tickmarkr 2.5.8 → 2.5.9

package/dist/run/supervision.js

@@ -1,5 +1,5 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
-import { randomUUID } from "node:crypto";
+import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { parseRunId } from "./journal.js";
 import { stateDirName, tickmarkrDir } from "../graph/graph.js";
@@ -86,6 +86,63 @@ const supervisionDir = (repoRoot) => join(repoRoot, stateDirName(repoRoot), "sup
 export const supervisionBeatPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.beat`);
 /** Where a watcher records that it STOOD DOWN. Its own file: the beat keeps meaning only "alive". */
 export const supervisionStandDownPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.standdown`);
+export const supervisionArmPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.arm`);
+function readArm(repoRoot, tier) {
+    try {
+        const arm = JSON.parse(readFileSync(supervisionArmPath(repoRoot, tier), "utf8"));
+        if (typeof arm.armId !== "string" || !arm.armId.trim() ||
+            typeof arm.armEpoch !== "string" || Number.isNaN(Date.parse(arm.armEpoch)) ||
+            typeof arm.markerFence !== "string")
+            throw new Error("invalid arm");
+        return arm;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new Error(`${tier} arm is unreadable`, { cause: error });
+    }
+}
+function markerFence(repoRoot, tier) {
+    const marker = readStandDown(repoRoot, tier);
+    if (marker === "UNREADABLE")
+        throw new Error(`${tier} stand-down is unreadable`);
+    return marker === "NONE" ? "NONE" : marker.fence;
+}
+/** Explicit arming acknowledges the current marker without deleting it. */
+export function newSupervisionArm(repoRoot, tier, armId = randomUUID(), initial = false) {
+    // Acknowledge only the marker observed when arming begins. In particular, do not
+    // sample it after stamping the epoch: a stand-down published in that gap is a
+    // later act, and must fence this arm rather than be silently acknowledged by it.
+    const fence = initial ? "NONE" : markerFence(repoRoot, tier);
+    const previous = readArm(repoRoot, tier);
+    const arm = {
+        armId, armEpoch: new Date(Math.max(Date.now(), previous ? Date.parse(previous.armEpoch) + 1 : 0)).toISOString(),
+        markerFence: fence,
+    };
+    tickmarkrDir(repoRoot);
+    const path = supervisionArmPath(repoRoot, tier);
+    if (!initial) {
+        atomicRecord(path, arm);
+        return arm;
+    }
+    // Only one legacy first tick may install the initial arm. A losing process reuses the winner.
+    mkdirSync(dirname(path), { recursive: true });
+    const tmp = `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(tmp, JSON.stringify(arm) + "\n");
+        try {
+            linkSync(tmp, path);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+    return readArm(repoRoot, tier);
+}
 /** The independent latch a stand-down cannot overwrite or remove. */
 const supervisionObligationPath = (repoRoot, tier) => join(supervisionDir(repoRoot), `${tier}.clear-owed`);
 // SUP-06: PRESENCE — one file per ARMED WATCHER, because a tier may legitimately have more than one.
@@ -190,6 +247,22 @@ function dischargeClearObligation(repoRoot, tier, observation) {
         rmSync(supervisionObligationPath(repoRoot, tier), { force: true });
     }
 }
+function raiseIfCrossed(repoRoot, tier, observation) {
+    if (observation.pct >= observation.thresholdPct) {
+        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
+    }
+}
+// The latch is orthogonal to liveness: a stood-down tier still raises a crossing and still lets a
+// different arm below threshold discharge it. Otherwise the context instrument goes silent after the
+// first hand-off — the watcher script stands its tier down on every exit.
+function observeWithoutBeat(repoRoot, tier, observation) {
+    if (observation !== undefined) {
+        tickmarkrDir(repoRoot);
+        raiseIfCrossed(repoRoot, tier, observation);
+        dischargeClearObligation(repoRoot, tier, observation);
+    }
+    return false;
+}
 function validateObservation(observation) {
     if (!observation.armId.trim())
         throw new Error("a supervision observation needs a non-empty arm identity");
@@ -202,7 +275,7 @@ function validateObservation(observation) {
 // WRITER — a watcher's own call, on its own tier, every SUPERVISION_BEAT_MS. Never a reader's: the
 // purity fence (status --watch leaves the state dir byte-identical) is the test that catches a reader
 // that beats on the watcher's behalf, which would report every dead tier as healthy.
-function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
+function writeSupervisionBeat(repoRoot, tier, seat, armId, observation, arm, loop = false) {
     // A seat tier may not be armed anonymously, and the refusal belongs HERE rather than only in the
     // verb: any caller that could write a seatless record could arm a tier nobody occupies.
     if (isSeatTier(tier) && !seat?.trim()) {
@@ -215,19 +288,42 @@ function writeSupervisionBeat(repoRoot, tier, seat, armId, observation) {
     mkdirSync(dirname(p), { recursive: true });
     // Raise before the beat so a later beat failure cannot hide a duty; discharge only after the
     // below-threshold observation exists on disk.
-    if (observation !== undefined && observation.pct >= observation.thresholdPct) {
-        raiseClearObligation(repoRoot, tier, observation.armId, observation.thresholdPct);
-    }
-    writeFileSync(p, JSON.stringify({
+    if (observation !== undefined)
+        raiseIfCrossed(repoRoot, tier, observation);
+    atomicRecord(p, {
         tier, ...(seat ? { seat } : {}), ...(armId ? { armId } : {}),
         ...(observation !== undefined ? { pct: observation.pct, thresholdPct: observation.thresholdPct } : {}),
-        exitedWriterPid: process.pid, beatAt: new Date().toISOString(),
-    }) + "\n");
+        ...arm,
+        ...(loop ? { pid: process.pid } : { exitedWriterPid: process.pid }),
+        beatAt: new Date().toISOString(),
+    });
     if (observation !== undefined)
         dischargeClearObligation(repoRoot, tier, observation);
 }
-export function beatSupervision(repoRoot, tier, seat, observation) {
-    writeSupervisionBeat(repoRoot, tier, seat, undefined, observation);
+export function beatSupervision(repoRoot, tier, seat, observation, options = {}) {
+    // `armId` only NAMES a first legacy arm; an existing arm is never refused for a name mismatch —
+    // the recorded id is a UUID no operator can know, and a mismatch is not a stand-down.
+    if (isSeatTier(tier) && !seat?.trim()) {
+        throw new Error(`${tier} is a per-seat tier — a beat must declare the seat identity it speaks for`);
+    }
+    if (observation !== undefined)
+        validateObservation(observation);
+    let arm = options.arm ?? readArm(repoRoot, tier);
+    if (!arm) {
+        if (markerFence(repoRoot, tier) !== "NONE")
+            return observeWithoutBeat(repoRoot, tier, observation);
+        arm = newSupervisionArm(repoRoot, tier, options.armId ?? observation?.armId, true);
+        // A marker published during initial creation must not be acknowledged implicitly.
+        if (arm.markerFence !== "NONE")
+            return observeWithoutBeat(repoRoot, tier, observation);
+    }
+    const current = readArm(repoRoot, tier);
+    if (current?.armId !== arm.armId || current.armEpoch !== arm.armEpoch ||
+        markerFence(repoRoot, tier) !== arm.markerFence)
+        return observeWithoutBeat(repoRoot, tier, observation);
+    writeSupervisionBeat(repoRoot, tier, seat, arm.armId, observation, arm, options.loop);
+    // The immutable fence travels WITH the beat, so a rename racing stand-down cannot outrank it.
+    return markerFence(repoRoot, tier) === arm.markerFence;
 }
 // THE WATCHER-FACING ENTRY POINT — the loop SUPERVISION_BEAT_MS actually drives. A supervising seat
 // calls this once at the top of its watch and holds the handle for the duration; a seat that dies,
@@ -348,11 +444,12 @@ function readBeat(repoRoot, tier) {
     // is not evidence that nobody armed the tier). On a SEAT tier it is the opposite: a record naming no
     // seat leaves the tier armed and unattributable, which reads as coverage no seat is providing, so
     // it is UNREADABLE — something is there and no beat any reader can attribute comes out of it.
-    const { seat, armId } = beatMetadata(p);
+    const { seat, armId, markerFence } = beatMetadata(p);
     if (isSeatTier(tier) && seat === undefined)
         return "UNREADABLE";
     return {
         mtimeMs: st.mtimeMs,
+        ...(markerFence !== undefined ? { markerFence } : {}),
         ...(seat !== undefined ? { seat } : {}),
         ...(armId !== undefined ? { armId } : {}),
     };
@@ -363,7 +460,8 @@ function beatMetadata(path) {
         const rec = JSON.parse(readFileSync(path, "utf8"));
         const seat = typeof rec?.seat === "string" && rec.seat.trim() ? rec.seat : undefined;
         const armId = typeof rec?.armId === "string" && rec.armId.trim() ? rec.armId : undefined;
-        return { ...(seat !== undefined ? { seat } : {}), ...(armId !== undefined ? { armId } : {}) };
+        const markerFence = typeof rec?.markerFence === "string" ? rec.markerFence : undefined;
+        return { ...(markerFence !== undefined ? { markerFence } : {}), ...(seat !== undefined ? { seat } : {}), ...(armId !== undefined ? { armId } : {}) };
     }
     catch {
         return {};
@@ -414,8 +512,11 @@ function readStandDown(repoRoot, tier) {
         return "UNREADABLE";
     let seat;
     let armId;
+    let fence;
     try {
-        const rec = JSON.parse(readFileSync(p, "utf8"));
+        const bytes = readFileSync(p, "utf8");
+        fence = createHash("sha256").update(bytes).digest("hex");
+        const rec = JSON.parse(bytes);
         if (rec?.tier !== tier)
             return "UNREADABLE";
         if (typeof rec.disarmedAt !== "string" || Number.isNaN(Date.parse(rec.disarmedAt)))
@@ -431,25 +532,22 @@ function readStandDown(repoRoot, tier) {
         return "UNREADABLE";
     } // unparseable or unreadable bytes — not a stand-down anyone can read
     return {
-        mtimeMs: st.mtimeMs,
+        mtimeMs: st.mtimeMs, fence,
         ...(seat !== undefined ? { seat } : {}),
         ...(armId !== undefined ? { armId } : {}),
     };
 }
-// THE TIER'S STATE — what every surface and every operator reads. A valid stand-down outranks the beat:
-// the watcher that wrote it is gone ON PURPOSE, and its last beat ages out exactly like a dead one's
-// would. It outranks the beat it FOLLOWED and no other — a later timestamp OR a FRESH different
-// armed-watcher identity is another arm, so a marker whose rename lost that race cannot mask a live
-// watcher. Once that foreign beat is stale, a newer clean hand-off must win: otherwise overlapping
-// boards closed in last-beater-first order would leave the tier reporting a death forever.
+// CLI beats carry the marker generation acknowledged at arm time, never at tick time. A new
+// marker dominates every tick of that arm regardless of rename order or beat mtime. The separate
+// presence-based lifecycle retains overlapping watch owners and their last-owner stand-down.
 export function supervisionStatus(repoRoot, tier, now = Date.now()) {
     const beat = readBeat(repoRoot, tier);
     const standDown = readStandDown(repoRoot, tier);
     if (standDown === "UNREADABLE")
         return withClearObligation(repoRoot, tier, { tier, state: "UNREADABLE" });
-    const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
-        beat.armId !== undefined && standDown.armId !== undefined && beat.armId !== standDown.armId &&
-        existsSync(supervisionPresencePath(repoRoot, tier, beat.armId))));
+    const beatOutranksStandDown = standDown !== "NONE" && typeof beat === "object" && (beat.markerFence !== undefined ? beat.markerFence === standDown.fence :
+        beat.armId !== undefined && existsSync(supervisionPresencePath(repoRoot, tier, beat.armId)) && (beat.mtimeMs > standDown.mtimeMs || (now - beat.mtimeMs <= SUPERVISION_STALE_MS &&
+            standDown.armId !== undefined && beat.armId !== standDown.armId)));
     if (standDown !== "NONE" && !beatOutranksStandDown) {
         // the seat that stood down is named by the marker, falling back to whatever its last beat named
         const seat = standDown.seat ?? (typeof beat === "object" ? beat.seat : undefined);

package/dist/tui/cockpit/evidence-view.d.ts

@@ -27,6 +27,10 @@ export interface EvidenceRow {
     /** Durable artifact locations this row's detail names (e.g. a saved raw-review capture); empty
      *  when none were recorded — rendered as "missing", never silently omitted. */
     readonly artifacts: readonly string[];
+    /** The row's execution-evidence receipt, each artifact resolved through the shared resolver against
+     *  the run root it was minted in (`originRunRoot` for a reused verdict) — reference then verified
+     *  availability; empty when the row carries no receipt. */
+    readonly receipts: readonly string[];
     readonly taskId?: string;
     readonly gate?: string;
 }
@@ -34,7 +38,10 @@ export interface EvidenceRow {
 export declare function parseArtifactLocations(details: string): string[];
 /** Pure C2-journal-to-Evidence-rows mapping: the original journal position IS the evidence identity
  *  — assigned once here, from the full unfiltered event list, never recomputed from a display slice. */
-export declare function deriveEvidenceJournal(eventsOrRows: readonly (JournalEvent | TrackedJournalRow)[], source?: string): EvidenceRow[];
+export declare function deriveEvidenceJournal(eventsOrRows: readonly (JournalEvent | TrackedJournalRow)[], source?: string, runRoot?: string): EvidenceRow[];
+/** The live cockpit names its journal by absolute path (`<state>/runs/<runId>/journal.jsonl`); that
+ *  directory IS the run root. A relative or foreign source names no root — nothing is guessed. */
+export declare function runRootOf(source: string | undefined): string | undefined;
 /** The most recent review verdict recorded for a task — by original journal position, so a merged
  *  task's review opens the row it actually happened on rather than any on-screen index. */
 export declare function selectTaskReview(journal: readonly EvidenceRow[], taskId: string): EvidenceRow | undefined;
@@ -42,6 +49,8 @@ export interface EvidenceViewInput {
     readonly events?: readonly JournalEvent[];
     readonly rows?: readonly TrackedJournalRow[];
     readonly source?: string;
+    /** The displayed run's root (its journal directory); receipts minted by this run resolve under it. */
+    readonly runRoot?: string;
     readonly costs?: readonly ChannelCost[];
     /** Caller-supplied Report-tab text (e.g. from `renderMarkdownRecord`/`textReport`) — kept as a pure
      *  input so this leaf never reads config/telemetry itself. */

package/dist/tui/cockpit/evidence-view.js

@@ -1,11 +1,12 @@
 import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
-import { existsSync, renameSync, statSync, unlinkSync } from "node:fs";
-import { basename, dirname, join } from "node:path";
+import { existsSync, realpathSync, renameSync, statSync, unlinkSync } from "node:fs";
+import { basename, dirname, isAbsolute, join } from "node:path";
 import { Box, useInput } from "ink";
 import { useEffect, useRef, useState } from "react";
 import { buildOperatorRecord, formatOperatorRecordRow } from "../../report/operator-record.js";
 import { EMPTY_OPERATOR_PAGE_SUMMARY, foldOperatorPages, operatorPageRow } from "../../run/operator-page-summary.js";
 import { formatJournalNarration } from "../../run/journal.js";
+import { formatReceiptResolution, resolveReceipt } from "../../run/receipt-resolver.js";
 import { BodyText, JournalRowPanel, Panel } from "./components.js";
 import { cellWidth, sliceCells } from "./width.js";
 // review.ts:485 emits `; raw saved: <path>) — failing closed`, the path immediately followed by
@@ -30,7 +31,7 @@ function stateFor(e) {
 }
 /** Pure C2-journal-to-Evidence-rows mapping: the original journal position IS the evidence identity
  *  — assigned once here, from the full unfiltered event list, never recomputed from a display slice. */
-export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
+export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl", runRoot) {
     const result = [];
     for (let i = 0; i < eventsOrRows.length; i++) {
         const item = eventsOrRows[i];
@@ -61,6 +62,7 @@ export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
                 artifacts.push(p);
         }
         const gate = typeof e.data?.gate === "string" ? e.data.gate : (e.event === "review-leg2" ? "review" : undefined);
+        const receipts = resolveRowReceipt(e.data, runRoot ?? runRootOf(rowSource));
         result.push({
             evidence: { source: rowSource, line, id },
             time: e.ts,
@@ -68,12 +70,42 @@ export function deriveEvidenceJournal(eventsOrRows, source = "journal.jsonl") {
             text: formatJournalNarration(e),
             fullText: details || JSON.stringify(e.data, null, 2),
             artifacts,
+            receipts,
             ...(e.taskId ? { taskId: e.taskId } : {}),
             ...(gate ? { gate } : {}),
         });
     }
     return result;
 }
+/** The live cockpit names its journal by absolute path (`<state>/runs/<runId>/journal.jsonl`); that
+ *  directory IS the run root. A relative or foreign source names no root — nothing is guessed. */
+export function runRootOf(source) {
+    return source && isAbsolute(source) && basename(source) === "journal.jsonl" ? dirname(source) : undefined;
+}
+// A reused verdict's receipt stays bound to the run root that minted it; the current run's root
+// answers only for evidence this run produced. No root known → nothing can be verified. A receipt
+// the schema rejects is still a receipt the row carries: each reference it names goes through the
+// resolver and is shown with its reason, never dropped. D-279: the boundary is the run root — the
+// host's ancestors are canonicalised (macOS `/var` → `/private/var`) but the root's own name is
+// passed as recorded, so a root that IS a symlink stays visible and the resolver refuses it.
+function resolveRowReceipt(data, runRoot) {
+    const receipt = data?.evidenceReceipt;
+    if (!receipt || typeof receipt !== "object")
+        return [];
+    const refs = [receipt.stdout, receipt.stderr];
+    const recorded = typeof data?.originRunRoot === "string" && data.originRunRoot ? data.originRunRoot : runRoot;
+    let root;
+    try {
+        root = recorded ? join(realpathSync(dirname(recorded)), basename(recorded)) : undefined;
+    }
+    catch {
+        root = undefined;
+    }
+    return refs.map(ref => {
+        const path = typeof ref?.path === "string" ? ref.path : "";
+        return formatReceiptResolution(root ? resolveReceipt(ref, root) : { ok: false, path, reason: "missing" });
+    });
+}
 /** The most recent review verdict recorded for a task — by original journal position, so a merged
  *  task's review opens the row it actually happened on rather than any on-screen index. */
 export function selectTaskReview(journal, taskId) {
@@ -100,7 +132,7 @@ export function deriveEvidenceView(input) {
             const row = operatorPageRow(event, tracked ? item.line : index + 1, tracked ? item.source ?? source : source);
             return row ? [row] : [];
         })).groups,
-        journal: deriveEvidenceJournal(items, source),
+        journal: deriveEvidenceJournal(items, source, input.runRoot),
         channels: buildOperatorRecord(events, input.costs ?? []),
         reportLines: input.reportLines ?? [],
         statsLines: input.statsLines ?? [],
@@ -229,7 +261,7 @@ export function EvidenceView({ model, width, focused = true, focusEvidence, onSe
         return { id: row.evidence.id, time, state: row.state, text: clipped };
     });
     return (_jsxs(Box, { flexDirection: "column", width: width, children: [_jsxs(BodyText, { emphasis: "strong", children: ["EVIDENCE ", TABS.map((t) => (t === tab ? `[${TAB_TITLE[t]}]` : TAB_TITLE[t])).join("  "), tab === "journal" ? `  | Follow ${follow ? "on" : "off"}` : "", selectedRow ? `  | selected ${selectedRow.evidence.id}` : ""] }), tab === "journal" && (_jsxs(_Fragment, { children: [_jsx(JournalRowPanel, { title: "RAW JOURNAL", rows: journalRows, selection: selectedIndex >= 0 ? selectedIndex : undefined }), _jsx(Panel, { title: "OPERATOR PAGE GROUPS", children: model.operatorPages.length ? model.operatorPages.map((group, index) => (_jsxs(Box, { flexDirection: "column", children: [_jsxs(BodyText, { emphasis: "strong", children: [group.taskId, " \u00B7 ", group.park, " \u00B7 ", group.status] }), _jsxs(BodyText, { children: ["first ", group.firstEvidenceAt] }), _jsxs(BodyText, { children: ["last ", group.lastEvidenceAt] }), _jsxs(BodyText, { children: ["visible ", group.observedCount, " \u00B7 suppressed ", group.suppressedCount, group.rawOnly ? " · raw-only (suppression unrecorded)" : ""] }), _jsx(BodyText, { children: "Raw source lines (\u2191\u2193 select, Enter open):" }), group.lines.map(line => _jsxs(BodyText, { children: ["#L", line] }, line))] }, `${group.key}:${index}`))) : _jsx(BodyText, { emphasis: "dim", children: "no operator pages" }) }), _jsx(Panel, { title: "SELECTED EVIDENCE", children: selectedRow
-                            ? (_jsxs(_Fragment, { children: [_jsxs(BodyText, { emphasis: "dim", children: ["Original journal ", selectedRow.evidence.id] }), selectedRow.fullText.split("\n").map((line, i) => _jsx(BodyText, { children: line }, i)), _jsxs(BodyText, { emphasis: "dim", children: ["Artifacts: ", selectedRow.artifacts.length ? selectedRow.artifacts.join(", ") : "missing"] })] }))
+                            ? (_jsxs(_Fragment, { children: [_jsxs(BodyText, { emphasis: "dim", children: ["Original journal ", selectedRow.evidence.id] }), selectedRow.fullText.split("\n").map((line, i) => _jsx(BodyText, { children: line }, i)), _jsxs(BodyText, { emphasis: "dim", children: ["Artifacts: ", selectedRow.artifacts.length ? selectedRow.artifacts.join(", ") : "missing"] }), selectedRow.receipts.map((line, i) => _jsxs(BodyText, { emphasis: "dim", children: ["Receipt: ", line] }, `r${i}`))] }))
                             : _jsx(BodyText, { emphasis: "dim", children: "no history" }) })] })), tab === "report" && (_jsx(Panel, { title: "REPORT", children: model.reportLines.length
                     ? model.reportLines.map((line, i) => _jsx(BodyText, { children: line }, i))
                     : _jsx(BodyText, { emphasis: "dim", children: "no history" }) })), tab === "stats" && (_jsx(Panel, { title: "STATS", children: model.statsLines.length

package/dist/tui/ink/fleet-app.d.ts

@@ -1,14 +1,10 @@
 import { type AuthHealth, type WorkerAdapter } from "../../adapters/types.js";
-import type { MapEntry, RoutingMode, Tier, TickmarkrConfig } from "../../config/config.js";
+import { type DenyScopeKey, type InitialDenyProps, type MapEntry, type RoutingMode, type StagedDenyKey, type Tier, type TickmarkrConfig } from "../../config/config.js";
 import { type Shape } from "../../graph/schema.js";
 export type FleetSteeringKey = "review" | "consult";
-export type FleetEditorState = {
-    denyAdapters: string[];
-    denyModels: string[];
+export type FleetEditorState = Record<DenyScopeKey, string[]> & {
     /** OBS-1046: the staged routing.allow complement, distinct from the authored deny lists above */
     allowOut?: string[];
-    denyWorkersAdapters: string[];
-    denyWorkersModels: string[];
     classifications: FleetClassification[];
     selectedMode: RoutingMode;
     map: Record<string, MapEntry>;
@@ -63,15 +59,15 @@ export type FleetModelEvidence = {
     /** OBS-972/FL-1: a floating alias's resolved concrete model id (e.g. "opus" → "claude-opus-5") */
     identity?: string;
 };
-/** The four staged deny sets every preview and the staged routing policy are computed from. */
-export type FleetStagedDeny = {
-    adapters: string[];
-    models: string[];
-    workersAdapters: string[];
-    workersModels: string[];
+/** OBS-1099 add.1: the staged deny list of every schema-enumerated scope — keyed by the scope
+ * key minus its `deny` prefix (denyWorkersAdapters → workersAdapters) — every preview and the
+ * staged routing policy are computed from; a scope the schema gains is a key here, not a hand field. */
+export type FleetStagedDeny = Record<StagedDenyKey, string[]> & {
     /** OBS-1046: the staged routing.allow complement; absent ⇒ the session's initial one */
     allowOut?: string[];
 };
+/** every scope's staged list, empty — the "every policy scope open" probe the picker lifts against */
+export declare const openStagedDeny: () => FleetStagedDeny;
 export type FleetModelGroup = {
     adapter: string;
     vendor?: string;
@@ -112,6 +108,8 @@ export type FleetCandidateOption = {
         via: string;
         model: string;
     };
+    /** ranked only after the shape's advisory floor was dropped (candidates.ts) — never lift-eligible */
+    belowFloor?: boolean;
 };
 export declare function formatDoctorAge(ageMs: number | null): string;
 export type FleetReach = "in" | "out-workers" | "out-all" | "out-allow" | "unknown";
@@ -123,15 +121,11 @@ export type FleetStagedRouting = {
     ok: false;
     error: string;
 };
-export declare function FleetApp({ ageMs, agents, initialDenyAdapters, initialDenyModels, initialAllowOut, initialDenyWorkersAdapters, initialDenyWorkersModels, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, }: {
+export declare function FleetApp({ ageMs, agents, initialAllowOut, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     agents: AgentCli[];
-    initialDenyAdapters: string[];
-    initialDenyModels: string[];
     /** OBS-1046: adapter ids and adapter:model keys routing.allow leaves out of the fleet */
     initialAllowOut?: string[];
-    initialDenyWorkersAdapters?: string[];
-    initialDenyWorkersModels?: string[];
     modelGroups: FleetModelGroup[];
     initialMode: RoutingMode;
     modeOptions: FleetModeOption[];
@@ -163,16 +157,12 @@ export declare function FleetApp({ ageMs, agents, initialDenyAdapters, initialDe
     /** terminal height — set only on a real TTY so the footer sticks to the bottom */
     frameRows?: number;
 }): import("react").JSX.Element;
-export declare function runFleetInkEditor({ ageMs, adapters, health, initialDenyAdapters, initialDenyModels, initialAllowOut, initialDenyWorkersAdapters, initialDenyWorkersModels, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, initialInput, input, output, debug, }: {
+export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewOverlay, reloadGuard, stagedRouting, entry, initialJudge, judgeSeats, initialInput, input, output, debug, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     adapters: WorkerAdapter[];
     health: Record<string, AuthHealth>;
-    initialDenyAdapters: string[];
-    initialDenyModels: string[];
     /** OBS-1046: adapter ids and adapter:model keys routing.allow leaves out of the fleet */
     initialAllowOut?: string[];
-    initialDenyWorkersAdapters?: string[];
-    initialDenyWorkersModels?: string[];
     modelGroups: FleetModelGroup[];
     initialMode: RoutingMode;
     modeOptions: FleetModeOption[];