tickmarkr 2.5.9 → 2.6.0

package/dist/adapters/claude-code.js

@@ -101,6 +101,14 @@ export const CLAUDE_INPUT_BOX = declareInputBox("claude-code", {
 export function claudeSlug(real) {
     return real.replace(/[^A-Za-z0-9]/g, "-");
 }
+// Shared resolution for context and resume identity: never scan a neighbouring session.
+function sessionTranscriptPath(session) {
+    const real = realpathSync(session.cwd);
+    const sid = session.id.replace(/\.jsonl$/i, "");
+    if (!sid || sid.includes("/") || sid.includes("\\") || sid.includes(".."))
+        return null;
+    return join(homedir(), ".claude", "projects", claudeSlug(real), `${sid}.jsonl`);
+}
 // newest-first by mtime, bounded — mtime picks WHICH files to scan, never a record's cursor.
 // Shared by collectUsage (spend) and readClaudeAliasIdentity (OBS-145): same store, same bounds.
 function newestSessionFiles(dir) {
@@ -318,19 +326,24 @@ export const claudeCode = {
             return undefined; // missing dir / any throw ⇒ fail open
         }
     },
+    readSessionTranscript(session) {
+        try {
+            const file = sessionTranscriptPath(session);
+            return file ? { bytes: readFileSync(file).byteLength } : null;
+        }
+        catch {
+            return null;
+        }
+    },
     // v1.23 T1: last-turn context fill from ~/.claude/projects/<slug>/<sessionId>.jsonl ONLY.
     // tokens = input_tokens + cache_creation_input_tokens + cache_read_input_tokens of the LAST
     // assistant usage record (not a sum over turns — ctx-watch.sh class; overseer wake signal).
     // Disk read only: no claude spawn, no pane, no network. null = unknown.
     contextUsage(session) {
         try {
-            const real = realpathSync(session.cwd);
-            const slug = claudeSlug(real);
-            // session id is a filename stem (herdr agent_session.value); refuse path traversal.
-            const sid = session.id.replace(/\.jsonl$/i, "");
-            if (!sid || sid.includes("/") || sid.includes("\\") || sid.includes(".."))
+            const file = sessionTranscriptPath(session);
+            if (!file)
                 return null;
-            const file = join(homedir(), ".claude", "projects", slug, `${sid}.jsonl`);
             let text;
             try {
                 text = readFileSync(file, "utf8").slice(0, MAX_SESSION_BYTES);

package/dist/adapters/prompt.js

@@ -18,7 +18,7 @@ Goal: ${task.goal}
 
 ## Acceptance criteria (you will be judged against these, verbatim)
 ${list(task.acceptance.map(renderAcceptanceItem))}
-${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(task.files)}\n` : ""}${task.context.length ? `\n## Context (read these first)\n${list(task.context)}\n` : ""}
+${task.files.length ? `\n## File scope — touch ONLY paths matching:\n${list(task.files)}\n` : ""}${task.context.length ? `\n## Context (read these first)\n${list(task.context)}\n` : ""}${task.outOfScope?.length ? `\n## Out of scope\nStay within the task’s declared bounds; do not pursue these items:\n${list(task.outOfScope)}\n` : ""}
 ## Rules
 - Work only inside the current directory (your isolated worktree). Never push. Never switch branches.
 - Make small atomic git commits as you go (git add + git commit, conventional messages).

package/dist/adapters/types.d.ts

@@ -188,6 +188,9 @@ export interface WorkerAdapter {
     listModelsFetchedAt?(): string | undefined;
     collectUsage?(cwd: string, sinceMs: number): TokenUsage | undefined;
     contextUsage?(session: SessionRef): ContextUsage | null;
+    readSessionTranscript?(session: SessionRef): {
+        bytes: number;
+    } | null;
     trust?(repoRoot: string): TrustVerdict;
     trustDialog: TrustDialog;
     inputBox?: InputBox;

package/dist/cli/commands/init.js

@@ -115,7 +115,7 @@ A run is green only when ALL of these hold: the run-end event exists in the jour
 
 ### Verified handoffs
 
-When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the TARGET composer afterward; if the sent text still sits unsubmitted after ~15 s, send-keys enter to that pane once and read again (OBS-975); never report "relayed" without read-back.
+When relaying missions between agents, never use bare send-text (\`herdr agent send\` / pane send-text) — it omits Enter. Use \`herdr pane run <pane> "<message>"\` or \`herdr notification show "<message>"\`. Confirm delivery by reading the TARGET composer afterward; if the sent text still sits unsubmitted after ~15 s, retry the Enter only when that composer read shows the staged text and no permission prompt or numbered choice holds focus — an Enter sent onto an active prompt approves it or picks a choice instead of submitting the message (OBS-1119). Under that guard, send-keys enter to that pane once and read again (OBS-975); when a prompt or choice holds focus instead, resolve it first and re-read before retrying. Never report "relayed" without read-back.
 
 ### Orient before you act — this block may be the ONLY guidance your host loaded
 

package/dist/cli/commands/report.js

@@ -11,6 +11,7 @@ import { estimateCosts } from "../../report/cost.js";
 import { assignmentChannel, buildOperatorRecord, formatChannelMoney, formatChannelTokens, formatTokenUsage as fields, totalTokens as total, } from "../../report/operator-record.js";
 import { cellsOf, cellSummary } from "../../route/profile.js";
 import { Journal, loadRoutingProfile } from "../../run/journal.js";
+import { formatTipProof, runEndTipProof } from "../../run/daemon.js";
 import { deriveRunCockpitData } from "../../tui/cockpit/derive.js";
 const n = (x) => x.toLocaleString("en-US"); // explicit locale — CI/darwin flake guard
 const EM = "—";
@@ -169,6 +170,15 @@ const VERIFICATION_READING = {
     failed: "FAILED — the run did not verify its own tip",
     absent: "absent — no tip verification recorded: neither passed nor failed",
 };
+function verificationReading(runId, events) {
+    const state = verificationOf(runId, events);
+    const proof = runEndTipProof(closedCycle(events));
+    if ((state === "passed" || state === "cached") && proof.gates?.length) {
+        const allCarried = proof.gates.every(({ kind }) => kind === "reused");
+        return `${allCarried ? "cached" : "passed"} — ${formatTipProof(proof)}`;
+    }
+    return VERIFICATION_READING[state];
+}
 // VIS-07 / REC-01: derived only from the run journal, telemetry, and local configuration.
 export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
     const runStart = events.find((e) => e.event === "run-start");
@@ -205,7 +215,7 @@ export function renderMarkdownRecord(runId, events, prices = [], rows = []) {
         `- **done:** ${count("done")}`,
         `- **failed:** ${count("failed")}`,
         `- **human:** ${count("human")}`,
-        `- **verification:** ${VERIFICATION_READING[verificationOf(runId, events)]}`,
+        `- **verification:** ${verificationReading(runId, events)}`,
         "",
         "## Usage & efficiency",
         "",

package/dist/cli/commands/verify.js

@@ -307,6 +307,8 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
                 try {
                     linkNodeModules(cwd, baseDir, { force: true });
                     baseline = await captureBaseline(baseDir, commands);
+                    if (baseline.refusal)
+                        return { out: baseline.refusal, code: 1 };
                     const missing = verdictlessCommands(baseline, commands);
                     if (missing.length) {
                         writeFileSync(verdictlessMarker, JSON.stringify({ base: mergeBase, commands: missing }) + "\n");

package/dist/compile/native.js

@@ -69,8 +69,11 @@ const NESTED_RE = /^\s+- (.+)$/;
 // v1.19: a typed acceptance oracle line — "command: ...", "test: ...", or "judge: ...". Anything
 // without one of these prefixes is a plain-string judge criterion (compat path, emits a warning).
 const ORACLE_RE = new RegExp(`^(${ORACLES.join("|")}):\\s*(.*)$`);
-const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins"]);
-const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw : draft.list === "pins" ? draft.pinsRaw : draft.gates;
+const FIELDS = new Set(["goal", "shape", "deps", "files", "context", "complexity", "humangate", "pin", "floor", "gates", "acceptance", "timeout", "pins", "outofscope"]);
+const listItems = (draft) => draft.list === "acceptance" ? draft.acceptanceRaw
+    : draft.list === "pins" ? draft.pinsRaw
+        : draft.list === "outofscope" ? draft.outOfScope
+            : draft.gates;
 // v2.5.8 T7: one declared pin item — "literal: <exact text> | glob: <search glob>" (split at the LAST
 // " | glob: " so the text may itself hold a bar) or "fixture: <path set>". A declaration missing the
 // payload its own kind requires refuses the compile naming the task and the item.
@@ -420,7 +423,7 @@ export function compileNative(file, options = {}) {
     for (const [index, line] of content.split("\n").entries()) {
         const heading = line.match(HEAD_RE);
         if (heading) {
-            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, pinsRaw: [], list: null, itemOpen: false, continuationField: null });
+            drafts.push({ id: heading[1], title: heading[2].trim(), fields: {}, acceptanceRaw: [], acceptance: [], gates: [], hasGates: false, pinsRaw: [], outOfScope: [], list: null, itemOpen: false, continuationField: null });
             continue;
         }
         const draft = drafts.at(-1);
@@ -455,7 +458,7 @@ export function compileNative(file, options = {}) {
                 invalid(draft.id, field[1], "is unknown");
             const value = field[2].trim();
             draft.itemOpen = false;
-            if (name === "acceptance" || name === "gates" || name === "pins") {
+            if (name === "acceptance" || name === "gates" || name === "pins" || name === "outofscope") {
                 if (value)
                     invalid(draft.id, field[1], "must be a nested list");
                 draft.list = name;
@@ -725,6 +728,9 @@ export function compileNative(file, options = {}) {
             ...(routingHints ? { routingHints } : {}),
             ...(draft.hasGates ? { gates: draft.gates } : {}),
             ...(draft.pinsRaw.length ? { pins: draft.pinsRaw.map((raw, i) => parsePin(draft.id, raw, i, pinPaths)) } : {}),
+            // OBS-1126: an absent list emits no key — a sealed graph's bytes must not move for tasks that
+            // never declared a bound.
+            ...(draft.outOfScope.length ? { outOfScope: draft.outOfScope } : {}),
         };
     });
     const result = validateGraph({
@@ -841,6 +847,23 @@ acceptance is required on every task (a nested list of observable outcomes).
                                                                   it carries no literal text)
                  LAW: a pins declaration is a LIMITED AUTHORING CONTRACT, not an assertion analyzer —
                  tickmarkr holds you to the obligations you DECLARE; it does not discover the pins you forgot.
+                 THE PIN SWEEP IS BY CALLERS OF EVERY RESHAPED TYPE, NOT BY THE LITERAL (OBS-1127): for each
+                 type, field or return shape the task changes, enumerate EVERY CALLER and EVERY BRIDGE — the
+                 command layer that re-serialises it, the live cockpit that renders it, the fixture that
+                 byte-pins it — and declare each one. A grep for the retired literal finds the sites that
+                 SPELL the old shape; it misses the sites that CONSUME it under another name. Measured in
+                 v2.5.9, twice: a deny-scope reshape swept by literal missed the Fleet command bridge that
+                 re-emitted the old scope set; a pane-status reshape missed the live cockpit caller that
+                 still read the retired field. Both compiled, both passed the declared pins, both shipped.
+    outOfScope:  nested list (optional) of bounds the task must NOT cross — carried onto the graph task
+                 and into its content identity (OBS-1126): a changed list retires prior-run findings.
+                 It is the DECLARED BOUND the reviewer and the repair worker are HELD TO, stated as EXPLICIT
+                 EXCLUSIONS ALONGSIDE the authoritative goal and acceptance criteria — it never displaces
+                 them. The review brief carries the goal (authoritative), the criteria and this list, so a
+                 finding inside the list is NOT MATERIAL and must not block approval (the reviewer may
+                 still raise it as minor); the repair worker receives the complete task prompt — goal,
+                 criteria and this list — not only the finding, so a repair that crosses the list fails
+                 even when it would silence the finding.
 
   HARD BOUNDS — these FAIL the compile, they do not warn:
     - at most 6 acceptance items per task (no exception path)
@@ -876,6 +899,15 @@ acceptance is required on every task (a nested list of observable outcomes).
       A criterion naming a CAPABILITY is satisfiable by a stub whose only caller is its own test, and the
       judge cannot catch it — it reads the DIFF, and a stub's hunks are real. Name the PRODUCTION CALLER
       that must exercise the capability, and the path it runs on; "X is supported" ships as dead code.
+    - A CRITERION RUNS END-TO-END THROUGH ITS PRODUCTION CALLER, STATED ONCE. Pin the observable at the
+      outermost production entry point — the CLI bridge, the rendered frame, the journal line — and let the
+      layers beneath it be exercised by that one claim. A criterion pinned at a helper is satisfied by the
+      helper alone while every layer above it is still wrong, and the fix then CLIMBS: each review round
+      moves the pin up one layer and burns a round. Measured in v2.5.9 (OBS-1127): a deny-scope criterion
+      first pinned the helper, then the production shape, then the Fleet state, then the CLI bridge — four
+      review rounds for one claim, "tkr fleet deny lists every scope the schema declares", that stated once
+      at the bridge would have failed at round one. Ask: WHAT DOES THE OPERATOR INVOKE, AND WHAT DO THEY
+      SEE? Pin that. A criterion satisfied one layer short of the operator is a criterion about plumbing.
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
@@ -922,6 +954,9 @@ acceptance is required on every task (a nested list of observable outcomes).
   PRE-SCOPE BY TEXT, ENUMERATE BLOCKERS BY EXECUTION:
     - Before assigning files[], sweep text across the repository tree for names, callers, tests and prose.
       A text sweep produces a candidate list; only running the change enumerates the real blocker set.
+      For every type the task RESHAPES, the sweep is by CALLER, not by literal: list each consumer and each
+      bridge of the type (command layer, cockpit, fixtures) and put every one in files[] or in a dep's —
+      the two v2.5.9 misses above were consumers that never spelled the retired literal (OBS-1127).
       Keep the candidates for scope, then execute the production path and full gates before declaring the
       set closed — this milestone paid a halted run to learn that the two populations are not identical.
     - SPIKE-THE-CONTRACT-THEN-SCOPE trigger question: COULD A TEST THIS TASK DOES NOT OWN BE ASSERTING THE

package/dist/drivers/orca.d.ts

@@ -81,7 +81,7 @@ export declare function terminalWorktree(term: Record<string, unknown>): string
  * it keeps its resolved spelling: deterministic, and still comparable to another spelling of itself.
  */
 export declare function canonicalWorktreePath(path: string): string;
-/** The proof line a worker terminal prints first: recovery and focus read it back (FX-N01). */
+/** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;

package/dist/drivers/orca.js

@@ -2,7 +2,7 @@ import { existsSync, linkSync, mkdirSync, readdirSync, readFileSync, readlinkSyn
 import { randomUUID } from "node:crypto";
 import { dirname, join, resolve } from "node:path";
 import { shq } from "../adapters/types.js";
-import { createWorktree, sh } from "../run/git.js";
+import { createWorktree, FORK_CAP_ENV, resolvedForkCap, sh } from "../run/git.js";
 import { Journal, parseRunId } from "../run/journal.js";
 import { stateDirName } from "../graph/graph.js";
 import { readWatchBoard, requestWatchBoardStop, stopWatchBoard, WATCH_OWNER_ENV } from "../run/supervision.js";
@@ -201,7 +201,7 @@ function enclosesCheckout(reported, checkout) {
     const tracked = canonicalWorktreePath(reported);
     return tracked === checkout || checkout.startsWith(`${tracked}/`);
 }
-/** The proof line a worker terminal prints first: recovery and focus read it back (FX-N01). */
+/** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // FX-N05: the proof is a FRAMED value — `TICKMARKR_CHECKOUT <byteLength>:<utf8 bytes as hex>;` — so it
 // carries no whitespace or quotes, survives renderer wrapping (hex rows re-join losslessly), and is
@@ -209,6 +209,7 @@ export const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
 // never decode to this one; `A` versus `A B`, `…--T1` versus `…--T10` are different frames.
 const CHECKOUT_FRAME_RE = /TICKMARKR_CHECKOUT (\d+):([0-9a-f]*)(;?)/g;
 const PROOF_PAGES = 16; // pages read from the oldest cursor before the proof is declared absent
+const CHECKOUT_PROOF_TIMEOUT_MS = 2_000; // allow the wrapper shell to emit its startup proof
 /** The exact bytes the create command prints as its first line. */
 export function checkoutProofLine(checkout) {
     const bytes = Buffer.from(checkout, "utf8");
@@ -764,9 +765,10 @@ export class OrcaDriver {
         // The selector names the TRACKED worktree enclosing this slot's checkout outright — never the
         // UI's active worktree (`active`/`current`) nor the daemon's cwd — and the command itself moves
         // into the checkout, because Orca cannot be asked to place a terminal in a path it does not
-        // track (OBS-1004). `--command` runs inside Orca's wrapper shell, so a `cd` prefix is honoured.
+        // track (OBS-1004). Shell startup can swallow that prefix; prove it from scrollback below.
+        const payload = `export ${FORK_CAP_ENV}=${shq(process.env[FORK_CAP_ENV] ?? resolvedForkCap())}; ${cmd}`;
         const env = await this.call("create", [
-            "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, cmd),
+            "terminal", "create", "--worktree", `path:${tracked}`, "--title", st.title, "--command", inCheckout(st.cwd, payload),
         ], this.cliCwd(st));
         const term = requireTerminal("create", env);
         const handle = str(term.handle);
@@ -788,6 +790,21 @@ export class OrcaDriver {
             catch { /* already gone, or no longer provably ours — never a blind retry */ }
             throw this.latched("create", st, `create receipt bound to ${worktree ?? "no worktree"}, not the tracked ${tracked} enclosing ${st.cwd}`, env.raw);
         }
+        // A receipt only proves placement on the enclosing tracked checkout. Wait briefly for the
+        // startup command's proof before run() can resolve and the daemon can count a worker launch.
+        const deadline = this.time.now() + CHECKOUT_PROOF_TIMEOUT_MS;
+        let proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        while (!proof.proven && this.time.now() < deadline) {
+            await this.time.sleep(POLL_MS);
+            proof = await this.checkoutProven(handle, st.cwd, this.cliCwd(st), env.runtimeId);
+        }
+        if (!proof.proven) {
+            try {
+                await this.closeTerminal({ ...st, handle, runtimeId: env.runtimeId });
+            }
+            catch { /* best effort under the answering runtime; the latch prevents another launch */ }
+            throw this.latched("create", st, `terminal ${handle} does not prove checkout ${st.cwd} (${proof.reason})`, env.raw);
+        }
         st.handle = handle;
         // The handle is bound to the runtime identity that ANSWERED its create.
         st.runtimeId = env.runtimeId;

package/dist/gates/baseline.d.ts

@@ -128,6 +128,8 @@ export interface BaselineFileDuration {
     durationMs: number;
 }
 export interface Baseline {
+    /** No command ran because the dependency inventory could not establish isolation. */
+    refusal?: string;
     /** Observational capture receipts stay outside the forgiveness-bearing command entries. */
     evidenceReceipts?: Record<string, GateEvidenceReceipt>;
     commands: Record<string, BaselineCommand>;

package/dist/gates/baseline.js

@@ -3,7 +3,7 @@ import { execFileSync } from "node:child_process";
 import { existsSync, readFileSync, mkdirSync, readdirSync, statSync, unlinkSync, writeFileSync, rmdirSync } from "node:fs";
 import { availableParallelism, loadavg, tmpdir } from "node:os";
 import { join } from "node:path";
-import { DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
+import { dependencyLinkRefusal, DEFAULT_SHELL_TIMEOUT_MS, describeCapacity, sameCapacity, sh } from "../run/git.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { isVitestTestCommand, manifestFileCount } from "./test-manifest.js";
 export const EVIDENCE_TAIL_BYTES = 16 * 1024;
@@ -620,6 +620,14 @@ export function staleFileCountCommands(baseline, commands, cwd) {
 }
 export async function captureBaseline(cwd, commands, opts = {}) {
     const base = { commands: {} };
+    const refusal = dependencyLinkRefusal(cwd);
+    if (refusal) {
+        base.refusal = refusal;
+        for (const name of Object.keys(commands)) {
+            base.commands[name] = { infra: true, invalidCause: "infra", fingerprints: [], invalidatingLines: [refusal] };
+        }
+        return base;
+    }
     for (const [name, cmd] of Object.entries(commands)) {
         if (name === "tipTest" && commands.test !== undefined && cmd === commands.test) {
             continue;

package/dist/gates/cache.d.ts

@@ -59,7 +59,15 @@ export declare function computeVerificationIdentity(params: {
 }): Promise<VerificationIdentity | undefined>;
 export declare function verificationIdentityKey(id: VerificationIdentity): string;
 export declare function formatReusedDetails(originalDetails: string, id: VerificationIdentity): string;
+declare module "./types.js" {
+    interface GateResult {
+        originRunRoot?: string;
+    }
+}
 export interface CachedVerdict {
+    evidenceReceipt?: GateResult["evidenceReceipt"];
+    evidenceReceipts?: GateResult["evidenceReceipts"];
+    originRunRoot?: string;
     gate: string;
     pass: boolean;
     details: string;

package/dist/gates/cache.js

@@ -1,9 +1,9 @@
 import { createHash } from "node:crypto";
 import { execSync } from "node:child_process";
-import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join, relative, resolve } from "node:path";
 import { tmpdir } from "node:os";
-import { describeCapacity, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
+import { describeCapacity, inventoryDependencyLinks, resolvedCapacity, shGit, verificationProtocol } from "../run/git.js";
 import { shq } from "../adapters/types.js";
 export const DEFAULT_VERDICT_CACHE_BOUND = 128;
 let testCacheBound;
@@ -84,6 +84,13 @@ export function environmentFingerprint(env) {
     const capacity = { forkCap: cap.forkCap, cores: cap.cores };
     const selectedSet = env.selectedSet ? [...env.selectedSet].sort() : undefined;
     const verification = env.verification ?? verificationProtocol(process.env, env.worktree ?? process.cwd());
+    // Admitted links still affect resolution. Normalize against the classified root so relocating
+    // an otherwise identical checkout (including its dependency store) preserves the identity.
+    const resolution = env.worktree ? inventoryDependencyLinks(env.worktree).map(({ link, target, classification }) => ({
+        link,
+        classification,
+        target: classification === "outside" ? target : relative(realpathSync(classification === "worktree" ? env.worktree : join(env.worktree, "node_modules")), target),
+    })).sort((a, b) => a.link < b.link ? -1 : a.link > b.link ? 1 : 0) : [];
     // R41: the protocol and the EFFECTIVE lifecycle are IN the hashed payload, so every entry written
     // before this stamp — green or red — keys differently and is never answered; no store surgery is
     // needed. `source` is provenance (kept in parts, printed on the row) and never enters the key: an
@@ -92,6 +99,7 @@ export function environmentFingerprint(env) {
         nodeRuntime,
         lockfile,
         capacity,
+        resolution,
         selectedSet: selectedSet ?? null,
         scope: env.scope ?? "battery",
         verification: { protocol: verification.protocol, lifecycle: verification.lifecycle },
@@ -155,6 +163,9 @@ export function formatReusedRow(cached, id) {
         pass: cached.pass,
         details: cached.pass ? reusedDetails : cached.details,
         capacity: cached.capacity,
+        ...(cached.evidenceReceipt ? { evidenceReceipt: cached.evidenceReceipt } : {}),
+        ...(cached.evidenceReceipts ? { evidenceReceipts: cached.evidenceReceipts } : {}),
+        ...(cached.originRunRoot ? { originRunRoot: cached.originRunRoot } : {}),
         meta: {
             ...cached.meta,
             reused: true,
@@ -306,6 +317,10 @@ export class VerdictStore {
                 ...("exitCode" in verdict ? { exitCode: verdict.exitCode } : {}),
                 ...(verdict.capacity ? { capacity: verdict.capacity } : {}),
                 ...(verdict.meta ? { meta: verdict.meta } : {}),
+                ...(verdict.evidenceReceipt ? { evidenceReceipt: verdict.evidenceReceipt } : {}),
+                ...(verdict.evidenceReceipts ? { evidenceReceipts: verdict.evidenceReceipts } : {}),
+                ...(verdict.originRunRoot ? { originRunRoot: verdict.originRunRoot }
+                    : typeof verdict.meta?.runDir === "string" ? { originRunRoot: resolve(verdict.meta.runDir) } : {}),
             },
             timestamp: Date.now(),
             sequence: ++globalStoreSequence,
@@ -314,17 +329,15 @@ export class VerdictStore {
         const tmpPath = join(this.dir, `verdict-${key}.${process.pid}.${Date.now()}.${Math.random().toString(16).slice(2)}.tmp`);
         writeFileSync(tmpPath, JSON.stringify(record, null, 2) + "\n");
         try {
-            unlinkSync(finalPath);
+            renameSync(tmpPath, finalPath);
         }
-        catch {
-            // ignore
-        }
-        writeFileSync(finalPath, readFileSync(tmpPath));
-        try {
-            unlinkSync(tmpPath);
-        }
-        catch {
-            // ignore
+        finally {
+            try {
+                unlinkSync(tmpPath);
+            }
+            catch {
+                // Already renamed, or best-effort cleanup after a failed replacement.
+            }
         }
         this.evictOldest(bound);
         return true;

package/dist/gates/review.d.ts

@@ -110,7 +110,7 @@ export declare function pickReviewer(author: Assignment, channels: BillingChanne
 prefer?: string[], // v1.53 T2: review.prefer — reorders eligible channels, never changes eligibility
 floor?: Tier, // task/config/prior floor from the caller; the author's own tier is ALWAYS applied here (RF-1)
 history?: string[], // run-scoped picks, oldest to newest; empty preserves the established ranking
-onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>): BillingChannel | null;
+onSeat?: (seat: number, count: number) => void, demoted?: ReadonlySet<string>, excludeVendors?: ReadonlySet<string>, authors?: readonly string[]): BillingChannel | null;
 export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-started" | "truncated" | "silent" | "closure-mismatch";
 /**
  * This shows the reviewer what the task DECLARED, never what the diff may actually reach. The diff
@@ -120,8 +120,7 @@ export type ReviewUnparseableCause = VerdictUnparseableCause | "launch-never-sta
 export declare function renderDeclaredWriteScope(files: ReadonlyArray<string>): string;
 /**
  * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
- * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
- * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ * never handed its own earlier work to approve. Unresolved channels are refused by reviewGate.
  */
 export declare function carriedAuthorVendors(channels: BillingChannel[], carriedAuthors?: readonly string[]): Set<string>;
 /**

package/dist/gates/review.js

@@ -283,15 +283,11 @@ floor, // task/config/prior floor from the caller; the author's own tier is ALWA
 history = [], // run-scoped picks, oldest to newest; empty preserves the established ranking
 onSeat, demoted = new Set(), 
 // OBS-1033: vendors that authored a carried commit inside the accumulated diff — excluded for the round.
-excludeVendors = new Set()) {
-    // FLEET-05 success criterion 2: an author not resolvable in the channel list yields NO reviewer.
-    // The old `?? author.adapter` fallback compared an adapter id to vendor names, matched nothing, and
-    // admitted every reviewer — including the author's own channel (fail-OPEN). null lands on reviewGate's
-    // fail-closed branch under review.required.
-    const authorChannel = channels.find((c) => c.adapter === author.adapter && c.model === author.model);
-    if (!authorChannel)
+excludeVendors = new Set(), authors = [channelKey(author)]) {
+    // Resolve every actual author, never guess a vendor from an adapter id.
+    const authorChannels = authors.map((key) => channels.find((c) => channelKey(c) === key));
+    if (authorChannels.some((c) => !c))
         return null;
-    const authorProvider = modelProvider(author.model, authorChannel.vendor);
     // RF-1: every caller inherits the author-tier floor — a reviewer is never seated below its author.
     const effectiveFloor = resolveReviewerFloor(author.tier, floor).floor;
     const ranked = channels
@@ -299,9 +295,9 @@ excludeVendors = new Set()) {
         // as well as failover, so an aggregator channel stamped "mixed" never seats the author's own provider),
         // and different base-model identity (ADDED TO the vendor rule, never replacing it). The diversity
         // filter runs BEFORE preference ranking, so prefer cannot resurrect an excluded channel.
-        .filter((c) => c.vendor !== authorChannel.vendor
-        && modelProvider(c.model, c.vendor) !== authorProvider
-        && modelId(c.model) !== modelId(author.model)
+        .filter((c) => authorChannels.every((a) => a && c.vendor !== a.vendor
+        && modelProvider(c.model, c.vendor) !== modelProvider(a.model, a.vendor)
+        && modelId(c.model) !== modelId(a.model))
         && !exclude.includes(channelKey(c))
         && !excludeVendors.has(c.vendor)
         && TIER_RANK[c.tier] >= TIER_RANK[effectiveFloor])
@@ -328,15 +324,12 @@ ${files.map((path) => `- ${path}`).join("\n")}`;
 }
 /**
  * OBS-1033: the vendors of the seats that authored commits inside the accumulated diff. A seat is
- * never handed its own earlier work to approve. A prior author not resolvable in the pool excludes
- * its adapter's vendors instead (fail closed: the seat is known, its vendor is whatever it bills as).
+ * never handed its own earlier work to approve. Unresolved channels are refused by reviewGate.
  */
 export function carriedAuthorVendors(channels, carriedAuthors = []) {
     const vendors = new Set();
     for (const key of carriedAuthors) {
-        const adapter = key.split(":")[0];
-        const exact = channels.filter((c) => channelKey(c) === key);
-        for (const c of exact.length ? exact : channels.filter((c) => c.adapter === adapter))
+        for (const c of channels.filter((c) => channelKey(c) === key))
             vendors.add(c.vendor);
     }
     return vendors;
@@ -391,7 +384,7 @@ artifactDir, reviewHistory, demotedReviewers, carriedFindings = [],
 // RF-1: channel keys of THIS task's prior reviewers (earlier rounds, a flaked seat) — task-scoped,
 // never the run-wide rotation history nor excludeReviewers; the seat holds the highest of their tiers.
 priorReviewers = [], 
-// OBS-1033: channel keys of the seats that authored the carried commits (the daemon's tried list).
+// Closed list of actual subject authors; empty preserves legacy callers' single-author contract.
 carriedAuthors = [], operatorContext) {
     // R3 (OBS-186): participation is keyed on PATHS. The compiler's assignment comes from the DECLARED
     // files[]; the operator's floor may RAISE it to full and can never lower it. `complexityThreshold` is
@@ -466,15 +459,15 @@ carriedAuthors = [], operatorContext) {
     // review.floor is read from config — cfg.routing.floors governs workers and never moves review seats.
     const { floor: reviewerFloor, cause: reviewerFloorCause } = gateReviewerFloor(task, cfg, author, channels, priorReviewers);
     const floorMeta = { reviewerFloor, reviewerFloorCause };
+    const authors = carriedAuthors.length ? carriedAuthors : [channelKey(author)];
+    const authorVendors = carriedAuthorVendors(channels, authors);
+    const unresolvedAuthors = authors.filter((key) => !channels.some((c) => channelKey(c) === key));
     let rotationSeat;
-    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers, carriedAuthorVendors(channels, carriedAuthors));
+    const reviewer = pickReviewer(author, channels, excludeReviewers ?? [], cfg.review.prefer ?? [], reviewerFloor, reviewHistory, reviewHistory ? (seat) => { rotationSeat = seat; } : undefined, demotedReviewers, authorVendors, authors);
     if (!reviewer) {
-        // meta.noEligibleReviewer lets run-gates' review-retry keep the ORIGINAL unparseable result when
-        // the retry finds no second seat — a truthful cause beats a synthetic no-reviewer failure.
-        const reason = `no cross-vendor reviewer available at or above ${reviewerFloor} floor (${reviewerFloorCause}; diversity rule)`;
-        return cfg.review.required || priorMaterials.length > 0
-            ? { gate: "review", pass: false, details: `unreadable — ${reason}; ${priorMaterials.length ? "carried materials require a review verdict" : "set review.required:false to waive"}`, meta: { noEligibleReviewer: true, unreadable: true, ...floorMeta } }
-            : { gate: "review", pass: true, details: `WARNING: ${reason} — review waived by config`, meta: { noEligibleReviewer: true, ...floorMeta } };
+        const reason = `no cross-vendor reviewer available at or above ${reviewerFloor} floor (${reviewerFloorCause}; diversity rule); author vendors: ${[...authorVendors].sort().join(", ") || "unknown"}${unresolvedAuthors.length ? `; unresolved author channels: ${unresolvedAuthors.join(", ")}` : ""}`;
+        return { gate: "review", pass: false, details: `unreadable — ${reason}; operator approve --waive required to proceed`,
+            meta: { noEligibleReviewer: true, unreadable: true, findings: [], authorVendors: [...authorVendors].sort(), unresolvedAuthors, ...floorMeta } };
     }
     reviewHistory?.push(channelKey(reviewer));
     const rotationMeta = rotationSeat === undefined ? {} : { rotationSeat };
@@ -515,6 +508,10 @@ ${priorMaterials.length ? `${renderPriorMaterials(priorMaterials)}
 Context only: this never substitutes for an acceptance criterion or closes a prior material.
 ${operatorContext.trim()}
 
+` : ""}${task.outOfScope?.length ? `## Out of scope
+The task declares these items out of scope. A finding inside these declared bounds is not material and must not block approval.
+${task.outOfScope.map((item) => `- ${item}`).join("\n")}
+
 ` : ""}## Diff
 \`\`\`diff
 ${diff}

package/dist/gates/run-gates.js

@@ -17,7 +17,7 @@ import { scopeGate } from "./scope.js";
 import { evaluateManifestedTest, isVitestTestCommand } from "./test-manifest.js";
 import { executionSignal } from "../run/execution-budget.js";
 import { failureDisposition } from "../run/recovery.js";
-import { preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
+import { dependencyLinkRefusal, preserveWorktree, shGit, resolvedCapacity, verificationProtocol } from "../run/git.js";
 import { withJudgeInvocationEvidence } from "../run/journal.js";
 import { computeVerificationIdentity, verificationIdentityKey, formatReusedRow, getVerdictStore, isInfraResult, resolveStateDir, reusedIdentity, } from "./cache.js";
 const productionLoadProvider = () => loadavg()[0] ?? 0;
@@ -304,6 +304,16 @@ export async function runGates(task, ctx) {
     };
     let selectionDecision;
     let commits = [];
+    // Check before cache identity, npm policy probes, or any gate command.
+    const dependencyRefusal = dependencyLinkRefusal(ctx.worktree);
+    if (dependencyRefusal) {
+        const gate = GATE_NAMES.find(g => task.gates.includes(g)) ?? "build";
+        const result = { gate, pass: false, details: dependencyRefusal,
+            meta: { infra: true, classification: "infra", retryable: false, kind: "workspace-dependency" } };
+        await noBuild("refused", dependencyRefusal);
+        await ctx.onGate?.({ phase: "end", gate, result });
+        return { results: [result], commits: [] };
+    }
     const stateDir = ctx.stateDir ?? resolveStateDir(ctx.worktree, ctx.artifactDir);
     const verdictStore = getVerdictStore(stateDir);
     // R41: the verification protocol and the EFFECTIVE npm lifecycle policy measured for THIS

package/dist/gates/test-manifest.d.ts

@@ -37,6 +37,11 @@ export interface TestReport {
     requested: string[];
     started: Record<string, number>;
     completed: Record<string, TestReportCompletion>;
+    /** Resolved scheduling observed at run start; absent/partial means unknown, never inferred. */
+    scheduling?: Record<string, {
+        pool: string;
+        singleFork: boolean;
+    }>;
     /** Files the reporter observed complete MORE than once — `completed`'s object keys cannot show
      * this themselves (a second write silently overwrites the first), so the reporter records the
      * evidence separately before it is lost. */