tickmarkr 2.5.7 → 2.5.9

package/dist/cli/help.d.ts

@@ -176,6 +176,8 @@ export declare const COMMAND_HELP: {
         description: string;
         options: {
             "--seat <identity>": string;
+            "--new-arm": string;
+            "--loop": string;
             "--arm-id <identity>": string;
             "--pct <0..100>": string;
             "--threshold-pct <0..100>": string;

package/dist/cli/help.js

@@ -140,14 +140,16 @@ export const COMMAND_HELP = {
     },
     beat: {
         usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",
-        description: "Write one supervision beat. The supervising seat's watcher loop repeats it; stopped beats become STALE.",
+        description: "Write one supervision beat using the recorded arm. Stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
         options: {
             "--seat <identity>": "Required: identify the supervising pane or agent.",
-            "--arm-id <identity>": "Identify this supervision arm.",
+            "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
+            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit within one interval after stand-down.",
+            "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
-            "--stand-down": "Record an explicit handoff and stand down this tier.",
-        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --stand-down"],
+            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
+        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down", "beat overseer --seat supervisor --new-arm"],
     },
     version: {
         usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",

package/dist/compile/native.js

@@ -69,7 +69,51 @@ const NESTED_RE = /^\s+- (.+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
 const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
-const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout"]);
+const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins"]);
+const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw : draft.list === "pins" ? draft.pinsRaw : draft.gates;
+// v2.5.8 T7: one declared pin item — "literal: <exact text> | glob: <search glob>" (split at the LAST
+// " | glob: " so the text may itself hold a bar) or "fixture: <path set>". A declaration missing the
+// payload its own kind requires refuses the compile naming the task and the item.
+const PIN_GLOB_SEP = "| glob:";
+// v2.5.8 T8 (OBS-1064): "test: <title> | suite: <path>" — split at the LAST " | suite: " so the title
+// stays the verbatim leaf the gate matches and the landing path never enters it.
+const LANDING_SEP = "| suite:";
+function parsePin(task, raw, index, pathSet) {
+    const bad = (detail) => invalid(task, "pins", `item ${index + 1} (${JSON.stringify(raw)}) ${detail}`);
+    const typed = raw.match(/^(\w+):\s*(.*)$/);
+    if (typed?.[1] === "fixture") {
+        const paths = pathSet(typed[2]);
+        if (!paths.length)
+            bad("is a fixture pin missing its path set");
+        return { kind: "fixture", paths };
+    }
+    if (typed?.[1] === "literal") {
+        const at = typed[2].lastIndexOf(PIN_GLOB_SEP);
+        const text = (at < 0 ? typed[2] : typed[2].slice(0, at)).trim();
+        const glob = at < 0 ? "" : typed[2].slice(at + PIN_GLOB_SEP.length).trim();
+        if (!text)
+            bad("is a literal pin missing its text");
+        if (!glob)
+            bad(`is a literal pin missing its search glob — write "literal: <text> ${PIN_GLOB_SEP} <glob>"`);
+        return { kind: "literal", text, glob };
+    }
+    return bad('must be "literal: <text> | glob: <glob>" or "fixture: <path set>"');
+}
+function parseTestOracle(task, body, index) {
+    const at = body.lastIndexOf(LANDING_SEP);
+    if (at < 0)
+        return { oracle: "test", test: body.trim() };
+    const test = body.slice(0, at).trim();
+    const landing = body.slice(at + LANDING_SEP.length).trim();
+    const bad = (detail) => invalid(task, "acceptance", `item ${index + 1} (${JSON.stringify(body)}) ${detail}`);
+    if (!test)
+        bad("is a test oracle missing its title before the landing");
+    if (!landing)
+        bad(`is a test oracle missing its landing path — write "test: <title> ${LANDING_SEP} <path>"`);
+    if (!picomatch(COLLECTABLE_TESTS, { dot: true })(landing))
+        bad(`declares landing ${JSON.stringify(landing)} which no runner collects (${COLLECTABLE_TESTS})`);
+    return { oracle: "test", test, landing };
+}
 function invalid(task, field, detail) {
     throw new CompileError(`Task ${task} field "${field}" ${detail}`);
 }
@@ -376,7 +420,7 @@ export function compileNative(file, options = {}) {
     for (const [index, line] of content.split("\n").entries()) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, list: null, itemOpen: false, continuationField: null });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, pinsRaw: [], list: null, itemOpen: false, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
@@ -411,7 +455,7 @@ export function compileNative(file, options = {}) {
                 invalid(draft.id, field[1], "is unknown");
             const value = field[2].trim();
             draft.itemOpen = false;
-            if (name === "acceptance" || name === "gates") {
+            if (name === "acceptance" || name === "gates" || name === "pins") {
                 if (value)
                     invalid(draft.id, field[1], "must be a nested list");
                 draft.list = name;
@@ -459,7 +503,7 @@ export function compileNative(file, options = {}) {
             const value = nested[1].trim();
             if (!value)
                 invalid(draft.id, draft.list, "must not contain empty entries");
-            (draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates).push(value);
+            listItems(draft).push(value);
             draft.itemOpen = true;
             continue;
         }
@@ -468,7 +512,7 @@ export function compileNative(file, options = {}) {
         // 1.87.0 dropped these lines silently: 53/78 of run-551's criteria compiled to first-line
         // stubs and every falsifier tail was invisible to the judge.
         if (draft.list && draft.itemOpen && (line.startsWith(" ") || line.startsWith("\t")) && line.trim()) {
-            const items = draft.list === "acceptance" ? draft.acceptanceRaw : draft.gates;
+            const items = listItems(draft);
             items[items.length - 1] += ` ${line.trim()}`;
             continue;
         }
@@ -489,14 +533,14 @@ export function compileNative(file, options = {}) {
     // OBS-488: typed-oracle prefixes parse on the COMPLETE joined item text, never its first
     // physical line — a wrapped `command:` body or falsifier tail is part of the criterion.
     for (const draft of drafts) {
-        for (const raw of draft.acceptanceRaw) {
+        for (const [index, raw] of draft.acceptanceRaw.entries()) {
             const typed = raw.match(ORACLE_RE);
             if (typed) {
                 const [, kind, body] = typed;
                 if (!body.trim())
                     invalid(draft.id, "acceptance", `${kind} oracle must carry a value`);
                 draft.acceptance.push(kind === "command" ? { oracle: "command", command: body.trim() }
-                    : kind === "test" ? { oracle: "test", test: body.trim() }
+                    : kind === "test" ? parseTestOracle(draft.id, body, index)
                         : { oracle: "judge", text: body.trim() });
             }
             else {
@@ -561,6 +605,9 @@ export function compileNative(file, options = {}) {
         return trimmed;
     };
     const csv = (value) => value && value.toLowerCase() !== "none" ? splitTop(value).map((item) => stripAnnotation(item.trim())).filter(Boolean) : [];
+    // A fixture pin's path set is split only — never annotation-stripped: "fixtures/output (old)" is a
+    // filename, and csv() would silently retarget the declared obligation to "fixtures/output".
+    const pinPaths = (value) => splitTop(value).map((item) => item.trim()).filter(Boolean);
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
@@ -677,6 +724,7 @@ export function compileNative(file, options = {}) {
             ...(timeoutMinutes !== undefined ? { timeoutMinutes } : {}),
             ...(routingHints ? { routingHints } : {}),
             ...(draft.hasGates ? { gates: draft.gates } : {}),
+            ...(draft.pinsRaw.length ? { pins: draft.pinsRaw.map((raw, i) => parsePin(draft.id, raw, i, pinPaths)) } : {}),
         };
     });
     const result = validateGraph({
@@ -780,9 +828,19 @@ acceptance is required on every task (a nested list of observable outcomes).
     acceptance:  nested list (REQUIRED, non-empty). Each item is either a typed oracle or plain text:
                  - command: <shell>   (oracle: command — exit code)
                  - test: <name>       (oracle: test — named test)
+                 - test: <name> | suite: <path>   (same, plus the tests/**/*.test.ts file it lands in;
+                                       the path lives in the item's landing field, never in the title)
                  - judge: <rubric>    (oracle: judge — LLM-judged, free text)
                  A judge criterion carries ONE claim; a semicolon-joined criterion warns — split its clauses.
                  - <plain text>       (compat: compiles as judge oracle, warns)
+    pins:        nested list (optional) of retired-literal and fixture pin obligations:
+                 - literal: <exact text> | glob: <search glob>   (every file matching the glob that holds
+                                                                  the text is an obligated file)
+                 - fixture: <comma-separated path set>           (every matching file is itself obligated:
+                                                                  byte-pinned output the change will move;
+                                                                  it carries no literal text)
+                 LAW: a pins declaration is a LIMITED AUTHORING CONTRACT, not an assertion analyzer —
+                 tickmarkr holds you to the obligations you DECLARE; it does not discover the pins you forgot.
 
   HARD BOUNDS — these FAIL the compile, they do not warn:
     - at most 6 acceptance items per task (no exception path)
@@ -799,6 +857,9 @@ acceptance is required on every task (a nested list of observable outcomes).
       describe() is allowed (OBS-511: the gate matches the criterion as the trailing segment of the
       runner-visible full name), but the leaf title itself must equal the criterion: a shortened,
       decorated, or paraphrased leaf selects ZERO tests and the gate parks even though the suite is green.
+      To say WHICH suite the test lands in, append " | suite: <tests/**/*.test.ts path>" — the path is
+      parsed off into the item's landing field and the title stays the bare leaf; a landing outside the
+      collectable glob refuses the compile.
       Measured before the widening: two parks across two runs, one full attempt lost in each.
     - NO criterion may be satisfiable by an absence, a rename, a source-text grep, or an empty collection.
       "no file references X" is not a criterion — it passes in a repo where the feature was never built.

package/dist/compile/retired-literals.d.ts

@@ -0,0 +1,22 @@
+import type { Task } from "../graph/schema.js";
+/** The file-system seam: tests substitute it to stage an unreadable file or a truncated read. */
+export interface PinScanIo {
+    size(abs: string): number;
+    read(abs: string): Buffer;
+    /** stat-following; throws like statSync (ENOENT for a broken link). */
+    isDirectory(abs: string): boolean;
+    /** stat-following: a regular file (or a link resolving to one) — never a FIFO, socket or device. */
+    isFile(abs: string): boolean;
+}
+export interface LiteralHit {
+    path: string;
+    line: number;
+}
+/** Each line of `content` holding `text`, 1-based. */
+export declare function literalHits(path: string, content: string, text: string): LiteralHit[];
+/**
+ * One line per uncovered obligation or uncertifiable scan; empty means every declared pin is covered
+ * by the task that declares it. Ownership by any OTHER task — merged predecessor or downstream — is
+ * named in the diagnostic and is no substitute.
+ */
+export declare function retiredLiteralErrors(tasks: ReadonlyArray<Pick<Task, "id" | "files" | "pins">>, repoRoot: string, io?: PinScanIo): string[];

package/dist/compile/retired-literals.js

@@ -0,0 +1,271 @@
+import { lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { filesGlob, literalParens } from "../graph/files-glob.js";
+const NODE_IO = {
+    size: (abs) => statSync(abs).size,
+    read: (abs) => readFileSync(abs),
+    isDirectory: (abs) => statSync(abs).isDirectory(),
+    isFile: (abs) => statSync(abs).isFile(),
+};
+const cause = (error) => (error instanceof Error ? error.message : String(error));
+const patternsOf = (pin) => (pin.kind === "literal" ? [pin.glob] : pin.paths);
+/** Leading segments with no glob syntax at all (never the last): every match of the pattern sits under them. */
+const literalBase = (pattern) => {
+    const segs = literalParens(pattern).split("/");
+    const wild = segs.findIndex((s) => !/^[\w.-]+$/.test(s) || s === "..");
+    return segs.slice(0, Math.min(wild < 0 ? segs.length : wild, segs.length - 1)).join("/");
+};
+/**
+ * picomatch's brace semantics are expansion (`{a,b/c}/x` ≡ `a/x`, `b/c/x`; `\,` and `\{` are literal):
+ * every top-level comma-holding brace is expanded until none remains, so a slash inside a brace is an
+ * honest segment boundary. A brace with no top-level comma (`{a}`, `{1..3}`) is left for filesGlob.
+ */
+function expandBraces(pattern) {
+    let depth = 0;
+    let open = -1;
+    let alts = [];
+    let last = -1;
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === "\\")
+            i++;
+        else if (c === "{") {
+            if (depth++ === 0) {
+                open = i;
+                last = i + 1;
+                alts = [];
+            }
+        }
+        else if (c === "," && depth === 1) {
+            alts.push(pattern.slice(last, i));
+            last = i + 1;
+        }
+        else if (c === "}" && depth > 0 && --depth === 0) {
+            if (!alts.length)
+                continue; // no top-level comma: a literal or range brace, not an alternation
+            alts.push(pattern.slice(last, i));
+            const head = pattern.slice(0, open);
+            const tail = pattern.slice(i + 1);
+            return alts.flatMap((a) => expandBraces(head + a + tail));
+        }
+    }
+    return [pattern];
+}
+/** Split on "/" where it is a segment boundary; null when a slash is escaped or sits inside brackets. */
+function segmentsOf(pattern) {
+    const out = [""];
+    let depth = 0;
+    for (let i = 0; i < pattern.length; i++) {
+        const c = pattern[i];
+        if (c === "\\") {
+            if (pattern[i + 1] === "/")
+                return null;
+            out[out.length - 1] += c + (pattern[++i] ?? "");
+        }
+        else if (c === "/") {
+            if (depth)
+                return null;
+            out.push("");
+        }
+        else {
+            if (c === "[")
+                depth++;
+            else if (c === "]" && depth)
+                depth--;
+            out[out.length - 1] += c;
+        }
+    }
+    return out;
+}
+/**
+ * Does `alt` (brace-free) match EVERY path beneath `d`? Only a trailing globstar right after a matched prefix
+ * proves it; a globstar before that may swallow any run of `d`'s segments (`**\/cache/**` covers fixtures/cache/loop).
+ */
+function coversBeneath(alt, d) {
+    const segs = segmentsOf(alt);
+    if (!segs)
+        return false;
+    const covers = (si, di) => {
+        if (si >= segs.length)
+            return false;
+        if (segs[si] === "**") {
+            if (si === segs.length - 1)
+                return true;
+            for (let k = di; k <= d.length; k++)
+                if (covers(si + 1, k))
+                    return true;
+            return false;
+        }
+        if (di >= d.length)
+            return false;
+        // the prefix is matched as ONE pattern: a standalone `!cache` segment would read as a negation
+        return filesGlob(segs.slice(0, si + 1).join("/"))(d.slice(0, di + 1).join("/")) && covers(si + 1, di + 1);
+    };
+    return covers(0, 0);
+}
+/**
+ * Could `pattern` match a path strictly beneath directory `dir`? Matcher-consistent by construction:
+ * braces are expanded the way picomatch reads them, then every segment prefix is decided by filesGlob itself,
+ * and only an exact `**` segment is a globstar (`**.txt` is one ordinary segment). A leading `!` matches
+ * every path its body does not, so it reaches beneath `dir` unless some branch of the body provably covers
+ * all of it. What still cannot be split soundly (an escaped or bracketed slash) answers yes rather than certify blind.
+ */
+function reachesBeneath(pattern, dir) {
+    const p = pattern.replace(/^\.\//, "");
+    const d = dir ? dir.split("/") : [];
+    if (p.startsWith("!"))
+        return !expandBraces(literalParens(p.slice(1))).some((alt) => coversBeneath(alt, d));
+    return expandBraces(literalParens(p)).some((alt) => {
+        const segs = segmentsOf(alt);
+        if (!segs)
+            return true;
+        for (let i = 0; i < d.length; i++) {
+            if (i >= segs.length)
+                return false;
+            if (segs[i] === "**")
+                return true;
+            // the prefix is matched as ONE pattern: a standalone `!cache` segment would read as a negation
+            if (!filesGlob(segs.slice(0, i + 1).join("/"))(d.slice(0, i + 1).join("/")))
+                return false;
+        }
+        return segs.length > d.length;
+    });
+}
+/**
+ * Every non-directory path at or under `base`, decided later by filesGlob alone. NOTHING is pruned:
+ * not .git, not node_modules, not ignored files, not the state dir — the declared glob is the only
+ * narrowing (the literal base is exact: no match can sit outside it). A directory symlink is
+ * followed so matches behind it are listed under the symlink's own path; a link back into its own
+ * ancestry has no finite listing, so it refuses by name instead of being skipped.
+ * ponytail: a rootless glob such as ** / *.txt walks node_modules too; narrow the glob if that is slow.
+ */
+function walkAll(repoRoot, base, io) {
+    const out = { paths: [], causes: [] };
+    const visit = (rel, chain) => {
+        const abs = join(repoRoot, rel);
+        let isDir;
+        try {
+            isDir = io.isDirectory(abs);
+        }
+        catch (error) {
+            try {
+                // only a confirmed ENOENT is a known non-directory: a broken link stays a candidate whose read names the cause
+                if (error.code === "ENOENT") {
+                    if (lstatSync(abs, { throwIfNoEntry: false }))
+                        out.paths.push(rel);
+                    return;
+                }
+            }
+            catch { /* the lstat failed too: fall through to the refusal */ }
+            // anything else may be a directory hiding obligations: never a candidate that a glob could filter away
+            out.causes.push({ at: rel, why: `unstattable path ${rel || "."} (${cause(error)})`, maybeFile: true });
+            return;
+        }
+        if (!isDir) {
+            if (rel)
+                out.paths.push(rel);
+            return;
+        }
+        try {
+            const real = realpathSync(abs);
+            if (chain.includes(real)) {
+                out.causes.push({ at: rel, why: `symlink cycle at ${rel} cannot be enumerated`, maybeFile: false });
+                return;
+            }
+            for (const name of readdirSync(abs).sort())
+                visit(rel ? `${rel}/${name}` : name, [...chain, real]);
+        }
+        catch (error) {
+            out.causes.push({ at: rel, why: `unlistable directory ${rel || "."} (${cause(error)})`, maybeFile: false });
+        }
+    };
+    visit(base, []);
+    return out;
+}
+/** Whole-file read, or a thrown cause: a short read is never evidence of absence. */
+function readWhole(repoRoot, rel, io) {
+    const abs = join(repoRoot, rel);
+    let size;
+    let bytes;
+    try {
+        // a FIFO, socket or device has no finite whole to read: refuse it by kind before any read could block
+        if (!io.isFile(abs))
+            throw new Error(`unsupported file ${rel} (not a regular file)`);
+        size = io.size(abs);
+        bytes = io.read(abs);
+    }
+    catch (error) {
+        throw new Error(`unreadable file ${rel} (${cause(error)})`);
+    }
+    if (bytes.length !== size)
+        throw new Error(`truncated read of ${rel} (${bytes.length} of ${size} bytes)`);
+    return bytes.toString("utf8");
+}
+/** Each line of `content` holding `text`, 1-based. */
+export function literalHits(path, content, text) {
+    return content.split("\n").flatMap((line, i) => (line.includes(text) ? [{ path, line: i + 1 }] : []));
+}
+const pinName = (pin) => pin.kind === "literal" ? `literal ${JSON.stringify(pin.text)} in ${pin.glob}` : `fixture pin ${pin.paths.join(", ")}`;
+/**
+ * One line per uncovered obligation or uncertifiable scan; empty means every declared pin is covered
+ * by the task that declares it. Ownership by any OTHER task — merged predecessor or downstream — is
+ * named in the diagnostic and is no substitute.
+ */
+export function retiredLiteralErrors(tasks, repoRoot, io = NODE_IO) {
+    const declaring = tasks.filter((t) => t.pins?.length);
+    if (!declaring.length)
+        return [];
+    const walks = new Map();
+    const walked = (base) => walks.get(base) ?? walks.set(base, walkAll(repoRoot, base, io)).get(base);
+    const owns = new Map(tasks.map((t) => [t.id, filesGlob(t.files.map((f) => f.replace(/^\.\//, "")))]));
+    const errors = [];
+    for (const task of declaring) {
+        const owner = (path) => {
+            const others = tasks.filter((t) => t.id !== task.id && owns.get(t.id)(path)).map((t) => t.id);
+            return others.length
+                ? `owned by ${others.join(", ")}, which is no substitute: add it to ${task.id}.files[]`
+                : `owned by no task: add it to ${task.id}.files[]`;
+        };
+        for (const pin of task.pins) {
+            const matches = filesGlob(patternsOf(pin));
+            const found = [...new Set(patternsOf(pin).map((p) => literalBase(p.replace(/^\.\//, ""))))].map(walked);
+            // a cause refuses only a pin that could match at or beneath it: a cycle under fixtures/sub never refuses fixtures/*.txt
+            const affects = (c) => (c.maybeFile && matches(c.at)) || patternsOf(pin).some((p) => reachesBeneath(p, c.at));
+            const causes = [...new Set(found.flatMap((w) => w.causes).filter(affects).map((c) => c.why))];
+            for (const why of causes)
+                errors.push(`${task.id}: ${pinName(pin)} refuses certification: ${why}`);
+            const refused = causes.length > 0;
+            const surface = [...new Set(found.flatMap((w) => w.paths))].filter(matches).sort();
+            if (!surface.length) {
+                if (refused)
+                    continue; // the refusal above already names why nothing was certified
+                errors.push(`${task.id}: ${pinName(pin)} refuses certification: empty search surface (the pattern matches no file)`);
+                continue;
+            }
+            for (const path of surface) {
+                const owned = owns.get(task.id)(path);
+                // both kinds certify a whole-file read first: an owned fixture nobody could read is not evidence
+                let content;
+                try {
+                    content = readWhole(repoRoot, path, io);
+                }
+                catch (error) {
+                    errors.push(`${task.id}: ${pinName(pin)} refuses certification: ${cause(error)}`);
+                    continue;
+                }
+                if (pin.kind === "fixture") {
+                    if (!owned)
+                        errors.push(`${task.id}: ${pinName(pin)} obligates ${path}, outside ${task.id}.files[] (${owner(path)})`);
+                    continue;
+                }
+                const hits = literalHits(path, content, pin.text);
+                if (owned)
+                    continue;
+                for (const hit of hits) {
+                    errors.push(`${task.id}: ${pinName(pin)} still appears at ${hit.path}:${hit.line}, outside ${task.id}.files[] (${owner(path)})`);
+                }
+            }
+        }
+    }
+    return errors;
+}

package/dist/config/config.d.ts

@@ -62,6 +62,46 @@ export declare const TierEntrySchema: z.ZodObject<{
     windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strip>;
 export type TierEntry = z.infer<typeof TierEntrySchema>;
+export declare const DenyBlockSchema: z.ZodObject<{
+    adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    workers: z.ZodOptional<z.ZodObject<{
+        adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type DenyKeysOf<T, P extends string> = {
+    [K in keyof T & string]: NonNullable<T[K]> extends string[] ? `${P}${Capitalize<K>}` : DenyKeysOf<NonNullable<T[K]>, `${P}${Capitalize<K>}`>;
+}[keyof T & string];
+export type DenyScopeKey = DenyKeysOf<z.infer<typeof DenyBlockSchema>, "deny">;
+export type DenyScope = {
+    /** the FleetEditable field: deny + the path segments capitalized (denyWorkersModels) */
+    key: DenyScopeKey;
+    /** the overlay path: ["routing", "deny", ...segments] */
+    path: string[];
+    /** the dotted config path the exclusion collector reports (routing.deny.workers.models) */
+    dotted: string;
+};
+export declare function denyScopesOf(schema: z.ZodObject<z.ZodRawShape>, segments?: string[]): Array<{
+    key: string;
+    path: string[];
+    dotted: string;
+}>;
+export declare const DENY_SCOPES: readonly DenyScope[];
+/** the staged-set key the fleet browser uses for a scope: its key minus the `deny` prefix (denyWorkersAdapters → workersAdapters) */
+export type StagedDenyKey = DenyScopeKey extends `deny${infer Rest}` ? Uncapitalize<Rest> : never;
+export declare const stagedDenyKeyOf: (scope: DenyScope) => StagedDenyKey;
+/** the FleetApp prop that seeds one scope's staged set (initialDenyWorkersAdapters). Lives here, not in
+ * fleet-app.tsx, so the fleet command needs no runtime import of the Ink module (the print path must
+ * never load Ink, and chalk reads FORCE_COLOR at import time). */
+export type InitialDenyProps = {
+    [K in DenyScopeKey as `initial${Capitalize<K>}`]?: string[];
+};
+export declare const initialDenyPropOf: (scope: DenyScope) => keyof InitialDenyProps;
+/** the authored list at one deny scope of a routing block, undefined when the scope is absent */
+export declare function denyEntriesAt(routing: TickmarkrConfig["routing"], scope: DenyScope): string[] | undefined;
+/** a routing.deny block built from per-scope lists (absent or empty lists are left out) */
+export declare function denyBlockFrom(lists: Partial<Record<DenyScopeKey, string[]>>): NonNullable<TickmarkrConfig["routing"]["deny"]>;
 export declare const ModelPricingSchema: z.ZodObject<{
     inPerMtok: z.ZodNumber;
     outPerMtok: z.ZodNumber;
@@ -371,11 +411,9 @@ export type FleetTierAssignment = {
     tier: Tier;
     provenance?: string;
 };
-export type FleetEditable = {
+export type FleetEditable = Partial<Record<DenyScopeKey, string[]>> & {
     denyAdapters: string[];
     denyModels: string[];
-    denyWorkersAdapters?: string[];
-    denyWorkersModels?: string[];
     allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;

package/dist/config/config.js

@@ -87,9 +87,50 @@ const PrefBlockSchema = z.object({
     adapters: z.array(z.string()).optional(),
     models: z.array(z.string()).optional(),
 });
-const DenyBlockSchema = PrefBlockSchema.extend({
+// exported so a test can extend the PRODUCTION deny shape and watch the enumeration grow (OBS-1099 add.1)
+export const DenyBlockSchema = PrefBlockSchema.extend({
     workers: PrefBlockSchema.optional(),
 });
+export function denyScopesOf(schema, segments = []) {
+    const unwrap = (t) => t instanceof z.ZodOptional ? unwrap(t.unwrap()) : t;
+    return Object.entries(schema.shape).flatMap(([name, type]) => {
+        const inner = unwrap(type);
+        const below = [...segments, name];
+        if (inner instanceof z.ZodObject)
+            return denyScopesOf(inner, below);
+        if (!(inner instanceof z.ZodArray))
+            return [];
+        const path = ["routing", "deny", ...below];
+        return [{ key: `deny${below.map((s) => s[0].toUpperCase() + s.slice(1)).join("")}`, path, dotted: path.join(".") }];
+    });
+}
+export const DENY_SCOPES = denyScopesOf(DenyBlockSchema);
+export const stagedDenyKeyOf = (scope) => (scope.key[4].toLowerCase() + scope.key.slice(5));
+export const initialDenyPropOf = (scope) => `initial${scope.key[0].toUpperCase()}${scope.key.slice(1)}`;
+/** the authored list at one deny scope of a routing block, undefined when the scope is absent */
+export function denyEntriesAt(routing, scope) {
+    let cur = routing;
+    for (const segment of scope.path.slice(1)) {
+        if (cur === undefined || cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[segment];
+    }
+    return Array.isArray(cur) ? cur : undefined;
+}
+/** a routing.deny block built from per-scope lists (absent or empty lists are left out) */
+export function denyBlockFrom(lists) {
+    const block = {};
+    for (const scope of DENY_SCOPES) {
+        const entries = lists[scope.key];
+        if (!entries?.length)
+            continue;
+        let cur = block;
+        for (const segment of scope.path.slice(2, -1))
+            cur = (cur[segment] ??= {});
+        cur[scope.path[scope.path.length - 1]] = [...entries];
+    }
+    return block;
+}
 // v1.20 REC-02: operator-maintained price table for the usage/cost report (src/report/cost.ts). Two
 // channel economics, never conflated (spec cost model): API = tokens × per-Mtok rate; sub = flat plan
 // amortized over a windows/month RANGE (+ an API-equivalent counterfactual when the model has a rate).
@@ -924,8 +965,8 @@ export function fleetEditableFromConfig(cfg, universe) {
             tiers[adapter][model] = { tier };
         }
     }
-    const denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
-    const denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    // every enumerated deny scope rides verbatim (sorted) under its own key
+    const denyLists = Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, [...(denyEntriesAt(cfg.routing, scope) ?? [])].sort()]));
     let allowOut;
     if (universe !== undefined) {
         const { allow } = cfg.routing;
@@ -947,13 +988,8 @@ export function fleetEditableFromConfig(cfg, universe) {
         allowOut = [...new Set([...adaptersOut, ...modelsOut])].sort();
     }
     return {
-        denyAdapters,
-        denyModels,
+        ...denyLists,
         ...(allowOut !== undefined ? { allowOut } : {}),
-        // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
-        // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
-        denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),
-        denyWorkersModels: [...(cfg.routing.deny?.workers?.models ?? [])].sort(),
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
@@ -992,14 +1028,9 @@ export function formatFleetPrint(repoRoot, opts = {}) {
             node.comment = ` ${fleetKeyLayer(repoRoot, dotted, opts)}`;
         }
     };
-    if (effective.routing.deny?.adapters !== undefined)
-        annotate(["routing", "deny", "adapters"]);
-    if (effective.routing.deny?.models !== undefined)
-        annotate(["routing", "deny", "models"]);
-    if (effective.routing.deny?.workers?.adapters !== undefined)
-        annotate(["routing", "deny", "workers", "adapters"]);
-    if (effective.routing.deny?.workers?.models !== undefined)
-        annotate(["routing", "deny", "workers", "models"]);
+    for (const scope of DENY_SCOPES)
+        if (denyEntriesAt(effective.routing, scope) !== undefined)
+            annotate(scope.path);
     for (const shape of Object.keys(effective.routing.map))
         annotate(["routing", "map", shape]);
     annotate(["routing", "floors"]);