tickmarkr 2.6.7 → 2.6.8

package/dist/run/git.d.ts

@@ -1,6 +1,7 @@
 import type { CommandReceiptAttribution, ShellReceipt } from "./protocol.js";
 import { spawn } from "node:child_process";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
+import { type OwnGitCapability } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
 export declare const FORK_CAP_ENV = "VITEST_MAX_FORKS";
 export declare const SUITE_PARENT_ENV = "TICKMARKR_SUITE_PARENT";
@@ -168,12 +169,32 @@ export interface ShellOptions {
     /** Called once per invocation (1-based), including each pre-spawn retry. */
     receiptAttribution?: (invocation: number) => CommandReceiptAttribution;
 }
-/** Shared command seam, including invocation-bound manifested runners. */
+/** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
+ * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
+ * or the command text. tickmarkr's own git goes through shGit/shGitOk. */
 export declare function shell(cmd: string, cwd: string, timeoutMs: number, login?: boolean, options?: ShellOptions): Promise<ShResult>;
+/**
+ * v2.6.8 T2: what an OWN-GIT caller declares at its call site — never inferred from the command text. Every own-git
+ * child in a linked checkout keeps the path pin and the ref-store pin; `createsWorktree` is the worktree capability the
+ * branch-creating call sites declare, and addDetachedWorktree is the detached one (see OwnGitCapability and ownGitPin).
+ */
+export type OwnGitOptions = OwnGitCapability;
 export declare function sh(cmd: string, cwd: string, timeoutMs?: number, options?: ShellOptions): Promise<ShResult>;
-export declare function shGit(cmd: string, cwd: string, timeoutMs?: number): Promise<ShResult>;
+export declare function shGit(cmd: string, cwd: string, timeoutMs?: number, own?: OwnGitOptions): Promise<ShResult>;
 export declare function shOk(cmd: string, cwd: string): Promise<string>;
-export declare function shGitOk(cmd: string, cwd: string): Promise<string>;
+export declare function shGitOk(cmd: string, cwd: string, own?: OwnGitOptions): Promise<string>;
+/**
+ * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
+ * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
+ * and checks out nothing, and no own-git step ever runs unpinned instead: the commit-ish is resolved to an object id in
+ * `cwd`'s checkout (HEAD and branch names read the trusted store), the checkout is added `--no-checkout --detach` at
+ * that id (its ref store pinned to the trusted common directory, see DetachedAddCapability), and then — pinned to the
+ * NEW checkout's own authority — its HEAD is written as that id, git's `refs/heads/.invalid` stub ref is deleted and the
+ * checkout is populated.
+ * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
+ * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
+ */
+export declare function addDetachedWorktree(cwd: string, dir: string, commitish: string, timeoutMs?: number): Promise<ShResult>;
 export declare function npmDependencyManifestChanged(cwd: string, baselineRef: string): Promise<boolean>;
 export declare function npmDependencyInstallCommand(cwd: string): string;
 export declare function gitHead(cwd: string): Promise<string>;

package/dist/run/git.js

@@ -1,5 +1,5 @@
 import { observeVerificationReceipt, observeVerificationSpawn, verificationJobEnvironment } from "./verification-job.js";
-import { executionSignal } from "./execution-budget.js";
+import { executionSignal, withoutExecutionBudget } from "./execution-budget.js";
 import { commandLeaseEnvironment, repositoryLeaseEnvironment, registerRepositoryChild, withCommandLease } from "./lease.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { execFile, execFileSync, spawn } from "node:child_process";
@@ -11,7 +11,7 @@ import { shq } from "../adapters/types.js";
 import { tickmarkrDir } from "../graph/graph.js";
 import { ROUTING_ENV_SEAMS } from "../route/router.js";
 import { titleEnvironment } from "./title-environment.js";
-import { assertGitTrust, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
+import { assertGitTrust, GitTrustRefusal, ownGitPin, protectedGitEnv, trustedCommonDir } from "./git-trust.js";
 export { ROUTING_ENV_SEAMS };
 // OBS-110: gate/baseline/tip-verify children are vitest suites; without a fork cap, concurrent
 // full-suite gate runs fork a worker-per-core pool per worktree and saturate the operator box.
@@ -259,8 +259,13 @@ export const SPAWN_RETRY_BACKOFF_MS = 50;
 // RULING-P99-28: SHIP — every gate user can hit the inherited-pipe hang at this product seam.
 /** Give a normally-exited shell's descendants this long to close their inherited pipes themselves. */
 const SHELL_REAP_GRACE_MS = 2000;
-/** Shared command seam, including invocation-bound manifested runners. */
+/** Shared command seam, including invocation-bound manifested runners. A PAYLOAD entry: its children keep the
+ * operator's git config (hooks, fsmonitor) and get no checkout pin — ownership follows the entry, never `login`
+ * or the command text. tickmarkr's own git goes through shGit/shGitOk. */
 export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, login, options, undefined);
+}
+function shellEntry(cmd, cwd, timeoutMs, login, options, ownGit) {
     const inherited = executionSignal();
     const signal = inherited && options.signal ? AbortSignal.any([inherited, options.signal]) : inherited ?? options.signal;
     let attribution;
@@ -305,22 +310,24 @@ export function shell(cmd, cwd, timeoutMs, login = false, options = {}) {
     };
     begin(1);
     checkAbort();
-    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, { ...options, signal }, { begin, emit, checkAbort }))
+    return withCommandLease(cmd, () => executeShell(cmd, cwd, timeoutMs, login, { ...options, signal }, { begin, emit, checkAbort }, ownGit))
         .catch((error) => {
         if (signal?.aborted)
             emit({ outcome: "cancelled", exitCode: null, signal: null });
         throw error;
     });
 }
-function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
+function executeShell(cmd, cwd, timeoutMs, login, options, observation, ownGit) {
     observation.checkAbort();
     // OBS-74: scrub tickmarkr's own routing env seams from every child — a daemon carrying
     // TICKMARKR_QUALITY leaked it into baseline/gate/tip-verify children, turning a dogfood
     // repo's route() tests red inside the gates. Scrub a copy at this one choke point so
     // children are hermetic by construction; the daemon's own process.env stays unchanged.
-    // v2.6.7 T4 (E1): git children run with core.fsmonitor=false and an inert hooksPath whatever the
-    // repository or inherited GIT_CONFIG_* say; every other parent, capability and explicit value survives.
-    const env = protectedGitEnv(verificationJobEnvironment(repositoryLeaseEnvironment(commandLeaseEnvironment(options.env ?? process.env))));
+    // v2.6.7 T4 (E1) / v2.6.8 T2: tickmarkr's OWN git children (shGit/shGitOk) run with core.fsmonitor=false and
+    // an inert hooksPath whatever the repository or inherited GIT_CONFIG_* say; payload children keep the
+    // operator's config. Every other parent, capability and explicit value survives.
+    const payloadEnv = verificationJobEnvironment(repositoryLeaseEnvironment(commandLeaseEnvironment(options.env ?? process.env)));
+    const env = ownGit ? protectedGitEnv(payloadEnv) : payloadEnv;
     for (const k of ROUTING_ENV_SEAMS)
         delete env[k];
     // A run freezes the operator override and cores at startup; admission can lower the round cap.
@@ -345,6 +352,8 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
     // under. `Number` of an unparseable export is NaN, which every reader treats as malformed and
     // therefore fails closed — the honest direction when the cap in play cannot be stated.
     const capacity = { forkCap: Number(env[FORK_CAP_ENV]), cores: resolvedCapacity().cores };
+    // v2.6.8 T2: the pin's post-exit recheck for the attempt that actually ran its child, and its ref view's release.
+    let recheck, release, unview, store;
     const attempt = () => new Promise((resolve) => {
         const startedAt = Date.now();
         // detached: bash gets its own process group so a timeout can kill the whole tree —
@@ -353,15 +362,24 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
         let p;
         // v2.6.7 T4: the trust check runs before EVERY spawn attempt (retries included) and caches nothing — a
         // seat can rewrite its gitdir's commondir/config.worktree between any two calls. A refusal names the file.
+        // v2.6.8 T2 (P3): an own-git attempt in a linked checkout also pins its child (config, objects and the ref store)
+        // to the authority that check derived, and its result is refused when commondir changed before the child exited;
+        // payloads get no pin. The command text never selects a pin.
+        let childEnv = env;
+        recheck = undefined;
+        unview = undefined;
+        store = undefined;
         try {
-            assertGitTrust(cwd);
+            const pin = ownGit ? ownGitPin(cwd, env, ownGit) : (assertGitTrust(cwd), undefined);
+            if (pin)
+                ({ env: childEnv, recheck, release, unview, store } = pin);
         }
         catch (error) {
             observation.emit({ outcome: "spawn-failed", exitCode: null, signal: null, error: String(error) });
             throw error;
         }
         try {
-            p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env, stdio: ["ignore", "pipe", "pipe"], detached: true });
+            p = (spawnChild ?? spawn)("bash", [login ? "-lc" : "-c", cmd], { cwd, env: childEnv, stdio: ["ignore", "pipe", "pipe"], detached: true });
         }
         catch (error) {
             observation.emit({ outcome: "spawn-failed", exitCode: null, signal: null, error: String(error) });
@@ -521,9 +539,29 @@ function executeShell(cmd, cwd, timeoutMs, login, options, observation) {
             if (n > 1)
                 observation.begin(n);
             observation.checkAbort();
-            const r = await attempt();
-            if (!("refused" in r))
-                return r;
+            let r;
+            try {
+                r = await attempt();
+            }
+            finally {
+                release?.();
+                release = undefined;
+            }
+            if (!("refused" in r)) {
+                try {
+                    recheck?.();
+                }
+                catch (error) {
+                    // v2.6.8 T2: a raced worktree add already registered what it created in the trusted store; it is removed through
+                    // the trusted common directory this attempt derived, even while the caller's commondir stays hostile and even
+                    // when the execution budget expired meanwhile; a failed rollback rides on the refusal, never swallowed
+                    const rollback = ownGit && "rollback" in ownGit ? ownGit.rollback : undefined;
+                    if (rollback && store)
+                        await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
+                    throw error;
+                }
+                return unview ? { ...r, stdout: unview(r.stdout), stderr: unview(r.stderr) } : r;
+            }
             // Bounded, and the bound is what makes a persisting shortage a REPORTED failure rather than a
             // wedged daemon: past it the caller gets the refusal's own text under exit 127, as before.
             if (n >= SPAWN_ATTEMPT_LIMIT) {
@@ -537,8 +575,10 @@ export function sh(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, options = {})
     return shell(cmd, cwd, timeoutMs, true, options);
 }
 // Git plumbing never needs an operator profile; skip login-shell startup and its side effects.
-export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
-    return shell(cmd, cwd, timeoutMs, false);
+// v2.6.8 T2: the explicit OWN-GIT entry — forced inert hooks/fsmonitor and, in a linked checkout, the trusted-path and
+// ref-store pin.
+export function shGit(cmd, cwd, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS, own = {}) {
+    return shellEntry(cmd, cwd, timeoutMs, false, {}, own);
 }
 export async function shOk(cmd, cwd) {
     const r = await sh(cmd, cwd);
@@ -546,12 +586,88 @@ export async function shOk(cmd, cwd) {
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
-export async function shGitOk(cmd, cwd) {
-    const r = await shGit(cmd, cwd);
+export async function shGitOk(cmd, cwd, own = {}) {
+    const r = await shGit(cmd, cwd, DEFAULT_SHELL_TIMEOUT_MS, own);
     if (r.code !== 0)
         throw new Error(`command failed (${r.code}): ${cmd}\n${r.stderr || r.stdout}`);
     return r.stdout;
 }
+/**
+ * v2.6.8 T2: the DETACHED worktree capability, declared by calling it (the daemon's baseline recapture and standalone
+ * verify's base worktree). Under the ref-store pin git stubs a detached add's new HEAD as `ref: refs/heads/.invalid`
+ * and checks out nothing, and no own-git step ever runs unpinned instead: the commit-ish is resolved to an object id in
+ * `cwd`'s checkout (HEAD and branch names read the trusted store), the checkout is added `--no-checkout --detach` at
+ * that id (its ref store pinned to the trusted common directory, see DetachedAddCapability), and then — pinned to the
+ * NEW checkout's own authority — its HEAD is written as that id, git's `refs/heads/.invalid` stub ref is deleted and the
+ * checkout is populated.
+ * A step raced by a commondir change is refused by name before the next one runs, and what the add created is rolled
+ * back through the trusted common directory derived here once (dropWorktree), even while that commondir stays hostile.
+ */
+export async function addDetachedWorktree(cwd, dir, commitish, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    // the authority this operation keeps, rollback included: derived once from the trusted layout, never a commondir
+    const store = trustedCommonDir(cwd);
+    const resolved = await shGit(`git rev-parse --verify --end-of-options ${shq(`${commitish}^{commit}`)}`, cwd, timeoutMs);
+    if (resolved.code !== 0)
+        return resolved;
+    const oid = resolved.stdout.trim();
+    // under a ref payload git also resolves its new-HEAD stub into a shared refs/heads/.invalid; it is deleted again
+    const rollback = { dir, branch: { name: ".invalid" } };
+    const added = await shellEntry(`git worktree add --no-checkout --detach ${shq(dir)} ${shq(oid)}`, cwd, timeoutMs, false, {}, { createsWorktree: "detached", rollback });
+    if (added.code !== 0)
+        return added;
+    let repaired;
+    try {
+        repaired = await shGit(`git update-ref --no-deref HEAD ${shq(oid)} && git update-ref -d refs/heads/.invalid && git reset -q --hard --no-recurse-submodules`, dir, timeoutMs);
+    }
+    catch (error) {
+        await dropWorktree(store, rollback, timeoutMs).catch((failure) => { throw rollbackFailed(error, failure); });
+        throw error;
+    }
+    if (repaired.code !== 0)
+        await dropWorktree(store, rollback, timeoutMs);
+    return repaired;
+}
+/** A failed rollback is never swallowed: it rides on the error the operation already throws (a refusal stays one). */
+function rollbackFailed(error, failure) {
+    const why = `; its rollback failed, so what it created may remain: ${failure instanceof Error ? failure.message : String(failure)}`;
+    return error instanceof GitTrustRefusal ? new GitTrustRefusal(error.path, `${error.detail}${why}`, { cause: failure })
+        : new AggregateError([error, failure], `${error instanceof Error ? error.message : String(error)}${why}`);
+}
+/**
+ * Removes a checkout `dir` and its registration — and, when named, a branch the add created (deleted) or moved
+ * (restored to `prior`) — through `store`, a trusted common directory derived from the layout (TrustedStoreCapability):
+ * nothing here reads the caller's checkout, so it completes while that checkout's commondir is hostile. Cleanup only, so
+ * it runs outside any execution budget (an expired one would refuse every step and leave what the add created), each
+ * step bounded by `timeoutMs`; every step is tried, and any that failed is thrown, never swallowed.
+ */
+async function dropWorktree(store, { dir, branch }, timeoutMs = DEFAULT_SHELL_TIMEOUT_MS) {
+    const failed = await withoutExecutionBudget(async () => {
+        const run = async (cmd) => {
+            try {
+                const r = await shellEntry(cmd, store, timeoutMs, false, {}, { store });
+                return r.code === 0 ? undefined : `${cmd} (${r.code}): ${(r.stderr || r.stdout).trim()}`;
+            }
+            catch (error) {
+                return `${cmd}: ${String(error)}`;
+            }
+        };
+        await run(`git worktree remove --force ${shq(dir)}`); // best-effort; the steps below decide
+        const steps = [`rm -rf ${shq(dir)}`, "git worktree prune"];
+        if (branch) {
+            const ref = shq(`refs/heads/${branch.name}`);
+            steps.push(branch.prior ? `git update-ref ${ref} ${shq(branch.prior)}` : `git update-ref -d ${ref}`);
+        }
+        const out = [];
+        for (const cmd of steps) {
+            const f = await run(cmd);
+            if (f)
+                out.push(f);
+        }
+        return out;
+    });
+    if (failed.length)
+        throw new Error(`cleanup of ${dir} through ${store} failed: ${failed.join("; ")}`);
+}
 const NPM_DEPENDENCY_MANIFESTS = ["package.json", "package-lock.json", "npm-shrinkwrap.json"];
 // OBS-126: compare the whole attempt (committed, staged, unstaged, or newly added manifest) with
 // the task's integration-tip baseline. A committed package.json change is invisible to `git status`,
@@ -705,7 +821,10 @@ export async function createWorktree(repo, branch, baseRef) {
     const dir = join(tickmarkrDir(repo), WORKTREES_DIR, sanitize(branch));
     if (existsSync(dir))
         await removeWorktree(repo, dir);
-    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+    // the worktree capability: a branch add, whose symbolic HEAD keeps the ref-store pin (see OwnGitCapability); a raced
+    // add is rolled back, its branch restored to the value read here or deleted when it is new
+    const prior = (await shGit(`git rev-parse --verify -q ${shq(`refs/heads/${branch}`)}`, repo)).stdout.trim() || undefined;
+    await shGitOk(`git worktree add -B ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch, prior } } });
     linkNodeModules(repo, dir);
     return dir;
 }
@@ -906,10 +1025,10 @@ export async function changeRepresented(cwd, commit, dest = "HEAD") {
     const tree = await shGit(`git rev-parse ${shq(`${dest}^{tree}`)}`, cwd);
     return tree.code === 0 && merged.stdout.split("\n")[0].trim() === tree.stdout.trim();
 }
+// v2.6.8 T2: through the trusted common directory derived once from `repo`'s layout, never `repo`'s mutable commondir,
+// so a checkout is removed even while that commondir stays hostile (see dropWorktree)
 export async function removeWorktree(repo, dir) {
-    await shGit(`git worktree remove --force ${shq(dir)}`, repo); // best-effort; stale dirs are re-added with -B
-    await shGit(`rm -rf ${shq(dir)}`, repo);
-    await shGit("git worktree prune", repo);
+    await dropWorktree(trustedCommonDir(repo), { dir });
 }
 export const REFS_PREFLIGHT_PREFIX = "refs/tickmarkr/preflight";
 export const REFS_PROBE_REMEDY = "run from the main repository or a full clone; a sandbox that denies writes under that path cannot host a run";

package/dist/run/merge.js

@@ -39,10 +39,10 @@ export async function ensureIntegration(repo, branch, baseRef) {
     if (!existsSync(join(dir, ".git"))) {
         const exists = (await shGit(`git rev-parse --verify refs/heads/${shq(branch)}`, repo)).code === 0;
         if (exists) {
-            await shGitOk(`git worktree add ${shq(dir)} ${shq(branch)}`, repo);
+            await shGitOk(`git worktree add ${shq(dir)} ${shq(branch)}`, repo, { createsWorktree: "branch", rollback: { dir } });
         }
         else {
-            await shGitOk(`git worktree add -b ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo);
+            await shGitOk(`git worktree add -b ${shq(branch)} ${shq(dir)} ${shq(baseRef)}`, repo, { createsWorktree: "branch", rollback: { dir, branch: { name: branch } } });
         }
     }
     linkNodeModules(repo, dir);

package/dist/run/verification-job.d.ts

@@ -38,6 +38,8 @@ export interface VerificationJobReport {
     phases: VerificationPhase[];
 }
 export declare const VERIFICATION_JOB_TOKEN_ENV = "TICKMARKR_VERIFICATION_JOB_TOKEN";
+/** v2.6.8 T2: a child carries only THIS process's local job id; outside a local job an inherited (foreign) token
+ * is dropped, never forwarded — a nested verify mints and stamps its own. */
 export declare function verificationJobEnvironment(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export declare const setVerificationJobClockForTests: (now: () => number) => void;
 export declare const resetVerificationJobClockForTests: () => void;

package/dist/run/verification-job.js

@@ -1,15 +1,21 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-import { execFileSync } from "node:child_process";
 import { randomUUID } from "node:crypto";
 import { renameSync, rmSync, writeFileSync } from "node:fs";
-import { assertGitTrust, protectedGitEnv } from "./git-trust.js";
+import { shGit } from "./git.js";
 import { executionSignal } from "./execution-budget.js";
-import { hasRepositoryLeaseOwnership, REPOSITORY_LEASE_TOKEN_ENV, reentrantHolder, repositoryLeasePath, reapRepositoryChildren, withCommandLease, withFreshCommandLease, withRepositoryLease } from "./lease.js";
+import { hasRepositoryLeaseOwnership, readHolder, REPOSITORY_LEASE_TOKEN_ENV, reentrantHolder, repositoryLeasePath, reapRepositoryChildren, withCommandLease, withFreshCommandLease, withRepositoryLease } from "./lease.js";
 const jobs = new AsyncLocalStorage();
 export const VERIFICATION_JOB_TOKEN_ENV = "TICKMARKR_VERIFICATION_JOB_TOKEN";
+/** v2.6.8 T2: a child carries only THIS process's local job id; outside a local job an inherited (foreign) token
+ * is dropped, never forwarded — a nested verify mints and stamps its own. */
 export function verificationJobEnvironment(env) {
     const job = jobs.getStore();
-    return job ? { ...env, [VERIFICATION_JOB_TOKEN_ENV]: job.report.id } : { ...env };
+    const child = { ...env };
+    if (job)
+        child[VERIFICATION_JOB_TOKEN_ENV] = job.report.id;
+    else
+        delete child[VERIFICATION_JOB_TOKEN_ENV];
+    return child;
 }
 let clock = () => Date.now();
 export const setVerificationJobClockForTests = (now) => { clock = now; };
@@ -60,9 +66,11 @@ export async function withVerificationJob(command, cwd, reportPath, evidence, ru
     const signal = executionSignal();
     let commit = evidence?.subjectCommit ?? null;
     if (!commit) {
+        // v2.6.8 T2: the job-identity HEAD read is tickmarkr's own git — pinned in a linked checkout, refused when raced
         try {
-            assertGitTrust(cwd);
-            commit = execFileSync("git", ["rev-parse", "HEAD"], { cwd, env: protectedGitEnv(process.env), encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+            const r = await shGit("git rev-parse HEAD", cwd);
+            if (r.code === 0)
+                commit = r.stdout.trim();
         }
         catch { /* unknown remains explicit */ }
     }
@@ -91,9 +99,10 @@ export async function withVerificationJob(command, cwd, reportPath, evidence, ru
         report.reservationReused = hasRepositoryLeaseOwnership() && !jobs.getStore();
         // A process descendant may share its ancestor's scheduler capability only after the file
         // generation and strict ancestry have been verified. A same-pid sibling always queues fresh.
-        const inherited = !hasRepositoryLeaseOwnership()
-            && await reentrantHolder(await repositoryLeasePath(cwd), process.env[REPOSITORY_LEASE_TOKEN_ENV]);
+        const leasePath = await repositoryLeasePath(cwd);
+        const inherited = !hasRepositoryLeaseOwnership() && await reentrantHolder(leasePath, process.env[REPOSITORY_LEASE_TOKEN_ENV]);
         const reserveCommand = report.reservationReused || inherited ? withCommandLease : withFreshCommandLease;
+        let owner; // the live holder the reservation's in-process owner reaps at release
         outcome = await reserveCommand(command, () => withRepositoryLease(cwd, () => {
             signal?.throwIfAborted();
             report.admittedAt = clock();
@@ -104,14 +113,27 @@ export async function withVerificationJob(command, cwd, reportPath, evidence, ru
                     return await run();
                 }
                 finally {
-                    await reapRepositoryChildren({ pid: process.pid, cwd, at: report.queuedAt, token: report.id }, 20, VERIFICATION_JOB_TOKEN_ENV);
+                    try {
+                        await reapRepositoryChildren({ pid: process.pid, cwd, at: report.queuedAt, token: report.id }, 20, VERIFICATION_JOB_TOKEN_ENV);
+                    }
+                    finally {
+                        // v2.6.8 T2: a nested verify records its shells' birth-checked groups in the reservation FILE, never in the
+                        // in-process owner's holder, which its release reaps. Carry them back to that owner — this job's own
+                        // reservation or a reused enclosing one — the same in-memory merge registerRepositoryChild makes, even
+                        // when the job census above failed (its error still propagates).
+                        const recorded = owner?.pid === process.pid ? readHolder(leasePath) : undefined;
+                        if (owner && recorded?.token === owner.token) {
+                            owner.roots = [...new Set([...(owner.roots ?? []), ...(recorded.roots ?? [])])];
+                            owner.rootBirths = { ...owner.rootBirths, ...recorded.rootBirths };
+                        }
+                    }
                     report.reapedAt = clock();
                     job.persist();
                 }
             }));
         }, { isolated: true, protectOrphans: true, independent: !!jobs.getStore(), signal, pollMs: 20,
             onWait: holder => { report.waitingOn = { ...holder }; job.persist(); },
-            onAdmission: holder => { report.repositoryAdmittedAt = clock(); report.reservation = { ...holder }; job.persist(); },
+            onAdmission: holder => { owner = holder; report.repositoryAdmittedAt = clock(); report.reservation = { ...holder }; job.persist(); },
             onRelease: () => { report.reapedAt ??= clock(); report.repositoryReleasedAt = clock(); job.persist(); } }));
         report.releasedAt = clock();
         report.state = signal?.aborted ? "cancelled" : outcome.pass ? "completed" : "failed";

package/dist/tui/ink/fleet-app.d.ts

@@ -157,7 +157,7 @@ export type FleetStagedRouting = {
     ok: false;
     error: string;
 };
-export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, ...initialDenyProps }: InitialDenyProps & {
+export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, viewRows, frameColumns, frameRows, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     agents: AgentCli[];
     /** OBS-1046: adapter ids and adapter:model keys routing.allow leaves out of the fleet */
@@ -181,6 +181,9 @@ export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEffort
     /** OBS-1052(3): advisory review no-verdict history lines — display only, never a routing input */
     reviewAdvisories?: string[];
     reviewOverlay: (state: FleetEditorState) => FleetOverlayReview;
+    /** B-KEYS r2 (D-1446): the loaded overlay layers' identity (fleet: both overlay files' bytes) — the rows
+     * derive from them, so a layer written during the session re-derives every row; read once per render */
+    layerStamp?: () => string;
     reloadGuard: (bytes: string) => string | null;
     /** the routing policy the staged deny sets load as (fleet: the config loader over the candidate
      * bytes); absent ⇒ the four staged sets alone, with no allowlist */
@@ -199,7 +202,7 @@ export declare function FleetApp({ ageMs, agents, initialAllowOut, initialEffort
     /** terminal height — set only on a real TTY so the footer sticks to the bottom */
     frameRows?: number;
 }): import("react").JSX.Element;
-export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, initialInput, input, output, debug, ...initialDenyProps }: InitialDenyProps & {
+export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut, initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories, reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry, initialJudge, judgeSeats, initialInput, input, output, debug, ...initialDenyProps }: InitialDenyProps & {
     ageMs: number | null;
     adapters: WorkerAdapter[];
     health: Record<string, AuthHealth>;
@@ -224,6 +227,8 @@ export declare function runFleetInkEditor({ ageMs, adapters, health, initialAllo
     /** OBS-1052(3): advisory review no-verdict history lines — display only, never a routing input */
     reviewAdvisories?: string[];
     reviewOverlay: (state: FleetEditorState) => FleetOverlayReview;
+    /** B-KEYS r2: the loaded overlay layers' identity (fleet: both overlay files' bytes), read once per render */
+    layerStamp?: () => string;
     reloadGuard: (bytes: string) => string | null;
     /** the routing policy the staged deny sets load as (fleet: the config loader over the candidate
      * bytes); absent ⇒ the four staged sets alone, with no allowlist */

package/dist/tui/ink/fleet-app.js

@@ -49,7 +49,7 @@ const REACH_CHOICES = [
     { id: "out-workers", label: "out · workers", gloss: "workers skip it; judge/review/consult unaffected" },
     { id: "out-all", label: "out · all seats", gloss: "no seat routes here" },
 ];
-export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts = {}, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, ...initialDenyProps }) {
+export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts = {}, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], viewRows = Number.POSITIVE_INFINITY, frameColumns = 100, frameRows, ...initialDenyProps }) {
     const { exit } = useApp();
     const [, setRevision] = useState(0);
     // the props are the fleet command's contract, one per schema-enumerated scope (initialDeny…),
@@ -137,21 +137,51 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
     // the STAGED policy (fleet loads the candidate bytes; see stagedRouting) and the recorded
     // identity — never literal membership of the staged sets, which missed identity, bare-model and
     // family entries and could not tell an allowlist exclusion from a deny.
-    let routingMemo = null;
+    // B-KEYS (D-1338): the staged CONTENT every row and the staged policy derive from — the deny sets,
+    // the allow complement, classifications, efforts and seeds, read raw off ui (the provenance a
+    // review folds is a pure function of them). Computed per call, never per render: a handler
+    // mutates ui and reads rows in the same tick, before bump.
+    const stagedKey = () => JSON.stringify([
+        DENY_SCOPES.map((scope) => [...ui[scope.key]].sort()),
+        [...ui.allowOut].sort(),
+        ui.classifications,
+        ui.efforts,
+        ui.seededAllowOut,
+    ]);
+    // ponytail: both memos live in refs keyed on stagedKey — a render-local memo reset on every keypress,
+    // so each cursor move reloaded the policy and re-derived ~800 rows' reach (B-KEYS). A cursor move,
+    // a filter, showAll or an overlay never recompute a row; any staged edit changes the key and
+    // recomputes every group. Ceiling: one JSON.stringify of the staged sets per lookup (µs); a dirty
+    // counter bumped at every mutation site if a fleet ever outgrows it.
+    const routingMemo = useRef(null);
     const stagedPolicy = () => {
+        const key = memoKey();
+        const memo = routingMemo.current;
+        if (memo?.key === key)
+            return memo.policy;
         const deny = stagedDeny();
         const stage = stagedMetadata();
-        const key = JSON.stringify([deny, stage]);
-        if (routingMemo?.key !== key) {
-            routingMemo = {
-                key,
-                policy: stagedRouting
-                    ? stagedRouting(deny, stage)
-                    : { ok: true, routing: { deny: denyBlockFrom(denyLists()) } },
-            };
-        }
-        return routingMemo.policy;
+        const policy = stagedRouting
+            ? stagedRouting(deny, stage)
+            : { ok: true, routing: { deny: denyBlockFrom(denyLists()) } };
+        routingMemo.current = { key, policy };
+        return policy;
     };
+    const rowsMemo = useRef({ key: "", byAdapter: new Map() });
+    // B-KEYS r2 (D-1446): staged content alone does not identify a row — the rows also derive from the loaded
+    // overlay layers (stagedRouting and holderOf read both files) and the props they read. Once per render a
+    // generation moves when the layer bytes or one of those props changes, and both memos key on it beside the
+    // staged content: a layer written mid-session shows on the next frame, as on the base, while a cursor move
+    // over unchanged layers still derives nothing. Cost: one read of each overlay per frame (the B2 previewCfg key).
+    const layers = useRef({ stamp: "", inputs: [], gen: 0 });
+    {
+        const stamp = layerStamp?.() ?? "";
+        const inputs = [modelGroups, stagedRouting, holderOf];
+        if (stamp !== layers.current.stamp || inputs.some((input, at) => input !== layers.current.inputs[at])) {
+            layers.current = { stamp, inputs, gen: layers.current.gen + 1 };
+        }
+    }
+    const memoKey = () => `${layers.current.gen}\u0000${stagedKey()}`;
     // OBS-1099 add.1: the browser's deny discovery ranges over the schema-enumerated scopes (the
     // route collector names its four paths by hand, so a scope the schema gains would never render
     // or lift here). A flat scope reaches every seat; a nested one only the seat its block names
@@ -321,7 +351,19 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
         const found = members.map(coveringFor).filter((covering) => covering !== undefined);
         return found.find((covering) => covering.shared) ?? found[0];
     };
+    // B-KEYS: one derivation per group per staged state — the memo above hands every later pass
+    // (visibleCount per rail row, modelRows, the hidden and folded counts, a handler's lookup) the
+    // same rows; the returned array is read, never mutated, by every caller.
     const groupRows = (group) => {
+        const key = memoKey();
+        if (rowsMemo.current.key !== key)
+            rowsMemo.current = { key, byAdapter: new Map() };
+        const memo = rowsMemo.current.byAdapter;
+        const rows = memo.get(group.adapter) ?? deriveGroupRows(group);
+        memo.set(group.adapter, rows);
+        return rows;
+    };
+    const deriveGroupRows = (group) => {
         const rows = group.rows.map((row) => {
             const members = membersOf(group.adapter, row);
             const staged = ui.classifications.find((classification) => classification.adapter === group.adapter
@@ -2180,7 +2222,7 @@ export function FleetApp({ ageMs, agents, initialAllowOut = [], initialEfforts =
                 ? _jsx(Text, { color: INK.warn, children: ` ! ${clip(ui.notice, width - 4)}` })
                 : details.map((line) => _jsx(Text, { dimColor: true, children: ` ${clip(line, width - 2)}` }, line)), _jsx(KeyBar, { binds: keyBinds() })] }));
 }
-export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut = [], initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, ...initialDenyProps }) {
+export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowOut = [], initialEfforts, modelGroups, initialMode, modeOptions, initialMap, modePreview, shapeRows, candidatesForShape, preferOptionsForShape, initialSteering, steeringOptionsFor, reviewAdvisories = [], reviewOverlay, layerStamp, reloadGuard, stagedRouting, holderOf, entry = "probe", initialJudge = "", judgeSeats = [], initialInput = [], input, output, debug = false, ...initialDenyProps }) {
     const agents = adapters.flatMap((adapter) => {
         const state = health[adapter.id];
         if (!state?.installed)
@@ -2204,7 +2246,7 @@ export async function runFleetInkEditor({ ageMs, adapters, health, initialAllowO
     // rebuilt from output.columns/rows so a pane resize re-renders at the new size. Same root
     // element type on every rerender ⇒ React keeps the component instance, so staged edits,
     // cursor, and overlays all survive the resize.
-    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, ...initialDenyProps, initialAllowOut: initialAllowOut, initialEfforts: initialEfforts, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewAdvisories: reviewAdvisories, reviewOverlay: reviewOverlay, reloadGuard: reloadGuard, stagedRouting: stagedRouting, holderOf: holderOf, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
+    const editorElement = () => (_jsx(FleetApp, { ageMs: ageMs, agents: agents, ...initialDenyProps, initialAllowOut: initialAllowOut, initialEfforts: initialEfforts, modelGroups: declaredModelGroups, initialMode: initialMode, modeOptions: modeOptions, initialMap: initialMap, modePreview: modePreview, shapeRows: shapeRows, candidatesForShape: candidatesForShape, preferOptionsForShape: preferOptionsForShape, initialSteering: initialSteering, steeringOptionsFor: steeringOptionsFor, reviewAdvisories: reviewAdvisories, reviewOverlay: reviewOverlay, layerStamp: layerStamp, reloadGuard: reloadGuard, stagedRouting: stagedRouting, holderOf: holderOf, entry: entry, initialJudge: initialJudge, judgeSeats: judgeSeats, 
         // v1.90.9: cap every list to the terminal minus chrome so the cursor and header can
         // never scroll off-screen (omp's 218-model list did exactly that pre-cap).
         // OBS-523: chrome is ≤12 rows worst case (header, borders, padding, scope+search,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tickmarkr",
-  "version": "2.6.7",
+  "version": "2.6.8",
   "description": "Spec in, verified work out.",
   "type": "module",
   "license": "MIT",