises";
 import { parseArgs } from "node:util";
@@ -9,10 +9,11 @@ import { allAdapters, formatDoctorAgeForInit, formatDoctorReport, initDoctorReus
 import { configTemplate, DEFAULT_CONFIG, globalConfigDir, loadConfig } from "../../config/config.js";
 import { LEGACY_PREFIX, specTemplate } from "../../compile/native.js";
 import { BANNER, kvRow, legend, rule, statusRow, title } from "../../brand.js";
-import { tickmarkrDir } from "../../graph/graph.js";
+import { stateDirName, tickmarkrDir } from "../../graph/graph.js";
 import { orcaHostDetected } from "../../drivers/index.js";
+import { WORKTREES_DIR } from "../../run/git.js";
 import { Journal } from "../../run/journal.js";
-import { runLockRunId, runStatusLine } from "../../run/lock.js";
+import { runLockOwner, runLockRunId, runStatusLine } from "../../run/lock.js";
 import { doctor } from "./doctor.js";
 import { assembleFleetEditor } from "./fleet.js";
 const SCAFFOLD_SPEC = "tickmarkr.spec.md";
@@ -340,6 +341,191 @@ async function runInitWizard(cwd, input, output) {
         return null;
     return { overlay: result.overlay, installSkills: result.installSkills, installDocs: result.installDocs };
 }
+function realpathSafe(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        const parent = dirname(p);
+        if (parent === p)
+            return p;
+        return join(realpathSafe(parent), basename(p));
+    }
+}
+function isPathInside(parentDir, candidatePath) {
+    const resolvedParent = realpathSafe(resolve(parentDir));
+    const resolvedCandidate = realpathSafe(resolve(candidatePath));
+    const rel = relative(resolvedParent, resolvedCandidate);
+    return rel !== "" && rel !== ".." && !rel.startsWith(`..${sep}`) && !isAbsolute(rel);
+}
+/**
+ * The ONLY way the --remove path runs git: GIT_DIR, GIT_WORK_TREE and GIT_COMMON_DIR are stripped so the repository acted on
+ * is always cwd's own, and LC_ALL=C keeps stderr parseable. Throws execFileSync's error (status, stderr) unchanged.
+ */
+function removeGit(cwd, args) {
+    const { GIT_DIR: _dir, GIT_WORK_TREE: _workTree, GIT_COMMON_DIR: _commonDir, ...env } = process.env;
+    return execFileSync("git", args, { cwd, env: { ...env, LC_ALL: "C" }, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+}
+function isLinkedWorktree(cwd) {
+    try {
+        const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
+        const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
+        return resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir);
+    }
+    catch {
+        return false;
+    }
+}
+function checkLiveLock(cwd) {
+    const localOwner = runLockOwner(cwd);
+    if (localOwner?.live)
+        return localOwner;
+    try {
+        const gitDir = removeGit(cwd, ["rev-parse", "--git-dir"]).trim();
+        const gitCommonDir = removeGit(cwd, ["rev-parse", "--git-common-dir"]).trim();
+        if (resolve(cwd, gitDir) !== resolve(cwd, gitCommonDir)) {
+            const mainRepo = dirname(resolve(cwd, gitCommonDir));
+            const mainOwner = runLockOwner(mainRepo);
+            if (mainOwner?.live)
+                return mainOwner;
+        }
+    }
+    catch {
+        // not a git repo
+    }
+    return undefined;
+}
+/**
+ * Only git's discovery answer — exit 128, stderr `fatal: not a git repository (or any of the parent directories)` — means false.
+ * Every other failure (explicit bad GIT_DIR, invalid gitfile, permission, missing binary) refuses: unregistration could not be verified.
+ */
+function isGitRepo(cwd) {
+    try {
+        removeGit(cwd, ["rev-parse", "--is-inside-work-tree"]);
+        return true;
+    }
+    catch (err) {
+        const e = err;
+        const stderr = String(e.stderr ?? "").trim();
+        if (e.status === 128 && stderr.startsWith("fatal: not a git repository (or any of the parent directories)"))
+            return false;
+        throw new Error(`cannot remove: git repository probe failed: ${stderr || e.message || "unknown error"}`);
+    }
+}
+/** Runs git and throws `message` plus git's stderr on failure — a remove never proceeds past a failed step. */
+function git(cwd, args, message) {
+    try {
+        return removeGit(cwd, args);
+    }
+    catch (err) {
+        const stderr = String(err.stderr ?? "").trim();
+        throw new Error(stderr ? `${message}: ${stderr}` : message);
+    }
+}
+function registeredWorktrees(cwd, worktreesDir) {
+    const out = git(cwd, ["worktree", "list", "--porcelain"], "cannot remove: git worktree list failed");
+    return out
+        .split("\n")
+        .filter((line) => line.startsWith("worktree "))
+        .map((line) => line.slice("worktree ".length).trim())
+        .filter((wt) => isPathInside(worktreesDir, wt));
+}
+function handleRemove(cwd) {
+    const owner = checkLiveLock(cwd);
+    if (owner?.live) {
+        const holder = typeof owner.pid === "number" ? `live pid ${owner.pid}` : (owner.pid ?? "unreadable payload");
+        throw new Error(`cannot remove: graph.lock held by ${holder}`);
+    }
+    if (isLinkedWorktree(cwd)) {
+        throw new Error("cannot remove from inside a linked worktree");
+    }
+    const notes = [];
+    const stateDir = join(cwd, stateDirName(cwd));
+    const worktreesDir = join(stateDir, WORKTREES_DIR);
+    // 1. Unregister every git worktree under stateDir/WORKTREES_DIR, and prove it, before deleting anything
+    if (isGitRepo(cwd)) {
+        for (const wt of registeredWorktrees(cwd, worktreesDir)) {
+            // double --force: git refuses a locked worktree (present or already deleted) with a single one
+            git(cwd, ["worktree", "remove", "--force", "--force", wt], `cannot remove: failed to unregister worktree ${wt}`);
+        }
+        git(cwd, ["worktree", "prune"], "cannot remove: git worktree prune failed");
+        const left = registeredWorktrees(cwd, worktreesDir);
+        if (left.length > 0) {
+            throw new Error(`cannot remove: worktrees still registered: ${left.join(", ")}`);
+        }
+    }
+    // 2. Delete .tickmarkr state directory
+    if (existsSync(stateDir)) {
+        rmSync(stateDir, { recursive: true, force: true });
+        notes.push(`deleted state directory ${stateDir}`);
+    }
+    // 3. Delete shipped skill directories at every host location
+    const targetSkillDirs = [
+        join(cwd, ".agents", "skills"),
+        join(cwd, ".claude", "skills"),
+    ];
+    for (const dir of targetSkillDirs) {
+        for (const skill of AGENT_SKILLS) {
+            const skillPath = join(dir, skill);
+            if (existsSync(skillPath)) {
+                rmSync(skillPath, { recursive: true, force: true });
+                notes.push(`deleted skill ${skillPath}`);
+            }
+        }
+    }
+    // 4. Delete marker-bounded guidance block in AGENTS.md and CLAUDE.md leaving every byte outside identical
+    const marked = new RegExp(`<!-- (?:tickmarkr|${LEGACY_PREFIX}):agent-docs begin -->[\\s\\S]*?`
+        + `<!-- (?:tickmarkr|${LEGACY_PREFIX}):agent-docs end -->`);
+    for (const doc of ["AGENTS.md", "CLAUDE.md"]) {
+        const docPath = join(cwd, doc);
+        if (existsSync(docPath)) {
+            const current = readFileSync(docPath, "utf8");
+            const m = current.match(marked);
+            if (m && m.index !== undefined) {
+                const before = current.slice(0, m.index);
+                const after = current.slice(m.index + m[0].length);
+                writeFileSync(docPath, before + after);
+                notes.push(`removed guidance block from ${docPath}`);
+            }
+        }
+    }
+    // 5. Delete scaffold spec only while it still equals the shipped template
+    const specPath = join(cwd, SCAFFOLD_SPEC);
+    if (existsSync(specPath)) {
+        const currentSpec = readFileSync(specPath, "utf8");
+        if (currentSpec === specTemplate()) {
+            rmSync(specPath, { force: true });
+            notes.push(`deleted scaffold spec ${specPath}`);
+        }
+        else {
+            notes.push(`kept edited spec ${specPath}`);
+        }
+    }
+    // 6. Query and print remaining branches and preserved refs
+    let branches = [];
+    try {
+        const out = removeGit(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/tickmarkr/"]);
+        branches = out.split("\n").map((b) => b.trim()).filter(Boolean);
+    }
+    catch {
+        // ignore
+    }
+    let preservedRefs = [];
+    try {
+        const out = removeGit(cwd, ["for-each-ref", "--format=%(refname)", "refs/tickmarkr/preserved/"]);
+        preservedRefs = out.split("\n").map((r) => r.trim()).filter(Boolean);
+    }
+    catch {
+        // ignore
+    }
+    for (const b of branches) {
+        notes.push(`left branch: ${b}`);
+    }
+    for (const r of preservedRefs) {
+        notes.push(`left ref: ${r}`);
+    }
+    return notes.join("\n");
+}
 export async function init(argv, cwd = process.cwd(), io = {}) {
     let bannerEmitted = false;
     const emitBanner = () => {
@@ -348,6 +534,8 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
             process.stdout.write(BANNER);
         }
     };
+    // banner at START on the visual surface — every init path, not just the wizard, and never trailing the probe (operator report 2026-07-17)
+    emitBanner();
     const { values } = parseArgs({
         args: argv,
         options: {
@@ -357,13 +545,15 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
             docs: { type: "boolean" },
             fresh: { type: "boolean" },
             yes: { type: "boolean" },
+            remove: { type: "boolean" },
         },
     });
-    // banner at START on the visual surface — every init path, not just the wizard, and never trailing the probe (operator report 2026-07-17)
-    emitBanner();
     if (packageName(cwd) === "tickmarkr") {
         throw new Error("OBS-584: tickmarkr init refuses to run inside the tickmarkr source repository");
     }
+    if (values.remove) {
+        return handleRemove(cwd);
+    }
     const gdir = values["global-dir"] ?? globalConfigDir();
     mkdirSync(gdir, { recursive: true });
     const notes = [];

package/dist/cli/commands/resume.js

@@ -1,6 +1,6 @@
 import { parseArgs } from "node:util";
 import { loadConfig } from "../../config/config.js";
-import { parseDriverOverride, pickDriver } from "../../drivers/index.js";
+import { classifyHost, parseDriverOverride, pickDriver, preflightHostDriver } from "../../drivers/index.js";
 import { loadGraph } from "../../graph/graph.js";
 import { formatSummary, runDaemon } from "../../run/daemon.js";
 import { denyPreferCollisionLine, denyPreferCollisions } from "../../route/preference.js";
@@ -38,6 +38,8 @@ export async function resume(argv, cwd = process.cwd()) {
         throw new Error(collisions.map(denyPreferCollisionLine).join("; "));
     }
     await assertRefsWritable(cwd, "resume");
+    const host = classifyHost();
+    preflightHostDriver(cfg, driverOverride, host);
     const narrate = narrationSink(runId);
     const s = await runDaemon(cwd, {
         runId,
@@ -45,7 +47,7 @@ export async function resume(argv, cwd = process.cwd()) {
         graphChanged,
         retryFailed,
         // bound to the same sink the daemon gets, so a driver-journaled recovery reaches this rail too
-        driver: bindNarration(pickDriver(cfg, driverOverride), narrate),
+        driver: bindNarration(pickDriver(cfg, driverOverride, host), narrate),
         // v1.99 T2: the ONE narration sink — the quiet rail on a TTY, the raw journal formatter on a
         // pipe. A resumed run meets the same surface a fresh one does; printing the raw formatter here
         // would leave `resume` as the last place the old unfiltered dump survives. Bound to the run id

package/dist/cli/commands/run.js

@@ -1,7 +1,7 @@
 import { parseArgs } from "node:util";
 import { allAdapters, discoverChannels, probeAll, readDoctor } from "../../adapters/registry.js";
 import { ROUTING_MODES } from "../../config/config.js";
-import { parseDriverOverride, pickDriver } from "../../drivers/index.js";
+import { classifyHost, parseDriverOverride, pickDriver, preflightHostDriver } from "../../drivers/index.js";
 import { loadGraph, onDiskSpecHash, readCompileRefusal } from "../../graph/graph.js";
 import { formatSummary, resolveRunMode, runDaemon } from "../../run/daemon.js";
 import { isRunLockLive } from "../../run/lock.js";
@@ -106,6 +106,7 @@ export const RAIL_ROWS = {
     "gate-fingerprint-cap": { label: "repeat capped", tone: "attention" },
     // a scope red every collateral prediction already named: the daemon parks the task WITHOUT
     // charging an attempt, which is the most consequential unchargeable decision it makes
+    "scope-request": { label: "scope requested", tone: "attention" },
     "scope-authoring": { label: "authoring defect", tone: "attention" },
     "session-reset": { label: "session reset", tone: "attention" },
     "worker-mode-fallback": { label: "dispatch mode", tone: "attention" },
@@ -131,6 +132,9 @@ export const RAIL_ROWS = {
     "phase-start": { label: "gate start", tone: "active" },
     "gate-result": { label: "gate", tone: "pass" },
     "baseline-wait": { label: "baseline wait", tone: "active" },
+    "suite-wait": { label: "suite wait", tone: "active" },
+    "suite-wait-ceiling": { label: "suite wait ceiling", tone: "attention" },
+    "worker-reaped-before-harvest": { label: "worker reaped", tone: "attention" },
     "suite-budget": { label: "suite budget", tone: "attention" },
     "gate-replayed": { label: "gate replayed", tone: "attention" },
     "gate-reused": { label: "gate reused", tone: "neutral" },
@@ -320,6 +324,7 @@ const RAIL_PROJECTION = {
         ? `to ${d.chosen}${typeof d.static === "string" ? ` over ${d.static}` : ""}`
         : undefined,
     // both rehash hashes: the ladder reaches `from` (null on an unbound journal) and never `to`
+    "scope-request": (d) => Array.isArray(d.paths) ? `files[]: ${d.paths.join(", ")}` : undefined,
     "graph-rehash": (d) => (typeof d.to === "string" ? `to ${d.to.slice(0, 12)}` : undefined),
     "repair-dispatch": (d) => typeof d.diffBytes === "number" ? `diff ${d.diffBytes}B${d.capped === true ? ", capped" : ""}` : undefined,
     "tip-moved": (d) => typeof d.gatedCommit === "string" && typeof d.branchTip === "string"
@@ -328,6 +333,8 @@ const RAIL_PROJECTION = {
     "trust-auto-answer": (d) => typeof d.adapter === "string" ? `${d.adapter}${typeof d.phase === "string" ? ` ${d.phase}` : ""}` : undefined,
     // SB-1: the census the ceiling released beside, and the budget the round ran under versus the one it
     // would have had on an empty census — none of `{count, occupancyCap, conservativeCap}` is on the ladder
+    "suite-wait": (d) => typeof d.count === "number" ? `waiting for ${d.count} command(s)` : undefined,
+    "suite-wait-ceiling": (d) => typeof d.count === "number" ? `${d.count} still live after ${d.waitedMs}ms` : undefined,
     "suite-budget": (d) => typeof d.count === "number" && typeof d.conservativeCap === "number" && typeof d.occupancyCap === "number"
         ? `beside ${d.count}, cap ${d.conservativeCap} not ${d.occupancyCap}`
         : undefined,
@@ -503,6 +510,8 @@ export async function run(argv, cwd = process.cwd()) {
                 throw new Error(`--route-strict: routing lints present, refusing to dispatch:\n${lints.join("\n")}`);
         }
         await assertRefsWritable(cwd, "run");
+        const host = classifyHost();
+        preflightHostDriver(cfg, driverOverride, host);
         // The run id is minted HERE rather than inside the daemon, because the narration sink has to know
         // which run it is narrating before the first event arrives (the daemon's `narrate` callback is
         // handed an event and nothing else, and `run-start` carries no run id). `runDaemon` uses the id
@@ -512,7 +521,7 @@ export async function run(argv, cwd = process.cwd()) {
         const s = await runDaemon(cwd, {
             runId,
             concurrency: values.concurrency ? Number(values.concurrency) : undefined,
-            driver: bindNarration(pickDriver(cfg, driverOverride), narrate),
+            driver: bindNarration(pickDriver(cfg, driverOverride, host), narrate),
             mode: flagMode,
             supersedes: values.supersedes,
             narrate,

package/dist/cli/commands/verify.js

@@ -306,7 +306,7 @@ export async function verify(argv, cwd = process.cwd()) {
         worktree: cwd, baseRef: mergeBase,
         result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
         author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
-        pipeline: "v185", artifactDir,
+        pipeline: "v185", verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
         onGate: (e) => {
             if (e.phase === "start")
                 console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);

package/dist/cli/help.d.ts

@@ -15,6 +15,7 @@ export declare const COMMAND_HELP: {
             "--docs": string;
             "--fresh": string;
             "--yes": string;
+            "--remove": string;
         };
         examples: string[];
     };
@@ -160,6 +161,7 @@ export declare const COMMAND_HELP: {
         usage: string;
         description: string;
         options: {
+            "--files <glob,\u2026>": string;
             "--by <name>": string;
             "--reason <text>": string;
             "--waive": string;

package/dist/cli/help.js

@@ -10,7 +10,8 @@ export const COMMAND_HELP = {
             "--docs": "Include agent guidance documents with --agent.",
             "--fresh": "Force fresh adapter probes instead of reusing recent health.",
             "--yes": "Skip the interactive setup wizard and use defaults.",
-        }, examples: ["init --yes", "init --agent --force --docs"],
+            "--remove": "Reverse init without scaffolding: delete state, skills, docs block, unedited spec, and prune worktrees.",
+        }, examples: ["init --yes", "init --agent --force --docs", "init --remove"],
     },
     doctor: {
         usage: "doctor [options]", description: "Probe configured adapters and models and print diagnostics. Default probing may make model calls and refresh a stale catalog.",
@@ -128,6 +129,7 @@ export const COMMAND_HELP = {
     approve: {
         usage: "approve <run-id> <task-id> [options]", description: "Append a validated park decision. A running owner may enact it; a closed run requires a separate resume. Decisions cannot be undone.",
         options: {
+            "--files <glob,…>": "Extend files[] for a scope-request park with comma-separated repository-relative globs; required for scope approval.",
             "--by <name>": "Name the actor (default: current OS user).",
             "--reason <text>": "Record the decision reason.",
             "--waive": "Waive only the identified failed gate.",

package/dist/config/config.d.ts

@@ -364,24 +364,30 @@ export type FleetTierAssignment = {
 export type FleetEditable = {
     denyAdapters: string[];
     denyModels: string[];
+    denyWorkersAdapters?: string[];
+    denyWorkersModels?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;
 };
 export declare function repoOverlayPath(repoRoot: string): string;
 export declare function readOverlayFile(path: string): Record<string, unknown>;
+/** A discovered fleet universe row: the served models of one adapter and, per model, the resolved
+ * identity doctor recorded for a floating alias (LEG2-T3 round 2 finding 3). */
+export type FleetUniverseRow = {
+    adapter: string;
+    models: string[];
+    identities?: Record<string, string>;
+};
+/** Does a deny/allow entry name this universe channel? Grammar A1 (adapter id, bare model id,
+ * adapter:model) plus the recorded identity (bare or adapter:identity) — the collector's authority. */
+export declare function universeEntryMatches(row: FleetUniverseRow, model: string, entry: string): boolean;
 /** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
  * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
  * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
  * membership state and must survive a membership write verbatim, never be re-derived away. */
-export declare function universeCovers(universe: {
-    adapter: string;
-    models: string[];
-}[], entry: string): boolean;
-export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: {
-    adapter: string;
-    models: string[];
-}[]): FleetEditable;
+export declare function universeCovers(universe: FleetUniverseRow[], entry: string): boolean;
+export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?: FleetUniverseRow[]): FleetEditable;
 /** Resolve which layer last set a dotted fleet path (defaults < global < repo). */
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -887,6 +887,14 @@ export function readOverlayFile(path) {
         throw new ConfigError(`invalid overlay at ${path}`);
     return raw;
 }
+/** Does a deny/allow entry name this universe channel? Grammar A1 (adapter id, bare model id,
+ * adapter:model) plus the recorded identity (bare or adapter:identity) — the collector's authority. */
+export function universeEntryMatches(row, model, entry) {
+    if (entry === row.adapter || entry === model || entry === `${row.adapter}:${model}`)
+        return true;
+    const identity = row.identities?.[model];
+    return identity !== undefined && (entry === identity || entry === `${row.adapter}:${identity}`);
+}
 /** Grammar A1 membership test: does any discovered universe row cover this deny/allow entry
  * (adapter id, bare model id, or adapter:model)? Uncovered entries name channels the probe
  * did not serve this session (failed auth, rate limit, retired sku) — they are NOT editable
@@ -895,9 +903,11 @@ export function universeCovers(universe, entry) {
     return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
 }
 // v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
-// the EFFECTIVE out-of-fleet complement — anything routing.allow does not admit (fail-closed) UNION
-// routing.deny adapters/models scopes (never workers). Absent universe ⇒ deny arrays verbatim, so
-// non-UI callers stay byte-identical.
+// the EFFECTIVE out-of-fleet set — the routing.allow complement (fail-closed) as adapter ids and
+// adapter:model keys, UNION every authored routing.deny adapters/models entry VERBATIM in its own list
+// (never workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership
+// key, so one Space press clears one reason; finding 3: allow admission honours recorded identity.
+// Absent universe ⇒ deny arrays verbatim, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
@@ -909,43 +919,32 @@ export function fleetEditableFromConfig(cfg, universe) {
     let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
     let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
     if (universe !== undefined) {
-        const { allow, deny } = cfg.routing;
-        // Grammar A1 (disallowedBy precedent): entries match adapter id, bare model id, or adapter:model.
-        // Inlined rather than imported — route/preference.ts imports this module.
-        const denyEntries = [...(deny?.adapters ?? []), ...(deny?.models ?? [])];
+        const { allow } = cfg.routing;
         const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
-        const outOfFleet = (adapter, model) => {
-            const matches = (e) => e === adapter || e === model || e === `${adapter}:${model}`;
-            if (denyEntries.some(matches))
-                return true;
-            return allowEntries !== null && !allowEntries.some(matches);
-        };
+        const notAdmitted = (row, model) => allowEntries !== null && !allowEntries.some((entry) => universeEntryMatches(row, model, entry));
         const adaptersOut = [];
         const modelsOut = [];
         for (const row of universe) {
-            const out = row.models.filter((m) => outOfFleet(row.adapter, m));
-            if (row.models.length ? out.length === row.models.length : outOfFleet(row.adapter, "")) {
+            const out = row.models.filter((m) => notAdmitted(row, m));
+            if (row.models.length ? out.length === row.models.length : notAdmitted(row, "")) {
                 adaptersOut.push(row.adapter);
             }
             else {
                 modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
             }
         }
-        // OBS-517: deny entries the probe universe does not cover (failed/rate-limited probes drop the
-        // channel from discoverChannels) are preserved VERBATIM — deriving membership purely from the
-        // universe silently un-denied them on the next write (fail-open on the operator's own ban list).
-        denyAdapters = [...new Set([
-                ...adaptersOut,
-                ...(deny?.adapters ?? []).filter((e) => !universeCovers(universe, e)),
-            ])].sort();
-        denyModels = [...new Set([
-                ...modelsOut,
-                ...(deny?.models ?? []).filter((e) => !universeCovers(universe, e)),
-            ])].sort();
+        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim, so a
+        // transient probe failure can never un-deny one on the next write (fail-open on the ban list).
+        denyAdapters = [...new Set([...adaptersOut, ...denyAdapters])].sort();
+        denyModels = [...new Set([...modelsOut, ...denyModels])].sort();
     }
     return {
         denyAdapters,
         denyModels,
+        // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
+        // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
+        denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),
+        denyWorkersModels: [...(cfg.routing.deny?.workers?.models ?? [])].sort(),
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
@@ -988,6 +987,10 @@ export function formatFleetPrint(repoRoot, opts = {}) {
         annotate(["routing", "deny", "adapters"]);
     if (effective.routing.deny?.models !== undefined)
         annotate(["routing", "deny", "models"]);
+    if (effective.routing.deny?.workers?.adapters !== undefined)
+        annotate(["routing", "deny", "workers", "adapters"]);
+    if (effective.routing.deny?.workers?.models !== undefined)
+        annotate(["routing", "deny", "workers", "models"]);
     for (const shape of Object.keys(effective.routing.map))
         annotate(["routing", "map", shape]);
     annotate(["routing", "floors"]);

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import { type FleetEditable, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 export type FleetOverlayWrite = {
@@ -19,10 +19,7 @@ export type FleetOverlayWrite = {
             consult?: string[];
         };
     };
-    universe?: {
-        adapter: string;
-        models: string[];
-    }[];
+    universe?: FleetUniverseRow[];
 };
 export type FleetFirstTouch = {
     vendor: string;
@@ -33,10 +30,7 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
-export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: {
-    adapter: string;
-    models: string[];
-}[]): Record<string, unknown>;
+export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: FleetUniverseRow[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;