tickmarkr 2.6.3 → 2.6.5

package/dist/compile/native.js

@@ -58,6 +58,121 @@ export function classifyContextPath(entry, tracked, repoDir) {
     const hits = [...tracked].filter((t) => basename(t) === base);
     return hits.length === 1 ? { kind: "missing", suggestion: hits[0] } : { kind: "missing" };
 }
+// v2.6.4 T9 (E): picomatch (the files[] matcher, graph/files-glob.ts) expands a brace group only when
+// it holds a top-level comma or a `..` range, which compiles to a character class — faithful only
+// between single characters: `{A..z}` is `[A-z]`, but `{1..10}` is the class `[1-10]`. Any other
+// unescaped group stays LITERAL braces: `docs/{a}.md` scopes a file named `docs/{a}.md`, never
+// `docs/a.md` (2.6.3 T10: six scope reds). Like picomatch, a `[...]` class (opened only when a `]`
+// follows; a `]` right after `[` or `[^` is a member) swallows braces and commas: `docs/{[a,b]}.md`
+// stays literal, `docs/[{a}].md` holds no group. A POSIX `[:name:]` inside a class is replayed as
+// picomatch's parser does it (the `:]` is consumed, the class stays open), so `docs/{[[:alpha:],]}.md`
+// stays literal and `docs/[[:alpha:]{a}].md` holds no group. Outside a class, picomatch reads `"..."` as
+// quoted literal text (an escape still applies inside it), so a quoted `[`, `{` or `,` opens nothing:
+// `docs/"["/{a}].md` still holds the group `{a}`, `docs/"{a}".md` holds none. A class picomatch never
+// closes (its only `]` is a member: `docs/[]/{a}.md`) has its opener escaped at the end, and everything
+// after that opener stays literal text — no quotes, no classes, braces literal — so that tail is
+// rescanned for groups with only escapes honoured: `docs/[]/{a}.md` holds `{a}`. Returns each literal
+// group and the pattern with those braces dropped — the literal path its author almost certainly meant.
+// A range is read with picomatch's escapes: its lexer drops a backslash before `.`, `/` or `;` (the char
+// stays live, so `{1\..3}` IS the range `{1..3}`) and keeps any other `\X` as one literal character. Each
+// end must be one such character, and the matcher itself must then match both ends: `{\d..z}` compiles
+// to the class `[\d-z]`, which never matches "d".
+const RANGE_END = String.raw `(\\[\s\S]|[^\\])`;
+const RANGE = new RegExp(`^${RANGE_END}\\.\\.${RANGE_END}$`);
+function supportedRange(group) {
+    const ends = RANGE.exec(group.replace(/\\([\s\S])/g, (pair, ch) => "./;".includes(ch) ? ch : pair));
+    if (!ends)
+        return false;
+    const match = filesGlob(`{${group}}`);
+    return ends.slice(1).every((end) => match(end.slice(-1)));
+}
+const POSIX_CLASS = picomatch.constants.POSIX_REGEX_SOURCE;
+function singletonBraces(pattern) {
+    const open = [];
+    const groups = [];
+    const drop = new Set();
+    let cls; // the open character class's text as picomatch accumulates it, undefined outside one
+    let clsAt = -1; // the open class's opener
+    let quoted = false; // inside a "..." run outside any class
+    let raw = false; // past an unterminated class's opener: literal text, only escapes and braces count
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (cls !== undefined) {
+            const at = cls.lastIndexOf("[");
+            if (ch === "\\")
+                cls += pattern.slice(i, ++i + 1);
+            else if (ch === "]" && cls !== "[" && cls !== "[^")
+                cls = undefined;
+            else if (ch === ":" && at > 0 && cls.includes(":", 1) && Object.hasOwn(POSIX_CLASS, cls.slice(at + 2))) {
+                cls = cls.slice(0, at) + POSIX_CLASS[cls.slice(at + 2)];
+                i++; // picomatch consumes the char after the closing `:` (the `]` of `[:name:]`) without closing the class
+            }
+            else
+                cls += ch;
+        }
+        else if (ch === "\\")
+            i++; // escaped: `\{a\}` is a literal filename
+        else if (ch === '"' && !raw)
+            quoted = !quoted;
+        else if (quoted)
+            continue;
+        else if (ch === "[" && !raw && pattern.includes("]", i + 1))
+            [cls, clsAt] = ["[", i];
+        else if (ch === "{")
+            open.push({ at: i, comma: false });
+        else if (ch === "," && open.length)
+            open[open.length - 1].comma = true;
+        else if (ch === "}" && open.length) {
+            const { at, comma } = open.pop();
+            if (comma || supportedRange(pattern.slice(at + 1, i)))
+                continue;
+            groups.push(pattern.slice(at, i + 1));
+            drop.add(at).add(i);
+        }
+        if (cls !== undefined && i + 1 >= pattern.length)
+            [i, cls, raw] = [clsAt, undefined, true]; // unterminated: rescan its tail raw
+    }
+    return { groups, bare: pattern.split("").filter((_, i) => !drop.has(i)).join("") };
+}
+// v2.6.4 T9 (E): a files[] path the SELECTED git tree (spec base, else HEAD — what a worker's worktree
+// is built from) stores as a symlink, mode 120000, scopes the link's own bytes: its stored target
+// text. An edit made THROUGH the link writes the file it points to, which the scope gate refuses. The
+// checkout is never the oracle — its links may be untracked or replaced. Advisory only; with no
+// repository (or no files[]) there is no tree to inspect and git is never spawned.
+function symlinkScopeWarnings(file, tasks, base) {
+    const scoped = tasks.filter((task) => task.files.length > 0)
+        .map((task) => ({ id: task.id, match: filesGlob(task.files.map((entry) => entry.replace(/^\.\//, ""))) }));
+    if (!scoped.length || !repositoryRoot(file))
+        return [];
+    const tree = base ?? "HEAD";
+    const git = (...args) => spawnSync("git", ["-C", dirname(file), ...args], { encoding: "utf8", maxBuffer: 1 << 28 });
+    const failed = (r) => r.error || r.signal || r.status !== 0 || typeof r.stdout !== "string";
+    const why = (r) => r.signal ? `signal ${r.signal}` : r.status === null ? "git did not run" : `git exit ${r.status}`;
+    const advisory = (what, r) => `tickmarkr: advisory: files[] symlink inspection could not read ${what} in the selected git tree ${JSON.stringify(tree)} (${why(r)}) — symlink scope is unverified for this compile.`;
+    const ls = git("ls-tree", "--full-tree", "-r", "-z", "--end-of-options", tree); // a base is never an option
+    if (failed(ls))
+        return [advisory("the tree", ls)];
+    const warnings = [];
+    for (const row of ls.stdout.split("\0")) {
+        const link = /^120000 blob ([0-9a-f]+)\t([\s\S]+)$/.exec(row);
+        if (!link)
+            continue;
+        const owners = scoped.filter((task) => task.match(link[2]));
+        if (!owners.length)
+            continue;
+        // ponytail: one cat-file per matched link; switch to `cat-file --batch` if a scope matches hundreds
+        const target = git("cat-file", "blob", link[1]);
+        if (failed(target)) {
+            warnings.push(advisory(`the stored target of ${JSON.stringify(link[2])}`, target));
+            continue;
+        }
+        for (const { id } of owners) {
+            warnings.push(`tickmarkr: task ${id} files[] path ${JSON.stringify(link[2])} is a symlink in the selected git tree ${JSON.stringify(tree)} storing target ${JSON.stringify(target.stdout)} — `
+                + `files[] owns only that stored target text; an edit made through the link changes the file it points to, which needs its own files[] entry.`);
+        }
+    }
+    return warnings;
+}
 // OBS-97: mirror of the vitest.config.ts suite include — the only path class vitest collects.
 export const COLLECTABLE_TESTS = "tests/**/*.test.ts";
 export const LEGACY_PREFIX = ["dro", "vr"].join("");
@@ -611,6 +726,19 @@ export function compileNative(file, options = {}) {
     // A fixture pin's path set is split only — never annotation-stripped: "fixtures/output (old)" is a
     // filename, and csv() would silently retarget the declared obligation to "fixtures/output".
     const pinPaths = (value) => splitTop(value).map((item) => item.trim()).filter(Boolean);
+    // v2.6.4 T9 (E): refused BEFORE the hosting probe below, which expands every brace group — so it
+    // would certify `tests/{native}.test.ts` as a test home while the scope gate never matches it.
+    for (const draft of drafts) {
+        for (const entry of csv(draft.fields.files)) {
+            const { groups, bare } = singletonBraces(entry);
+            if (groups.length) {
+                invalid(draft.id, "files", `entry ${JSON.stringify(entry)} holds single-item brace group${groups.length === 1 ? "" : "s"} ${groups.join(", ")}: `
+                    + `the scope gate matches ${groups.length === 1 ? "it" : "them"} as literal braces while test hosting expands ${groups.length === 1 ? "it" : "them"}, `
+                    + `so the declared scope disagrees with itself. Write the bare path ${JSON.stringify(bare)}, list two or more alternatives as {a,b}, `
+                    + `or escape the braces (\\{ \\}) if they are part of the filename (a range expands only between single characters, e.g. {1..3} or {a..c}).`);
+            }
+        }
+    }
     // OBS-97: a typed test: oracle needs a collectable home. vitest only collects COLLECTABLE_TESTS
     // paths, so a task whose non-empty files[] cannot host one makes scope-green and acceptance-green
     // mutually exclusive by construction — run-20260719-210434 burned two dispatch attempts before a
@@ -744,6 +872,8 @@ export function compileNative(file, options = {}) {
         },
         tasks,
     });
+    for (const warning of symlinkScopeWarnings(file, result.tasks, specBase))
+        console.warn(warning);
     const authoringFindings = authoringLintFindings(result.tasks, file);
     const blockingCodes = new Set(["criterion-scope", "fence-symbol-absent"]);
     const blockingFindings = authoringFindings.filter((finding) => options.strict || blockingCodes.has(finding.code));

package/dist/config/config.d.ts

@@ -394,19 +394,23 @@ export type ModeResolution = {
 export declare function loadConfigWithMode(repoRoot: string, opts?: {
     globalDir?: string;
     repoOverlayText?: string;
+    userOverlayText?: string;
 }): {
     cfg: TickmarkrConfig;
     mode: ModeResolution;
 };
-/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay resolve them. */
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay resolve them. */
 export type LowerLayerModelOverrides = Record<string, Record<string, Record<string, unknown>>>;
-/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
- *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited.
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay merge them —
+ *  defaults + global under the repo overlay; B2 `below: "user"`: the defaults alone under the USER
+ *  overlay, which is never read as its own lower layer. Read raw, never schema-validated: a lower
+ *  layer may only validate beside upper fields (global `vendor: null` completed by a repo vendor)
+ *  and its override metadata is still inherited.
  *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
  *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export declare function lowerLayerModelOverrides(opts?: {
     globalDir?: string;
+    below?: "repo" | "user";
 }): {
     ok: true;
     overrides: LowerLayerModelOverrides;
@@ -417,11 +421,14 @@ export declare function lowerLayerModelOverrides(opts?: {
 export declare function loadConfig(repoRoot: string, opts?: {
     globalDir?: string;
 }): TickmarkrConfig;
-/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
- *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
- *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+/** v1.52 T2 write-time reload guard: run candidate overlay bytes (the repo layer, or B2's USER layer)
+ *  through the SAME production loader path every later command uses (parse → merge → schema → mode
+ *  resolution). Returns null when the bytes load, else the loader's failure message — the caller
+ *  must refuse the write. */
 export declare function overlayBytesLoadError(repoRoot: string, bytes: string, opts?: {
     globalDir?: string;
+    layer?: "repo" | "user";
+    repoOverlayText?: string;
 }): string | null;
 export type InitConfigOverlay = {
     concurrency?: number;
@@ -474,6 +481,17 @@ export declare function fleetEditableFromConfig(cfg: TickmarkrConfig, universe?:
 export declare function fleetKeyLayer(repoRoot: string, dotted: string, opts?: {
     globalDir?: string;
 }): "defaults" | "global" | "repo";
+/** B2: the user-overlay keys a write changes that the repo overlay (merged above it) decides in this
+ *  repository — it declares the path, or a non-map (value, list, null tombstone) at a prefix that
+ *  replaces or deletes the user's subtree, or its merge otherwise moves the value (a repo pin/pool/
+ *  prefer replaces the user's whole routing.map slot atomically) — each with the value that still
+ *  applies here. Bytes the loader refuses yield none: the write guard refuses them anyway. */
+export declare function repoShadowedUserKeys(repoRoot: string, beforeUser: string, afterUser: string, opts?: {
+    globalDir?: string;
+}): Array<{
+    path: string;
+    value: unknown;
+}>;
 /** Non-interactive fleet state for CI drift checks (`tickmarkr fleet --print`). */
 export declare function formatFleetPrint(repoRoot: string, opts?: {
     globalDir?: string;

package/dist/config/config.js

@@ -545,10 +545,27 @@ export const DEFAULT_CONFIG = {
         // retired id. Installed codex 0.144.1 lists it (models_cache.json client_version 0.144.0, fetched
         // 2026-07-10) AND a live runtime probe (`codex exec --model gpt-5.6-sol` → "OK", 2026-07-10) confirmed
         // it runs. Reseeding away would be a regression — the CLI upgrade closed the gate. Seed stays.
+        // v2.6.4 T3 (B1b, D-717): gpt-6-astra / gpt-6-sol / gpt-6-luna seeded AHEAD of the retained gpt-5.x
+        // ids from the installed CLI's models_cache.json snapshot (codex 0.159.0, fetched 2026-09-29T16:09Z).
+        // Tiers are ASSUMPTIONS, not measurements — no benchmark was run or cited for any of the three:
+        // astra=frontier and luna=cheap follow the provider's own descriptions in the local cache (read
+        // 2026-09-29: "Frontier intelligence for the most demanding work" / "Fast and affordable model for
+        // easier tasks"); sol=frontier keeps the shipped workhorse-family mapping (gpt-5.6-sol above) by
+        // continuity. Learned routing or an overlay may retier on evidence. gpt-5.5 stays seeded until its
+        // CLI-announced retirement (2026-10-14T19:00:00Z → gpt-5.6-sol); gpt-5.6-sol is not retiring.
+        // Windows: the same snapshot lists context_window=272000 for all seven — the budget the CLI launches
+        // with, and the authority for these seeds. The API's published 1,050,000 is a different surface and is
+        // not contradicted. A later cache listing more ids (gpt-6.1-sol) does not widen this sealed set.
         codex: {
             vendor: "openai", channel: "sub",
-            models: { "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap" },
-            windows: { "gpt-5.6-sol": 1_050_000, "gpt-5.5": 1_050_000, "gpt-5.6-terra": 1_050_000, "gpt-5.6-luna": 1_050_000 },
+            models: {
+                "gpt-6-astra": "frontier", "gpt-6-sol": "frontier", "gpt-6-luna": "cheap",
+                "gpt-5.6-sol": "frontier", "gpt-5.5": "frontier", "gpt-5.6-terra": "mid", "gpt-5.6-luna": "cheap",
+            },
+            windows: {
+                "gpt-6-astra": 272_000, "gpt-6-sol": 272_000, "gpt-6-luna": 272_000,
+                "gpt-5.6-sol": 272_000, "gpt-5.5": 272_000, "gpt-5.6-terra": 272_000, "gpt-5.6-luna": 272_000,
+            },
         },
         // grok-4.5 (xAI, released 2026-07-08) → mid: AA Intelligence 54 (#4), Terminal-Bench 2.1 83.3%
         // (≈ GPT-5.5 83.4, Fable 5 84.3), SWE-bench Pro 64.7%, ~4.2× more token-efficient than Opus 4.8
@@ -809,7 +826,11 @@ function resolveRoutingMode(cfg, layers) {
 /** loadConfig plus the mode-resolution record (floor provenance + plan lints). The resolved floors are
  *  already applied to cfg.routing.floors — route() consumes floors only and never sees the mode. */
 export function loadConfigWithMode(repoRoot, opts = {}) {
-    const globalCfg = readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"));
+    // B2: userOverlayText substitutes candidate bytes for the on-disk USER layer — the fleet's save
+    // destination — so a preview and the write guard load exactly the bytes a save would land.
+    const globalCfg = opts.userOverlayText === undefined
+        ? readYaml(join(opts.globalDir ?? globalConfigDir(), "config.yaml"))
+        : parse(opts.userOverlayText);
     // v1.52 T2: repoOverlayText substitutes candidate bytes for the on-disk repo layer — the fleet
     // write guard validates EXACTLY what it is about to write through this one loader path.
     const repoCfg = opts.repoOverlayText === undefined
@@ -824,9 +845,11 @@ export function loadConfigWithMode(repoRoot, opts = {}) {
     assertSeededModelWindows();
     return { cfg: r.data, mode: resolveRoutingMode(r.data, [globalCfg, repoCfg]) };
 }
-/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the repo overlay (defaults + global)
- *  merge them. Read raw, never schema-validated: a lower layer may only validate beside repo fields
- *  (global `vendor: null` completed by a repo vendor) and its override metadata is still inherited.
+/** OBS-1182: tiers.<adapter>.modelOverrides as the layers under the written overlay merge them —
+ *  defaults + global under the repo overlay; B2 `below: "user"`: the defaults alone under the USER
+ *  overlay, which is never read as its own lower layer. Read raw, never schema-validated: a lower
+ *  layer may only validate beside upper fields (global `vendor: null` completed by a repo vendor)
+ *  and its override metadata is still inherited.
  *  OBS-1188: an unparseable global file, or a non-map where this path expects a map, is an error —
  *  never an empty lower layer, which would silently drop the metadata a write must re-mask. */
 export function lowerLayerModelOverrides(opts = {}) {
@@ -834,7 +857,7 @@ export function lowerLayerModelOverrides(opts = {}) {
     const path = join(opts.globalDir ?? globalConfigDir(), "config.yaml");
     let global;
     try {
-        global = readYaml(path);
+        global = opts.below === "user" ? undefined : readYaml(path);
     }
     catch (error) {
         return { ok: false, error: `lower config layer ${path} is malformed YAML: ${error.message.replace(/\s+/g, " ").trim()}` };
@@ -865,12 +888,17 @@ export function lowerLayerModelOverrides(opts = {}) {
 export function loadConfig(repoRoot, opts = {}) {
     return loadConfigWithMode(repoRoot, opts).cfg;
 }
-/** v1.52 T2 write-time reload guard: run candidate repo-overlay bytes through the SAME production
- *  loader path every later command uses (parse → merge → schema → mode resolution). Returns null
- *  when the bytes load, else the loader's failure message — the caller must refuse the write. */
+/** v1.52 T2 write-time reload guard: run candidate overlay bytes (the repo layer, or B2's USER layer)
+ *  through the SAME production loader path every later command uses (parse → merge → schema → mode
+ *  resolution). Returns null when the bytes load, else the loader's failure message — the caller
+ *  must refuse the write. */
 export function overlayBytesLoadError(repoRoot, bytes, opts = {}) {
     try {
-        loadConfigWithMode(repoRoot, { ...opts, repoOverlayText: bytes });
+        loadConfigWithMode(repoRoot, {
+            globalDir: opts.globalDir,
+            // B2: a user-layer check may substitute the repo layer too ("" = none: the bytes on their own)
+            ...(opts.layer === "user" ? { userOverlayText: bytes, repoOverlayText: opts.repoOverlayText } : { repoOverlayText: bytes }),
+        });
         return null;
     }
     catch (e) {
@@ -1085,6 +1113,59 @@ export function fleetKeyLayer(repoRoot, dotted, opts = {}) {
         return "global";
     return "defaults";
 }
+const isPlainMap = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+/** B2: every leaf path an overlay write changes — a map on either side (the other absent) is
+ *  walked, anything else (scalar, list, null tombstone) is one leaf. */
+function changedLeafPaths(before, after, path = []) {
+    if (JSON.stringify(before) === JSON.stringify(after))
+        return [];
+    const walkable = (v) => v === undefined || isPlainMap(v);
+    if (!walkable(before) || !walkable(after))
+        return [path];
+    const b = (before ?? {});
+    const a = (after ?? {});
+    return [...new Set([...Object.keys(b), ...Object.keys(a)])].flatMap((key) => changedLeafPaths(b[key], a[key], [...path, key]));
+}
+/** B2: the user-overlay keys a write changes that the repo overlay (merged above it) decides in this
+ *  repository — it declares the path, or a non-map (value, list, null tombstone) at a prefix that
+ *  replaces or deletes the user's subtree, or its merge otherwise moves the value (a repo pin/pool/
+ *  prefer replaces the user's whole routing.map slot atomically) — each with the value that still
+ *  applies here. Bytes the loader refuses yield none: the write guard refuses them anyway. */
+export function repoShadowedUserKeys(repoRoot, beforeUser, afterUser, opts = {}) {
+    let effective;
+    let paths;
+    try {
+        effective = loadConfigWithMode(repoRoot, { globalDir: opts.globalDir, userOverlayText: afterUser }).cfg;
+        paths = changedLeafPaths(parse(beforeUser) ?? undefined, parse(afterUser) ?? undefined);
+    }
+    catch {
+        return [];
+    }
+    // the same bytes without the repo layer: any changed path whose value differs here is the repo's merge
+    let alone;
+    try {
+        alone = loadConfigWithMode(repoRoot, { globalDir: opts.globalDir, userOverlayText: afterUser, repoOverlayText: "" }).cfg;
+    }
+    catch {
+        alone = undefined;
+    }
+    const at = (cfg, path) => path.reduce((cur, key) => (isPlainMap(cur) ? cur[key] : undefined), cfg);
+    const repo = readOverlayFile(repoOverlayPath(repoRoot));
+    const decides = (path) => {
+        if (alone !== undefined && JSON.stringify(at(alone, path)) !== JSON.stringify(at(effective, path)))
+            return true;
+        let cur = repo;
+        for (const key of path) {
+            if (!isPlainMap(cur))
+                return cur !== repo;
+            if (!(key in cur))
+                return false;
+            cur = cur[key];
+        }
+        return true;
+    };
+    return paths.filter(decides).map((path) => ({ path: path.join("."), value: at(effective, path) }));
+}
 /** Non-interactive fleet state for CI drift checks (`tickmarkr fleet --print`). */
 export function formatFleetPrint(repoRoot, opts = {}) {
     const gdir = opts.globalDir ?? globalConfigDir();

package/dist/config/fleet-overlay.d.ts

@@ -1,4 +1,4 @@
-import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type RoutingMode } from "./config.js";
+import { type FleetEditable, type FleetUniverseRow, type LowerLayerModelOverrides, type MapEntry, type RoutingMode } from "./config.js";
 /** Fleet-owned overlay keys — the only config surface `tickmarkr fleet` may write. */
 export declare const FLEET_OVERLAY_KEYS: readonly ["routing", "tiers"];
 type FleetOverlayWriteFields = {
@@ -20,6 +20,7 @@ type FleetOverlayWriteFields = {
         };
     };
     universe?: FleetUniverseRow[];
+    lowerMap?: Record<string, MapEntry>;
 };
 type EffortFree = FleetEditable & {
     efforts?: undefined;

package/dist/config/fleet-overlay.js

@@ -1,5 +1,5 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isMap, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
 import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
 // OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
 // take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
@@ -161,7 +161,71 @@ function setStringSequencePreservingComments(doc, path, values) {
 // Total forms: a delete treats the masked subtree as absent (the operator's tombstone already
 // denies it, and survives untouched); a set clears the scalar and rebuilds what fleet owns —
 // the routing.allow precedent below.
+// T8 repair: an alias is no tombstone — `spec: *empty` resolves to a mapping. Each alias on the path
+// is replaced by an un-anchored copy of its target, so what it resolves to decides, and a write under
+// it never edits the anchored node its other aliases share.
+function materializeAliases(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isAlias(node))
+            continue;
+        const target = node.resolve(doc);
+        if (target === undefined)
+            return;
+        doc.setIn(path.slice(0, depth), detachedCopy(doc, node, target, new Set()));
+    }
+}
+const nodesOf = (root) => {
+    const out = [];
+    visit(root, (_key, node) => {
+        if (isNode(node))
+            out.push(node);
+    });
+    return out;
+};
+// D-821: a copy carries NO anchor (a nested `&empty` would rebind `plan: *empty` and every later
+// alias to the edited copy), and each inner alias must still name what it named in the original —
+// one whose anchor is redefined before `at` is replaced by a detached copy of its original target.
+function detachedCopy(doc, at, target, expanding) {
+    if (expanding.has(target))
+        throw new Error(`fleet cannot detach the recursive YAML alias *${at.source}`);
+    const visible = new Map();
+    visit(doc, (_key, node) => {
+        if (node === at)
+            return visit.BREAK;
+        if (isNode(node) && !isAlias(node) && node.anchor)
+            visible.set(node.anchor, node);
+    });
+    const copy = target.clone();
+    const originals = nodesOf(target);
+    const replace = new Map();
+    nodesOf(copy).forEach((node, index) => {
+        if (!isAlias(node)) {
+            node.anchor = undefined;
+            return;
+        }
+        const resolved = originals[index].resolve(doc);
+        if (resolved !== undefined && visible.get(node.source) !== resolved) {
+            replace.set(node, detachedCopy(doc, at, resolved, new Set([...expanding, target])));
+        }
+    });
+    if (!replace.size)
+        return copy;
+    visit(copy, (_key, node) => (isNode(node) ? replace.get(node) : undefined));
+    return copy;
+}
+function underScalar(doc, path) {
+    for (let depth = 1; depth < path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (node === undefined)
+            return false;
+        if (!isMap(node))
+            return true;
+    }
+    return false;
+}
 function deleteAt(doc, path) {
+    materializeAliases(doc, path); // an aliased mapping is no tombstone: Auto under `spec: *pinned` deletes the pin
     for (let depth = 1; depth < path.length; depth++) {
         if (!isMap(doc.getIn(path.slice(0, depth), true)))
             return;
@@ -171,6 +235,7 @@ function deleteAt(doc, path) {
         doc.deleteIn(path);
 }
 function setAt(doc, path, value) {
+    materializeAliases(doc, path); // edit a copy of an aliased mapping, never drop what it resolved to
     for (let depth = 1; depth < path.length; depth++) {
         const node = doc.getIn(path.slice(0, depth), true);
         if (node === undefined)
@@ -281,11 +346,19 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
         const before = initial.map[shape];
         const after = edited.map[shape];
-        if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
+        const pinPath = ["routing", "map", shape, "pin"];
+        const declares = after?.pin !== undefined || after?.pool !== undefined || after?.prefer !== undefined;
+        if (!declares && write.lowerMap?.[shape]?.pin !== undefined && JSON.stringify(before) !== JSON.stringify(after)) {
+            // pin: null tombstone — masks the lower-layer pin; a scalar tombstone above it already masks the entry
+            materializeAliases(doc, pinPath);
+            if (!underScalar(doc, pinPath))
+                setScalarPreservingComment(doc, pinPath, null);
+        }
+        else if (JSON.stringify(before?.pin) !== JSON.stringify(after?.pin)) {
             if (after?.pin === undefined)
-                deleteAt(doc, ["routing", "map", shape, "pin"]);
+                deleteAt(doc, pinPath);
             else
-                setAt(doc, ["routing", "map", shape, "pin"], doc.createNode(after.pin));
+                setAt(doc, pinPath, doc.createNode(after.pin));
         }
         if (JSON.stringify(before?.pool) !== JSON.stringify(after?.pool)) {
             const path = ["routing", "map", shape, "pool"];

package/dist/drivers/orca.d.ts

@@ -31,16 +31,18 @@ export declare class OrcaError extends Error {
     readonly raw: string;
     readonly code?: string;
     readonly runtimeId?: string;
+    readonly launchCause?: SeatLaunchCause;
     constructor(family: string, reason: string, raw: string, opts?: {
         code?: string;
         runtimeId?: string;
+        launchCause?: SeatLaunchCause;
     });
 }
 /** The slot cannot be addressed: dead/unknown terminal record, or a handle that cannot be recovered
  *  to exactly one owned terminal in the slot's own worktree. Never a silent false or empty string. */
 export declare class OrcaUnavailableError extends OrcaError {
     readonly terminalStatus?: string | undefined;
-    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined);
+    constructor(family: string, reason: string, raw: string, terminalStatus?: string | undefined, launchCause?: SeatLaunchCause);
 }
 export interface OrcaEnvelope {
     result: Record<string, unknown>;
@@ -83,6 +85,10 @@ export declare function terminalWorktree(term: Record<string, unknown>): string
 export declare function canonicalWorktreePath(path: string): string;
 /** The proof line a worker terminal prints first: create, recovery and focus read it back. */
 export declare const CHECKOUT_MARK = "TICKMARKR_CHECKOUT";
+/** E1: the one typed launch cause a driver attaches to its launch failure. `checkout-proof-timeout`
+ *  means the terminal printed NO proof frame by the ceiling — a slow host, not a misplaced seat. A
+ *  foreign or malformed frame is placement evidence and carries no cause (never a timeout exemption). */
+export type SeatLaunchCause = "checkout-proof-timeout";
 /** The exact bytes the create command prints as its first line. */
 export declare function checkoutProofLine(checkout: string): string;
 /** Every complete frame in a scrollback, decoded and canonicalized; whether an incomplete one was seen. */
@@ -250,6 +256,18 @@ export declare class OrcaDriver implements ExecutorDriver {
      * that supplied the ownership listing — else another terminal's or another runtime's bytes were
      * answered and nothing is proven. Proven means provesCheckout: exact canonical full-path equality
      * of a complete frame, no other checkout named, no incomplete frame.
+     * E1: with a `deadline` (create's window) there is ONE absolute deadline: a read is issued only while
+     * budget is left and is handed exactly that budget, and a page that still lands past it is late —
+     * nothing late proves the checkout. `seen` is what the scrollback showed, for the typed timeout:
+     * `misplaced` — a frame naming another checkout, a cut frame or an unparseable mark in anything read
+     * (the anchor's tail and every page included, even when paging stopped or a later read threw);
+     * `absent` — ONLY when every page down to the start of the scrollback was read before the ceiling
+     * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
+     * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
+     * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
+     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
+     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     private checkoutProven;
     private recover;