tickmarkr 2.6.5 → 2.6.7

package/dist/cli/commands/init.js

@@ -130,13 +130,24 @@ you were handed the whole picture — list the repository root, open every guida
   predate a project rename, so **search by CONCEPT, not by the current product name.** A memory nobody opens
   is worse than none: every seat assumes the lesson is recorded somewhere and no seat looks.
 - **The gates are the product.** Seven, defined in \`src/graph/schema.ts\`:
-  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order** —
-  the first five run as a battery that stops at its first red, then \`acceptance\` and \`review\` run
-  CONCURRENTLY (\`run-gates.ts:39\`, *"judge ‖ review"*). One repair reorders them: a repair the REVIEW sent
-  back (carried \`review:material\`, test selection on, no required repair test) runs build, lint, evidence and
-  scope, then \`acceptance\` ‖ \`review\`, then its test screen, so a review that re-reds an unchanged subject
-  starts no test at all; a test-red repair keeps the battery first. Either way nothing merges until the FULL
-  suite has passed on the merge-candidate commit. The first five are MANDATORY; only \`acceptance\` and
+  \`build test lint evidence scope acceptance review\`. **That is DECLARATION order, not execution order.**
+  The cheap checks run first and stop at their first red: \`build\`, \`lint\`, then \`evidence\` and \`scope\`.
+  A fresh or semantic-repair candidate then runs \`acceptance\` ‖ \`review\` CONCURRENTLY (\`run-gates.ts\`,
+  *"judge ‖ review"*) before any test payload: a decisive semantic red ends the round with zero diagnostic
+  or full test-gate runs (a required acceptance oracle still executes); otherwise ONE full verification job
+  follows, with no selected screen. Only an attributed behavioral test-red repair may buy one diagnostic
+  first — every required failing file plus conservatively selected tests reaching the diff — admitted only
+  on comparable harness timing with ratio <= 0.15 AND estimated cost <= 60000 ms; its behavioral red stops
+  the round before semantics, otherwise semantics precede the full job. Disabled, unsupported, over-cap or
+  unknown-cost selection skips the diagnostic instead of running a full suite before semantics, and a
+  killed diagnostic is never green. A seatless or no-verdict review lets acceptance finish and publish and
+  the full job run in-round, and stays unsatisfied until review-only recovery; a seatless acceptance
+  cancels its sibling, records the unrun test (\`testOwed\`) and every enabled gate still owed (an unrecorded
+  review included), cannot merge and parks infra; an actual cancellation or throw awaits cleanup and leaves
+  no mergeable partial set. Test-only verification and an explicit full recheck keep their full scope with
+  no invented semantics and no diagnostic. Nothing merges until the FULL suite has passed on the exact
+  merge-candidate commit; an exact full green answers only after identity, environment, cleanliness and
+  current complete-manifest checks. The first five are MANDATORY; only \`acceptance\` and
   \`review\` may be omitted per task. Implementations are in \`src/gates/\` — \`baseline.ts\` (build/test/lint,
   diffed against a recorded baseline so pre-existing failures are forgiven), \`evidence.ts\`, \`scope.ts\`,
   \`acceptance.ts\` (its judge reads the DIFF and every criterion must cite a changed hunk), \`review.ts\`
@@ -639,7 +650,8 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
     const interactive = input.isTTY === true && output.isTTY === true && !(values.yes ?? false);
     // Act 1 — preferences. Only when the repo config does not exist yet: init never rewrites an
     // operator's config; re-tuning is `tickmarkr fleet` (act 3 below still runs). Act 1 writes only
-    // project execution preferences; model choices are act 3's, saved to the USER overlay (B2).
+    // project execution preferences; model choices are act 3's, saved by Fleet's one destination rule:
+    // the USER overlay (B2), except a membership edit the repo overlay holds (T10).
     if (!repoConfigExists) {
         if (interactive) {
             emitBanner();
@@ -677,7 +689,9 @@ export async function init(argv, cwd = process.cwd(), io = {}) {
     // Act 3 — fleet. The compact discovery surface prints BETWEEN the acts so the operator reads
     // what the fleet browser (and its presets overlay, raised on the first Shapes entry) ranks
     // with; the final summary then carries a pointer, not a repeat. Its confirmation is the shared
-    // Fleet actuator's: the reviewed choices land in the user overlay (gdir), never the repo's.
+    // Fleet actuator's: a preset (routing.mode) lands in the user overlay (gdir), and so does every
+    // choice except a routing.allow/deny membership edit this repo overlay holds — T10 writes that one
+    // where it is effective, and the review names the destination before y.
     if (interactive) {
         output.write(`${doc}\n`);
         doc = "discovery shown above — full matrix any time with `tickmarkr doctor`";

package/dist/cli/commands/plan.js

@@ -19,7 +19,8 @@ import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.j
 import { carriedAuthorVendors, gateReviewerFloor, modelId, modelProvider, pickReviewer } from "../../gates/review.js";
 import { Journal, loadRoutingProfile, readProfileCursor, recordedGraphDefinitionHash, RUNS_WINDOW } from "../../run/journal.js";
 import { harnessLine, resolveHarness } from "../harness.js";
-import { codexCommitHeadline } from "../../adapters/codex-commit-check.js";
+import { codexCommitHeadline, codexEscapeRoleLine } from "../../adapters/codex-commit-check.js";
+import { codex } from "../../adapters/codex.js";
 import { channelKey, shq } from "../../adapters/types.js";
 import { shGit } from "../../run/git.js";
 import { runLockRunId, runStatusLine } from "../../run/lock.js";
@@ -279,6 +280,16 @@ export async function plan(argv, cwd = process.cwd(), adapters = allAdapters(),
     const entrySeats = routingEntrySeatLines(cfg);
     if (entrySeats.length)
         lines.push(...entrySeats, "");
+    // v2.6.6 T9 (K): Codex judge/review/consult seats launch with the worker grant (llm.ts, consult.ts), so a
+    // doctor-probed escape blocks them too; worker rows carry their own headline below.
+    const codexRoles = [
+        ...(cfg.judge.adapter === codex.id ? ["judge"] : []),
+        ...(pools.review.some((c) => c.adapter === codex.id) ? ["review"] : []),
+        ...(cfg.consult.adapter === codex.id || pools.consult.some((c) => c.adapter === codex.id) ? ["consult"] : []),
+    ];
+    const codexEscape = codexEscapeRoleLine(codexRoles, adapters, health);
+    if (codexEscape)
+        lines.push(codexEscape, "");
     // OBS-1185: the floor route() resolved for THIS task — a task hint over the configured/mode floor.
     const derivation = (t) => {
         const floor = resolvedFloor(t, cfg);

package/dist/cli/commands/verify.js

@@ -102,6 +102,37 @@ export function excludeAuthorProvider(channels, author) {
     const provider = modelProvider(author.model, author.vendor);
     return [author, ...channels.filter((candidate) => candidate !== author && modelProvider(candidate.model, candidate.vendor) !== provider)];
 }
+/**
+ * G (D-874): `--author` names who wrote the diff so review can EXCLUDE it — it never asks for a seat. So
+ * it resolves against installed identities (an installed adapter's doctor-listed or configured model),
+ * not against the review pool, whose role allow/deny, model-auth and tier gates say nothing about
+ * authorship. A pool member resolves to itself, unchanged. Anything else is an author-only identity: its
+ * vendor is the configured declaration (the model's override, else the adapter entry's; the adapter's own
+ * only when config has no entry), never inferred, and an unseeded model carries no tier of its own — it
+ * holds the human sentinel's frontier floor, so the reviewer floor is never lowered. Same-vendor, so it
+ * can never be seated. An identity nothing declares refuses by name.
+ */
+function authorIdentity(claim, cfg, adapters, health, pool) {
+    const [adapter = "", ...rest] = claim.split(":");
+    const model = rest.join(":");
+    const member = pool.find((c) => c.adapter === adapter && c.model === model);
+    if (member)
+        return member;
+    const a = adapters.find((x) => x.id === adapter);
+    const h = health[adapter];
+    const seeded = a?.channels(cfg).find((c) => c.model === model);
+    const entry = cfg.tiers[adapter];
+    const vendor = seeded?.vendor ?? (entry ? entry.modelOverrides?.[model]?.vendor ?? entry.vendor : a?.vendor);
+    const why = !a ? `no registered adapter "${adapter}"`
+        : !h?.installed ? `doctor does not record ${adapter} as installed`
+            : !seeded && !h.models?.includes(model) ? `${adapter} neither lists "${model}" in doctor nor configures it`
+                : !vendor ? `no vendor is declared for ${adapter}:${model}`
+                    : undefined;
+    if (why) {
+        throw new Error(`--author ${claim} does not name a discoverable author identity (${why}) — name an installed adapter's doctor-listed or configured model as <adapter>:<model>, or human`);
+    }
+    return seeded ?? { adapter, vendor: vendor, model, channel: entry?.modelOverrides?.[model]?.channel ?? entry?.channel ?? "sub", tier: "frontier" };
+}
 function recordedMerges(repoRoot) {
     const runs = join(repoRoot, ".tickmarkr", "runs");
     if (!existsSync(runs))
@@ -288,6 +319,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         const pools = rolePools(cfg, adapters, health);
         judgeChannels = pools.judge;
         channels = pools.review;
+        // Resolved before either branch so an undiscoverable claim refuses here, ahead of any capture —
+        // even where recorded authors bind and the claim is otherwise ignored.
+        const claimed = values.author && values.author !== "human" ? authorIdentity(values.author, cfg, adapters, health, channels) : undefined;
         if (owed.length) {
             // The run's lifetime patch authors bind the reviewer's exclusions; --author never overrides
             // them. An author the pool cannot resolve leaves review unseatable, which fails closed.
@@ -298,15 +332,9 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
             if (first)
                 author = { adapter: first.adapter, model: first.model, channel: first.channel, tier: first.tier };
         }
-        else if (values.author && values.author !== "human") {
-            const [adapter, ...rest] = values.author.split(":");
-            const model = rest.join(":");
-            const c = channels.find((ch) => ch.adapter === adapter && ch.model === model);
-            if (!c) {
-                throw new Error(`--author ${values.author} does not name a discoverable review channel — one of: ${channels.map(channelKey).join(", ") || "(none)"}`);
-            }
-            author = { adapter: c.adapter, model: c.model, channel: c.channel, tier: c.tier };
-            channels = excludeAuthorProvider(channels, c);
+        else if (claimed) {
+            author = { adapter: claimed.adapter, model: claimed.model, channel: claimed.channel, tier: claimed.tier };
+            channels = excludeAuthorProvider(channels, claimed);
         }
         else {
             channels = [...channels, HUMAN_CHANNEL];

package/dist/cli/help.d.ts

@@ -186,6 +186,7 @@ export declare const COMMAND_HELP: {
             "--pct <0..100>": string;
             "--threshold-pct <0..100>": string;
             "--stand-down": string;
+            "--status": string;
         };
         examples: string[];
     };

package/dist/cli/help.js

@@ -148,17 +148,22 @@ export const COMMAND_HELP = {
         ],
     },
     beat: {
-        usage: "beat <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> [options]",
-        description: "Write one supervision beat using the recorded arm. Stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
+        usage: "beat <start|stop|status> <orchestrator|orchestrator-context|overseer|overseer-context|watch> --seat <identity> | beat <tier> --seat <identity> [options]",
+        description: "start launches one detached --loop beat per tier and exits 0 only after reading back that child's own advancing beat; stop retires only that recorded generation and reads back DISARMED; status is read-only and exits nonzero for STALE, MISMATCH or UNREADABLE. The legacy <tier> form writes one supervision beat using the recorded arm: stood-down arms stay DISARMED until explicitly re-armed; stopped beats become STALE.",
         options: {
-            "--seat <identity>": "Required: identify the supervising pane or agent.",
+            "--seat <identity>": "Required for start, stop and every write: identify the supervising pane or agent; optional for status.",
             "--new-arm": "Create a new durable arm, allowing beats to resume after stand-down; the hand-off step for a seat taking over a stood-down tier (combine with --arm-id and --pct on a context tier).",
-            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit within one interval after stand-down.",
+            "--loop": "Create a new durable arm and beat in this process every 10 seconds; exit nonzero with its reason within one interval after stand-down, supersession or a refused write.",
             "--arm-id <identity>": "Name a newly created arm; with --pct, identify the context observation arm. Never refuses a tick.",
             "--pct <0..100>": "Report current context consumption percentage.",
             "--threshold-pct <0..100>": "Set the context warning threshold (default 75).",
             "--stand-down": "Record an explicit handoff and stand down this tier. A later one-shot tick on the old arm exits non-zero; context observations still raise and discharge the clear duty.",
-        }, examples: ["beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down", "beat overseer --seat supervisor --new-arm"],
+            "--status": "Legacy spelling of beat status <tier>: the same read-only result, writing nothing.",
+        }, examples: [
+            "beat start overseer --seat supervisor", "beat status overseer --seat supervisor", "beat stop overseer --seat supervisor",
+            "beat overseer --seat supervisor", "beat overseer --seat supervisor --loop", "beat overseer --seat supervisor --stand-down",
+            "beat overseer --seat supervisor --new-arm", "beat overseer --status",
+        ],
     },
     version: {
         usage: "version [--dist]", description: "Print the installed package version. Top-level aliases: --version and -v.",

package/dist/cli/index.d.ts

@@ -45,7 +45,7 @@ export declare const COMMANDS: {
     eval: typeof evalCommand;
 };
 export type RegisteredCommand = keyof typeof COMMANDS;
-export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
+export declare const USAGE = "tickmarkr \u2014 spec-driven orchestration harness for AI coding agents\nusage: tickmarkr <command>\n  init          guided setup + doctor; init --agent [--force] [--docs] adds agent skills/docs\n  doctor        re-probe adapters, herdr, auth; print capability matrix (--fix writes the test-runner ignore when a safe edit exists)\n  fleet         interactive fleet editor (fleet --print for CI drift checks)\n  compile <src> spec \u2192 .tickmarkr/graph.json (fails without acceptance criteria)\n  scope <intent> preview locally with --preview; draft after confirmation or --yes (--force to overwrite)\n  plan          dry-run routing table + cost estimate + floor lints\n  eval          discover and validate fixtures, seed isolated temp repos, then clean them up\n  run           execute the graph (--concurrency N --driver auto|herdr|subprocess|orca --route-strict; orca runs only when named)\n  status        live run state (--watch --events: JSON documents on stdout, keepalives on stderr; 2>&1 corrupts the stream)\n  stats         all-run channel delivery, red, rescue, author and reviewer statistics\n  verify        run the gate battery standalone against merge-base(--base, HEAD)..HEAD \u2014 verdict/JSON on stdout, progress on stderr; 2>&1 corrupts the verdict stream (--base main --criteria <file> | --task <id> [--files <glob>] [--author adapter:model] [--no-review] [--json])\n  resume <id>   continue a run from its journal\n  report <id>   cost/quality report (--md writes Markdown to stdout; redirect to save a record)\n  profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)\n  ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)\n  unlock        remove a stale/garbage run lock (refuses if the holder is alive)\n  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop\n  approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume\n  version       print the installed version (--dist adds build location and fingerprint)\n\nUse tickmarkr <command> --help (or -h) for all options and examples.\nUse tickmarkr profile <operation> --help for nested profile help.";
 export declare function dispatch(cmd: string | undefined, argv: string[], commands?: CommandMap): Promise<{
     out: string;
     code: number;

package/dist/cli/index.js

@@ -46,7 +46,7 @@ usage: tickmarkr <command>
   profile       show learned routing profile (profile reset = forget history via cursor, keeps telemetry)
   ui            open Home, Run or Evidence (--view home|run|evidence; --setup <id> opens Run Parks)
   unlock        remove a stale/garbage run lock (refuses if the holder is alive)
-  beat <tier>   record one supervision beat for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required (--stand-down to hand off); a supervising seat's own watcher loop calls it, and status reads the tier STALE once the beats stop
+  beat <tier>   supervision beats for orchestrator|orchestrator-context|overseer|overseer-context|watch, --seat <identity> required: beat start|stop|status <tier> owns one detached loop per tier (status is read-only); the legacy beat <tier> records one beat (--stand-down to hand off), and status reads the tier STALE once the beats stop
   approve <id> <task>  release a park (--uphold sides with the reviewer and funds a fixed attempt; --by <name> --reason <text>); takes effect on resume
   version       print the installed version (--dist adds build location and fingerprint)
 

package/dist/config/fleet-overlay.d.ts

@@ -21,6 +21,14 @@ type FleetOverlayWriteFields = {
     };
     universe?: FleetUniverseRow[];
     lowerMap?: Record<string, MapEntry>;
+    preservedAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
+    lowerAllow?: {
+        adapters?: string[];
+        models?: string[];
+    };
 };
 type EffortFree = FleetEditable & {
     efforts?: undefined;
@@ -40,6 +48,12 @@ export declare function fleetFirstTouchProvenance(note: string, firstTouch: Flee
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
 export declare function renderFleetOverlayWrite(priorBytes: string, write: FleetOverlayWrite): string;
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export declare function overlayHoldingLine(bytes: string, path: readonly string[]): number | undefined;
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export declare function overlayHoldsMap(bytes: string, path: readonly string[]): boolean;
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export declare function fleetRepoOverlayFromDelta(initial: FleetEditable, edited: FleetEditable, existingRepo?: Record<string, unknown>, firstTouches?: Readonly<Record<string, FleetFirstTouch>>, universe?: FleetUniverseRow[]): Record<string, unknown>;
 export declare function repoOverlayYaml(overlay: Record<string, unknown>): string;

package/dist/config/fleet-overlay.js

@@ -1,6 +1,6 @@
 // Fleet-overlay mutation, serialization, and diff rendering for the `tickmarkr fleet` write path.
-import { isAlias, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
-import { DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
+import { isAlias, isCollection, isMap, isNode, isScalar, isSeq, parseDocument, stringify, visit } from "yaml";
+import { ConfigError, DENY_SCOPES, universeCovers, universeEntryMatches } from "./config.js";
 // OBS-1099 add.1: the writer ranges over the schema-derived scopes. The flat (all-seats) scopes
 // take part in the membership/allow-form write; every nested scope (routing.deny.workers.*) is a
 // literal deny list written on its own. ponytail: "flat" = directly under routing.deny. Read
@@ -64,9 +64,12 @@ function residualDeny(universe, entries) {
 // list keeps its node. A staged entry the allow form cannot express as a membership key (outside the
 // probe universe, or a bare-model/identity spelling) is written verbatim too; canonical keys the
 // session added ride the allow form alone.
+// T10 (D-973): read as the loader reads these bytes (readYaml parses with yaml's defaults, as toJS does
+// here) — aliases at the leaf, its items and every ancestor resolve, and `<<` merges only in a document
+// whose YAML version merges — so an aliased list's entries are authored entries too.
 function authoredEntries(doc, path) {
-    const node = doc.getIn(path, true);
-    return isSeq(node) ? node.items.flatMap((item) => (isScalar(item) ? [String(item.value)] : [])) : [];
+    const value = path.reduce((node, key) => (node !== null && typeof node === "object" ? node[key] : undefined), doc.toJS());
+    return Array.isArray(value) ? value.flatMap((item) => (item === null || typeof item !== "object" ? [String(item)] : [])) : [];
 }
 function flatDenyAfterWrite(doc, path, after, universe) {
     const authored = authoredEntries(doc, path);
@@ -112,8 +115,10 @@ function unpackFleetProvenance(provenance) {
 }
 function setScalarPreservingComment(doc, path, value, authoredComment) {
     const existing = doc.getIn(path, true);
-    if (isScalar(existing))
+    if (isScalar(existing)) {
+        releaseAnchors(doc, path);
         existing.value = value;
+    }
     else
         setAt(doc, path, doc.createNode(value));
     if (authoredComment !== undefined) {
@@ -146,6 +151,10 @@ function setStringSequencePreservingComments(doc, path, values) {
         setAt(doc, path, doc.createNode(values));
         return;
     }
+    // T10 owed review F2: an unchanged list is not edited, so its anchor and every alias keep their bytes
+    if (existing.items.length === values.length && existing.items.every((item, at) => isScalar(item) && String(item.value) === values[at]))
+        return;
+    releaseAnchors(doc, path); // an anchored list is edited in place: its other aliases keep the original
     const available = [...existing.items];
     existing.items = values.map((value) => {
         const at = available.findIndex((item) => isScalar(item) && String(item.value) === value);
@@ -175,6 +184,30 @@ function materializeAliases(doc, path) {
         doc.setIn(path.slice(0, depth), detachedCopy(doc, node, target, new Set()));
     }
 }
+// T10 (D-973): a write mutates every ancestor on its path and edits or replaces the leaf with all it
+// holds; any of those nodes may be an anchor other aliases share. Each such alias first becomes a
+// detached copy of what it resolved to, so the write never changes another consumer's value nor
+// leaves its alias dangling.
+function releaseAnchors(doc, path) {
+    const held = new Set();
+    for (let depth = 1; depth <= path.length; depth++) {
+        const node = doc.getIn(path.slice(0, depth), true);
+        if (!isNode(node))
+            break;
+        for (const inner of depth < path.length ? [node] : nodesOf(node)) {
+            if (!isAlias(inner) && inner.anchor)
+                held.add(inner);
+        }
+    }
+    if (!held.size)
+        return;
+    visit(doc, {
+        Alias: (_key, alias) => {
+            const target = alias.resolve(doc);
+            return target !== undefined && held.has(target) ? detachedCopy(doc, alias, target, new Set()) : undefined;
+        },
+    });
+}
 const nodesOf = (root) => {
     const out = [];
     visit(root, (_key, node) => {
@@ -231,26 +264,56 @@ function deleteAt(doc, path) {
             return;
     }
     // deleteIn throws on an empty document — only delete keys that exist.
-    if (doc.getIn(path) !== undefined)
-        doc.deleteIn(path);
+    if (doc.getIn(path) === undefined)
+        return;
+    releaseAnchors(doc, path);
+    doc.deleteIn(path);
 }
 function setAt(doc, path, value) {
     materializeAliases(doc, path); // edit a copy of an aliased mapping, never drop what it resolved to
+    releaseAnchors(doc, path);
     for (let depth = 1; depth < path.length; depth++) {
         const node = doc.getIn(path.slice(0, depth), true);
         if (node === undefined)
             break;
         if (!isMap(node)) {
-            doc.deleteIn(path.slice(0, depth));
+            const prefix = path.slice(0, depth);
+            doc.deleteIn(prefix);
+            // T10: a null mask over membership lists stays a mask for every deny leaf — and the routing.allow
+            // block — this write does not set, so materializing one leaf never resurrects a lower layer's
+            // other deny lists or its allow form (judge/review/consult reach)
+            if (isScalar(node) && node.value === null) {
+                const under = (inner, outer) => outer.every((key, at) => inner[at] === key);
+                for (const masked of [...DENY_SCOPES.map((scope) => scope.path), ["routing", "allow"]]) {
+                    if (under(masked, prefix) && !under(masked, path) && !under(path, masked))
+                        doc.setIn(masked, doc.createNode(null));
+                }
+            }
             break;
         }
     }
     doc.setIn(path, value);
 }
+// T10 (D-987): Fleet writes through no YAML merge key — a membership write whose edited path (the edited
+// leaf or any map above it) takes keys through `<<` is refused, fail-closed, so nothing is published.
+function refuseMerge(doc, priorBytes, path) {
+    let node = doc.contents;
+    for (let depth = 0; depth <= path.length && isMap(node); depth++) {
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        if (merge) {
+            const range = isNode(merge.value) ? merge.value.range : undefined;
+            const shape = range ? priorBytes.slice(range[0], range[1]).trim().replace(/\s+/g, " ") : "…";
+            throw new ConfigError(`${path.join(".")} takes keys through the YAML merge key \`<<: ${shape}\` in ${path.slice(0, depth).join(".") || "the document root"} — Fleet does not write through merge keys; inline the merged keys there by hand, then save again`);
+        }
+        node = depth < path.length ? node.get(path[depth], true) : undefined;
+        if (isAlias(node))
+            node = node.resolve(doc);
+    }
+}
 function deleteEmptyMap(doc, path) {
     const node = doc.getIn(path, true);
     if (isMap(node) && node.items.length === 0)
-        doc.deleteIn(path);
+        deleteAt(doc, path);
 }
 /** Apply only fields fleet authored to the parsed YAML document. Untouched nodes retain their
  * keys, ordering, scalar style, and comments; fresh provenance is written directly on its tier node. */
@@ -266,24 +329,49 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     const flatChanged = new Map(FLAT_DENY_SCOPES.map((scope) => [scope.key, changed(...listsOf(write, scope))]));
     if ([...flatChanged.values()].some(Boolean) || changed(initial.allowOut, edited.allowOut)) {
         if (write.universe) {
+            refuseMerge(doc, priorBytes, ["routing", "allow"]);
             // Membership write: the allow form IS the fleet; deny adapters/models scopes are tombstoned
             // so a lower layer can never re-exclude behind the operator's back (workers untouched).
             const form = allowFormFromExclusions(write.universe, edited);
+            const universe = write.universe;
+            const known = (entry) => universe.some((row) => entry === row.adapter || row.models.some((m) => universeEntryMatches(row, m, entry)));
+            const retainedAll = [];
+            for (const leaf of ["adapters", "models"]) {
+                const retained = [...(write.preservedAllow?.[leaf] ?? []), ...authoredEntries(doc, ["routing", "allow", leaf])]
+                    .filter((entry) => !known(entry));
+                if (!retained.length)
+                    continue;
+                retainedAll.push(...retained);
+                form[leaf] = sortedUnique([...form[leaf], ...retained]);
+                form.excluded = true;
+            }
+            // T10 review: a retained allow entry admits a channel the allow form cannot see, so a staged flat
+            // deny covering it stays in deny verbatim — folded into the allow form alone, the retained entry
+            // would re-admit what the operator just excluded (rail out · all over an unprobed fake:U).
+            // Either allow leaf admits a bare model (routing matches both leaves alike), so coverage never
+            // depends on which leaf retained the entry.
+            // ponytail: a bare retained entry's adapter is unknown, so any discovered adapter id covers it;
+            // an identity alias of an unprobed channel is unknowable and is matched by spelling only.
+            const coversRetained = (entry) => retainedAll.some((kept) => {
+                const colon = kept.indexOf(":");
+                if (colon !== -1) {
+                    const model = kept.slice(colon + 1);
+                    return universeEntryMatches({ adapter: kept.slice(0, colon), models: [model] }, model, entry);
+                }
+                return entry === kept || universe.some((row) => row.adapter === entry);
+            });
             if (form.excluded) {
                 const allowNode = doc.getIn(["routing", "allow"], true);
                 if (allowNode !== undefined && !isMap(allowNode))
-                    doc.deleteIn(["routing", "allow"]);
-                if (form.adapters.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "adapters"], form.adapters);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "adapters"]);
-                }
-                if (form.models.length) {
-                    setStringSequencePreservingComments(doc, ["routing", "allow", "models"], form.models);
-                }
-                else {
-                    deleteAt(doc, ["routing", "allow", "models"]);
+                    deleteAt(doc, ["routing", "allow"]);
+                for (const leaf of ["adapters", "models"]) {
+                    const path = ["routing", "allow", leaf];
+                    if (form[leaf].length)
+                        setStringSequencePreservingComments(doc, path, form[leaf]);
+                    else if (write.lowerAllow?.[leaf] != null)
+                        setStringSequencePreservingComments(doc, path, null);
+                    else
+                        deleteAt(doc, path);
                 }
                 // Whole fleet out: allow stays present but empty — fail-closed, nothing admitted.
                 if (doc.getIn(["routing", "allow"]) === undefined) {
@@ -291,8 +379,12 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 }
             }
             else {
-                // Whole fleet in: no restriction to express — the allow block goes away entirely.
-                deleteAt(doc, ["routing", "allow"]);
+                // Whole fleet in: no restriction to express — the allow block goes away entirely, or is
+                // masked when a lower layer's allow would otherwise come back (T10 A/B resurrection).
+                if (write.lowerAllow)
+                    setAt(doc, ["routing", "allow"], doc.createNode(null));
+                else
+                    deleteAt(doc, ["routing", "allow"]);
             }
             // Authored and non-canonical entries stay in deny (LEG2-T3 finding 4, round 2 finding 2).
             // OBS-1046: only an EDITED scope is rewritten, and only when its bytes must change — an
@@ -313,7 +405,8 @@ export function renderFleetOverlayWrite(priorBytes, write) {
                 const stale = authored.some((entry) => admitted.includes(entry));
                 if (!touched && !stale)
                     continue;
-                const remaining = flatDenyAfterWrite(doc, path, after, write.universe);
+                refuseMerge(doc, priorBytes, path);
+                const remaining = [...new Set([...flatDenyAfterWrite(doc, path, after, write.universe), ...after.filter(coversRetained)])];
                 if (remaining.length) {
                     if (remaining.join("\n") !== authored.join("\n"))
                         setStringSequencePreservingComments(doc, path, remaining);
@@ -327,6 +420,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
             for (const scope of FLAT_DENY_SCOPES) {
                 if (!flatChanged.get(scope.key))
                     continue;
+                refuseMerge(doc, priorBytes, scope.path);
                 const after = edited[scope.key] ?? [];
                 setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
             }
@@ -341,6 +435,7 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         const [before, after] = listsOf(write, scope);
         if (!changed(before, after))
             continue;
+        refuseMerge(doc, priorBytes, scope.path);
         setStringSequencePreservingComments(doc, scope.path, after.length ? sortedUnique(after) : null);
     }
     for (const shape of new Set([...Object.keys(initial.map), ...Object.keys(edited.map)])) {
@@ -530,8 +625,9 @@ export function renderFleetOverlayWrite(priorBytes, write) {
     // byte-identical to yaml's own stringifyComment. OBS-1046: a scalar parsed from the prior bytes
     // keeps the exact whitespace it had before its hash sign (yaml itself emits one space, so the
     // sentinel carries the rest); only a comment fleet authored gets the two-space style.
+    // T10 (D-936): a flow collection's trailing note (`[codex]  # c`) is inline too, so it keeps its gap.
     visit(doc, (_key, node) => {
-        if (isScalar(node) && typeof node.comment === "string" && !node.comment.includes("\n")) {
+        if ((isScalar(node) || (isCollection(node) && node.flow)) && typeof node.comment === "string" && !node.comment.includes("\n")) {
             const tail = node.range ? priorBytes.slice(node.range[1], node.range[2]) : "";
             const gap = /^([ \t]+)#/.exec(tail)?.[1] ?? "  ";
             node.comment = `${INLINE_COMMENT_SENTINEL}${gap.slice(1)}#${node.comment}`;
@@ -547,6 +643,39 @@ export function renderFleetOverlayWrite(priorBytes, write) {
         flowCollectionPadding: false,
     });
 }
+/** T10: the 1-based line of the key that holds `path` in these overlay bytes — the path's own key, the
+ * key whose `null` masks it from above, or a `<<` merge key on it (D-987: the write there refuses) — else
+ * undefined (the overlay neither declares nor masks it). */
+export function overlayHoldingLine(bytes, path) {
+    const doc = parseDocument(bytes);
+    if (doc.errors.length)
+        return undefined;
+    const lineOf = (offset) => bytes.slice(0, offset).split("\n").length;
+    let node = doc.contents;
+    let line;
+    for (const key of path) {
+        if (isAlias(node))
+            node = node.resolve(doc);
+        if (line !== undefined && isScalar(node) && node.value === null)
+            return line; // a mask at or above
+        if (!isMap(node))
+            return undefined;
+        const merge = node.items.find((item) => isScalar(item.key) && typeof item.key.value === "symbol");
+        const pair = merge ?? node.items.find((item) => isScalar(item.key) && String(item.key.value) === key);
+        if (!pair || !isScalar(pair.key) || !pair.key.range)
+            return undefined;
+        line = lineOf(pair.key.range[0]);
+        if (merge)
+            return line;
+        node = pair.value;
+    }
+    return line;
+}
+/** T10: does `path` hold a mapping in these overlay bytes — neither absent nor a `null` mask? */
+export function overlayHoldsMap(bytes, path) {
+    const doc = parseDocument(bytes);
+    return !doc.errors.length && isMap(doc.getIn(path, true));
+}
 /** Build the repo overlay fragment fleet would write for edits since session start. */
 export function fleetRepoOverlayFromDelta(initial, edited, existingRepo = {}, firstTouches = {}, universe) {
     if (fleetEditableEquals(initial, edited))

package/dist/drivers/orca.d.ts

@@ -5,7 +5,7 @@ import { type ExecutorDriver, type FocusTarget, type FocusResult, type NotifyOpt
 /** The response families the ONE shared envelope parser serves. There is no second JSON seam. */
 export declare const ORCA_RESPONSE_FAMILIES: readonly ["status", "create", "list", "read", "send", "wait", "show", "close", "worktree-current", "worktree-set", "hooks-status", "split"];
 export type OrcaFamily = (typeof ORCA_RESPONSE_FAMILIES)[number];
-export declare const ORCA_FIXTURE_VERSION = "1.4.195";
+export declare const ORCA_FIXTURE_VERSION = "1.4.218";
 export declare const ORCA_CLI_COMMAND_ENV = "ORCA_CLI_COMMAND";
 export declare const STALE_HANDLE_CODE = "terminal_handle_stale";
 export declare const TERMINAL_GONE_CODE = "terminal_gone";
@@ -176,6 +176,17 @@ export interface OrcaDriverOpts {
     probeStalenessMs?: number;
     launchingHandle?: string;
 }
+/**
+ * F (D-832): what one proof page's OWN metadata says about the scrollback it was read from — the closed
+ * seam checkoutProven decides paging and absence by. `complete`: explicit `limited:false` and
+ * `truncated:false` with cursors that agree — nothing lies past this page. `partial`: explicit booleans,
+ * one of them true, cursors that agree — more scrollback exists. `unread`: everything else — a flag
+ * missing or not a boolean, a cursor that is not a string, `limited:false` with a next cursor short of
+ * the latest one (the contradictory "last" page), a blind stream page
+ * (isBlindStreamPage), or a source that is not the stream (`screen-unavailable`). Missing metadata is
+ * never inferred complete: its page's bytes still count as read evidence, but no absence rests on it.
+ */
+export declare function classifyProofPage(term: Record<string, unknown>): "complete" | "partial" | "unread";
 export declare class OrcaDriver implements ExecutorDriver {
     id: string;
     interactive: boolean;
@@ -265,8 +276,11 @@ export declare class OrcaDriver implements ExecutorDriver {
      * and none carries a trace of the mark; `unread` — every other exit: PROOF_PAGES reached, a limited
      * read with no (or the same) next cursor or a truncated anchor without one, a read that threw, a read
      * the ceiling cut off or never let start (the anchor included), or a page that landed late (even one
-     * carrying the right proof), a malformed page (its tail, cursors or paging flags), or a blind stream
-     * page (isBlindStreamPage). Unread output is unknown — never an empty page, never absence.
+     * carrying the right proof), a malformed page (its tail or cursors), a blind stream page
+     * (isBlindStreamPage), or — F (D-832) — any page read whose paging metadata classifyProofPage cannot
+     * call complete or partial (flags missing, not boolean or contradicted; even when they were omitted,
+     * that page's bytes stay evidence and its matching proof still proves). Unread output is unknown —
+     * never an empty page, never absence.
      * Without a deadline (reconcile, recovery) only `proven` is consumed.
      */
     private checkoutProven;