tickmarkr 2.5.5 → 2.5.7

package/dist/cli/commands/verify.js

@@ -6,13 +6,15 @@ import { parseArgs } from "node:util";
 import { allAdapters, probeAll, readDoctor, rolePools } from "../../adapters/registry.js";
 import { channelKey } from "../../adapters/types.js";
 import { loadConfig } from "../../config/config.js";
-import { captureBaseline, detectGateCommands } from "../../gates/baseline.js";
+import { captureBaseline, detectGateCommands, staleFileCountCommands } from "../../gates/baseline.js";
 import { modelProvider } from "../../gates/review.js";
 import { runGates } from "../../gates/run-gates.js";
 import { getTask, loadGraph } from "../../graph/graph.js";
 import { GATE_NAMES } from "../../graph/schema.js";
+import { executionSignal } from "../../run/execution-budget.js";
 import { linkNodeModules, removeWorktree, shGit, shGitOk } from "../../run/git.js";
 import { Journal } from "../../run/journal.js";
+import { withRepositoryLease } from "../../run/lease.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -148,10 +150,12 @@ export async function verify(argv, cwd = process.cwd()) {
         allowPositionals: false,
     });
     const stateRoot = await verifyStateRoot(cwd);
+    const fileRoot = (file) => existsSync(join(cwd, ".tickmarkr", file)) ? cwd : stateRoot;
     if (resolve(stateRoot) !== resolve(cwd)) {
-        console.error(`verify: state files graph.json, doctor.json and config.yaml resolved read-only from ${join(stateRoot, ".tickmarkr")} (linked worktree)`);
+        console.error(`verify: state files resolved read-only from ${join(stateRoot, ".tickmarkr")} (linked worktree; per-file origins: `
+            + STATE_FILES.map(file => `${file}: ${join(fileRoot(file), ".tickmarkr", file)} (${fileRoot(file) === cwd ? "local" : "common root"})`).join("; ") + ")");
     }
-    const cfg = loadConfig(stateRoot);
+    const cfg = loadConfig(fileRoot("config.yaml"));
     const head = (await shGitOk("git rev-parse HEAD", cwd)).trim();
     const baseTip = (await shGitOk(`git rev-parse '${values.base}'`, cwd).catch(() => {
         throw new Error(`--base ${values.base} is not a resolvable ref — pass --base <ref> naming the branch this diff targets`);
@@ -165,7 +169,7 @@ export async function verify(argv, cwd = process.cwd()) {
     let files = values.files ?? [];
     let goal = `independent verification of the ${values.base}..HEAD diff`;
     if (values.task) {
-        const t = getTask(loadGraph(stateRoot), values.task);
+        const t = getTask(loadGraph(fileRoot("graph.json")), values.task);
         acceptance = t.acceptance;
         if (!files.length)
             files = t.files;
@@ -221,7 +225,7 @@ export async function verify(argv, cwd = process.cwd()) {
     let author = HUMAN_AUTHOR;
     const adapters = allAdapters();
     if (wantAcceptance || wantReview) {
-        const health = readDoctor(stateRoot) ?? (await probeAll(adapters));
+        const health = readDoctor(fileRoot("doctor.json")) ?? (await probeAll(adapters));
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
@@ -249,95 +253,114 @@ export async function verify(argv, cwd = process.cwd()) {
     // ponytail: tmpdir means the baseline cache dies on reboot/cleanup — worst case is one re-capture.
     const stateDir = verifyStateDir(cwd);
     mkdirSync(stateDir, { recursive: true });
-    let baseline;
-    const cachePath = baselineCachePath(cwd, mergeBase, commands);
-    const verdictlessMarker = `${cachePath}.verdictless`;
-    mkdirSync(dirname(cachePath), { recursive: true });
-    if (values.baseline) {
-        baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
-    }
-    else {
-        let cached;
-        if (existsSync(cachePath)) {
-            cached = JSON.parse(readFileSync(cachePath, "utf8"));
-            const missing = verdictlessCommands(cached, commands);
-            if (missing.length) {
-                console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
-                rmSync(cachePath, { force: true });
-                cached = undefined;
-            }
-        }
-        if (cached) {
-            console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
-            baseline = cached;
+    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
+    // OBS-1042: one runner root per repository across every linked worktree — the capture and the
+    // battery below run under a reservation keyed on the common git dir, and a waiter says who holds it.
+    return withRepositoryLease(cwd, () => leasedVerify(), {
+        signal: executionSignal(),
+        onWait: (holder) => {
+            console.error(`verify: waiting for the repository's runner lease held by pid ${holder.pid} in ${holder.cwd}`);
+            recordJournal?.append("suite-wait", values.task ?? "VERIFY", { holderPid: holder.pid, holderCwd: holder.cwd });
+        },
+    });
+    async function leasedVerify() {
+        let baseline;
+        const cachePath = baselineCachePath(cwd, mergeBase, commands);
+        const verdictlessMarker = `${cachePath}.verdictless`;
+        mkdirSync(dirname(cachePath), { recursive: true });
+        if (values.baseline) {
+            baseline = JSON.parse(readFileSync(values.baseline, "utf8"));
         }
         else {
-            if (existsSync(verdictlessMarker)) {
-                console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
-            }
-            else {
-                console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
-            }
-            const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
-            await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
-            await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
-            try {
-                linkNodeModules(cwd, baseDir, { force: true });
-                baseline = await captureBaseline(baseDir, commands);
-                const missing = verdictlessCommands(baseline, commands);
+            let cached;
+            if (existsSync(cachePath)) {
+                cached = JSON.parse(readFileSync(cachePath, "utf8"));
+                const missing = verdictlessCommands(cached, commands);
                 if (missing.length) {
-                    writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                    console.error(`verify: cached baseline recorded no verdict for ${missing.join(", ")}; it was not reusable and will be recaptured`);
                     rmSync(cachePath, { force: true });
+                    cached = undefined;
                 }
-                else {
-                    writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
-                    rmSync(verdictlessMarker, { force: true });
+                // OBS-1044: a cached vitest count that is a stdout sum may be inflated by nested runner echo;
+                // applying it would manufacture a deficit. Only a manifest-derived count is a floor.
+                const stale = cached ? staleFileCountCommands(cached, commands, cwd) : [];
+                if (stale.length) {
+                    console.error(`verify: cached baseline's file count for ${stale.join(", ")} is not manifest-derived; it will be recaptured`);
+                    rmSync(cachePath, { force: true });
+                    cached = undefined;
                 }
             }
-            finally {
-                await removeWorktree(cwd, baseDir);
+            if (cached) {
+                console.error(`verify: reusing cached baseline for ${mergeBase.slice(0, 12)} (${cachePath})`);
+                baseline = cached;
+            }
+            else {
+                if (existsSync(verdictlessMarker)) {
+                    console.error(`verify: prior baseline recorded no verdict and was not cached; recapturing merge-base ${mergeBase.slice(0, 12)}`);
+                }
+                else {
+                    console.error(`verify: capturing baseline at merge-base ${mergeBase.slice(0, 12)} (cached by base, lockfile and command hashes at ${cachePath})`);
+                }
+                const baseDir = join(stateDir, `base-${mergeBase.slice(0, 12)}`);
+                await shGit(`git worktree remove --force '${baseDir}'`, cwd); // stale leftover from an interrupted run
+                await shGitOk(`git worktree add --detach '${baseDir}' '${mergeBase}'`, cwd);
+                try {
+                    linkNodeModules(cwd, baseDir, { force: true });
+                    baseline = await captureBaseline(baseDir, commands);
+                    const missing = verdictlessCommands(baseline, commands);
+                    if (missing.length) {
+                        writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");
+                        rmSync(cachePath, { force: true });
+                    }
+                    else {
+                        writeFileSync(cachePath, JSON.stringify(baseline, null, 2));
+                        rmSync(verdictlessMarker, { force: true });
+                    }
+                }
+                finally {
+                    await removeWorktree(cwd, baseDir);
+                }
             }
         }
-    }
-    const recordJournal = values.record ? Journal.open(stateRoot, values.record) : undefined;
-    const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
-    mkdirSync(artifactDir, { recursive: true });
-    const { results } = await runGates(task, {
-        worktree: cwd, baseRef: mergeBase,
-        result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
-        author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
-        pipeline: "v185", verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
-        onGate: (e) => {
-            if (e.phase === "start")
-                console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
-            else if (e.phase === "note")
-                console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
-            else
-                console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
-        },
-    });
-    const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
-    const reviewRows = results.filter((result) => result.gate === "review");
-    const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
-        const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
-        return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
-    }));
-    const artifactPath = join(artifactDir, "verify-results.json");
-    writeFileSync(artifactPath, JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
-    console.error(`verify: artifacts written to ${artifactPath}`);
-    const review = reviewRows.at(-1);
-    if (recordJournal && review) {
-        recordJournal.append("review-leg2", values.task ?? "VERIFY", {
-            base: baseTip, head, mergeBase, author: channelKey(author), artifactPath,
-            ...review,
+        const artifactDir = join(stateDir, new Date().toISOString().replace(/[:.]/g, "-"));
+        mkdirSync(artifactDir, { recursive: true });
+        const { results } = await runGates(task, {
+            worktree: cwd, baseRef: mergeBase,
+            result: { ok: true, summary: "standalone verify — no worker claims to trust", deviations: [], raw: "" },
+            author, commands, baseline, channels, ...(judgeChannels ? { judgeChannels } : {}), adapters, cfg,
+            verificationScope: "standalone", artifactDir, stateDir: join(stateRoot, ".tickmarkr"),
+            onGate: (e) => {
+                if (e.phase === "start")
+                    console.error(`verify: → ${e.gate} (${e.index}/${e.total})`);
+                else if (e.phase === "note")
+                    console.error(`verify: note ${e.gate} ${e.name} ${JSON.stringify(e.payload)}`);
+                else
+                    console.error(`verify: ${e.result.pass ? "✓" : "✗"} ${e.result.gate} — ${e.result.details.split("\n")[0] ?? ""}`);
+            },
         });
+        const green = results.length > 0 && results.every((r) => r.pass || r.meta?.skipped === true);
+        const reviewRows = results.filter((result) => result.gate === "review");
+        const reviewFindings = reviewRows.flatMap((result) => result.details.split("\n").flatMap((line) => {
+            const match = /^- \[([^\]]+)\] (.*)$/.exec(line);
+            return match ? [{ classification: match[1], note: match[2], reviewer: result.meta?.reviewer }] : [];
+        }));
+        const artifactPath = join(artifactDir, "verify-results.json");
+        writeFileSync(artifactPath, JSON.stringify({ base: baseTip, head, mergeBase, green, gateRows: results, reviewFindings }, null, 2) + "\n");
+        console.error(`verify: artifacts written to ${artifactPath}`);
+        const review = reviewRows.at(-1);
+        if (recordJournal && review) {
+            recordJournal.append("review-leg2", values.task ?? "VERIFY", {
+                base: baseTip, head, mergeBase, author: channelKey(author), artifactPath,
+                ...review,
+            });
+        }
+        if (values.json) {
+            return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, results }, null, 2), code: green ? 0 : 2 };
+        }
+        const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
+        const verdict = green
+            ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
+            : `verify RED — first failure decides; artifacts: ${artifactPath}`;
+        return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
     }
-    if (values.json) {
-        return { out: JSON.stringify({ base: baseTip, head, mergeBase, green, artifactPath, results }, null, 2), code: green ? 0 : 2 };
-    }
-    const lines = results.map((r) => `${r.pass ? "PASS" : "FAIL"} ${r.gate}\n${r.details.split("\n").map((l) => `  ${l}`).join("\n")}`);
-    const verdict = green
-        ? `verify GREEN — ${results.length} gate(s) passed on ${mergeBase.slice(0, 12)}..${head.slice(0, 12)} (merge is a human decision; artifacts: ${artifactPath})`
-        : `verify RED — first failure decides; artifacts: ${artifactPath}`;
-    return { out: [...lines, "", verdict].join("\n"), code: green ? 0 : 2 };
 }

package/dist/config/config.d.ts

@@ -132,7 +132,17 @@ export declare function effectiveReviewPolicy(files: ReadonlyArray<string>, revi
  * under-flagged one skips the only gate that exists for it.
  */
 export declare function criticalPathHits(files: ReadonlyArray<string>, criticalPaths?: ReadonlyArray<string>): string[];
+export declare const ExecutionPolicySchema: z.ZodObject<{
+    boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
+    repairSelection: z.ZodDefault<z.ZodBoolean>;
+    taskExecutionLimitMs: z.ZodNumber;
+}, z.core.$strict>;
 export declare const TickmarkrConfigSchema: z.ZodObject<{
+    executionPolicy: z.ZodOptional<z.ZodObject<{
+        boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
+        repairSelection: z.ZodDefault<z.ZodBoolean>;
+        taskExecutionLimitMs: z.ZodNumber;
+    }, z.core.$strict>>;
     concurrency: z.ZodNumber;
     driver: z.ZodEnum<{
         auto: "auto";
@@ -366,6 +376,7 @@ export type FleetEditable = {
     denyModels: string[];
     denyWorkersAdapters?: string[];
     denyWorkersModels?: string[];
+    allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;
     floors: Record<string, Tier>;

package/dist/config/config.js

@@ -264,7 +264,14 @@ const ShapeGateParticipationSchema = z
         });
     }
 });
+export const ExecutionPolicySchema = z.object({
+    boundedInfrastructure: z.boolean().default(false),
+    repairSelection: z.boolean().default(false),
+    taskExecutionLimitMs: z.number().int().positive(),
+}).strict();
 export const TickmarkrConfigSchema = z.object({
+    // Opt-in recovery experiment. The original run snapshot owns this across resumes.
+    executionPolicy: ExecutionPolicySchema.optional(),
     concurrency: z.number().int().positive(),
     driver: z.enum(["auto", "herdr", "subprocess", "orca"]),
     integrationBranchPrefix: z
@@ -902,12 +909,13 @@ export function universeEntryMatches(row, model, entry) {
 export function universeCovers(universe, entry) {
     return universe.some((row) => entry === row.adapter || row.models.some((m) => entry === m || entry === `${row.adapter}:${m}`));
 }
-// v1.92 fleet membership: with a discovered `universe` (classified models only) the deny sets become
-// the EFFECTIVE out-of-fleet set — the routing.allow complement (fail-closed) as adapter ids and
-// adapter:model keys, UNION every authored routing.deny adapters/models entry VERBATIM in its own list
-// (never workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership
-// key, so one Space press clears one reason; finding 3: allow admission honours recorded identity.
-// Absent universe ⇒ deny arrays verbatim, so non-UI callers stay byte-identical.
+// v1.92 fleet membership: with a discovered `universe` (classified models only) the routing.allow
+// complement (fail-closed) rides as `allowOut` — adapter ids and adapter:model keys — BESIDE the
+// authored routing.deny adapters/models entries, which ride VERBATIM in their own lists (never
+// workers). LEG2-T3 round 2 finding 2: authored entries are never collapsed into a membership key;
+// OBS-1046: nor is an allow exclusion folded into a deny list — the two reasons stay distinct so
+// one Space press clears one; finding 3: allow admission honours recorded identity.
+// Absent universe ⇒ deny arrays verbatim and no allowOut, so non-UI callers stay byte-identical.
 export function fleetEditableFromConfig(cfg, universe) {
     const tiers = {};
     for (const [adapter, entry] of Object.entries(cfg.tiers)) {
@@ -916,8 +924,9 @@ export function fleetEditableFromConfig(cfg, universe) {
             tiers[adapter][model] = { tier };
         }
     }
-    let denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
-    let denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    const denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
+    const denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    let allowOut;
     if (universe !== undefined) {
         const { allow } = cfg.routing;
         const allowEntries = allow ? [...(allow.adapters ?? []), ...(allow.models ?? [])] : null;
@@ -933,14 +942,14 @@ export function fleetEditableFromConfig(cfg, universe) {
                 modelsOut.push(...out.map((m) => `${row.adapter}:${m}`));
             }
         }
-        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim, so a
-        // transient probe failure can never un-deny one on the next write (fail-open on the ban list).
-        denyAdapters = [...new Set([...adaptersOut, ...denyAdapters])].sort();
-        denyModels = [...new Set([...modelsOut, ...denyModels])].sort();
+        // OBS-517: authored deny entries — covered by the probe universe or not — ride verbatim (above),
+        // so a transient probe failure can never un-deny one on the next write (fail-open on the ban list).
+        allowOut = [...new Set([...adaptersOut, ...modelsOut])].sort();
     }
     return {
         denyAdapters,
         denyModels,
+        ...(allowOut !== undefined ? { allowOut } : {}),
         // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
         // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
         denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),

package/dist/config/fleet-overlay.js

@@ -23,7 +23,8 @@ function allowFormFromExclusions(universe, edited) {
     }
     // LEG2-T3 round 2 finding 1: every staged entry excludes what it NAMES — a bare model id every
     // adapter serving it, an identity its alias — never only an adapter id or an adapter:model key.
-    const entries = [...edited.denyAdapters, ...edited.denyModels];
+    // OBS-1046: the staged allow complement is a reason of its own, beside the authored deny lists.
+    const entries = [...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])];
     const adapters = [];
     const models = [];
     let excluded = false;
@@ -56,9 +57,12 @@ function residualDeny(universe, entries) {
 // list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
 // probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
 // session added ride the allow form alone.
-function flatDenyAfterWrite(doc, path, after, universe) {
+function authoredEntries(doc, path) {
     const node = doc.getIn(path, true);
-    const authored = isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    return isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+}
+function flatDenyAfterWrite(doc, path, after, universe) {
+    const authored = authoredEntries(doc, path);
     const canonical = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => entry === `${row.adapter}:${m}`));
     const kept = authored.filter((entry) => after.includes(entry));
     const verbatim = sortedUnique(after.filter((entry) => !kept.includes(entry)
@@ -183,9 +187,12 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     if (doc.errors.length)
         throw doc.errors[0];
     const { initial, edited } = write;
-    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
-    if (denyChanged) {
+    // OBS-1046: each flat scope (and the allow complement) is compared on its own — a scope the
+    // session never edited keeps its node byte for byte, whatever its sibling did.
+    const changed = (before = [], after = []) => sortedUnique(before).join() !== sortedUnique(after).join();
+    const adaptersChanged = changed(initial.denyAdapters, edited.denyAdapters);
+    const modelsChanged = changed(initial.denyModels, edited.denyModels);
+    if (adaptersChanged || modelsChanged || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
@@ -215,18 +222,44 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 // Whole fleet in: no restriction to express — the allow block goes away entirely.
                 deleteAt(doc, ["routing", "allow"]);
             }
-            // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2); a
-            // list left with nothing is tombstoned so a lower layer can never re-exclude behind the
-            // operator's back (workers untouched).
-            for (const [scope, after] of [["adapters", edited.denyAdapters], ["models", edited.denyModels]]) {
+            // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2).
+            // OBS-1046: only an EDITED scope is rewritten, and only when its bytes must change — an
+            // addition the allow form carries leaves the list (an explicit `[]` included) untouched; a
+            // scope the press CLEARED down to nothing is tombstoned so a lower layer can never
+            // re-exclude behind the operator's back (workers untouched).
+            // LEG2-T3 finding 4: an authored entry the edit admits (staged nowhere any more) must go
+            // even from a scope whose own set did not change, or the admitted channel stays excluded
+            // behind the preserved bytes.
+            const stagedAfter = new Set([...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])]);
+            const admitted = [...initial.denyAdapters, ...initial.denyModels, ...(initial.allowOut ?? [])]
+                .filter((entry) => !stagedAfter.has(entry));
+            const scopes = [
+                ["adapters", initial.denyAdapters, edited.denyAdapters, adaptersChanged],
+                ["models", initial.denyModels, edited.denyModels, modelsChanged],
+            ];
+            for (const [scope, before, after, touched] of scopes) {
                 const path = ["routing", "deny", scope];
+                const authored = authoredEntries(doc, path);
+                const stale = authored.some((entry) => admitted.includes(entry));
+                if (!touched && !stale)
+                    continue;
                 const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
-                setStringSequencePreservingComments(doc, path, remaining.length ? remaining : null);
+                if (remaining.length) {
+                    if (remaining.join("\n") !== authored.join("\n"))
+                        setStringSequencePreservingComments(doc, path, remaining);
+                }
+                else if (stale || before.some((entry) => !after.includes(entry))) {
+                    setStringSequencePreservingComments(doc, path, null);
+                }
             }
         }
         else {
-            setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
-            setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+            if (adaptersChanged) {
+                setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
+            }
+            if (modelsChanged) {
+                setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+            }
         }
     }
     // OBS-994/FL-1: routing.deny.workers is a literal deny list, never a universe-derived
@@ -360,15 +393,19 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // operator reviews. commentString has no position context, but this writer owns the document:
     // scalar-trailing single-line comments (the only inline form fleet emits) are marked with a
     // private-use sentinel (the FIRST_TOUCH envelope precedent above), everything else renders
-    // byte-identical to yaml's own stringifyComment.
+    // byte-identical to yaml's own stringifyComment. OBS-1046: a scalar parsed from the prior bytes
+    // keeps the exact whitespace it had before its hash sign (yaml itself emits one space, so the
+    // sentinel carries the rest); only a comment fleet authored gets the two-space style.
     visit(doc, (_key, node) => {
         if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
-            node.comment = `${INLINE_COMMENT_SENTINEL}${node.comment}`;
+            const tail = node.range ? priorBytes.slice(node.range[1], node.range[2]) : "";
+            const gap = /^([ \t]+)#/.exec(tail)?.[1] ?? "  ";
+            node.comment = `${INLINE_COMMENT_SENTINEL}${gap.slice(1)}#${node.comment}`;
         }
     });
     return doc.toString({
         commentString: (comment) => comment.startsWith(INLINE_COMMENT_SENTINEL)
-            ? ` #${comment.slice(1)}`
+            ? comment.slice(1)
             : comment.replace(/^(?!$)(?: $)?/gm, "#"),
         // OBS-518: yaml's default pads flow collections (`[kimi]` → `[ kimi ]`), churning untouched
         // lines on the one confirmation surface an operator reviews. Hand-written overlays use the
@@ -384,7 +421,8 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
     const routing = { ...out.routing };
     let routingTouched = false;
     const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join();
+        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join()
+        || sortedUnique(initial.allowOut ?? []).join() !== sortedUnique(edited.allowOut ?? []).join();
     if (denyChanged) {
         if (universe) {
             const form = allowFormFromExclusions(universe, edited);

package/dist/drivers/index.js

@@ -15,7 +15,8 @@ const hostByDriver = new WeakMap();
 export function classifyHost(env = process.env) {
     if (env.HERDR_ENV === "1")
         return "herdr";
-    if (env.TERM_PROGRAM === "Orca" && env.ORCA_TERMINAL_HANDLE !== undefined && env.ORCA_TERMINAL_HANDLE !== "")
+    // A whitespace-only handle is no handle: the narrator trims it and would refuse the split.
+    if (env.TERM_PROGRAM === "Orca" && (env.ORCA_TERMINAL_HANDLE ?? "").trim() !== "")
         return "orca";
     return "none";
 }

package/dist/drivers/orca.d.ts

@@ -124,19 +124,28 @@ export declare function mapAgentState(term: Record<string, unknown>, tuiIdle: bo
  * is proven gone. Everything else — a reservation or claim with no bound pane, a failed cleanup, a
  * record another driver holds with a live observer — refuses and keeps the record exactly as it is.
  */
+/** `placer` is the pid of the narrator that wrote the reservation: a reserved or claimed record is a
+ *  normal intermediate state while that pid lives (another driver awaiting listing or bind) and a
+ *  crash to recover only once it is dead. */
 type BoardRecord = WatchBoardOwner & {
     retired?: true;
     runtimeId?: string;
+    placer?: number;
 };
 /**
  * Whole-record compare-and-swap. The canonical path stays readable until commit: a mkdir lock
  * excludes other writers, then create-only `link`s the new inode (fails if anything exists) or
  * `rename`s the new file over the live path (POSIX atomic replace — readers see old or new, never
  * absence). A crash that leaves a `.tmp` or `.lock` does not drop the previous record.
+ * Each lock generation publishes its pid and nonce atomically in a symlink target. A holder that died
+ * between taking and releasing it is recovered at once (its lock is taken over in place); a live
+ * holder bounds the wait on injected time and is then refused with the record untouched. A legacy
+ * pid-less or malformed generation is recoverable too: a contender atomically creates the next owner
+ * generation, and release removes the directory only while that exact generation is still current.
  * ponytail: observeNamedRun (supervision.ts) renames without CAS. It cannot interleave with a swap
  * because the narrator writes nothing between reserve and claim, and no transition here swaps one.
  */
-export declare function casBoard(family: string, path: string, expected: string | undefined, next: BoardRecord): string;
+export declare function casBoard(family: string, path: string, expected: string | undefined, next: BoardRecord, time?: OrcaTimeSource): Promise<string>;
 /**
  * The renderer hard-wraps long lines, paints margin chrome, and a cursor page boundary splits a
  * marker exactly like a wrap does. `parseWorkerResult` (src/adapters/prompt.ts) already de-wraps
@@ -146,6 +155,8 @@ export declare function casBoard(family: string, path: string, expected: string
  * never depends on this.
  */
 export declare function joinWrapped(raw: string): string;
+/** The OBS-1011 add.1 capture: `status:"exited", tail:[], returnedLineCount 0` from a stream read. */
+export declare function isBlindStreamPage(term: Record<string, unknown>): boolean;
 export interface OrcaDriverOpts {
     bin?: string;
     env?: NodeJS.ProcessEnv | Record<string, string | undefined>;
@@ -242,6 +253,15 @@ export declare class OrcaDriver implements ExecutorDriver {
     private liveShowTerm;
     private tailText;
     private readPage;
+    /**
+     * OBS-1011 add.1 / OBS-1016: the captured incident shape — a stream page answering status exited
+     * with an empty tail on a terminal that accepted a send seconds earlier — is BLIND, not dead, when
+     * the same handle's show record on the same runtime reports connected and not orphaned (show carries
+     * no status field; none is demanded) and its screen read reports running. Then the rendered frame is
+     * the terminal's bytes. Anything less — disconnected, orphaned, another handle or runtime, a screen
+     * that is unavailable or exited — is refused as unavailable, exactly as the dead record would be.
+     */
+    private screenBehindBlindStream;
     /** A rendered-frame liveness read. `--screen` and `--cursor` are mutually exclusive in Orca. */
     private readScreen;
     /** A single UNPAGED tail read — exactly what the caller asked for and nothing more. Markers split