tickmarkr 2.5.8 → 2.6.0

package/dist/cli/help.js

@@ -140,14 +140,16 @@ export const COMMAND_HELP = {
     },
     beat: {
         usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",
-        description: "Write one supervision beat. The supervising seat's watcher loop repeats it; stopped beats become STALE.",
+        description: "Write one supervision beat using the recorded arm. Stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
         options: {
             "--seat <identity>": "Required: identify the supervising pane or agent.",
-            "--arm-id <identity>": "Identify this supervision arm.",
+            "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
+            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit within one interval after stand-down.",
+            "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
-            "--stand-down": "Record an explicit handoff and stand down this tier.",
-        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --stand-down"],
+            "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
+        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down", "beat overseer --seat supervisor --new-arm"],
     },
     version: {
         usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",

package/dist/compile/native.js

@@ -69,8 +69,11 @@ const NESTED_RE = /^\s+- (.+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
 const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
-const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins"]);
-const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw : draft.list === "pins" ? draft.pinsRaw : draft.gates;
+const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins", "outofscope"]);
+const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw
+    : draft.list === "pins" ? draft.pinsRaw
+        : draft.list === "outofscope" ? draft.outOfScope
+            : draft.gates;
 // v2.5.8 T7: one declared pin item — "literal: <exact text> | glob: <search glob>" (split at the LAST
 // " | glob: " so the text may itself hold a bar) or "fixture: <path set>". A declaration missing the
 // payload its own kind requires refuses the compile naming the task and the item.
@@ -420,7 +423,7 @@ export function compileNative(file, options = {}) {
     for (const [index, line] of content.split("\n").entries()) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, pinsRaw: [], list: null, itemOpen: false, continuationField: null });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, pinsRaw: [], outOfScope: [], list: null, itemOpen: false, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
@@ -455,7 +458,7 @@ export function compileNative(file, options = {}) {
                 invalid(draft.id, field[1], "is unknown");
             const value = field[2].trim();
             draft.itemOpen = false;
-            if (name === "acceptance" || name === "gates" || name === "pins") {
+            if (name === "acceptance" || name === "gates" || name === "pins" || name === "outofscope") {
                 if (value)
                     invalid(draft.id, field[1], "must be a nested list");
                 draft.list = name;
@@ -725,6 +728,9 @@ export function compileNative(file, options = {}) {
             ...(routingHints ? { routingHints } : {}),
             ...(draft.hasGates ? { gates: draft.gates } : {}),
             ...(draft.pinsRaw.length ? { pins: draft.pinsRaw.map((raw, i) => parsePin(draft.id, raw, i, pinPaths)) } : {}),
+            // OBS-1126: an absent list emits no key — a sealed graph's bytes must not move for tasks that
+            // never declared a bound.
+            ...(draft.outOfScope.length ? { outOfScope: draft.outOfScope } : {}),
         };
     });
     const result = validateGraph({
@@ -841,6 +847,23 @@ acceptance is required on every task (a nested list of observable outcomes).
                                                                   it carries no literal text)
                  LAW: a pins declaration is a LIMITED AUTHORING CONTRACT, not an assertion analyzer —
                  tickmarkr holds you to the obligations you DECLARE; it does not discover the pins you forgot.
+                 THE PIN SWEEP IS BY CALLERS OF EVERY RESHAPED TYPE, NOT BY THE LITERAL (OBS-1127): for each
+                 type, field or return shape the task changes, enumerate EVERY CALLER and EVERY BRIDGE — the
+                 command layer that re-serialises it, the live cockpit that renders it, the fixture that
+                 byte-pins it — and declare each one. A grep for the retired literal finds the sites that
+                 SPELL the old shape; it misses the sites that CONSUME it under another name. Measured in
+                 v2.5.9, twice: a deny-scope reshape swept by literal missed the Fleet command bridge that
+                 re-emitted the old scope set; a pane-status reshape missed the live cockpit caller that
+                 still read the retired field. Both compiled, both passed the declared pins, both shipped.
+    outOfScope:  nested list (optional) of bounds the task must NOT cross — carried onto the graph task
+                 and into its content identity (OBS-1126): a changed list retires prior-run findings.
+                 It is the DECLARED BOUND the reviewer and the repair worker are HELD TO, stated as EXPLICIT
+                 EXCLUSIONS ALONGSIDE the authoritative goal and acceptance criteria — it never displaces
+                 them. The review brief carries the goal (authoritative), the criteria and this list, so a
+                 finding inside the list is NOT MATERIAL and must not block approval (the reviewer may
+                 still raise it as minor); the repair worker receives the complete task prompt — goal,
+                 criteria and this list — not only the finding, so a repair that crosses the list fails
+                 even when it would silence the finding.
 
   HARD BOUNDS — these FAIL the compile, they do not warn:
     - at most 6 acceptance items per task (no exception path)
@@ -876,6 +899,15 @@ acceptance is required on every task (a nested list of observable outcomes).
       A criterion naming a CAPABILITY is satisfiable by a stub whose only caller is its own test, and the
       judge cannot catch it — it reads the DIFF, and a stub's hunks are real. Name the PRODUCTION CALLER
       that must exercise the capability, and the path it runs on; "X is supported" ships as dead code.
+    - A CRITERION RUNS END-TO-END THROUGH ITS PRODUCTION CALLER, STATED ONCE. Pin the observable at the
+      outermost production entry point — the CLI bridge, the rendered frame, the journal line — and let the
+      layers beneath it be exercised by that one claim. A criterion pinned at a helper is satisfied by the
+      helper alone while every layer above it is still wrong, and the fix then CLIMBS: each review round
+      moves the pin up one layer and burns a round. Measured in v2.5.9 (OBS-1127): a deny-scope criterion
+      first pinned the helper, then the production shape, then the Fleet state, then the CLI bridge — four
+      review rounds for one claim, "tkr fleet deny lists every scope the schema declares", that stated once
+      at the bridge would have failed at round one. Ask: WHAT DOES THE OPERATOR INVOKE, AND WHAT DO THEY
+      SEE? Pin that. A criterion satisfied one layer short of the operator is a criterion about plumbing.
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
@@ -922,6 +954,9 @@ acceptance is required on every task (a nested list of observable outcomes).
   PRE-SCOPE BY TEXT, ENUMERATE BLOCKERS BY EXECUTION:
     - Before assigning files[], sweep text across the repository tree for names, callers, tests and prose.
       A text sweep produces a candidate list; only running the change enumerates the real blocker set.
+      For every type the task RESHAPES, the sweep is by CALLER, not by literal: list each consumer and each
+      bridge of the type (command layer, cockpit, fixtures) and put every one in files[] or in a dep's —
+      the two v2.5.9 misses above were consumers that never spelled the retired literal (OBS-1127).
       Keep the candidates for scope, then execute the production path and full gates before declaring the
       set closed — this milestone paid a halted run to learn that the two populations are not identical.
     - SPIKE-THE-CONTRACT-THEN-SCOPE trigger question: COULD A TEST THIS TASK DOES NOT OWN BE ASSERTING THE

package/dist/config/config.d.ts

@@ -62,6 +62,46 @@ export declare const TierEntrySchema: z.ZodObject<{
     windows: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
 }, z.core.$strip>;
 export type TierEntry = z.infer<typeof TierEntrySchema>;
+export declare const DenyBlockSchema: z.ZodObject<{
+    adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    workers: z.ZodOptional<z.ZodObject<{
+        adapters: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        models: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type DenyKeysOf<T, P extends string> = {
+    [K in keyof T & string]: NonNullable<T[K]> extends string[] ? `${P}${Capitalize<K>}` : DenyKeysOf<NonNullable<T[K]>, `${P}${Capitalize<K>}`>;
+}[keyof T & string];
+export type DenyScopeKey = DenyKeysOf<z.infer<typeof DenyBlockSchema>, "deny">;
+export type DenyScope = {
+    /** the FleetEditable field: deny + the path segments capitalized (denyWorkersModels) */
+    key: DenyScopeKey;
+    /** the overlay path: ["routing", "deny", ...segments] */
+    path: string[];
+    /** the dotted config path the exclusion collector reports (routing.deny.workers.models) */
+    dotted: string;
+};
+export declare function denyScopesOf(schema: z.ZodObject<z.ZodRawShape>, segments?: string[]): Array<{
+    key: string;
+    path: string[];
+    dotted: string;
+}>;
+export declare const DENY_SCOPES: readonly DenyScope[];
+/** the staged-set key the fleet browser uses for a scope: its key minus the `deny` prefix (denyWorkersAdapters → workersAdapters) */
+export type StagedDenyKey = DenyScopeKey extends `deny${infer Rest}` ? Uncapitalize<Rest> : never;
+export declare const stagedDenyKeyOf: (scope: DenyScope) => StagedDenyKey;
+/** the FleetApp prop that seeds one scope's staged set (initialDenyWorkersAdapters). Lives here, not in
+ * fleet-app.tsx, so the fleet command needs no runtime import of the Ink module (the print path must
+ * never load Ink, and chalk reads FORCE_COLOR at import time). */
+export type InitialDenyProps = {
+    [K in DenyScopeKey as `initial${Capitalize<K>}`]?: string[];
+};
+export declare const initialDenyPropOf: (scope: DenyScope) => keyof InitialDenyProps;
+/** the authored list at one deny scope of a routing block, undefined when the scope is absent */
+export declare function denyEntriesAt(routing: TickmarkrConfig["routing"], scope: DenyScope): string[] | undefined;
+/** a routing.deny block built from per-scope lists (absent or empty lists are left out) */
+export declare function denyBlockFrom(lists: Partial<Record<DenyScopeKey, string[]>>): NonNullable<TickmarkrConfig["routing"]["deny"]>;
 export declare const ModelPricingSchema: z.ZodObject<{
     inPerMtok: z.ZodNumber;
     outPerMtok: z.ZodNumber;
@@ -371,11 +411,9 @@ export type FleetTierAssignment = {
     tier: Tier;
     provenance?: string;
 };
-export type FleetEditable = {
+export type FleetEditable = Partial<Record<DenyScopeKey, string[]>> & {
     denyAdapters: string[];
     denyModels: string[];
-    denyWorkersAdapters?: string[];
-    denyWorkersModels?: string[];
     allowOut?: string[];
     tiers: Record<string, Record<string, FleetTierAssignment | null>>;
     map: Record<string, MapEntry>;

package/dist/config/config.js

@@ -87,9 +87,50 @@ const PrefBlockSchema = z.object({
     adapters: z.array(z.string()).optional(),
     models: z.array(z.string()).optional(),
 });
-const DenyBlockSchema = PrefBlockSchema.extend({
+// exported so a test can extend the PRODUCTION deny shape and watch the enumeration grow (OBS-1099 add.1)
+export const DenyBlockSchema = PrefBlockSchema.extend({
     workers: PrefBlockSchema.optional(),
 });
+export function denyScopesOf(schema, segments = []) {
+    const unwrap = (t) => t instanceof z.ZodOptional ? unwrap(t.unwrap()) : t;
+    return Object.entries(schema.shape).flatMap(([name, type]) => {
+        const inner = unwrap(type);
+        const below = [...segments, name];
+        if (inner instanceof z.ZodObject)
+            return denyScopesOf(inner, below);
+        if (!(inner instanceof z.ZodArray))
+            return [];
+        const path = ["routing", "deny", ...below];
+        return [{ key: `deny${below.map((s) => s[0].toUpperCase() + s.slice(1)).join("")}`, path, dotted: path.join(".") }];
+    });
+}
+export const DENY_SCOPES = denyScopesOf(DenyBlockSchema);
+export const stagedDenyKeyOf = (scope) => (scope.key[4].toLowerCase() + scope.key.slice(5));
+export const initialDenyPropOf = (scope) => `initial${scope.key[0].toUpperCase()}${scope.key.slice(1)}`;
+/** the authored list at one deny scope of a routing block, undefined when the scope is absent */
+export function denyEntriesAt(routing, scope) {
+    let cur = routing;
+    for (const segment of scope.path.slice(1)) {
+        if (cur === undefined || cur === null || typeof cur !== "object")
+            return undefined;
+        cur = cur[segment];
+    }
+    return Array.isArray(cur) ? cur : undefined;
+}
+/** a routing.deny block built from per-scope lists (absent or empty lists are left out) */
+export function denyBlockFrom(lists) {
+    const block = {};
+    for (const scope of DENY_SCOPES) {
+        const entries = lists[scope.key];
+        if (!entries?.length)
+            continue;
+        let cur = block;
+        for (const segment of scope.path.slice(2, -1))
+            cur = (cur[segment] ??= {});
+        cur[scope.path[scope.path.length - 1]] = [...entries];
+    }
+    return block;
+}
 // v1.20 REC-02: operator-maintained price table for the usage/cost report (src/report/cost.ts). Two
 // channel economics, never conflated (spec cost model): API = tokens × per-Mtok rate; sub = flat plan
 // amortized over a windows/month RANGE (+ an API-equivalent counterfactual when the model has a rate).
@@ -924,8 +965,8 @@ export function fleetEditableFromConfig(cfg, universe) {
             tiers[adapter][model] = { tier };
         }
     }
-    const denyAdapters = [...(cfg.routing.deny?.adapters ?? [])].sort();
-    const denyModels = [...(cfg.routing.deny?.models ?? [])].sort();
+    // every enumerated deny scope rides verbatim (sorted) under its own key
+    const denyLists = Object.fromEntries(DENY_SCOPES.map((scope) => [scope.key, [...(denyEntriesAt(cfg.routing, scope) ?? [])].sort()]));
     let allowOut;
     if (universe !== undefined) {
         const { allow } = cfg.routing;
@@ -947,13 +988,8 @@ export function fleetEditableFromConfig(cfg, universe) {
         allowOut = [...new Set([...adaptersOut, ...modelsOut])].sort();
     }
     return {
-        denyAdapters,
-        denyModels,
+        ...denyLists,
         ...(allowOut !== undefined ? { allowOut } : {}),
-        // OBS-994: workers-only deny is never folded into the all-seats complement above — it is
-        // returned verbatim beside the flat scopes so the fleet browser can show and toggle it.
-        denyWorkersAdapters: [...(cfg.routing.deny?.workers?.adapters ?? [])].sort(),
-        denyWorkersModels: [...(cfg.routing.deny?.workers?.models ?? [])].sort(),
         tiers,
         map: structuredClone(cfg.routing.map),
         floors: { ...cfg.routing.floors },
@@ -992,14 +1028,9 @@ export function formatFleetPrint(repoRoot, opts = {}) {
             node.comment = ` ${fleetKeyLayer(repoRoot, dotted, opts)}`;
         }
     };
-    if (effective.routing.deny?.adapters !== undefined)
-        annotate(["routing", "deny", "adapters"]);
-    if (effective.routing.deny?.models !== undefined)
-        annotate(["routing", "deny", "models"]);
-    if (effective.routing.deny?.workers?.adapters !== undefined)
-        annotate(["routing", "deny", "workers", "adapters"]);
-    if (effective.routing.deny?.workers?.models !== undefined)
-        annotate(["routing", "deny", "workers", "models"]);
+    for (const scope of DENY_SCOPES)
+        if (denyEntriesAt(effective.routing, scope) !== undefined)
+            annotate(scope.path);
     for (const shape of Object.keys(effective.routing.map))
         annotate(["routing", "map", shape]);
     annotate(["routing", "floors"]);

package/dist/config/fleet-overlay.js

@@ -1,6 +1,13 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
 import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
-import { universeCovers, universeEntryMatches } from "./config.js";
+import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
+// OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
+// take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
+// literal deny list written on its own. ponytail: "flat" = directly under routing.deny. Read
+// lazily: config.ts imports this module, so the enumeration is not initialized at load time.
+const flatDenyScopes = () => DENY_SCOPES.filter((scope) => scope.path.length === 3);
+const nestedDenyScopes = () => DENY_SCOPES.filter((scope) => scope.path.length > 3);
+const listsOf = (write, scope) => [write.initial[scope.key] ?? [], write.edited[scope.key] ?? []];
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export const FLEET_OVERLAY_KEYS = ["routing", "tiers"];
 function fleetSubset(obj) {
@@ -24,7 +31,7 @@ function allowFormFromExclusions(universe, edited) {
     // LEG2-T3 round 2 finding 1: every staged entry excludes what it NAMES — a bare model id every
     // adapter serving it, an identity its alias — never only an adapter id or an adapter:model key.
     // OBS-1046: the staged allow complement is a reason of its own, beside the authored deny lists.
-    const entries = [...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])];
+    const entries = [...flatDenyScopes().flatMap((scope) => edited[scope.key] ?? []), ...(edited.allowOut ?? [])];
     const adapters = [];
     const models = [];
     let excluded = false;
@@ -190,9 +197,9 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // OBS-1046: each flat scope (and the allow complement) is compared on its own — a scope the
     // session never edited keeps its node byte for byte, whatever its sibling did.
     const changed = (before = [], after = []) => sortedUnique(before).join() !== sortedUnique(after).join();
-    const adaptersChanged = changed(initial.denyAdapters, edited.denyAdapters);
-    const modelsChanged = changed(initial.denyModels, edited.denyModels);
-    if (adaptersChanged || modelsChanged || changed(initial.allowOut, edited.allowOut)) {
+    const FLAT_DENY_SCOPES = flatDenyScopes();
+    const flatChanged = new Map(FLAT_DENY_SCOPES.map((scope) => [scope.key, changed(...listsOf(write, scope))]));
+    if ([...flatChanged.values()].some(Boolean) || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
@@ -230,15 +237,13 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             // LEG2-T3 finding 4: an authored entry the edit admits (staged nowhere any more) must go
             // even from a scope whose own set did not change, or the admitted channel stays excluded
             // behind the preserved bytes.
-            const stagedAfter = new Set([...edited.denyAdapters, ...edited.denyModels, ...(edited.allowOut ?? [])]);
-            const admitted = [...initial.denyAdapters, ...initial.denyModels, ...(initial.allowOut ?? [])]
+            const stagedAfter = new Set([...FLAT_DENY_SCOPES.flatMap((scope) => edited[scope.key] ?? []), ...(edited.allowOut ?? [])]);
+            const admitted = [...FLAT_DENY_SCOPES.flatMap((scope) => initial[scope.key] ?? []), ...(initial.allowOut ?? [])]
                 .filter((entry) => !stagedAfter.has(entry));
-            const scopes = [
-                ["adapters", initial.denyAdapters, edited.denyAdapters, adaptersChanged],
-                ["models", initial.denyModels, edited.denyModels, modelsChanged],
-            ];
-            for (const [scope, before, after, touched] of scopes) {
-                const path = ["routing", "deny", scope];
+            for (const scope of FLAT_DENY_SCOPES) {
+                const [before, after] = listsOf(write, scope);
+                const touched = flatChanged.get(scope.key);
+                const path = scope.path;
                 const authored = authoredEntries(doc, path);
                 const stale = authored.some((entry) => admitted.includes(entry));
                 if (!touched && !stale)
@@ -254,28 +259,24 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             }
         }
         else {
-            if (adaptersChanged) {
-                setStringSequencePreservingComments(doc, ["routing", "deny", "adapters"], edited.denyAdapters.length ? sortedUnique(edited.denyAdapters) : null);
-            }
-            if (modelsChanged) {
-                setStringSequencePreservingComments(doc, ["routing", "deny", "models"], edited.denyModels.length ? sortedUnique(edited.denyModels) : null);
+            for (const scope of FLAT_DENY_SCOPES) {
+                if (!flatChanged.get(scope.key))
+                    continue;
+                const after = edited[scope.key] ?? [];
+                setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
             }
         }
     }
     // OBS-994/FL-1: routing.deny.workers is a literal deny list, never a universe-derived
     // membership scope — it never routes through the allow-complement dance above, in either
-    // branch. Same tombstone/comment-preserving rules as the flat scopes.
-    const initialWorkersAdapters = initial.denyWorkersAdapters ?? [];
-    const editedWorkersAdapters = edited.denyWorkersAdapters ?? [];
-    const initialWorkersModels = initial.denyWorkersModels ?? [];
-    const editedWorkersModels = edited.denyWorkersModels ?? [];
-    // Each sub-path mutates independently — an untouched sibling must not be rewritten (a `null`
-    // tombstone over an absent/untouched sibling would mask a lower layer's own workers scope).
-    if (sortedUnique(initialWorkersAdapters).join() !== sortedUnique(editedWorkersAdapters).join()) {
-        setStringSequencePreservingComments(doc, ["routing", "deny", "workers", "adapters"], editedWorkersAdapters.length ? sortedUnique(editedWorkersAdapters) : null);
-    }
-    if (sortedUnique(initialWorkersModels).join() !== sortedUnique(editedWorkersModels).join()) {
-        setStringSequencePreservingComments(doc, ["routing", "deny", "workers", "models"], editedWorkersModels.length ? sortedUnique(editedWorkersModels) : null);
+    // branch. Same tombstone/comment-preserving rules as the flat scopes. Each nested scope
+    // mutates independently — an untouched sibling must not be rewritten (a `null` tombstone over
+    // an absent/untouched sibling would mask a lower layer's own workers scope).
+    for (const scope of nestedDenyScopes()) {
+        const [before, after] = listsOf(write, scope);
+        if (!changed(before, after))
+            continue;
+        setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
@@ -420,8 +421,11 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
     const out = structuredClone(existingRepo);
     const routing = { ...out.routing };
     let routingTouched = false;
-    const denyChanged = sortedUnique(initial.denyAdapters).join() !== sortedUnique(edited.denyAdapters).join()
-        || sortedUnique(initial.denyModels).join() !== sortedUnique(edited.denyModels).join()
+    // OBS-1099 add.1: the flat scopes (routing.deny.<leaf>) and the allow complement are one
+    // membership write; a list or its tombstone lands at every flat scope the enumeration names
+    const changedAt = (scope) => sortedUnique(initial[scope.key] ?? []).join() !== sortedUnique(edited[scope.key] ?? []).join();
+    const listOrTombstone = (entries) => entries.length ? entries : null;
+    const denyChanged = flatDenyScopes().some(changedAt)
         || sortedUnique(initial.allowOut ?? []).join() !== sortedUnique(edited.allowOut ?? []).join();
     if (denyChanged) {
         if (universe) {
@@ -434,44 +438,25 @@ export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, fi
             }
             else
                 delete routing.allow;
-            const residualAdapters = residualDeny(universe, edited.denyAdapters);
-            const residualModels = residualDeny(universe, edited.denyModels);
             routing.deny = {
                 ...routing.deny,
-                adapters: residualAdapters.length ? residualAdapters : null,
-                models: residualModels.length ? residualModels : null,
+                ...Object.fromEntries(flatDenyScopes().map((scope) => [scope.path[scope.path.length - 1], listOrTombstone(residualDeny(universe, edited[scope.key] ?? []))])),
             };
         }
         else {
-            routing.deny = {
-                adapters: edited.denyAdapters.length ? edited.denyAdapters : null,
-                models: edited.denyModels.length ? edited.denyModels : null,
-            };
+            routing.deny = Object.fromEntries(flatDenyScopes().map((scope) => [scope.path[scope.path.length - 1], listOrTombstone(edited[scope.key] ?? [])]));
         }
         routingTouched = true;
     }
-    // OBS-994/FL-1: workers deny is a literal list, independent of the universe/allow dance above.
-    // Each sub-path is included only when it actually changed — an untouched sibling must not be
-    // rewritten as a `null` tombstone over whatever the existing repo overlay already held.
-    const initialWorkersAdapters = initial.denyWorkersAdapters ?? [];
-    const editedWorkersAdapters = edited.denyWorkersAdapters ?? [];
-    const initialWorkersModels = initial.denyWorkersModels ?? [];
-    const editedWorkersModels = edited.denyWorkersModels ?? [];
-    const workersAdaptersChanged = sortedUnique(initialWorkersAdapters).join() !== sortedUnique(editedWorkersAdapters).join();
-    const workersModelsChanged = sortedUnique(initialWorkersModels).join() !== sortedUnique(editedWorkersModels).join();
-    if (workersAdaptersChanged || workersModelsChanged) {
-        routing.deny = {
-            ...routing.deny,
-            workers: {
-                ...(routing.deny?.workers),
-                ...(workersAdaptersChanged
-                    ? { adapters: editedWorkersAdapters.length ? editedWorkersAdapters : null }
-                    : {}),
-                ...(workersModelsChanged
-                    ? { models: editedWorkersModels.length ? editedWorkersModels : null }
-                    : {}),
-            },
-        };
+    // OBS-994/FL-1: a nested scope (routing.deny.workers.*) is a literal list, independent of the
+    // universe/allow dance above. Each sub-path is included only when it actually changed — an
+    // untouched sibling must not be rewritten as a `null` tombstone over whatever the existing repo
+    // overlay already held.
+    for (const scope of nestedDenyScopes().filter(changedAt)) {
+        let cur = (routing.deny = { ...routing.deny });
+        for (const segment of scope.path.slice(2, -1))
+            cur = (cur[segment] = { ...cur[segment] });
+        cur[scope.path[scope.path.length - 1]] = listOrTombstone(edited[scope.key] ?? []);
         routingTouched = true;
     }
     // pool widened to accept the null tombstone; MapEntry itself never carries null in memory.

package/dist/drivers/orca.d.ts

@@ -81,7 +81,7 @@ export declare function terminalWorktree(term: Record<string, unknown>): string
  * it keeps its resolved spelling: deterministic, and still comparable to another spelling of itself.
  */
 export declare function canonicalWorktreePath(path: string): string;
-/** The proof line a worker terminal prints first: recovery and focus read it back (FX-N01). */
+/** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;

package/dist/drivers/orca.js

@@ -2,7 +2,7 @@ import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, readlinkSyn
 import { randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
-import { createWorktree, sh } from "../run/git.js";
+import { createWorktree, FORK_CAP_ENV, resolvedForkCap, sh } from "../run/git.js";
 import { Journal, parseRunId } from "../run/journal.js";
 import { stateDirName } from "../graph/graph.js";
 import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
@@ -201,7 +201,7 @@ function enclosesCheckout(reported, checkout) {
     const tracked = canonicalWorktreePath(reported);
     return tracked === checkout || checkout.startsWith(`${tracked}/`);
 }
-/** The proof line a worker terminal prints first: recovery and focus read it back (FX-N01). */
+/** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // FX-N05: the proof is a FRAMED value — `TICKMARKR_CHECKOUT <byteLength>:<utf8 bytes as hex>;` — so it
 // carries no whitespace or quotes, survives renderer wrapping (hex rows re-join losslessly), and is
@@ -209,6 +209,7 @@ export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // never decode to this one; `A` versus `A B`, `…--T1` versus `…--T10` are different frames.
 const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT (\d+):([0-9a-f]*)(;?)/g;
 const PROOF_PAGES = 16; // pages read from the oldest cursor before the proof is declared absent
+const CHECKOUT_PROOF_TIMEOUT_MS = 2_000; // allow the wrapper shell to emit its startup proof
 /** The exact bytes the create command prints as its first line. */
 export function checkoutProofLine(checkout) {
     const bytes = Buffer.from(checkout, "utf8");
@@ -764,9 +765,10 @@ export class OrcaDriver {
         // The selector names the TRACKED worktree enclosing this slot's checkout outright — never the
         // UI's active worktree (`active`/`current`) nor the daemon's cwd — and the command itself moves
         // into the checkout, because Orca cannot be asked to place a terminal in a path it does not
-        // track (OBS-1004). `--command` runs inside Orca's wrapper shell, so a `cd` prefix is honoured.
+        // track (OBS-1004). Shell startup can swallow that prefix; prove it from scrollback below.
+        const payload = `export ${FORK_CAP_ENV}=${shq(process.env[FORK_CAP_ENV] ?? resolvedForkCap())}; ${cmd}`;
         const env = await this.call("create", [
-            "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, cmd),
+            "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, payload),
         ], this.cliCwd(st));
         const term = requireTerminal("create", env);
         const handle = str(term.handle);
@@ -788,6 +790,21 @@ export class OrcaDriver {
             catch { /* already gone, or no longer provably ours — never a blind retry */ }
             throw this.latched("create", st, `create receipt bound to ${worktree ?? "no worktree"}, not the tracked ${tracked} enclosing ${st.cwd}`, env.raw);
         }
+        // A receipt only proves placement on the enclosing tracked checkout. Wait briefly for the
+        // startup command's proof before run() can resolve and the daemon can count a worker launch.
+        const deadline = this.time.now() + CHECKOUT_PROOF_TIMEOUT_MS;
+        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        while (!proof.proven && this.time.now() < deadline) {
+            await this.time.sleep(POLL_MS);
+            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        }
+        if (!proof.proven) {
+            try {
+                await this.closeTerminal({ ...st, handle, runtimeId: env.runtimeId });
+            }
+            catch { /* best effort under the answering runtime; the latch prevents another launch */ }
+            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} (${proof.reason})`, env.raw);
+        }
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
         st.runtimeId = env.runtimeId;

package/dist/gates/baseline.d.ts

@@ -1,3 +1,4 @@
+import { type EvidenceArtifact, type GateEvidenceReceipt, type ShellReceipt } from "../run/protocol.js";
 import type { TickmarkrConfig } from "../config/config.js";
 import type { AcceptanceItem } from "../graph/schema.js";
 import { type RunCapacity, type ShellOptions, type ShResult } from "../run/git.js";
@@ -13,8 +14,69 @@ import type { GateResult } from "./types.js";
 declare module "./types.js" {
     interface GateResult {
         capacity?: RunCapacity;
+        evidenceReceipt?: GateEvidenceReceipt;
+        evidenceReceipts?: GateEvidenceReceipt[];
     }
 }
+/** Evidence is observational: the command verdict never depends on this store. */
+export interface GateEvidenceOptions {
+    artifactDir?: string;
+    runId?: string;
+    taskId?: string;
+    attempt?: number;
+    subjectCommit?: string;
+    quotaBytes?: number;
+    env?: NodeJS.ProcessEnv;
+    /** Injectable storage boundary; mandatory manifest/reporter writes do not use it. */
+    write?: (path: string, bytes: Buffer) => void;
+}
+export declare const EVIDENCE_TAIL_BYTES: number;
+export declare const EVIDENCE_RUN_QUOTA_BYTES: number;
+export declare function redactGateOutput(text: string, env: NodeJS.ProcessEnv): string;
+/** Resolve a snapshot reference against actual bytes: eviction never fabricates a live artifact. */
+export declare function resolveEvidenceArtifact(root: string, ref: EvidenceArtifact): EvidenceArtifact;
+export declare function beginGateEvidence(cwd: string, gate: string, command: string, opts?: GateEvidenceOptions, nonce?: string): {
+    root: string;
+    history: {
+        invocationId: string;
+        subject: {
+            runId: string;
+            taskId: string | null;
+            attempt: number | null;
+            gate: string;
+            subjectCommit: string | null;
+        };
+        termination: {
+            kind: "unknown" | "signal" | "not-started" | "exit" | "timeout";
+            exitCode: number | null;
+            signal: string | null;
+            timedOut: boolean | null;
+        };
+        availability: "available" | "not-started" | "capture-failed" | "killed" | "expired" | "missing";
+        redaction: {
+            material: boolean;
+        };
+        stdout: {
+            path: string;
+            availability: "available" | "not-started" | "capture-failed" | "killed" | "expired" | "missing";
+            sha256: string | null;
+            retainedBytes: number;
+            droppedBytes: number;
+            truncated: boolean;
+        };
+        stderr: {
+            path: string;
+            availability: "available" | "not-started" | "capture-failed" | "killed" | "expired" | "missing";
+            sha256: string | null;
+            retainedBytes: number;
+            droppedBytes: number;
+            truncated: boolean;
+        };
+        nonce?: string | undefined;
+    }[];
+    observe(receipt: ShellReceipt): void;
+    finish(stdout?: string, stderr?: string): GateEvidenceReceipt;
+};
 export interface BaselineCommand {
     /**
      * Absent when the capture returned no verdict — see `infra`. A pre-v1.90 baseline can also lack it
@@ -66,6 +128,10 @@ export interface BaselineFileDuration {
     durationMs: number;
 }
 export interface Baseline {
+    /** No command ran because the dependency inventory could not establish isolation. */
+    refusal?: string;
+    /** Observational capture receipts stay outside the forgiveness-bearing command entries. */
+    evidenceReceipts?: Record<string, GateEvidenceReceipt>;
     commands: Record<string, BaselineCommand>;
     warnings?: BaselineWarning[];
 }
@@ -158,6 +224,7 @@ export declare const CAPTURE_CEILING_MS = 1800000;
  * count is safe to apply as a deficit floor. A null count compares nothing and is safe as-is. */
 export declare function staleFileCountCommands(baseline: Baseline, commands: Record<string, string>, cwd: string): string[];
 export interface BaselineReceiptOptions {
+    evidence?: GateEvidenceOptions;
     onReceipt?: ShellOptions["onReceipt"];
     /** Only comparison's build command may carry task-build identity; capture never does. */
     taskBuildAttribution?: ShellOptions["receiptAttribution"];