tickmarkr 2.7.8 → 2.8.0

package/dist/adapters/codex.d.ts

@@ -5,7 +5,7 @@ export declare function readCodexModelsCache(path?: string): {
     retirements?: Record<string, ModelRetirement | null>;
     hidden?: string[];
 };
-export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ \"$tkr_gitdir\" != \"$tkr_common\" ]; then printf '\"%s\",' \"$tkr_gitdir\"; fi; printf '\"%s/objects\",\"%s/refs\",\"%s/logs\"' \"$tkr_common\" \"$tkr_common\" \"$tkr_common\")]\"";
+export declare const CODEX_GIT_GRANT = "-c \"sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=${tkr_common%?/} && tkr_gitdir=${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=${tkr_head%/*};; (*) tkr_leaf=;; esac && [ \"$(printf %s \"$tkr_common$tkr_gitdir$tkr_leaf\" | LC_ALL=C tr -d '\\0-\\37\\177\"\\\\')\" = \"$tkr_common$tkr_gitdir$tkr_leaf\" ] && { [ \"$tkr_gitdir\" = \"$tkr_common\" ] || printf '\"%s\",' \"$tkr_gitdir\"; } && printf '\"%s/objects\"' \"$tkr_common\" && { [ -z \"$tkr_leaf\" ] || printf ',\"%s/%s\",\"%s/logs/%s\"' \"$tkr_common\" \"$tkr_leaf\" \"$tkr_common\" \"$tkr_leaf\"; })]\"";
 export declare const CODEX_TRUST_DIALOG: TrustDialog;
 export declare const CODEX_INPUT_BOX: import("./types.js").InputBox;
 export declare function seedCodexTrust(repoRoot: string, configPath?: string): TrustVerdict;

package/dist/adapters/codex.js

@@ -106,13 +106,25 @@ function codexRetirement(upgrade) {
 // worktree cwd, for Codex WORKERS only: v2.6.7 T4 (D-1046) — invoke() (the headless worker form, including
 // the interactive size fallback) and interactiveCommand carry it; headlessCommand, which judge, review,
 // consult and the model probe launch, carries no writable_roots at all (those seats never commit).
-// v2.6.6 T9 (K, D-912): the grant is exactly what a linked-worktree branch commit writes — the worktree's
-// own gitdir (only when it differs from the common dir), common/objects, common/refs, common/logs. The
-// shipped [common] grant (and D-910's [common, gitdir]) let a sandboxed seat write <common>/hooks and
-// <common>/config, which unsandboxed git later runs. No common-root fallback: an ordinary checkout gets
-// no gitdir root and its commit fails closed. packed-refs is not granted (packed-ref ops fail closed).
+// v2.6.6 T9 (K, D-912) → v2.8.0 T1 (rows 17/18, D-910): the grant is a LEAF of what a linked-worktree branch
+// commit writes, never the shared hooks/config (the shipped [common] and D-910's [common, gitdir] let a seat
+// write <common>/hooks and <common>/config, which unsandboxed git later runs) and never whole common/refs and
+// common/logs (which let a seat move main, any branch or tag, or the stash). The closed root table, in order:
+//   - the worktree's own gitdir, only when it differs from the common dir (an ordinary checkout gets none);
+//   - <common>/objects;
+//   - only when HEAD is a symbolic ref refs/heads/<B>: <common>/refs/heads/<D> and <common>/logs/refs/heads/<D>,
+//     <D> being <B> without its last slash-separated segment (refs/heads itself when <B> holds no slash);
+//     a detached HEAD gets no refs or reflog root.
+// A directory outside any repository, any failed git read, or any root holding a character of the closed
+// forbidden set (U+0000 to U+001F, U+007F DEL, the double quote, the backslash) yields the EMPTY array `[]`:
+// no git write root, so a commit fails closed — never a partial array, an escaped string or codex's
+// literal-string fallback. Every emitted root is therefore a TOML basic string that parses back to the exact
+// path (git's own trailing newline is stripped through a sentinel, never a path's). No common-root fallback;
+// packed-refs is not granted (packed-ref ops fail closed); stash, tags, notes and branches outside the leaf
+// are denied. Declared: sibling refs in the same leaf (other task branches, the run's integration branch
+// under the default prefix) stay writable until 2.8.1's integration identity.
 // doctor's probe (codex-commit-check.ts) executes these exact bytes; it never rebuilds the grant.
-export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir); tkr_gitdir=$(git rev-parse --absolute-git-dir); if [ "$tkr_gitdir" != "$tkr_common" ]; then printf '"%s",' "$tkr_gitdir"; fi; printf '"%s/objects","%s/refs","%s/logs"' "$tkr_common" "$tkr_common" "$tkr_common")]"`;
+export const CODEX_GIT_GRANT = `-c "sandbox_workspace_write.writable_roots=[$(tkr_common=$(git rev-parse --path-format=absolute --git-common-dir && echo /) && tkr_gitdir=$(git rev-parse --absolute-git-dir && echo /) && tkr_common=\${tkr_common%?/} && tkr_gitdir=\${tkr_gitdir%?/} && { tkr_head=$(git symbolic-ref -q HEAD); [ $? -le 1 ]; } && case $tkr_head in (refs/heads/*) tkr_leaf=\${tkr_head%/*};; (*) tkr_leaf=;; esac && [ "$(printf %s "$tkr_common$tkr_gitdir$tkr_leaf" | LC_ALL=C tr -d '\\0-\\37\\177"\\\\')" = "$tkr_common$tkr_gitdir$tkr_leaf" ] && { [ "$tkr_gitdir" = "$tkr_common" ] || printf '"%s",' "$tkr_gitdir"; } && printf '"%s/objects"' "$tkr_common" && { [ -z "$tkr_leaf" ] || printf ',"%s/%s","%s/logs/%s"' "$tkr_common" "$tkr_leaf" "$tkr_common" "$tkr_leaf"; })]"`;
 // OBS-125: codex 0.144.x gates enabled hooks behind PER-PROJECT-PATH hook trust — a NEW gate distinct
 // from the directory trust seedCodexTrust seeds. Every worker runs in a fresh ephemeral worktree, an
 // untrusted project, so codex re-prompts "Hooks need review" and the interactive worker stalls forever

package/dist/adapters/fake.js

@@ -2,6 +2,40 @@ import { readFileSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { parseWorkerResult } from "./prompt.js";
 import { OPENCODE_BUSY_FRAME_MARKERS, shq, TokenUsageSchema } from "./types.js";
+/**
+ * S23: the first citation of the gate's nonce-framed index — from the LAST line exactly `CITABLE_LINES_BEGIN <nonce>`
+ * to the next line exactly `CITABLE_LINES_END <nonce>`. Every entry must be a JSON object with a string path and a
+ * non-empty array of non-negative safe-integer lines before any is used; otherwise (no block, no END, an empty or
+ * invalid entry anywhere) there is no citation. Never throws.
+ */
+function firstCitation(prompt, nonce) {
+    if (!nonce)
+        return undefined;
+    const lines = prompt.split("\n");
+    const begin = lines.lastIndexOf(`CITABLE_LINES_BEGIN ${nonce}`);
+    const end = begin < 0 ? -1 : lines.indexOf(`CITABLE_LINES_END ${nonce}`, begin + 1);
+    if (end < 0)
+        return undefined;
+    const entries = [];
+    for (const line of lines.slice(begin + 1, end)) {
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            return undefined;
+        }
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+            return undefined;
+        const { path, lines: cited } = entry;
+        if (typeof path !== "string" || !Array.isArray(cited) || cited.length === 0
+            || !cited.every((n) => Number.isSafeInteger(n) && n >= 0))
+            return undefined;
+        entries.push({ path, lines: cited });
+    }
+    const first = entries[0];
+    return first ? { path: first.path, line: first.lines[0] } : undefined;
+}
 // ponytail: deterministic scripted adapter — the whole integration suite runs on it, zero tokens.
 export class FakeAdapter {
     scriptPath;
@@ -77,13 +111,15 @@ export class FakeAdapter {
                     val = { ...verdict, criteria: items.map((criterion) => ({ criterion, met: true, reason: "scripted fake pass" })) };
                 }
             }
+            // S23: a scripted row without evidence cites the first line of the first entry of the gate's own citable
+            // index — never a string. An invalid or unterminated index yields no evidence (the gate then fails closed).
             if (key === "judge" && isJudge && val && typeof val === "object" && !Array.isArray(val)) {
                 const verdict = val;
-                const line = /```diff\n([\s\S]*?)```/.exec(prompt)?.[1].split("\n").find((candidate) => candidate.trim());
-                if (line && Array.isArray(verdict.criteria)) {
+                const evidence = firstCitation(prompt, nonce);
+                if (evidence && Array.isArray(verdict.criteria)) {
                     val = {
                         ...verdict,
-                        criteria: verdict.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence: line } : row),
+                        criteria: verdict.criteria.map((row) => row && typeof row === "object" && !("evidence" in row) ? { ...row, evidence } : row),
                     };
                 }
             }
@@ -152,10 +188,12 @@ export class FakeAdapter {
     }
     // the run nonce lives in the prompt writePrompt handed us; echo a matching trailer so
     // parseWorkerResult(output, nonce) succeeds exactly as before the nonce existed
+    // S23: the verdict nonce is the LAST whole `VERDICT_NONCE: <hex>` line — the gate writes its own after the goal,
+    // criteria and diff, so a nonce line quoted in any of them never binds.
     nonceFor(promptFile) {
         try {
             const prompt = readFileSync(promptFile, "utf8");
-            return /VERDICT_NONCE:\s*([0-9a-f]+)/i.exec(prompt)?.[1]
+            return prompt.split("\n").map((line) => /^VERDICT_NONCE: ([0-9a-f]+)$/.exec(line)?.[1]).filter(Boolean).at(-1)
                 ?? /TICKMARKR_RESULT_([0-9a-z]+)/.exec(prompt)?.[1]
                 ?? "";
         }

package/dist/cli/commands/doctor.js

@@ -22,7 +22,7 @@ import { sh } from "../../run/git.js";
 import { auditNamedTestOracles, listVitestTests } from "../../gates/acceptance.js";
 import { readReviewNoVerdictHistory, reviewNoVerdictRows } from "../../run/journal.js";
 import { checkModelDiscovery } from "../../adapters/model-discovery-check.js";
-import { recordLaunchServices } from "../../run/launchservices-check.js";
+import { LAUNCHSERVICES_PORT_ADVISORY, probeLaunchServicesPorts, recordLaunchServices } from "../../run/launchservices-check.js";
 /** Where a newer `table_<date>.csv` is discovered — the deployed site builds filenames by
  *  concatenation and publishes no index, so the release listing is the only enumerable surface. */
 export const LIVEBENCH_RELEASES_URL = "https://api.github.com/repos/LiveBench/livebench.github.io/contents/public";
@@ -670,7 +670,8 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
     const discovery = await checkModelDiscovery({ cwd, cfg, adapters, health, catalog, resolved: resolvedIdentitySnapshot, mayRefresh: !opts.catalog && !catalogRefreshLine && catalogRefreshAllowed, fetcher: opts.catalogFetcher, now: opts.catalogNow });
     catalog = discovery.catalog;
     aliasDriftFindings.push(...discovery.findings);
-    const launchServices = await recordLaunchServices(readDoctor(cwd), health);
+    const portProbe = await probeLaunchServicesPorts();
+    const launchServices = await recordLaunchServices(readDoctor(cwd), health, portProbe.observation);
     writeDoctor(cwd, launchServices.health);
     const rows = adapters.map((a) => {
         const h = health[a.id];
@@ -680,6 +681,14 @@ export async function doctor(_argv, cwd = process.cwd(), adapters = allAdapters(
         const healthy = h.installed && (a.id !== kimi.id || h.authed) && !(a.id === codex.id && h.codexCommit === "escape");
         return alignedStatusRow(healthy ? "pass" : "fail", a.id, state);
     });
+    const ports = portProbe.ports;
+    const portLine = ports.status === "non-darwin" ? "launchservicesd ports: not applicable"
+        : ports.status === "read" ? `launchservicesd pid ${ports.pid}: ${ports.count} ports`
+            : `launchservicesd pid ${ports.status === "unknown" ? ports.pid ?? "unknown" : "unknown"}: ports unknown`;
+    if (ports.status !== "skipped") {
+        rows.push(alignedStatusRow(ports.status === "read" && ports.count < LAUNCHSERVICES_PORT_ADVISORY || ports.status === "non-darwin"
+            ? "pass" : "warn", "launchservicesd", portLine));
+    }
     const reviewDemotions = recentReviewDemotions(cwd);
     if (reviewDemotions.length) {
         rows.push(legend("recent review-seat demotions:"));

package/dist/cli/commands/fleet.js

@@ -1,4 +1,5 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
 import { homedir } from "node:os";
 import { dirname, join, relative } from "node:path";
 import { parseArgs } from "node:util";
@@ -92,6 +93,131 @@ function formatFleetSteering(cfg) {
 // T10: what every review says about where its bytes land and when they take effect
 const REPO_DESTINATION_NOTE = (path) => `destination: the repository overlay ${path} holds this repository's routing.allow/deny membership, so the edit lands there — the file is tracked: Fleet never stages or commits it; commit it to share the change`;
 const FUTURE_LOADS_NOTE = "the save changes future config loads only — a tickmarkr run already in progress keeps the config it loaded";
+// Queue 134: routing.mode, review.prefer, consult.prefer and judge each follow the overlay that holds
+// them. A YAML merge holds one only when that merge supplies it — an unrelated sibling merge does not —
+// and the review refuses a write through a supplying merge (D-987). A scalar alias key is the name it
+// resolves to, at the alias's own line; a parent alias is refused because the writer cannot update
+// through it without replacing its siblings. A merge sequence is shallow and first-source-wins.
+// Membership stays on heldLine.
+const CONTROL_PATH = {
+    "routing.mode": ["routing", "mode"],
+    "review.prefer": ["review", "prefer"],
+    "consult.prefer": ["consult", "prefer"],
+    judge: ["judge"],
+};
+const CONTROL_NAMES = new Set(Object.keys(CONTROL_PATH));
+const { isAlias: yamlIsAlias, isMap: yamlIsMap, isNode: yamlIsNode, isScalar: yamlIsScalar, isSeq: yamlIsSeq, parseDocument: yamlParseDocument, } = createRequire(import.meta.url)("yaml");
+const controlHoldMemo = new Map();
+const controlLineOf = (bytes, offset) => bytes.slice(0, offset).split("\n").length;
+const resolveYaml = (doc, node) => yamlIsAlias(node) ? node.resolve(doc) : node;
+// A plain scalar, or a scalar alias (`*modeKey` resolving to mode). The merge key `<<` is a symbol
+// and is not a name. Callers that report a line keep the key node's own range — the alias as written,
+// never the anchor it points at.
+const scalarKeyName = (doc, key) => {
+    const resolved = resolveYaml(doc, key);
+    if (!yamlIsScalar(resolved) || typeof resolved.value === "symbol" || resolved.value == null)
+        return undefined;
+    return String(resolved.value);
+};
+const namedPair = (doc, map, name) => map.items.find((item) => scalarKeyName(doc, item.key) === name);
+const mergePair = (map) => map.items.find((item) => yamlIsScalar(item.key) && typeof item.key.value === "symbol");
+const mergeShapeOf = (bytes, value) => {
+    const range = yamlIsNode(value) ? value.range : null;
+    const text = range ? bytes.slice(range[0], range[1]).trim().replace(/\s+/g, " ") : "…";
+    return `<<: ${text}`;
+};
+const mergeSources = (doc, value) => {
+    const node = resolveYaml(doc, value);
+    return yamlIsSeq(node) ? node.items.map((item) => resolveYaml(doc, item)) : [node];
+};
+// YAML 1.1 merge: an explicit key wins over `<<`, and a sequence is shallow — the first source that
+// declares a key owns that key whole. A later source's prefer or mode does not survive an earlier
+// source that already declared the parent mapping. `seen` stops a merge that aliases itself.
+const definesKey = (doc, node, key, seen) => {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || seen.has(here))
+        return false;
+    if (namedPair(doc, here, key))
+        return true;
+    const merge = mergePair(here);
+    if (!merge)
+        return false;
+    const next = new Set(seen);
+    next.add(here);
+    return mergeSources(doc, merge.value).some((source) => definesKey(doc, source, key, next));
+};
+const controlSupplied = (doc, node, rest, seen = new Set()) => {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || seen.has(here))
+        return false;
+    if (rest.length === 0)
+        return true;
+    const [head, ...tail] = rest;
+    if (head === undefined)
+        return false;
+    const pair = namedPair(doc, here, head);
+    if (pair) {
+        const value = resolveYaml(doc, pair.value);
+        if (yamlIsScalar(value) && value.value === null)
+            return true;
+        if (tail.length === 0)
+            return true;
+        const next = new Set(seen);
+        next.add(here);
+        return controlSupplied(doc, value, tail, next);
+    }
+    const merge = mergePair(here);
+    if (!merge)
+        return false;
+    const next = new Set(seen);
+    next.add(here);
+    for (const source of mergeSources(doc, merge.value)) {
+        if (!definesKey(doc, source, head, next))
+            continue;
+        return controlSupplied(doc, source, rest, next);
+    }
+    return false;
+};
+/** The repository (or user) overlay holds a control at its own key, at a null mask at it or above, or at a
+ * merge key that supplies it. An explicit key wins over a sibling merge. Parse errors hold nothing. */
+function controlHold(bytes, path) {
+    const key = `${path.join(".")}\0${bytes}`;
+    if (controlHoldMemo.has(key))
+        return controlHoldMemo.get(key);
+    if (controlHoldMemo.size > 256)
+        controlHoldMemo.clear();
+    const doc = yamlParseDocument(bytes);
+    const hold = doc.errors.length ? undefined : walkControl(doc, bytes, doc.contents, path);
+    controlHoldMemo.set(key, hold);
+    return hold;
+}
+function walkControl(doc, bytes, node, rest) {
+    const here = resolveYaml(doc, node);
+    if (!yamlIsMap(here) || rest.length === 0)
+        return undefined;
+    const [head, ...tail] = rest;
+    const pair = head === undefined ? undefined : namedPair(doc, here, head);
+    if (pair) {
+        const range = yamlIsNode(pair.key) ? pair.key.range : null;
+        if (!range)
+            return undefined;
+        const line = controlLineOf(bytes, range[0]);
+        const value = resolveYaml(doc, pair.value);
+        if (yamlIsScalar(value) && value.value === null) {
+            return { line, via: yamlIsAlias(pair.key) && tail.length > 0 ? "alias-parent" : "mask" };
+        }
+        if (tail.length === 0)
+            return { line, via: "declared" };
+        const nested = walkControl(doc, bytes, value, tail);
+        return nested && yamlIsAlias(pair.key) ? { line, via: "alias-parent" } : nested;
+    }
+    const merge = mergePair(here);
+    if (!merge || !yamlIsScalar(merge.key) || !merge.key.range)
+        return undefined;
+    if (!controlSupplied(doc, here, rest))
+        return undefined;
+    return { line: controlLineOf(bytes, merge.key.range[0]), via: "merge", shape: mergeShapeOf(bytes, merge.value) };
+}
 const MODE_GLOSS = {
     "partner-led": "every shape frontier · explore off",
     "risk-based": "risk-tiered default floors",
@@ -224,8 +350,10 @@ export async function fleet(argv, cwd = process.cwd(), adapters = allAdapters(),
 export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const globalDir = opts.globalDir;
     // B2: the editor's choices are the operator's MACHINE choices — a save lands in the USER overlay,
-    // which every repository on this machine inherits. T10 (D-925/D-926): except a membership edit the
-    // repository overlay holds — it lands where it is effective (destinationEdits below).
+    // which every repository on this machine inherits. T10 (D-925/D-926): a membership edit and a
+    // routing.mode, review.prefer, consult.prefer or judge edit each land in the overlay that holds
+    // them (destinationEdits below) — the repository overlay when it declares the key or masks it
+    // with null at it or above, else the user overlay.
     const userPath = join(globalDir, "config.yaml");
     const repoPath = repoOverlayPath(cwd);
     const currentUserText = () => (existsSync(userPath) ? readFileSync(userPath, "utf8") : "");
@@ -552,11 +680,12 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
     const home = homedir();
     const shown = (path) => (path.startsWith(`${home}/`) ? `~${path.slice(home.length)}` : path);
     const holderOf = (dotted) => {
-        const path = dotted.split(".");
-        const repoLine = heldLine(currentRepoOverlayText(cwd), path);
+        const control = dotted in CONTROL_PATH ? CONTROL_PATH[dotted] : undefined;
+        const lineIn = (text) => control ? controlHold(text, control)?.line : heldLine(text, dotted.split("."));
+        const repoLine = lineIn(currentRepoOverlayText(cwd));
         if (repoLine !== undefined)
             return `${relative(cwd, repoPath)}:${repoLine}`;
-        const userLine = heldLine(currentUserText(), path);
+        const userLine = lineIn(currentUserText());
         return userLine === undefined ? undefined : `${shown(userPath)}:${userLine}`;
     };
     // the allow + flat-deny family is ONE coupled write (the allow form is
@@ -615,7 +744,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         }
         if (JSON.stringify(initial.efforts ?? {}) !== JSON.stringify(staged.efforts ?? {}))
             edits.push({ name: "model efforts", destination: "user" });
-        return [...edits, ...controls.map((name) => ({ name, destination: "user" }))];
+        // a control lands where it is held. A merge that supplies it is still the repository (the review
+        // then refuses the write); review.prefer and consult.prefer are two edits, never one
+        const controlDestination = (name) => {
+            if (!(name in CONTROL_PATH))
+                return "user";
+            return controlHold(currentRepoOverlayText(cwd), CONTROL_PATH[name]) !== undefined ? "repo" : "user";
+        };
+        return [...edits, ...controls.map((name) => ({ name, destination: controlDestination(name) }))];
     };
     // ONE review confirms ONE destination; a batch needing both is refused before any write (no
     // multi-file transaction) and names what to save in separate sessions
@@ -800,8 +936,8 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             parts.push(`${unroutable} unroutable`);
         return `  mix: ${mix} — ${parts.join(" · ")}`;
     };
-    // B2: the floors the candidate user-layer bytes resolve to — the same config the routed mix ranks
-    // against, so a repo-declared mode that shadows the user's pick previews no floor change
+    // Floors come from the candidate the chosen destination would load. A routing.mode the repository
+    // holds is previewed there, so those floors move; an unheld mode is previewed in the user overlay.
     const floorPreview = (mode, map, deny, stage) => {
         if (mode === rm.mode.mode)
             return [];
@@ -818,9 +954,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 : ["    (no floor changes)"]),
         ];
     };
-    // B2: `resolution` is the candidate user-layer bytes' own mode resolution — a repo-declared mode that
-    // shadows the user's pick keeps its provenance, never an operator pin the loader would not apply
-    // B2: `entry` is the slot the candidate's loader applies — a staged slot a repo declaration shadows
+    // `resolution` is the candidate destination's mode. A routing.mode the repository holds is written
+    // into that preview, so a changed mode pins the floors the loader will apply.
+    // `entry` is the slot the candidate's loader applies — a staged slot a repo declaration shadows
     // is no operator pin here; the repo's winning declaration keeps its provenance
     const whyDeclaration = (shape, resolution, entry, mapProducedValue) => {
         const mapChanged = JSON.stringify(mapSlot(entry)) !== JSON.stringify(mapSlot(editable.map[shape]));
@@ -1154,7 +1290,9 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         // the diff and asks for confirmation, but owns neither filesystem access nor a writer.
         // B2: defaults/user/repo are re-read here, at review. T10: so is the destination.
         const modeChanged = state.selectedMode !== rm.mode.mode;
-        const steeringChanged = ["review", "consult"].some((key) => JSON.stringify(state.steering[key]) !== JSON.stringify(initialSteering[key]));
+        const reviewChanged = JSON.stringify(state.steering.review) !== JSON.stringify(initialSteering.review);
+        const consultChanged = JSON.stringify(state.steering.consult) !== JSON.stringify(initialSteering.consult);
+        const steeringChanged = reviewChanged || consultChanged;
         const judgeSeat = state.judgeSeat;
         const judgeChanged = judgeSeat !== undefined
             && `${judgeSeat.adapter}:${judgeSeat.model}` !== initialJudge;
@@ -1162,11 +1300,14 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
             pendingWrite = null;
             return { kind: "empty" };
         }
-        const chosen = chooseDestination(destinationEdits(staged, metadata.seeds, [
+        const controlNames = [
             ...(modeChanged ? ["routing.mode"] : []),
-            ...(steeringChanged ? ["review/consult prefer"] : []),
+            ...(reviewChanged ? ["review.prefer"] : []),
+            ...(consultChanged ? ["consult.prefer"] : []),
             ...(judgeChanged ? ["judge"] : []),
-        ]));
+        ];
+        const edits = destinationEdits(staged, metadata.seeds, controlNames);
+        const chosen = chooseDestination(edits);
         if (!chosen.ok) {
             pendingWrite = null;
             return { kind: "refused", reason: chosen.reason };
@@ -1174,6 +1315,43 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         const destination = chosen.destination;
         const user = currentUserText();
         const repo = currentRepoOverlayText(cwd);
+        // A merge that supplies a control or an alias used as its parent is a holder, but the writer
+        // cannot update through either key. Refuse before any bytes change, naming the key's own line.
+        if (destination === "repo") {
+            const refusals = edits.flatMap((edit) => {
+                if (!(edit.name in CONTROL_PATH))
+                    return [];
+                const hold = controlHold(repo, CONTROL_PATH[edit.name]);
+                if (hold?.via === "merge") {
+                    const shape = hold.shape ?? "<<: …";
+                    return [`${edit.name} takes keys through the YAML merge key \`${shape}\` at ${holderOf(edit.name)} — Fleet does not write through merge keys; inline the merged keys there by hand, then save again`];
+                }
+                if (hold?.via === "alias-parent") {
+                    return [`${edit.name} takes keys through a YAML alias parent key at ${holderOf(edit.name)} — Fleet does not write through alias parent keys; replace that key with its scalar name, then save again`];
+                }
+                return [];
+            });
+            if (refusals.length) {
+                pendingWrite = null;
+                return { kind: "refused", reason: refusals.join("; ") };
+            }
+        }
+        // clearing a repository-held prefer writes an explicit empty sequence, so a lower user list cannot
+        // reappear. A user-held or unheld clear stays undefined and the writer deletes the key, as before.
+        const steeringEdited = { ...state.steering };
+        if (destination === "repo") {
+            for (const key of ["review", "consult"]) {
+                if (JSON.stringify(steeringEdited[key]) === JSON.stringify(initialSteering[key]))
+                    continue;
+                const chain = steeringEdited[key];
+                if (chain != null && chain.length > 0)
+                    continue;
+                const name = `${key}.prefer`;
+                const hold = controlHold(repo, CONTROL_PATH[name]);
+                if (hold !== undefined && hold.via !== "merge")
+                    steeringEdited[key] = [];
+            }
+        }
         const before = destination === "repo" ? repo : user;
         const path = pathOf(destination);
         const lower = lowerLayers(destination);
@@ -1186,7 +1364,7 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
                 lowerOverrides: lowerOverrides[destination],
                 ...(modeChanged ? { mode: state.selectedMode } : {}),
                 ...(judgeChanged && judgeSeat ? { judge: judgeSeat } : {}),
-                steering: { initial: initialSteering, edited: state.steering },
+                steering: { initial: initialSteering, edited: steeringEdited },
             });
             after = renderFleetOverlayWrite(before, write); // T10 (D-987): a merge-key path refuses here
         }
@@ -1211,9 +1389,19 @@ export async function assembleFleetEditor(cwd, adapters, io, opts) {
         catch {
             poolNotes = [];
         }
+        const controlEdits = edits.filter((edit) => CONTROL_NAMES.has(edit.name));
+        const controlNote = controlEdits.length === 0
+            ? undefined
+            : `destination: ${controlEdits.map((edit) => `${edit.name} at ${holderOf(edit.name)}`).join("; ")} — the file is tracked and Fleet never commits it`;
         const notes = [
-            // T10: the review names where the edit lands and what that file is
-            ...(destination === "repo" ? [REPO_DESTINATION_NOTE(repoPath)] : repoShadowNotes(before, after)),
+            // T10: a membership edit keeps the membership destination note. Every repository-destined
+            // control in the same batch is named beside it, path:line from holderOf, file tracked.
+            ...(destination === "repo"
+                ? [
+                    ...(edits.some((edit) => !CONTROL_NAMES.has(edit.name)) ? [REPO_DESTINATION_NOTE(repoPath)] : []),
+                    ...(controlNote ? [controlNote] : []),
+                ]
+                : repoShadowNotes(before, after)),
             FUTURE_LOADS_NOTE,
             ...(lower.ok ? [] : [`${lower.error} — y will be refused`]),
             ...poolNotes,

package/dist/cli/commands/verify.js

@@ -17,7 +17,7 @@ import { addDetachedWorktree, linkNodeModules, removeWorktree, shGit, shGitOk }
 import { foldOwedChecks, integrationMapped, owedCriteria, Journal, OWED_DISCHARGE_EVENT } from "../../run/journal.js";
 import { describeLeaseWait, withRepositoryLease } from "../../run/lease.js";
 import { isPidLive } from "../../run/lock.js";
-import { recordLaunchServices } from "../../run/launchservices-check.js";
+import { LAUNCHSERVICES_PORT_STOP, probeLaunchServicesPorts, recordLaunchServices } from "../../run/launchservices-check.js";
 /**
  * tickmarkr verify — the gate battery as a standalone command (OPERATING-MODEL-2026-08-11 item 3).
  *
@@ -184,6 +184,14 @@ export async function verify(argv, cwd = process.cwd(), options = {}) {
         },
         allowPositionals: false,
     });
+    const portProbe = await probeLaunchServicesPorts({ requireTop: true });
+    const ports = portProbe.ports;
+    if (ports.status === "read" || ports.status === "unknown") {
+        console.error(`verify: ports ${ports.status === "read" ? ports.count : "unknown"}`);
+    }
+    if (ports.status === "read" && ports.count >= LAUNCHSERVICES_PORT_STOP) {
+        return { out: `verify refused: launchservicesd has ${ports.count} ports (threshold ${LAUNCHSERVICES_PORT_STOP}); log out or restart to reset launchservicesd before verifying`, code: 1 };
+    }
     const stateRoot = await verifyStateRoot(cwd);
     const fileRoot = (file) => existsSync(join(cwd, ".tickmarkr", file)) ? cwd : stateRoot;
     if (resolve(stateRoot) !== resolve(cwd)) {

package/dist/gates/acceptance.d.ts

@@ -12,7 +12,7 @@ export interface JudgeVerdict {
         criterion: string;
         met: boolean;
         reason: string;
-        evidence: string | EvidenceCitation;
+        evidence: EvidenceCitation;
     }>;
     comments?: Array<{
         path: string;