tickmarkr 2.6.2 → 2.6.4

package/dist/compile/native.js

@@ -58,6 +58,121 @@ export function classifyContextPath(entry, tracked, repoDir) {
     const hits = [...tracked].filter((t) => basename(t) === base);
     return hits.length === 1 ? { kind: "missing", suggestion: hits[0] } : { kind: "missing" };
 }
+// v2.6.4 T9 (E): picomatch (the files[] matcher, graph/files-glob.ts) expands a brace group only when
+// it holds a top-level comma or a `..` range, which compiles to a character class — faithful only
+// between single characters: `{A..z}` is `[A-z]`, but `{1..10}` is the class `[1-10]`. Any other
+// unescaped group stays LITERAL braces: `docs/{a}.md` scopes a file named `docs/{a}.md`, never
+// `docs/a.md` (2.6.3 T10: six scope reds). Like picomatch, a `[...]` class (opened only when a `]`
+// follows; a `]` right after `[` or `[^` is a member) swallows braces and commas: `docs/{[a,b]}.md`
+// stays literal, `docs/[{a}].md` holds no group. A POSIX `[:name:]` inside a class is replayed as
+// picomatch's parser does it (the `:]` is consumed, the class stays open), so `docs/{[[:alpha:],]}.md`
+// stays literal and `docs/[[:alpha:]{a}].md` holds no group. Outside a class, picomatch reads `"..."` as
+// quoted literal text (an escape still applies inside it), so a quoted `[`, `{` or `,` opens nothing:
+// `docs/"["/{a}].md` still holds the group `{a}`, `docs/"{a}".md` holds none. A class picomatch never
+// closes (its only `]` is a member: `docs/[]/{a}.md`) has its opener escaped at the end, and everything
+// after that opener stays literal text — no quotes, no classes, braces literal — so that tail is
+// rescanned for groups with only escapes honoured: `docs/[]/{a}.md` holds `{a}`. Returns each literal
+// group and the pattern with those braces dropped — the literal path its author almost certainly meant.
+// A range is read with picomatch's escapes: its lexer drops a backslash before `.`, `/` or `;` (the char
+// stays live, so `{1\..3}` IS the range `{1..3}`) and keeps any other `\X` as one literal character. Each
+// end must be one such character, and the matcher itself must then match both ends: `{\d..z}` compiles
+// to the class `[\d-z]`, which never matches "d".
+const RANGE_END = String.raw `(\\[\s\S]|[^\\])`;
+const RANGE = new RegExp(`^${RANGE_END}\\.\\.${RANGE_END}$`);
+function supportedRange(group) {
+    const ends = RANGE.exec(group.replace(/\\([\s\S])/g, (pair, ch) => "./;".includes(ch) ? ch : pair));
+    if (!ends)
+        return false;
+    const match = filesGlob(`{${group}}`);
+    return ends.slice(1).every((end) => match(end.slice(-1)));
+}
+const POSIX_CLASS = picomatch.constants.POSIX_REGEX_SOURCE;
+function singletonBraces(pattern) {
+    const open = [];
+    const groups = [];
+    const drop = new Set();
+    let cls; // the open character class's text as picomatch accumulates it, undefined outside one
+    let clsAt = -1; // the open class's opener
+    let quoted = false; // inside a "..." run outside any class
+    let raw = false; // past an unterminated class's opener: literal text, only escapes and braces count
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (cls !== undefined) {
+            const at = cls.lastIndexOf("[");
+            if (ch === "\\")
+                cls += pattern.slice(i, ++i + 1);
+            else if (ch === "]" && cls !== "[" && cls !== "[^")
+                cls = undefined;
+            else if (ch === ":" && at > 0 && cls.includes(":", 1) && Object.hasOwn(POSIX_CLASS, cls.slice(at + 2))) {
+                cls = cls.slice(0, at) + POSIX_CLASS[cls.slice(at + 2)];
+                i++; // picomatch consumes the char after the closing `:` (the `]` of `[:name:]`) without closing the class
+            }
+            else
+                cls += ch;
+        }
+        else if (ch === "\\")
+            i++; // escaped: `\{a\}` is a literal filename
+        else if (ch === '"' && !raw)
+            quoted = !quoted;
+        else if (quoted)
+            continue;
+        else if (ch === "[" && !raw && pattern.includes("]", i + 1))
+            [cls, clsAt] = ["[", i];
+        else if (ch === "{")
+            open.push({ at: i, comma: false });
+        else if (ch === "," && open.length)
+            open[open.length - 1].comma = true;
+        else if (ch === "}" && open.length) {
+            const { at, comma } = open.pop();
+            if (comma || supportedRange(pattern.slice(at + 1, i)))
+                continue;
+            groups.push(pattern.slice(at, i + 1));
+            drop.add(at).add(i);
+        }
+        if (cls !== undefined && i + 1 >= pattern.length)
+            [i, cls, raw] = [clsAt, undefined, true]; // unterminated: rescan its tail raw
+    }
+    return { groups, bare: pattern.split("").filter((_, i) => !drop.has(i)).join("") };
+}
+// v2.6.4 T9 (E): a files[] path the SELECTED git tree (spec base, else HEAD — what a worker's worktree
+// is built from) stores as a symlink, mode 120000, scopes the link's own bytes: its stored target
+// text. An edit made THROUGH the link writes the file it points to, which the scope gate refuses. The
+// checkout is never the oracle — its links may be untracked or replaced. Advisory only; with no
+// repository (or no files[]) there is no tree to inspect and git is never spawned.
+function symlinkScopeWarnings(file, tasks, base) {
+    const scoped = tasks.filter((task) => task.files.length > 0)
+        .map((task) => ({ id: task.id, match: filesGlob(task.files.map((entry) => entry.replace(/^\.\//, ""))) }));
+    if (!scoped.length || !repositoryRoot(file))
+        return [];
+    const tree = base ?? "HEAD";
+    const git = (...args) => spawnSync("git", ["-C", dirname(file), ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const failed = (r) => r.error || r.signal || r.status !== 0 || typeof r.stdout !== "string";
+    const why = (r) => r.signal ? `signal ${r.signal}` : r.status === null ? "git did not run" : `git exit ${r.status}`;
+    const advisory = (what, r) => `tickmarkr: advisory: files[] symlink inspection could not read ${what} in the selected git tree ${JSON.stringify(tree)} (${why(r)}) — symlink scope is unverified for this compile.`;
+    const ls = git("ls-tree", "--full-tree", "-r", "-z", "--end-of-options", tree); // a base is never an option
+    if (failed(ls))
+        return [advisory("the tree", ls)];
+    const warnings = [];
+    for (const row of ls.stdout.split("\0")) {
+        const link = /^120000 blob ([0-9a-f]+)\t([\s\S]+)$/.exec(row);
+        if (!link)
+            continue;
+        const owners = scoped.filter((task) => task.match(link[2]));
+        if (!owners.length)
+            continue;
+        // ponytail: one cat-file per matched link; switch to `cat-file --batch` if a scope matches hundreds
+        const target = git("cat-file", "blob", link[1]);
+        if (failed(target)) {
+            warnings.push(advisory(`the stored target of ${JSON.stringify(link[2])}`, target));
+            continue;
+        }
+        for (const { id } of owners) {
+            warnings.push(`tickmarkr: task ${id} files[] path ${JSON.stringify(link[2])} is a symlink in the selected git tree ${JSON.stringify(tree)} storing target ${JSON.stringify(target.stdout)} — `
+                + `files[] owns only that stored target text; an edit made through the link changes the file it points to, which needs its own files[] entry.`);
+        }
+    }
+    return warnings;
+}
 // OBS-97: mirror of the vitest.config.ts suite include — the only path class vitest collects.
 export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
@@ -611,6 +726,19 @@ export function compileNative(file, options = {}) {
     // A fixture pin's path set is split only — never annotation-stripped: "fixtures/output (old)" is a
     // filename, and csv() would silently retarget the declared obligation to "fixtures/output".
     const pinPaths = (value) => splitTop(value).map((item) => item.trim()).filter(Boolean);
+    // v2.6.4 T9 (E): refused BEFORE the hosting probe below, which expands every brace group — so it
+    // would certify `tests/{native}.test.ts` as a test home while the scope gate never matches it.
+    for (const draft of drafts) {
+        for (const entry of csv(draft.fields.files)) {
+            const { groups, bare } = singletonBraces(entry);
+            if (groups.length) {
+                invalid(draft.id, "files", `entry ${JSON.stringify(entry)} holds single-item brace group${groups.length === 1 ? "" : "s"} ${groups.join(", ")}: `
+                    + `the scope gate matches ${groups.length === 1 ? "it" : "them"} as literal braces while test hosting expands ${groups.length === 1 ? "it" : "them"}, `
+                    + `so the declared scope disagrees with itself. Write the bare path ${JSON.stringify(bare)}, list two or more alternatives as {a,b}, `
+                    + `or escape the braces (\\{ \\}) if they are part of the filename (a range expands only between single characters, e.g. {1..3} or {a..c}).`);
+            }
+        }
+    }
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
@@ -744,6 +872,8 @@ export function compileNative(file, options = {}) {
         },
         tasks,
     });
+    for (const warning of symlinkScopeWarnings(file, result.tasks, specBase))
+        console.warn(warning);
     const authoringFindings = authoringLintFindings(result.tasks, file);
     const blockingCodes = new Set(["criterion-scope", "fence-symbol-absent"]);
     const blockingFindings = authoringFindings.filter((finding) => options.strict || blockingCodes.has(finding.code));
@@ -911,6 +1041,13 @@ acceptance is required on every task (a nested list of observable outcomes).
     - Enumerating one axis exhaustively is what hides the others. A spec that guards PARTIAL coverage
       site-by-site, member-by-member, can be defeated wholesale by CONDITIONAL coverage, which leaves
       every enumeration satisfied. After you enumerate, ask what a single flag would do to the whole set.
+    - A GOAL STATING AN INVARIANT OVER "every", "never" OR "any" CARRIES ITS CLOSED CASE TABLE AS A
+      CRITERION: the in-scope consumers, bridges, operations and event sequences it ranges over, each a
+      row a test exercises. An unenumerated invariant is repaired one edge per review round while every
+      round re-judges the accumulated diff (OBS-1019 add.2). The table binds author and reviewer, never a
+      worker's claim: each review material binds its declared class to the goal clause or criterion it
+      violates through input-to-consequence evidence marked executed, static or blocked. A worker's own
+      table alone never silences a real finding, and blocked evidence is never a pass.
     - EVERY CRITERION NAMES THE PAIR IT DISCRIMINATES: the correct case that MUST PASS, and the
       neighbouring plausible-wrong or false-clean case that MUST FAIL. Two easy examples that both pass are
       not discrimination — they are two ways of being green, and the wrong half is the whole point: it is

package/dist/config/config.d.ts

@@ -181,13 +181,13 @@ export declare function effectiveReviewPolicy(files: ReadonlyArray<string>, revi
 export declare function criticalPathHits(files: ReadonlyArray<string>, criticalPaths?: ReadonlyArray<string>): string[];
 export declare const ExecutionPolicySchema: z.ZodObject<{
     boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
-    repairSelection: z.ZodDefault<z.ZodBoolean>;
+    repairSelection: z.ZodOptional<z.ZodBoolean>;
     taskExecutionLimitMs: z.ZodNumber;
 }, z.core.$strict>;
 export declare const TickmarkrConfigSchema: z.ZodObject<{
     executionPolicy: z.ZodOptional<z.ZodObject<{
         boundedInfrastructure: z.ZodDefault<z.ZodBoolean>;
-        repairSelection: z.ZodDefault<z.ZodBoolean>;
+        repairSelection: z.ZodOptional<z.ZodBoolean>;
         taskExecutionLimitMs: z.ZodNumber;
     }, z.core.$strict>>;
     concurrency: z.ZodNumber;
@@ -309,6 +309,8 @@ export declare const TickmarkrConfigSchema: z.ZodObject<{
         tipTest: z.ZodOptional<z.ZodString>;
         lint: z.ZodOptional<z.ZodString>;
         diffCap: z.ZodOptional<z.ZodNumber>;
+        evidenceQuotaBytes: z.ZodOptional<z.ZodNumber>;
+        repairSelection: z.ZodOptional<z.ZodBoolean>;
         byShape: z.ZodOptional<z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             plan: "plan";
             spec: "spec";
@@ -374,6 +376,7 @@ export type TickmarkrConfig = z.infer<typeof TickmarkrConfigSchema>;
 export declare class ConfigError extends Error {
     constructor(message: string);
 }
+export declare const DEFAULT_EVIDENCE_QUOTA_BYTES: number;
 export declare const DEFAULT_CONFIG: TickmarkrConfig;
 export declare function globalConfigDir(): string;
 export declare function overlayPreferShapes(repoRoot: string, opts?: {
@@ -391,24 +394,41 @@ export type ModeResolution = {
 export declare function loadConfigWithMode(repoRoot: string, opts?: {
     globalDir?: string;
     repoOverlayText?: string;
+    userOverlayText?: string;
 }): {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
 };
-/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
- *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay resolve them. */
+export type LowerLayerModelOverrides = Record<string, Record<string, Record<string, unknown>>>;
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay merge them —
+ *  defaults + global under the repo overlay; B2 `below: "user"`: the defaults alone under the USER
+ *  overlay, which is never read as its own lower layer. Read raw, never schema-validated: a lower
+ *  layer may only validate beside upper fields (global `vendor: null` completed by a repo vendor)
+ *  and its override metadata is still inherited.
+ *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
+ *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export declare function lowerLayerModelOverrides(opts?: {
     globalDir?: string;
-}): Record<string, Record<string, Record<string, unknown>>>;
+    below?: "repo" | "user";
+}): {
+    ok: true;
+    overrides: LowerLayerModelOverrides;
+} | {
+    ok: false;
+    error: string;
+};
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
-/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
- *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
- *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+/** v1.52 T2 write-time reload guard: run candidate overlay bytes (the repo layer, or B2's USER layer)
+ *  through the SAME production loader path every later command uses (parse → merge → schema → mode
+ *  resolution). Returns null when the bytes load, else the loader's failure message — the caller
+ *  must refuse the write. */
 export declare function overlayBytesLoadError(repoRoot: string, bytes: string, opts?: {
     globalDir?: string;
+    layer?: "repo" | "user";
+    repoOverlayText?: string;
 }): string | null;
 export type InitConfigOverlay = {
     concurrency?: number;
@@ -461,6 +481,17 @@ export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?:
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;
 }): "defaults" | "global" | "repo";
+/** B2: the user-overlay keys a write changes that the repo overlay (merged above it) decides in this
+ *  repository — it declares the path, or a non-map (value, list, null tombstone) at a prefix that
+ *  replaces or deletes the user's subtree, or its merge otherwise moves the value (a repo pin/pool/
+ *  prefer replaces the user's whole routing.map slot atomically) — each with the value that still
+ *  applies here. Bytes the loader refuses yield none: the write guard refuses them anyway. */
+export declare function repoShadowedUserKeys(repoRoot: string, beforeUser: string, afterUser: string, opts?: {
+    globalDir?: string;
+}): Array<{
+    path: string;
+    value: unknown;
+}>;
 /** Non-interactive fleet state for CI drift checks (`tickmarkr fleet --print`). */
 export declare function formatFleetPrint(repoRoot: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -325,7 +325,8 @@ const ShapeGateParticipationSchema = z
 });
 export const ExecutionPolicySchema = z.object({
     boundedInfrastructure: z.boolean().default(false),
-    repairSelection: z.boolean().default(false),
+    // OBS-1199: absent inherits the effective default (on); an explicit false stays off.
+    repairSelection: z.boolean().optional(),
     taskExecutionLimitMs: z.number().int().positive(),
 }).strict();
 export const TickmarkrConfigSchema = z.object({
@@ -408,6 +409,12 @@ export const TickmarkrConfigSchema = z.object({
         tipTest: z.string(),
         lint: z.string(),
         diffCap: z.number().int().positive(),
+        // OBS-1140: per-run gate-evidence byte quota; the oldest artifacts are evicted (and tombstoned)
+        // past it. Zero retains zero artifact bytes. Evidence retention never changes a gate's pass bit.
+        evidenceQuotaBytes: z.number().int().nonnegative(),
+        // OBS-1199: repair rounds screen known failing files plus affected tests before the full suite
+        // that still decides every merge. On unless false here or in executionPolicy, on every driver.
+        repairSelection: z.boolean(),
         byShape: z.partialRecord(z.enum(SHAPES), ShapeGateParticipationSchema).optional(),
     }).partial(),
     scope: z.object({
@@ -488,6 +495,7 @@ function assertSeededModelWindows() {
         }
     }
 }
+export const DEFAULT_EVIDENCE_QUOTA_BYTES = 8 * 1024 * 1024;
 export const DEFAULT_CONFIG = {
     concurrency: 3,
     driver: "auto",
@@ -537,10 +545,27 @@ export const DEFAULT_CONFIG = {
         // retired id. Installed codex 0.144.1 lists it (models_cache.json client_version 0.144.0, fetched
         // 2026-07-10) AND a live runtime probe (`codex exec --model gpt-5.6-sol` → "OK", 2026-07-10) confirmed
         // it runs. Reseeding away would be a regression — the CLI upgrade closed the gate. Seed stays.
+        // v2.6.4 T3 (B1b, D-717): gpt-6-astra / gpt-6-sol / gpt-6-luna seeded AHEAD of the retained gpt-5.x
+        // ids from the installed CLI's models_cache.json snapshot (codex 0.159.0, fetched 2026-09-29T16:09Z).
+        // Tiers are ASSUMPTIONS, not measurements — no benchmark was run or cited for any of the three:
+        // astra=frontier and luna=cheap follow the provider's own descriptions in the local cache (read
+        // 2026-09-29: "Frontier intelligence for the most demanding work" / "Fast and affordable model for
+        // easier tasks"); sol=frontier keeps the shipped workhorse-family mapping (gpt-5.6-sol above) by
+        // continuity. Learned routing or an overlay may retier on evidence. gpt-5.5 stays seeded until its
+        // CLI-announced retirement (2026-10-14T19:00:00Z → gpt-5.6-sol); gpt-5.6-sol is not retiring.
+        // Windows: the same snapshot lists context_window=272000 for all seven — the budget the CLI launches
+        // with, and the authority for these seeds. The API's published 1,050,000 is a different surface and is
+        // not contradicted. A later cache listing more ids (gpt-6.1-sol) does not widen this sealed set.
         codex: {
             vendor: "openai", channel: "sub",
-            models: { "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap" },
-            windows: { "gpt-5.6-sol": 1_050_000, "gpt-5.5": 1_050_000, "gpt-5.6-terra": 1_050_000, "gpt-5.6-luna": 1_050_000 },
+            models: {
+                "gpt-6-astra": "frontier", "gpt-6-sol": "frontier", "gpt-6-luna": "cheap",
+                "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
+            },
+            windows: {
+                "gpt-6-astra": 272_000, "gpt-6-sol": 272_000, "gpt-6-luna": 272_000,
+                "gpt-5.6-sol": 272_000, "gpt-5.5": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
+            },
         },
         // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%
         // (≈ GPT-5.5 83.4, Fable 5 84.3), SWE-bench Pro 64.7%, ~4.2× more token-efficient than Opus 4.8
@@ -660,7 +685,7 @@ export const DEFAULT_CONFIG = {
         },
     },
     pricing: { cheap: 0.1, mid: 0.5, frontier: 2.5 },
-    gates: { diffCap: DEFAULT_DIFF_CAP },
+    gates: { diffCap: DEFAULT_DIFF_CAP, evidenceQuotaBytes: DEFAULT_EVIDENCE_QUOTA_BYTES },
     judge: { adapter: "claude-code", model: "fable" },
     // R3: no `policy` floor — the neutral floor leaves the compiler's per-task assignment standing, so
     // the path-keyed rule is reachable out of the box rather than raised to full by construction.
@@ -801,7 +826,11 @@ function resolveRoutingMode(cfg, layers) {
 /** loadConfig plus the mode-resolution record (floor provenance + plan lints). The resolved floors are
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export function loadConfigWithMode(repoRoot, opts = {}) {
-    const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
+    // B2: userOverlayText substitutes candidate bytes for the on-disk USER layer — the fleet's save
+    // destination — so a preview and the write guard load exactly the bytes a save would land.
+    const globalCfg = opts.userOverlayText === undefined
+        ? readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"))
+        : parse(opts.userOverlayText);
     // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
     // write guard validates EXACTLY what it is about to write through this one loader path.
     const repoCfg = opts.repoOverlayText === undefined
@@ -816,24 +845,60 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     assertSeededModelWindows();
     return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
 }
-/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
- *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited. */
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay merge them —
+ *  defaults + global under the repo overlay; B2 `below: "user"`: the defaults alone under the USER
+ *  overlay, which is never read as its own lower layer. Read raw, never schema-validated: a lower
+ *  layer may only validate beside upper fields (global `vendor: null` completed by a repo vendor)
+ *  and its override metadata is still inherited.
+ *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
+ *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export function lowerLayerModelOverrides(opts = {}) {
     const isMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
-    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml")));
-    const tiers = isMap(merged) && isMap(merged.tiers) ? merged.tiers : {};
-    return Object.fromEntries(Object.entries(tiers).map(([adapter, entry]) => [adapter, Object.fromEntries(Object.entries(isMap(entry) && isMap(entry.modelOverrides) ? entry.modelOverrides : {}).filter(([, o]) => isMap(o)))]));
+    const path = join(opts.globalDir ?? globalConfigDir(), "config.yaml");
+    let global;
+    try {
+        global = opts.below === "user" ? undefined : readYaml(path);
+    }
+    catch (error) {
+        return { ok: false, error: `lower config layer ${path} is malformed YAML: ${error.message.replace(/\s+/g, " ").trim()}` };
+    }
+    const malformed = (at) => ({ ok: false, error: `lower config layer ${path} is malformed: ${at} is not a map` });
+    // deepMerge replaces a map with any non-map the global declares, so the merged shape is the global's
+    const merged = deepMerge(structuredClone(DEFAULT_CONFIG), global);
+    if (!isMap(merged))
+        return malformed("the document");
+    const tiers = merged.tiers ?? {}; // a global `tiers: null` tombstone leaves no lower tiers
+    if (!isMap(tiers))
+        return malformed("tiers");
+    const overrides = {};
+    for (const [adapter, entry] of Object.entries(tiers)) {
+        if (!isMap(entry))
+            return malformed(`tiers.${adapter}`);
+        const models = entry.modelOverrides ?? {};
+        if (!isMap(models))
+            return malformed(`tiers.${adapter}.modelOverrides`);
+        for (const [model, override] of Object.entries(models)) {
+            if (!isMap(override))
+                return malformed(`tiers.${adapter}.modelOverrides.${model}`);
+        }
+        overrides[adapter] = models;
+    }
+    return { ok: true, overrides };
 }
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
-/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
- *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
- *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+/** v1.52 T2 write-time reload guard: run candidate overlay bytes (the repo layer, or B2's USER layer)
+ *  through the SAME production loader path every later command uses (parse → merge → schema → mode
+ *  resolution). Returns null when the bytes load, else the loader's failure message — the caller
+ *  must refuse the write. */
 export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
     try {
-        loadConfigWithMode(repoRoot, { ...opts, repoOverlayText: bytes });
+        loadConfigWithMode(repoRoot, {
+            globalDir: opts.globalDir,
+            // B2: a user-layer check may substitute the repo layer too ("" = none: the bytes on their own)
+            ...(opts.layer === "user" ? { userOverlayText: bytes, repoOverlayText: opts.repoOverlayText } : { repoOverlayText: bytes }),
+        });
         return null;
     }
     catch (e) {
@@ -1048,6 +1113,59 @@ export function fleetKeyLayer(repoRoot, dotted, opts = {}) {
         return "global";
     return "defaults";
 }
+const isPlainMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** B2: every leaf path an overlay write changes — a map on either side (the other absent) is
+ *  walked, anything else (scalar, list, null tombstone) is one leaf. */
+function changedLeafPaths(before, after, path = []) {
+    if (JSON.stringify(before) === JSON.stringify(after))
+        return [];
+    const walkable = (v) => v === undefined || isPlainMap(v);
+    if (!walkable(before) || !walkable(after))
+        return [path];
+    const b = (before ?? {});
+    const a = (after ?? {});
+    return [...new Set([...Object.keys(b), ...Object.keys(a)])].flatMap((key) => changedLeafPaths(b[key], a[key], [...path, key]));
+}
+/** B2: the user-overlay keys a write changes that the repo overlay (merged above it) decides in this
+ *  repository — it declares the path, or a non-map (value, list, null tombstone) at a prefix that
+ *  replaces or deletes the user's subtree, or its merge otherwise moves the value (a repo pin/pool/
+ *  prefer replaces the user's whole routing.map slot atomically) — each with the value that still
+ *  applies here. Bytes the loader refuses yield none: the write guard refuses them anyway. */
+export function repoShadowedUserKeys(repoRoot, beforeUser, afterUser, opts = {}) {
+    let effective;
+    let paths;
+    try {
+        effective = loadConfigWithMode(repoRoot, { globalDir: opts.globalDir, userOverlayText: afterUser }).cfg;
+        paths = changedLeafPaths(parse(beforeUser) ?? undefined, parse(afterUser) ?? undefined);
+    }
+    catch {
+        return [];
+    }
+    // the same bytes without the repo layer: any changed path whose value differs here is the repo's merge
+    let alone;
+    try {
+        alone = loadConfigWithMode(repoRoot, { globalDir: opts.globalDir, userOverlayText: afterUser, repoOverlayText: "" }).cfg;
+    }
+    catch {
+        alone = undefined;
+    }
+    const at = (cfg, path) => path.reduce((cur, key) => (isPlainMap(cur) ? cur[key] : undefined), cfg);
+    const repo = readOverlayFile(repoOverlayPath(repoRoot));
+    const decides = (path) => {
+        if (alone !== undefined && JSON.stringify(at(alone, path)) !== JSON.stringify(at(effective, path)))
+            return true;
+        let cur = repo;
+        for (const key of path) {
+            if (!isPlainMap(cur))
+                return cur !== repo;
+            if (!(key in cur))
+                return false;
+            cur = cur[key];
+        }
+        return true;
+    };
+    return paths.filter(decides).map((path) => ({ path: path.join("."), value: at(effective, path) }));
+}
 /** Non-interactive fleet state for CI drift checks (`tickmarkr fleet --print`). */
 export function formatFleetPrint(repoRoot, opts = {}) {
     const gdir = opts.globalDir ?? globalConfigDir();

package/dist/config/fleet-overlay.d.ts

@@ -1,7 +1,7 @@
-import { type FleetEditable, type FleetUniverseRow, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
-export type FleetOverlayWrite = {
+type FleetOverlayWriteFields = {
     initial: FleetEditable;
     edited: FleetEditable;
     mode?: RoutingMode;
@@ -20,8 +20,17 @@ export type FleetOverlayWrite = {
         };
     };
     universe?: FleetUniverseRow[];
-    lowerOverrides?: Record<string, Record<string, Record<string, unknown>>>;
 };
+type EffortFree = FleetEditable & {
+    efforts?: undefined;
+};
+export type FleetOverlayWrite = FleetOverlayWriteFields & ({
+    lowerOverrides: LowerLayerModelOverrides;
+} | {
+    initial: EffortFree;
+    edited: EffortFree;
+    lowerOverrides?: undefined;
+});
 export type FleetFirstTouch = {
     vendor: string;
     channel: "sub" | "api";
@@ -36,3 +45,4 @@ export declare function repoOverlayYaml(overlay: Record<string, unknown>): strin
 export declare function serializeFleetOverlay(overlay: Record<string, unknown>): string;
 export declare function unifiedYamlDiff(before: string, after: string, label?: string): string;
 export declare function fleetEditableEquals(a: FleetEditable, b: FleetEditable): boolean;
+export {};

package/dist/config/fleet-overlay.js

@@ -368,27 +368,32 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             const after = efforts(edited)[adapter]?.[model];
             if (efforts(initial)[adapter]?.[model] === after)
                 continue;
+            // OBS-1188: the type already demands lower state here; this refuses a cast/JS caller before the
+            // bytes are returned, so a blind effort write never reaches disk.
+            const lowerAll = write.lowerOverrides;
+            if (!lowerAll) {
+                throw new Error(`fleet write: the effort edit on ${adapter}:${model} needs the lower config layers' model overrides — refusing to write it blind`);
+            }
             const override = ["tiers", adapter, "modelOverrides", model];
             if (after !== undefined) {
                 // Setting beneath a tombstone (the override, or modelOverrides above it) lifts it, and
                 // deepMerge would restore what it masked: re-mask each lower-layer key it covered — sibling
-                // models, then this override's vendor/channel (unknown lower ⇒ both, blind).
+                // models, then this override's own keys.
                 // ponytail: tiers.<adapter> itself tombstoned is unreachable here — its models, and so a tier, are masked too.
                 const tombstoned = (depth) => {
                     const node = doc.getIn(override.slice(0, depth), true);
                     return node !== undefined && !isMap(node);
                 };
-                const lowerModels = write.lowerOverrides?.[adapter] ?? {};
+                const lowerModels = lowerAll[adapter] ?? {};
                 const remask = [];
                 if (tombstoned(3))
                     for (const other of Object.keys(lowerModels))
                         if (other !== model)
                             remask.push([...override.slice(0, 3), other]);
                 if (tombstoned(3) || tombstoned(4)) {
-                    for (const key of write.lowerOverrides ? Object.keys(lowerModels[model] ?? {}) : ["vendor", "channel"]) {
+                    for (const key of Object.keys(lowerModels[model] ?? {}))
                         if (key !== "effort")
                             remask.push([...override, key]);
-                    }
                 }
                 setScalarPreservingComment(doc, [...override, "effort"], after);
                 for (const path of remask)
@@ -396,11 +401,10 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 continue;
             }
             // Clearing means no effort in the MERGED config: drop the repo key, then mask an effort the
-            // lower layers still declare (unknown lower ⇒ a repo that never held the key inherited it).
-            const held = doc.getIn([...override, "effort"]) !== undefined;
+            // lower layers still declare.
             deleteAt(doc, [...override, "effort"]);
-            const lower = write.lowerOverrides?.[adapter]?.[model];
-            const maskEffort = write.lowerOverrides ? lower?.effort !== undefined : !held;
+            const lower = lowerAll[adapter]?.[model];
+            const maskEffort = lower?.effort !== undefined;
             const repoNode = doc.getIn(override, true);
             const { effort: _masked, ...rest } = { ...lower, ...(isMap(repoNode) ? repoNode.toJSON() : {}) };
             if (Object.values(rest).some((v) => v !== null && v !== undefined)) {

package/dist/drivers/herdr.d.ts

@@ -62,6 +62,8 @@ export declare class HerdrDriver implements ExecutorDriver {
     private deliverySerial;
     private dispatchLeases;
     private deliveredPanes;
+    /** OBS-1203: slots bound by adopt() — their reads are harvest evidence, so a failed read throws. */
+    private adoptedSlots;
     private inputBoxes;
     private bootstraps;
     private journalRoots;
@@ -93,6 +95,16 @@ export declare class HerdrDriver implements ExecutorDriver {
     private paneId;
     private paneWidth;
     slot(cwd: string, name: string, opts?: SlotOpts): Promise<Slot>;
+    /**
+     * OBS-1203: bind THIS instance, READ-ONLY, to the pane an earlier daemon created for an owned slot,
+     * so a resumed daemon can read the interrupted attempt's trailer. slot() is never a substitute: it
+     * allocates a tab, reclaimStaleLabel closes the very pane holding the evidence, and it holds a
+     * dispatch lease only run() releases. Binding needs ownership evidence, never a label alone: exactly
+     * one pane carries the FULL owned label, herdr reports that pane's cwd as the journaled task
+     * checkout, and that path is a git checkout whose own top level it is. Zero, ambiguous or foreign
+     * candidates throw — the caller's decline. `pane list` and `git rev-parse` are the only calls made.
+     */
+    adopt(slot: Slot): Promise<Slot>;
     private tabSlot;
     private reclaimStaleLabel;
     private staleLabelPanes;